Privacy Policy

Controller and contact

Liralang is the controller for personal data processed in the app and public site. For privacy requests, contact privacy@liralang.com.

Data we process

• Account data: name, email, base language, CEFR level, Google profile image if used, verification status, role, and preferences.
• Authentication and security: sessions, IP, user-agent, security events, 2FA, and verification or recovery tokens.
• Learning data: progress, answers, notes, vocabulary, phrases, conversation memory, tutor preferences, and note images you paste.
• AI and voice: prompts, corrections, conversation turns, generated replies, model, token usage, duration, and estimated cost.
• Billing: tier, subscription status, customer/subscription ids, billing events, currency, and amounts. Full card data is handled by Lemon Squeezy, not Liralang.
• First-party analytics: pages, product events, referrer, approximate country, device class, anonymous local ids, and salted hashed IP. Raw IP is not stored in analytics tables.
• Support: feedback or messages you send, together with your account and current page.

Purposes

• Create and secure accounts, verify email, and maintain sessions.
• Save progress, adapt the course, and sync data across devices.
• Generate corrections, conversations, explanations, and audio with AI providers.
• Measure usage, cost, plan limits, conversions, and errors to operate the service.
• Manage subscriptions, gifts, invoices, cancellations, and support.
• Prevent abuse, investigate incidents, and comply with legal obligations.

Legal bases

Data necessary to provide Liralang is processed for contract performance. Security, abuse prevention, minimal first-party analytics, and product improvement rely on legitimate interests, with analytics opt-out. Transactional emails are necessary for account and security. Where law requires consent, we will request it before using the relevant data or technology.

Providers and transfers

We use providers for hosting, database, authentication, email, payments, and AI, including Vercel, Neon/Postgres or the configured database provider, Resend, Lemon Squeezy, Google OAuth, Anthropic, and Inworld. Some providers may process data outside the EEA; applicable contractual safeguards are used where required.

Retention

Account and learning data is kept while your account exists. If you delete your account, linked data is deleted by cascade where the model supports it. Some security, billing, fraud, or compliance logs may be retained as needed for legal obligations, claims, or security.

Your rights

You can request access, correction, export, deletion, restriction, objection, and portability by contacting privacy. In the app you can also export data, disable local analytics, and delete your account. If you are in the EU/EEA, you may also complain to your data protection authority.

Children

Liralang is not directed to children under 16. If you believe a child sent us data without authorization, contact us so we can review and delete it where appropriate.