Privacy Policy

Effective Date: 2024-08-14

Last Updated: 2026-10-05

1. Introduction

Welcome to Lingaku! We are committed to protecting your privacy and ensuring that your personal information is handled in a safe and responsible manner. This Privacy Policy outlines how we collect, use, store, and protect your information when you use our web application for learning Chinese and Japanese vocabulary.

2. Data Collection and Usage

Information We Collect and How We Use It:

  • Registration Information:
    • Data Collected: Name, email address, and profile image URL (via Google authentication).
    • Purpose: To create and manage your account.
    • Lawful Basis: Performance of a contract.
  • Payment Information:
    • Data Collected: Handled directly by Stripe and/or Paddle (depending on the region); we do not store this information.
    • Purpose: For processing payments.
    • Lawful Basis: Performance of a contract.
  • Product Usage Analytics (signed-in users):
    • Data Collected: When you are signed in to the website, the mobile app or the browser extension, we record what you do in Lingaku on our own servers: the day you use it and on which of those apps, signing up and signing in, verifying your email, the placement test, opening texts and lessons, finishing content, adding cards, importing vocabulary, enrolling in courses, viewing pricing, starting a checkout, plan changes, settings changes, and clicks on the buttons in our emails. Each record holds your account, the event, the time, the language you study, the app you used, and a few details of the event, such as the lesson, the number of cards or the plan. Your study records, such as flashcard reviews and the words you look up, are also used for these statistics.
    • Purpose: To understand which parts of Lingaku help people learn and where they get stuck, and to improve the product. We look at the results mostly as totals, such as how many new users reach their first review, and sometimes per account, for example to understand why a learner stopped.
    • Lawful Basis: Legitimate interests (improving our service). These records are not stored on your device, are not shared with third parties or advertisers, and are not used for advertising or automated decisions about you. You can turn this off at any time with the "Usage analytics" switch in Account Settings, or by contacting us (see "User Rights").
  • Signup Source:
    • Data Collected: If you accepted analytics cookies, the website where you found us (domain only) and any campaign tags in the link you followed (utm_source, utm_medium, utm_campaign), plus the page you first landed on. This is linked to your account when you sign up.
    • Purpose: To learn which channels bring people to Lingaku.
    • Lawful Basis: Consent (the analytics cookie category).
  • Website Traffic Statistics:
    • Data Collected: For each page you open on the website, whether or not you are signed in: the page address without its query string, the language section, the website you came from (domain only, on the first page you open), any campaign tags in the link (utm_source, utm_medium, utm_campaign), the kind of device (phone, tablet or computer, worked out from your browser's user agent), and the country you are in, worked out from your IP address with a country database kept on our own server. To count how many people visit in a day without a cookie, our server combines your IP address and user agent with a random value that exists only in the server's memory, is never written to disk or to backups, and is replaced every day, and keeps only the resulting code. Your IP address and user agent are not stored, and once the day's random value is replaced the code can no longer be linked to you or to your visits on other days. Page addresses that point at a specific person's data, such as a profile, a deck, a chat or a text you added yourself, are stored without that part. Nothing is stored on or read from your device for this, and it is never linked to your account.
    • Purpose: To count visitors and see which pages people use and where they come from.
    • Lawful Basis: Legitimate interests (understanding how the website is used). If your browser sends a Do Not Track or Global Privacy Control signal, we do not count your page views.
  • Cookies and Tracking Technologies:
    • Data Collected: Cookies and similar technologies.
    • Purpose: To authenticate users and, with your consent, to remember how you found us (see "Signup Source").
    • Lawful Basis: Legitimate interests for essential cookies and consent for non-essential cookies.
  • Marketing and Promotional Purposes:
    • Data Collected: With your consent, we may use your data for marketing and promotional purposes.
    • Lawful Basis: Consent.

Sharing Information:

  • We share your email address with Stripe and/or Paddle (depending on the region) for payment processing. Other payment information is directly entered by the user into Stripe or Paddle.
  • We do not share your personal data with any other third parties unless required by law or to protect our rights. Product usage analytics and website traffic statistics are processed on our own servers only; we do not use any third-party analytics service.

3. Cookies and Tracking Technologies

We use cookies to authenticate users. With your consent, we also keep a note in your browser of how you found us. Our website traffic statistics do not use cookies or any other storage on your device. Cookies are small text files stored on your device that help us provide a better user experience.

