Privacy policy

Last updated 30 October 2026

This page explains what Lingolib stores about you and why, in plain language. Lingolib is run from Sweden and follows the GDPR. The data controller is Lingolib (Adam), adam@lingolib.com.

What we store

• Account: your name, email address and a hashed password (we never see the password itself).
• Learning data: which lessons you've watched and how far, words you save, quiz and practice results, and the videos you open in Watch. This is the product: without it the app can't remember your progress.
• Purchases: when you became a member (or bought the earlier first year or starter pack) and whether your membership is active, plus the Stripe customer and order ids. Card details never reach us; Stripe handles payment.
• Usage events: counts of things like “lesson opened” or “word saved”, used to understand what helps people learn and to notice when something breaks. Visitors who are not signed in are counted anonymously: our statistics set no cookie and keep no identifier in your browser, and visits are told apart only by a scrambled value that changes every day, so we cannot follow you from one day to the next or across other sites. Our legal basis is our legitimate interest in knowing how the site is used. To opt out, open “Cookie settings” at the bottom of any page and choose “No thanks”, and nothing is recorded after that. Once you have an account, usage while you are signed in is recorded and linked to your account (name, email, plan), as set out in our Terms. Our legal basis is our legitimate interest in running and improving the service you signed up for. You can object by emailing us, and we will stop.
• Waitlist: if you joined the waitlist, your email address and when you joined.
• Partners: if you join the partner programme, your name, email, the PayPal address you give for payouts, and the sales and commissions linked to your link.

What we send to other services

Only what each one needs to do its job:

• OpenRouter receives the text you ask the tutor, the words you look up and the sentences to translate, and passes it to the AI model that produces the answer.
• Speech recognition: when you speak in practice, a lesson or a tool, your browser recognises the speech with its own built-in service. Depending on the browser, that service may send the audio to the browser maker (Google for Chrome, Apple for Safari); we never receive that audio. When you speak a word list into your library, the recording comes to us: Swedish is transcribed on our own server, and other languages, or Swedish when our server is busy, through OpenRouter. Audio is not stored after the text is produced.
• Spoken audio: the text to be read aloud goes through OpenRouter to Google's Gemini speech model. Only the text is sent, never your voice or your account details.
• TranscriptAPI, with Supadata as a backup, receives the YouTube video id when you open a video, to fetch its transcript.
• Bunny.net streams the lesson videos from its content delivery network, which sees your IP address as any website host does.
• Stripe receives your name, email and billing address to create your checkout, work out VAT and issue your receipt.
• SMTP2GO delivers our emails (welcome, password reset, waitlist, contact form). It receives your email address and the message we send you.
• OpenPanel, which we host ourselves on our own server, records usage events: anonymously for visitors, and linked to the account for signed-in account holders. Nothing is sent to a third-party analytics company.
• GlitchTip, also hosted on our own server, receives error reports when something breaks: the error, the page it happened on and your browser version. They contain no name or email address and are deleted after 30 days.
• PayPal receives a partner's PayPal address, name and the amount when we pay out commission. Only partners are affected.
• Bunny.net also stores our nightly backups. The database is encrypted on our own server before it is uploaded, so Bunny.net cannot read it.
• YouTube sets its own cookies when its player loads in Watch, under Google's privacy policy.

Cookies

We use one essential cookie to keep you logged in, one to remember your cookie choice, and one during the pre-launch period to let testers past the coming-soon page. Our visitor statistics use no cookies. The only optional cookie is the partner referral one: we ask before setting it, and only if a partner's link brought you here. You can change your choice at any time with “Cookie settings” at the bottom of every page. No advertising cookies.

How long we keep it

For as long as you have an account. Delete your account from Settings and your profile, library and progress are removed within 30 days; purchase records are kept as long as accounting law requires (seven years in Sweden). Waitlist emails are deleted after the launch emails go out, or sooner if you ask.

Your rights

You can ask for a copy of your data, correct it, or have it deleted. Email adam@lingolib.com and we'll handle it within 30 days. You can also complain to the Swedish data protection authority, IMY (imy.se).

Where data lives

Our server is in Sweden (Hostup), and the encrypted backups are stored with Bunny.net in Sweden. Some of the services above run in the United States under standard contractual clauses.

Changes

If this policy changes in a way that matters, we'll email account holders before it takes effect.