1. The short version
The full document follows. In summary:
- We collect the minimum the account needs: email, display name and your study progress.
- We do not sell data, we show no advertising, and we do no tracking for advertising purposes.
- We use no third-party analytics, crash-reporting or session-recording tools at all.
- Your voice recordings and exercise texts are not stored on our servers — they are only sent to the providers that perform transcription and correction.
- The exception is disputing a correction: there, the content is kept for review.
- You can export your data, reset your progress and delete your account from within the app.
- Contact for privacy and to exercise your rights: help@langualy.app.
2. Who the controller is
The controller of the personal data processed by Langualy is Viper LTDA, CNPJ 51.663.220/0001-36, trading as Viper, with its registered office at Rua Manoel Medeiros Guedes, nº 12, Sala 201, Manaíra, João Pessoa – PB, postcode 58038-360, Brazil.
Contact channel for privacy matters and for exercising your rights: help@langualy.app.
Viper LTDA is a small-scale processing agent and has not, at present, formally appointed a data protection officer. The channel above is the official means of contact for the purposes set out in the Brazilian General Data Protection Law, and it is how we handle requests from data subjects and from the national authority. Should an officer be appointed, this Policy will be updated.
3. What this Policy covers
The Langualy app and the langualy.app website, including the langualy.com address. It does not cover third-party services you reach elsewhere, nor the app store you download the program from, which has its own policy.
4. What data we handle
Data you provide when creating and using the account:
| Data | Source | Required? |
|---|---|---|
| Email address | You type it at sign-up | Yes |
| Password | You choose it; we store only the hash | Yes |
| Display name | You type it; it can be a nickname | Yes |
| Declaration that you are 18 or over | You tick it at sign-up; we store the date and time | Yes |
| Acceptance of the Terms and this Policy | Same action; we store the date and time | Yes |
| Time zone | Detected from the device at sign-up; editable | Yes |
| Preferences: theme, study language, audio autoplay, daily goal, notifications | You choose them in the app | No |
Data generated by your use of the app:
- the state of each word for you: already known, being learned, or learned in the app, with the corresponding dates;
- the spaced repetition state of each word in each of the four skills;
- the rating history, with the rating, the skill and the date;
- study sessions, with start, end and status;
- daily activity, day streaks and milestones reached;
- technical product events, described in the metrics section.
We do not collect date of birth, age, gender, identity documents, phone number, location, contacts, photos, advertising identifiers, browsing history or payment data.
5. Texts, recordings, and what happens to them
This is the part that raises the most questions, so let us go exercise by exercise.
| What you produce | Does it leave the device? | Is it stored? |
|---|---|---|
| Your dictation answer | No. The comparison happens on the device itself | No, unless you dispute |
| Your voice recording in shadowing | Yes, to the transcription provider, and only when you ask for the analysis | No |
| The recognised text of your speech | It comes back to the device | No, unless you dispute |
| Your English sentence in writing | Yes, to the artificial intelligence provider | No, unless you dispute |
| The meaning you write in Portuguese | Yes, together with the sentence | No, unless you dispute |
| The correction returned by the artificial intelligence | It comes back to the device | No, unless you dispute |
About the voice recording, in detail: it begins only when you tap record, after granting microphone permission. The file stays on your device while you are on that exercise, and you can listen to it as many times as you like. It is deleted when you re-record, move on, skip the item, or leave the exercise. We do not keep the recording on any server.
One honest clarification: if the operating system force-quits the app while a recording exists, the cleanup routine may not get to run, and the temporary file remains in the app’s private storage on your device until the system reclaims it or you open the exercise again. It still never leaves your device.
Declining microphone permission is a legitimate choice: the shadowing exercise can be skipped with no impact on your progress.
Artificial intelligence correction of writing only happens on items that ask you to create a sentence. On items where you simply write the word itself, you rate yourself and nothing is sent outside.
6. Disputing a correction
When an automated correction looks wrong, you can send it for review through the “Does this correction look wrong?” link. That is the only situation in which the content of an exercise is stored, which is why sending it depends on an action from you.
