At a glance. Lengio is built privacy-first. Your vocabulary, photos, and study progress stay on your device. We don't require accounts, run advertising SDKs, sell data, or use behavioural analytics. Optional AI speech features run securely on our servers only when you choose to use them.
This page explains exactly what does — and does not — happen with your information.
This Privacy Policy ("Policy") describes how Lengio ("Lengio", "we", "us", or "our") processes information when you use the Lengio mobile application (the "App") or visit the Lengio website at lengio.app (the "Site"), collectively the "Services".
This Policy applies to all users of the Services worldwide, with additional disclosures for residents of specific regions (see Region-Specific Disclosures). It does not apply to third-party services you reach through links inside the Services — those are governed by their own privacy policies.
By using the Services you confirm you have read and understood this Policy. If you do not agree, please do not use the Services.
For the purposes of EU/UK General Data Protection Regulation, similar laws, and CCPA/CPRA, the data controller (or "business") responsible for the limited information we process is Lengio. You can reach us at support@lengio.app for any privacy-related question, request, or complaint.
We have not appointed a statutory data protection officer because our processing does not require one, but the contact above is monitored by a person with responsibility for privacy matters.
We have intentionally designed Lengio to collect as little personal information as possible. The categories below describe everything we receive.
If you choose to use the AI Speech Partner, the App will, only while the feature is active, capture audio from your device microphone, transcribe what you said, and send your transcript to our AI provider so it can generate a tutor reply. The reply is streamed back to your device.
The following information lives on your device only and is never transmitted to us. iOS encryption and sandboxing apply.
If you have iCloud Backup enabled at the iOS level, this data may be included in your encrypted iCloud backup managed by Apple. Lengio does not have its own server-side sync; we cannot read your iCloud backup.
The limited information we collect is used for the following purposes only:
We do not use your information for advertising, profiling, automated decision-making with legal effects, or to train external machine-learning models.
If you are in the European Economic Area, United Kingdom, Switzerland, or any region with similar law, we rely on these legal bases under Article 6 GDPR (or its local equivalent):
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
We do not sell or rent personal information. We do not share information with advertisers. We share information only with the parties below, and only as needed to operate the Services or comply with law:
The Services rely on the third parties below. We disclose them so you can review their practices independently:
We integrate no third-party advertising SDKs, behavioural analytics SDKs, marketing pixels, or session-replay tools inside the App.
The Site is a static website that does not set marketing or analytics cookies. Your browser may use functional storage (e.g. cache) as part of normal operation. The App does not use web cookies because it is a native iOS application.
Our hosting provider may set short-lived security cookies (e.g. to mitigate denial-of-service attacks). These are strictly necessary and exempt from consent under the ePrivacy framework.
We use technical and organisational measures appropriate to the nature of the data we process. These include:
No method of transmission or storage is 100% secure. We cannot guarantee absolute security. If we discover a breach affecting personal information we will notify you and any regulator as required by law.
Lengio operates internationally. When you contact us by email, or when our service providers process server logs, your information may be transferred to and processed in countries outside your country of residence, including jurisdictions that may not provide the same level of data-protection law as your own.
Where required, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and adequacy decisions. A copy of the safeguards used is available on request from support@lengio.app.
Subject to local law, you may have the following rights regarding your personal information. Because most data stays on your device, you can exercise many of these yourself directly inside the App.
To make a request, email support@lengio.app with the subject line "Privacy Request". We may need to verify your identity (for example, by replying from the email address you used when contacting us) before responding. We will respond within the statutory time frame applicable to you (typically 30 days, extendable as permitted by law).
If you are a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) gives you specific rights. The categories of personal information we have collected in the past 12 months are: identifiers (email when you contact us), internet activity information (server logs), and limited commercial information (purchase confirmations from Apple). We have not collected sensitive personal information as defined by CPRA in the past 12 months.
We have not sold or shared personal information for cross-context behavioural advertising in the past 12 months and have no intention to do so. We do not use or disclose sensitive personal information for purposes that would require us to offer a "Limit the Use of My Sensitive Personal Information" link.
You may exercise California rights — to know, delete, correct, opt out of sale/share, and not be retaliated against — by emailing support@lengio.app. An authorised agent may make a request on your behalf with written authorisation.
Shine the Light. California Civil Code § 1798.83 permits California residents to request information about disclosure of certain categories of personal information to third parties for direct-marketing purposes. We do not disclose information for such purposes.
The legal bases on which we process personal information are described in Section 7. You have the GDPR rights described in Section 14. You also have the right to lodge a complaint with your local supervisory authority. We are not currently required to appoint an EU/UK representative under Article 27 GDPR; if this changes we will list the representative here.
Brazilian users have rights equivalent to those described in Section 14 under Lei Geral de Proteção de Dados. Email support@lengio.app to exercise them.
Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Iowa (ICDPA), Tennessee (TIPA), Indiana (INCDPA), New Jersey (NJDPA), Delaware (DPDPA), New Hampshire (NHDPA), and other states with consumer-privacy laws have rights of access, deletion, correction, portability, and opt-out of targeted advertising or sale. We do not engage in targeted advertising or the sale of personal information. To exercise other rights, email support@lengio.app.
Where local law gives you additional rights — for example the Australian Privacy Principles or Canadian PIPEDA — we will honour them. Contact us for specifics.
The Services are not directed to children under the age of 13 (or the equivalent minimum age in your jurisdiction — 14 in Spain, 15 in the Czech Republic and France, 16 in Germany and the Netherlands, and similar national variants under GDPR Article 8). We do not knowingly collect personal information from children below those ages.
Lengio is rated 4+ on the App Store and contains no objectionable content, but parents are responsible for supervising their child's use. If you believe a child has provided us with personal information, please email support@lengio.app and we will delete it promptly.
Lengio lets you attach personal photos to vocabulary entries. These photos remain on your device. We have no access to them and they are not transmitted to our servers. If you choose to share screenshots with our support team, the images become part of your support correspondence and are governed by this Policy.
We strongly discourage including sensitive personal information (e.g. images of identification documents, payment cards, health records) in support correspondence. If you do, we will treat it confidentially and delete it once your support inquiry is resolved.
The App may send local notifications (e.g. daily study reminders). These are scheduled and delivered entirely on your device by iOS based on settings you control. We do not see when notifications are delivered or opened. You may disable notifications at any time in iOS Settings.
We do not send marketing emails. We will reply to support correspondence you initiate, and may send transactional emails strictly necessary to resolve an inquiry.
Because the Site does not perform user tracking, Do-Not-Track signals (DNT) and Global Privacy Control (GPC) have no behavioural effect. We honour these signals where they are legally required by treating them as a valid opt-out of any future sale or share of personal information.
We may update this Policy from time to time to reflect changes to our practices, technology, legal requirements, or for other operational reasons. The "Last updated" date at the top of the page indicates the most recent revision.
For material changes that affect your rights, we will provide additional notice — for example, an in-app message, a prominent notice on this page, or an email to known support contacts — before the change takes effect. Continued use of the Services after the effective date constitutes acceptance of the revised Policy.
For any privacy question, request, or complaint, please contact us:
We aim to acknowledge requests within 5 business days and resolve them within 30 days, or sooner where required by law. If you are not satisfied with our response, you may contact your local data-protection supervisory authority.
Disclaimer. This Policy is provided in good faith and reflects our practices as of the effective date above. It is not legal advice. Where translation conflicts with the English original, the English version controls. If a provision is held unenforceable, the remaining provisions remain in full effect.