Effective date: October 15, 2026 Last updated: November 1, 2026
This Privacy Policy explains how we collect, use, share, and protect your information when you use the flangu mobile app (the "App") on iOS and Android and the flangu website at flangu.app (the "Site"). Together we call them the "Service".
1. Who we are
flangu is run by an independent developer based in Poland, who is the controller of your personal data under the EU General Data Protection Regulation (GDPR). The controller's name and postal address are in Section 15. In this policy, "flangu," "we," "us," and "our" refer to the controller. We have not appointed a data protection officer. For any privacy question or request, email contact@flangu.app.
2. Information we collect
2.1 Account information
When you create an account, we collect:
- Email address
- Password, stored only as a salted, one-way hash. We never store or see your plaintext password.
- The name you enter during onboarding. The App uses it to greet you. It can be any name or nickname.
- Your native language and the language you're learning, and your time zone, so we can translate in the right direction and schedule reviews and reminders on your local days
If you sign in with Google, Google sends us your email address, a Google account identifier, and the basic profile details in your Google sign-in token (your name and profile picture link). We use the email address and identifier to create your account and sign you in. We store the rest with your sign-in record but don't use it.
If you sign in with Apple, Apple sends us an Apple account identifier and your email address. If you chose Hide My Email, that is a private relay address that forwards to your real one. We also keep a token Apple issues so we can revoke the sign-in when you delete your account. Apple may also offer the App your name; we don't send it to our servers or store it.
2.2 Content you create
- Words, phrases, and text you enter to translate, and the flashcards and decks you create from them
- Linguistic content generated for your cards: translations, synonyms, definitions, example sentences, pronunciation and audio, and AI-generated vocabulary images
- Personal Tutor messages (a Pro feature). See Section 4.
- Translation reports: when you flag an AI-generated translation as wrong, the fields you flagged and any comment you add
- Messages you send us through the App's "Contact us" form or the contact page on the Site: your name (optional), email address, subject, category, and message
Please don't enter sensitive personal details (for example about health, finances, or other people) into flashcards, the translator, or the Personal Tutor. The Service doesn't need them.
2.3 Learning and usage data
- Your review history: each rating (Again, Hard, Good, Easy), when you gave it, and how long the review took
- Spaced-repetition scheduling data for your cards (stability, difficulty, due dates) under the FSRS-6 algorithm, and your personal FSRS parameters if you optimize them
- Study statistics, streaks, and progress
- App settings and preferences, such as desired retention, appearance, voice, and notification preferences
2.4 Subscription and purchase information
flangu Pro is sold through Apple's App Store and Google Play. Subscriptions are managed through RevenueCat, our subscription management provider. We and RevenueCat receive transaction identifiers, the product you bought, the purchase, renewal, trial, and cancellation status, and whether you currently have Pro. We never receive your payment card details; Apple or Google handles payment.
2.5 Device and technical information
- Push notification token and your device platform (iOS or Android), if you allow notifications
- IP address and request details (time, the address requested, response status) in our server logs, and briefly in memory to rate-limit abusive traffic
- Crash reports and error diagnostics from the App and our servers, collected through Sentry. A report contains your device model, operating system, and App version; a random identifier for your installation of the App; your account's numeric ID when you're signed in; and technical details about the error, such as a stack trace and the App's recent technical events (for example, which addresses it contacted). Sentry is set not to store IP addresses. Reports never include your email address, name, password, flashcard content, translations, or Personal Tutor messages.
2.6 Data stored on your device
The App keeps a copy of your flashcards, decks, and review history on your device so you can study offline, and syncs it with our servers when you're online. It also stores your sign-in token in the device's secure storage, your preferences, and cached pronunciation audio. This data stays on your device until you sign out, delete your account, or uninstall the App.
2.7 Waitlist signups (Site)
Before flangu launches, you can join a waitlist on the Site. If you do, we collect the email address you submit, which waitlist form you used, and when you signed up.
2.8 What we don't collect
We don't collect your precise location, contacts, photos, camera, microphone recordings, health data, or biometric data. The App contains no ads and no advertising or tracking SDKs, and it doesn't access your device's advertising identifier.