In all three exercises, the app shows a notice of what will be stored and waits for your confirmation before sending. When disputing a writing correction, the record includes:
- the requested word, its translation, its part of speech and the reference sentence from the catalogue;
- your English sentence and the meaning you wrote in Portuguese;
- the full response from the artificial intelligence, as it arrived;
- what the app did with it: interpretation, corrected text, errors shown, highlighted differences and what was discarded;
- the outcome assigned, the rating recorded and the messages you read on screen;
- technical information needed to diagnose the case: model used, rule and prompt versions, app version, platform and date;
- your account identifier, so that we can reply to you and locate the case.
When disputing a dictation or shadowing correction, the record includes the exercise word, the expected answer, the alternative answers accepted, what you typed or the recognised text of your speech, the outcome assigned and the highlighted differences, together with your account identifier.
That content is accessed only by our internal team and used to:
- review the dispute;
- fix content and correction failures;
- improve and protect the service;
- comply with legal obligations;
- exercise or defend rights.
The data will be kept for as long as it is necessary to review the dispute, improve and protect the service, comply with legal obligations, or exercise and defend rights, with periodic reviews of necessity. You can ask for a specific dispute to be deleted at help@langualy.app.
7. What we use each piece of information for, and on what legal basis
| Purpose | Data involved | Legal basis (LGPD) |
|---|---|---|
| Create and maintain your account, authenticate access and recover the password | Email, password (hash), display name | Performance of a contract (art. 7, V) |
| Store and sync your progress, schedule reviews and show statistics | Word states, ratings, sessions, daily activity, milestones | Performance of a contract (art. 7, V) |
| Correct writing and transcribe speech in the exercises | English sentence, meaning in Portuguese, recording audio | Performance of a contract (art. 7, V) |
| Evidence the minimum-age declaration and acceptance of the documents | Date and time of the confirmation | Compliance with a legal obligation (art. 7, II) and exercise of rights (art. 7, VI) |
| Send the reminders you turned on | Notification preferences and the time you chose | Performance of a contract (art. 7, V) |
| Review correction disputes | The content described in the previous section | Legitimate interest (art. 7, IX) and performance of a contract (art. 7, V) |
| Protect the service, prevent fraud and enforce usage limits | Account identifier, usage counters, technical records | Legitimate interest (art. 7, IX) |
| Understand how the app is used and control the cost of paid features | Product events and technical metrics, with no text or audio | Legitimate interest (art. 7, IX) |
| Respond to support requests and to data subject requests | Your email and whatever you write to us | Performance of a contract (art. 7, V) and compliance with a legal obligation (art. 7, II) |
| Comply with a legal or authority order and defend rights | Whatever is strictly necessary | Compliance with a legal obligation (art. 7, II) and exercise of rights (art. 7, VI) |
When we rely on legitimate interest, it is always for a concrete purpose — keeping the service running, preventing abuse and improving the quality of corrections — using the minimum data necessary and within what you would reasonably expect from a study app. You may object to that processing through the contact channel, and we will assess the request.
We do not process personal data for advertising, for commercial profiling, or for automated decisions with legal effects on you. Automated correction assesses a language exercise; it has no effect outside the app.
8. Metrics, technical records and diagnostics
Langualy uses no third-party analytics, error-reporting or session-recording tool. There is no advertising SDK and no tracking identifier.
In our own database we record a small set of product events: sign-up completed, session started, completed or abandoned, exercise completed (with the skill and the rating), exercise skipped (with the skill), and technical sync or content failures (with the position of the word). Those events are linked to your account and contain no free text, no IP address and no device information.
We also record usage metrics for the paid features — length of transcribed audio, number of characters corrected, model, success or error, and estimated cost. Those tables never contain the audio or the text, and are not accessible from the app.
As with any service reached over the internet, the infrastructure hosting Langualy keeps technical access records, which may include IP address, date and time, and connection agent information. Those records are generated and retained by the infrastructure provider according to the configuration of the service contracted, and are used for security, diagnostics and legal compliance.
