Privacy Policy

Controller and contact

Liralang is the controller for personal data processed in the app and public site. For privacy requests, contact privacy@liralang.com.

Legal identity: Liralang, Italy.

Data we process

• Account data: name, email, base language, CEFR level, Google profile image if used, verification status, role, and preferences.
• Authentication and security: sessions, IP, user-agent, security events, 2FA, and verification or recovery tokens.
• Learning data: progress, answers, notes, vocabulary, phrases, conversation memory, tutor preferences, and note images you paste.
• AI and voice: prompts, corrections, conversation turns, generated replies, model, token usage, duration, and estimated cost.
• Billing: tier, subscription status, customer/subscription ids, billing events, currency, and amounts. Polar and its payment processors handle full card data under the role and terms shown in Polar Checkout; Liralang does not receive it.
• Funnel analytics (first-party): landing views and CTA clicks, with a salted hashed IP only to rate-limit abuse. Without measurement permission, we send only aggregatable counters and no visit identifier. We store neither the raw IP nor the user-agent.
• Visit source and optional attribution: every visit records, without identifying you, the site you came from and the link's UTM labels, and we count unique visitors per day with a server-side key that changes daily and stores nothing in your browser. If you arrive from a campaign, we ask permission before saving a visit id to join the visit to a signup. Opaque advertising-platform click identifiers are not stored.
• Optional first-party product analytics: the app records allowlisted, account-linked events (for example onboarding, features opened, and client-reported learning outcomes), with approximate country and device class when available. Learner answer text is never included in those events.
• Product analytics (Aptabase): anonymous, cookieless usage metrics (page views, device type, browser and operating system, approximate country), processed by Aptabase in the EU. It is anonymous, uses no cookies or persistent ids, and is not linked to your account.
• Support: feedback or messages you send, together with your account and current page.

Purposes

• Create and secure accounts, verify email, and maintain sessions.
• Save progress, adapt the course, and sync data across devices.
• Generate corrections, conversations, explanations, and audio with AI providers.
• Measure usage, cost, plan limits, conversions, and errors to operate the service.
• Manage subscriptions, gifts, invoices or receipts, cancellations, and support.
• Prevent abuse, investigate incidents, and comply with legal obligations.

Legal bases

Data necessary to provide Liralang is processed for contract performance. Security, abuse prevention, identifier-free aggregate metrics, and product improvement — including optional first-party analytics — rely on our legitimate interests, subject to your right to object. Attribution that writes browser storage or joins a campaign to your account relies on prior consent and is off by default. Do Not Track and Global Privacy Control block optional analytics in that browser. You can withdraw measurement in Settings > Privacy: the first-party preference applies to your account, stops new optional events, and deletes optional product events already linked to it; necessary learning-progress, billing, security, and abuse-prevention records remain. Transactional emails are necessary for account and security.

Providers and transfers

We use providers for hosting, database, authentication, email, payments, AI, analytics, and error logging, including Vercel, Neon/Postgres or the configured database provider, Resend, Polar, Google OAuth, Anthropic, Inworld, Aptabase, and Sentry. Some providers may process data outside the EEA; applicable contractual safeguards are used where required.

Retention

Account and learning data is kept while your account exists. Optional account-linked product events are kept until you turn that measurement off, delete the account, or they are no longer needed for product improvement; turning it off deletes them. If you delete your account, linked data is deleted by cascade where the model supports it. Some security, billing, fraud, or compliance logs may be retained as needed for legal obligations, claims, or security.

Your rights

You can request access, correction, export, deletion, restriction, objection, and portability by contacting privacy@liralang.com. In the app you can also export data, disable first-party analytics for your account (and Aptabase in that browser), and delete your account. If you are in the EU/EEA, you may also complain to your data protection authority.

Children

Liralang is not directed to children under 14. If you believe a child sent us data without authorization, contact us so we can review and delete it where appropriate.