Types of Cookies We Use:

  • Authentication Cookies: Essential for website operation and managing user sessions.
    • __Host-authjs.csrf-token: Prevents Cross-Site Request Forgery attacks. Lasts for the session.
    • __Secure-authjs.callback-url: Redirects users during authentication. Lasts for the session.
    • __Secure-authjs.session-token: Maintains user sessions across pages. Lasts for one month.
  • Signup Source Storage: Set only if you accept analytics cookies. It is session storage in your browser, not a cookie, and is cleared when you close the tab.
    • lingaku.firstTouch: Remembers how you arrived at the website (referring domain, campaign tags and landing page) until you sign up.
    • lingaku.firstTouchSent: Records that the signup source has already been sent, so it is sent only once.

Consent to Cookies:

  • When you first visit our website, you will see a cookie banner that informs you about our use of cookies and provides a link to this policy. You can choose to accept all cookies or manage your cookie preferences.
  • You can change your cookie preferences at any time via Cookie Preferences.

4. Data Storage and Security

Storage:

  • User data is stored in cloud storage within the EU.

Retention Periods:

  • Registration Information: We retain registration information for as long as necessary to provide our services and fulfill the purposes outlined in this Privacy Policy. If you delete your account, your personal information will be permanently deleted within 30 days, except where we are required to retain it for legal, regulatory, or security reasons.
  • Product Usage Analytics: Individual usage events are deleted automatically after 400 days (about 13 months). If you delete your account, your usage events are deleted with it.
  • Website Traffic Statistics: The daily random value is kept only in memory and replaced when the day ends (UTC). Page view records are deleted automatically after 400 days.
  • Cookies: Refer to the Cookies and Tracking Technologies section.

Security Measures:

  • Communication with our server is encrypted to protect your data.
  • We use access controls to ensure only authorized personnel can access your data.

5. User Rights

Under the GDPR, you have the following rights:

  • Right to be Informed: You have the right to be informed about the collection and use of your personal data.
  • Right of Access: You can request a copy of the personal data we hold about you.
  • Right to Rectification: You can request that we correct any inaccuracies in your personal data.
  • Right to Erasure (Right to be Forgotten): You can request that we delete your personal data.
  • Right to Restriction of Processing: You can request that we limit the processing of your personal data.
  • Right to Data Portability: You can request a copy of your personal data in a commonly used format.
  • Right to Object: You can object to the processing of your personal data in certain circumstances. This includes product usage analytics: turning off "Usage analytics" in Account Settings, or asking us to, stops us recording usage events for your account, deletes the ones we hold, and leaves your account out of our per-account statistics, such as activation and retention. Overall totals, such as the number of signups or flashcard reviews in a week, may still include your activity, but never identify you.
  • Right Not to Be Subject to Automated Decision-Making: You have the right not to be subject to decisions made solely by automated processing, including profiling, if these decisions have legal effects on you or significantly affect you in a similar way.

To exercise any of these rights, please contact us at support@lingaku.com. We will respond to your request within one month. This period may be extended by two additional months if the request is complex or if we receive numerous requests. You will be informed of any such extension within one month of your request.

6. Children's Privacy

Our application is not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16 without verification of parental consent, we will take steps to delete that information.

7. International Data Transfers

If we transfer your personal data outside the European Economic Area (EEA), we ensure it is protected by appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission.

8. Data Breach Notification

In the event of a data breach, we will notify affected users and the relevant supervisory authorities within 72 hours, as required by the GDPR. Notification will include the nature of the breach, likely consequences, and measures taken to address the breach.

9. Policy Updates

We review and update the privacy policy periodically to ensure compliance with legal requirements. Users can read about any changes to the privacy policy on this page. We will notify you of significant changes to this policy by email or through the application.

Obtaining Consent:

We obtain your explicit consent for the use of cookies and for processing your personal data for specific purposes.

Managing and Withdrawing Consent:

You can manage your consent preferences and withdraw consent at any time via Cookie Preferences for cookies. For the withdrawal of consent regarding the processing of personal data, please contact us via email at support@lingaku.com. Please note that withdrawing consent for personal data processing may limit our ability to provide our services to the fullest extent. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

11. Contact Information

For any privacy questions or concerns, please contact us at support@lingaku.com.

LingakuLingaku
© 2026, lingaku.com. Read our Terms of Service and Privacy Policy. Manage Cookie Preferences.