9. Device permissions
| Permission | What for | If you decline |
|---|---|---|
| Microphone | Recording your voice in the shadowing exercise | The exercise can be skipped, with no impact on your progress |
| Notifications | Sending the daily reminder and the alert about available reviews | The reminders are simply not scheduled |
Both permissions can be revoked at any time in your device settings, without preventing you from using the rest of the app.
Langualy notifications are local: they are scheduled by the device itself, at the time you choose. We use no push server and we collect no notification token.
10. Who we share with
We do not sell personal data, do not release it for advertising, and do not share it with data brokers. We share only with the providers needed for the service to work, and only what is needed:
| Provider | Role | What it receives |
|---|---|---|
| Supabase | Hosting, database and authentication | Account, progress, disputes and technical records |
| OpenAI | Automated correction of written production | The exercise word, your English sentence and the meaning you wrote in Portuguese |
| ElevenLabs | Speech transcription in shadowing | The audio of that attempt’s recording |
| Apple | Distribution of the app through the App Store | The data Apple itself collects when distributing the app, under its own policy |
The correction and transcription calls do not send your email, your name, your account identifier or your history: only the content of that exercise goes out. On the correction call, the app expressly instructs the provider not to store a record of the interaction.
What each provider does with the content while processing it is governed by that provider’s own terms and policies. We engage those services so that they process data only under our instructions and for the requested purpose.
We may also share information where required by law or by a competent authority, or where necessary to exercise or defend rights.
11. Where the data sits, and international transfers
Langualy is operated by a Brazilian company. The database holding your account and your progress is hosted in the São Paulo region, in Brazil.
The automated correction and transcription services are operated by foreign companies and process the content sent to them outside Brazil. That constitutes an international transfer of data, which we carry out on the basis of the need to perform the contract entered into with you and observing the applicable mechanisms and safeguards set out in the Brazilian General Data Protection Law.
The app may be downloaded in other countries. Depending on where you are, local law may grant you rights in addition to those described here; where that is the case, those rights are respected. This Policy was drafted under Brazilian law and does not claim compliance with every legal regime in the world.
12. How long we keep it
| Information | Period |
|---|---|
| Account, profile, preferences and all study progress | For as long as the account exists |
| Voice recordings | Not stored on our servers; on the device, until you re-record, move on, skip or leave the exercise |
| Exercise texts and corrections received | Not stored, unless disputed |
| Correction disputes | For as long as necessary to review the case, improve and protect the service, comply with legal obligations, or exercise and defend rights, with periodic reviews of necessity |
| Product events and usage metrics for paid features | For as long as necessary to monitor the quality, security and cost of the service, with periodic reviews of necessity |
| Infrastructure access records | For the period configured in the hosting service contracted and for as long as the law requires |
| Account with deletion requested | 30 days of recovery; after that, permanent deletion by a daily automated routine |
13. Account deletion: what goes and what stays
You can delete your account under Profile and settings. We ask for a confirmation word and your current password, and the account enters a 30-day recovery period. During that time, signing in opens a recovery screen: confirming there cancels the deletion. After 30 days, an automated routine deletes the account permanently, and it can no longer be recovered.
Permanently deleted:
- the authentication record, with your email and password;
- the profile, display name, time zone and all preferences;
- all progress: word states, spaced repetition, rating history, sessions, daily activity, streaks and milestones;
- the product events linked to you;
- writing correction disputes, together with the texts you submitted.
The following remain, with no link whatsoever to your account and with no possibility of restoring it:
- dictation and shadowing disputes, which stay on record for reviewing the learning content, including the text that was typed or recognised, but with no identification of who submitted it;
- usage metrics for the paid features — duration, tokens, success and cost — which contain neither audio nor text;
- internal content-inconsistency records, which point only to catalogue positions;
- infrastructure access records, for the applicable period;
- anything we need to keep to comply with a legal obligation or to exercise and defend rights.
If you would rather the text of a specific dispute were deleted too, write to help@langualy.app.
Infrastructure backups may retain data for a short period after deletion, until they are overwritten in the normal rotation cycle. They are not used to restore deleted accounts.
14. Resetting your progress
Without deleting your account, you can erase your progress in a language. “Reset learning” deletes reviews, statistics and words learned in the app, and asks whether you want to keep the words you marked as already known. “Start over completely” also deletes those and resets your best streak.
