Privacy Policy

Naralingo ("we", "us", "our") is an AI-powered language learning service available at naralingo.com. If you have questions about this policy, contact us at support@naralingo.com.

Guest accounts. You can start learning without registering. We then create a guest account identified only by a random ID stored in your browser. Everything you do as a guest (your answers in the onboarding quiz, lessons, progress) is linked to that ID. If you later sign in with Google or an email and password, the same account keeps your data.

Account information. When you create an account with an email address and password, we store that email address and a securely hashed password (we never see or store your password in plain text). If you sign in with Google instead, we receive your name, email address, and profile picture from Google. We store this information in our database to identify your account.

Email address for lesson notifications. An email address is required before your first lesson: you either type one in or continue with Google. We use it to tell you when a lesson or analysis is ready. Learning reminders are a separate, unticked checkbox — we send them only if you tick it, and if you typed the address yourself, only after you click the link in the confirmation email we send to it (see Section 4). Together with the address we store a record of your choice: whether you agreed to reminders, when you confirmed the address, when and where in the app you made the choice, in which language, and which version of the consent text you saw.

Audio recordings. When you record yourself speaking, the audio file is uploaded to Firebase Storage and sent to OpenAI for transcription. The transcript and the derived analysis and lesson content are stored in your account. You can delete recordings at any time from the app.

Language learning data. We store your chosen languages, level estimates, goals and situations you describe, vocabulary progress, lesson history, translation history, and any feedback you give about a lesson, so that lessons can be personalised to you.

Payment information. Subscription payments are processed by Stripe. We never see or store your card number — Stripe handles payment details directly and shares with us only what's needed to manage your subscription (e.g. plan, status, and billing history).

Approximate location (for pricing). Before you sign up, we look up your IP address via a geo-IP lookup service (geojs.io, or ipwho.is as a fallback) to guess your country and show local pricing. Only the resulting country code is used; we do not store your IP address or precise location.

Usage data and analytics. We keep standard server logs (timestamps, feature usage, errors) and the history of emails we sent you (address, type of email, time, delivery status). We also use product analytics and advertising measurement tools described in Sections 5 and 7.

We use your data to provide and improve Naralingo, and to responsibly market it:

• Generate personalised audio lessons from your answers, situations and recordings.
• Track your vocabulary progress and spaced-repetition schedule.
• Display your credit balance and lesson history.
• Send lesson notifications and, if you agreed, learning reminders.
• Process subscription payments and manage your billing.
• Diagnose and fix technical issues, and improve lesson quality.
• Measure how people find Naralingo (e.g. via a Facebook ad) and how that translates into sign-ups and subscriptions, so we know which ads are worth running.

We do not sell your data.

We send two kinds of email:

• Lesson notifications — for example "your lesson is ready" or "your conversation analysis is ready". These go to the address you gave us for this purpose or to your account address. Until a typed-in address is confirmed, we send it at most one such email (for the lesson you are waiting for).
• Learning reminders — for example "your next lesson is waiting", sent after a period without activity (at most a handful over the following weeks, at least three days apart, and none after about three months of inactivity). For an address you typed in, reminders start only if you ticked the reminders checkbox and then confirmed the address through the link we emailed you. For accounts registered with Google, or with an email and password whose address has been verified, reminders are currently switched on by default; you can turn them off at any time.
• Confirmation email — a single message with a link to confirm a typed-in address for reminders. We send it at most once a day to the same address; if you ignore it, you get no reminders.

Every email contains a link to stop it: reminders have a "Turn off reminders" link, and lesson notifications have "Unsubscribe from all emails" and "Manage email settings" links. The link opens a page where you confirm with one button. Turning off reminders stops only reminders — lesson notifications continue until you use "Unsubscribe from all emails" or switch them off in your profile. An unsubscribe applies to the email address, so no other Naralingo account using the same address will receive those emails either. You can also change both settings in your profile, or email us. Emails are sent through Resend (see Section 5).

We share data with the following processors only to the extent necessary:

• Google Firebase / Google Cloud — authentication (including guest accounts), database (Firestore), file storage, and cloud functions.
• OpenAI — your audio recordings (and spoken topic descriptions) are sent to OpenAI for transcription. OpenAI does not use API-submitted data to train its models by default.
• OpenRouter and the AI model providers it routes to (such as Anthropic, OpenAI and Google) — to write lessons, translations and conversation analyses we send them the relevant text: your languages and level, the goals and situations you describe, lesson vocabulary, and transcripts of your recordings. We do not send your name or email address.
• Cartesia — lesson scripts are sent to Cartesia to generate the lesson audio (text-to-speech).
• Resend — delivers our emails; it receives your email address and the content of each email.
• Stripe — processes subscription payments. We never see or store your full card number. See Stripe's privacy policy.
• geojs.io and ipwho.is — geo-IP lookup services used to detect your approximate country from your IP address, so we can show pricing in your local currency.
• PostHog (servers in the United States) — product analytics: which screens you visit and which features you use, linked to your account ID, so we can see where people get stuck.
• Meta (Facebook) Pixel and Conversions API — measures which ads lead to visits, sign-ups and purchases. Meta receives page and event information, your IP address and browser identifiers, a hashed (non-readable) form of your account ID and, when we have it, of your email address.
• Google Analytics 4 — site usage statistics, loaded only if you accept the cookie banner.

Some of these providers are located outside the European Economic Area (mainly in the United States); transfers rely on the providers' standard contractual clauses or equivalent safeguards.

We keep your account data — including guest accounts, your email address and the record of your email choices — for as long as the account exists. We do not currently delete inactive accounts automatically. Unsubscribing does not remove your address from your account; it only changes which emails we send. To make unsubscribes work across accounts, we also keep a list of unsubscribed addresses in a one-way hashed form (we cannot read the address back from it). You may delete individual recordings from within the app. To delete your entire account (registered or guest) and all associated data, email us at support@naralingo.com and we will process the request within 30 days.

We always use browser local storage to keep you signed in (including as a guest) and to remember your UI preferences (e.g. selected language).

The Meta Pixel and PostHog currently run from your first visit, whatever you choose in the cookie banner. Until you accept, PostHog keeps its identifier only for the current browser tab session (no cookie); after you accept, it uses a first-party cookie so it can recognise you across visits. Google Analytics 4 loads only after you accept the banner — if you decline or take no action, it does not run and sets no cookies. You can change your choice at any time by clearing your browser's local storage for this site, which will show the banner again.

All data is transmitted over HTTPS. Firebase Security Rules restrict access so that each user can only read and write their own data; email settings and consent records can only be changed through our servers. Audio files in Firebase Storage are private and accessible only to the authenticated owner.

Naralingo is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

Depending on your location, you may have rights to access, correct, or delete your personal data, to withdraw consent (for example to reminders) at any time, or to object to or restrict certain processing. To exercise any of these rights, contact us at support@naralingo.com.

We may update this policy from time to time. If we make material changes we will notify you via the app or by email. Continued use of Naralingo after the effective date constitutes acceptance of the updated policy.