In both cases the account, email, name and preferences remain, other languages are unaffected, disputes already submitted stay on record, and the action cannot be undone.
15. Security
We have the following measures in place — these are the ones that actually exist today:
- all communication between the app, our servers and the providers happens over an encrypted connection (HTTPS/TLS);
- passwords are stored only as a hash by the authentication service; nobody at Langualy has access to your password;
- the session is kept in the operating system’s secure storage on the device (Keychain on iOS, Keystore on Android), not in ordinary storage;
- the database applies row-level access control on every table: each account can reach only its own records;
- administrative and metrics tables are not accessible from the app under any circumstances;
- disputes can only be created by the app, never read by it;
- the correction and transcription provider keys live on the server only and are never bundled into the app;
- there are per-minute, per-hour and per-day usage limits on calls to external services;
- deleting the account requires confirming your current password.
No system is entirely immune. We do not promise absolute security, and we do not claim certifications, external audits or security programmes that we do not yet have. If a security incident occurs with significant risk to your rights, we will notify you and the Brazilian National Data Protection Authority in the manner and within the deadlines set by law.
16. Your rights and how to exercise them
The Brazilian General Data Protection Law grants you, among others, the right to:
- confirm that we process your data and access it;
- correct incomplete, inaccurate or out-of-date data;
- request anonymisation, blocking or deletion of unnecessary data or data processed unlawfully;
- request portability of your data to another provider;
- obtain information about sharing and about the consequences of not providing a piece of data;
- withdraw consent, where processing relies on it;
- object to processing carried out on the basis of legitimate interest.
Much of that you can do yourself, inside the app:
- change your display name, time zone, theme and preferences, under Profile and settings;
- export your data as a JSON file, on the same screen;
- reset your progress in a language;
- delete your account, with 30 days of recovery.
For anything else — including access, correction, information, portability, objection, or deletion of a specific dispute — write to help@langualy.app. We will acknowledge receipt and respond within the periods set by applicable law. We may need additional information to confirm your identity before acting, which is there to protect your own account.
You may also lodge a complaint with the Brazilian National Data Protection Authority.
17. Children’s and teenagers’ data
Langualy is intended for people aged 18 and over and is not directed at children or teenagers. We do not knowingly collect data from anyone under 18.
If we identify, or are told, that an account belongs to someone under 18, we will suspend and delete the account and the associated data, subject to legal obligations. If you are responsible for a minor and believe they created an account, write to help@langualy.app.
18. The langualy.app website
The website is informational and requires no sign-up. It uses no advertising, tracking or analytics cookies, and loads no third-party scripts.
We use a single strictly necessary first-party cookie, which stores the language chosen in the selector so that your next visit opens in it. Your light or dark theme preference is kept in your browser’s local storage. Neither of them identifies you.
19. Changes to this Policy
We may update this Policy when the service, the law or our practices change. The version and the effective date appear at the beginning and at the end of the document, and significant changes are announced in the app, on the website or by email.
If a change requires fresh consent, we will ask for it before applying it.
20. Governing law
This Policy is governed by Brazilian law, in particular the General Data Protection Law (Law No. 13,709/2018), the Internet Civil Framework (Law No. 12,965/2014) and the Consumer Protection Code (Law No. 8,078/1990), where applicable.
21. Languages of this document
We publish this Policy in Brazilian Portuguese, English and Spanish. All three versions aim to communicate exactly the same rules. In the event of a difference in interpretation, the Brazilian Portuguese version prevails, to the extent permitted by applicable law, without removing rights mandatorily guaranteed by the user’s own jurisdiction.
22. Contact
For anything relating to privacy and to exercising your rights: help@langualy.app. We will reply as soon as we can, and within the periods set by applicable law where a data subject request is involved.
Viper LTDA — CNPJ 51.663.220/0001-36 — Rua Manoel Medeiros Guedes, nº 12, Sala 201, Manaíra, João Pessoa – PB, postcode 58038-360, Brazil.
Privacy Policy · Version 1.0 · Last updated August 26, 2026
help@langualy.app