3. How we use your information, and our legal bases
The GDPR requires a legal basis for each use of personal data. The table shows what we do, and the basis we rely on:
| What we do | Legal basis (GDPR art. 6(1)) |
|---|---|
| Create your account, sign you in, and keep your account secure | Performance of a contract (b) |
| Translate your words and generate flashcards, linguistic content, audio, and vocabulary images | Performance of a contract (b) |
| Schedule your reviews with FSRS-6 and show your statistics | Performance of a contract (b) |
| Run the Personal Tutor (Pro) | Performance of a contract (b) |
| Sync your data between your devices and back it up | Performance of a contract (b) |
| Process and manage your flangu Pro subscription | Performance of a contract (b) |
| Send service emails (verification codes, password reset, account deletion confirmation, important account notices) | Performance of a contract (b) |
| Send study-reminder push notifications | Your consent (a), given through your device's notification permission. Withdraw it at any time in the App or your device settings. |
| Answer your support messages and feedback | Legitimate interest (f) in responding to you |
| Diagnose crashes and fix bugs | Legitimate interest (f) in keeping the Service working |
| Protect the Service against fraud, abuse, spam, and bots | Legitimate interest (f) in security |
| Produce aggregate statistics from our own data (for example how many learners study each week, or keep studying after their first month) to understand and improve flangu. We don't share these statistics. | Legitimate interest (f) in improving the Service |
| Review flagged translations, and check shared translation cache entries, to improve translation quality | Legitimate interest (f) in improving the Service |
| Email you once when flangu launches, if you joined the waitlist | Your consent (a) |
| Measure Site traffic with Google Analytics | Your consent (a), given in the cookie banner |
| Keep records and answer lawful requests | Legal obligation (c) |
Is providing your data required? You need an email address (or a Google or Apple account) to create an account, because the Service is built around syncing your account. The App can't work without the data it needs to provide what you ask for, such as the text you want translated. Everything else is optional.
Automated decisions. We don't make decisions about you that are based solely on automated processing and have legal or similarly significant effects. FSRS-6 decides when a card is due for review; that is a study schedule, not a decision about you.
We do not sell your personal information. We don't use it for advertising, and we don't share it with anyone for their own marketing. We don't send marketing emails unless you've asked for them, such as the waitlist launch email.
4. AI features and third-party AI
Translating text and generating card content are the core of flangu, and they run on artificial intelligence (AI) services provided by other companies. This section explains what each of them receives, and when.
- Translation and linguistic content: Google Gemini API. When you tap Translate, the text you entered and your language pair go to Google's Gemini API, which returns the translation, definitions, examples, and other card content. The same happens when you pick an alternative translation, or open the details (synonyms, definitions, examples, pronunciation) of a card that doesn't have them yet.
- Personal Tutor (Pro): Google Gemini API. When you chat with the Personal Tutor, your messages, the conversation so far, and the card you're asking about (front, back, and language pair) go to the Gemini API to generate the answer. We don't store Tutor conversations on our servers. The App keeps a conversation only while it's open.
- Pronunciation audio (Pro): Google Cloud Text-to-Speech. When you play a word or an example sentence in the HD voice, that word or sentence goes to Google Cloud Text-to-Speech, which generates the audio with an AI voice. The standard voice runs on your device and sends nothing.
- Vocabulary images (Pro): Google Gemini API, Wikidata, and fal.ai. When you ask for an image, the Gemini API works out which meaning of the word your card is about. We look that meaning up in Wikidata, a public knowledge base, by sending only its English name. Then fal.ai draws the image with image models from OpenAI (and, to remove the background, a model from Bria). fal.ai receives only a short description of the meaning (for example "apple, the fruit"), never your account details or your other content.
What these services never receive. All of these requests are sent from our servers, not from your device, and contain only the text the feature needs. The AI providers never receive your email address, name, account ID, IP address, or device identifiers, so they can't tell from our requests who you are. Still, please don't type personal details into the translator or the Personal Tutor (see Section 2.2).
When it happens. Content is sent only when you use one of the features above. Studying, reviewing, statistics, and everything you do offline involve no AI service. If you'd rather not use AI for a card, create it in the translator's manual mode: a manual card is sent to an AI service only if you later ask for its details.
Improving translations. To find and fix wrong translations, we may also send entries of the shared translation cache (see Section 7), which aren't linked to any account, to the Gemini API to check them.
We use the paid Gemini API. Under Google's terms, it doesn't use what we send to train its models. Google keeps prompts and responses for 55 days to detect abuse and meet legal obligations, and then deletes them.
The Personal Tutor is an AI, not a person, and AI-generated content can be wrong.
5. How we share your information
We share personal data only with service providers that help us run the Service. They act on our instructions under data processing terms, may use the data only to provide their service to us, and must protect it to at least the standard this policy describes.
| Purpose | Provider | Data involved |
|---|---|---|
| Hosting, database, and backups | Railway | All account and learning data |
| Translation, linguistic content, and the Personal Tutor (AI) | Google (Gemini API) | Text you translate, Tutor messages, card content |
| Vocabulary image generation (AI) | fal.ai (models by OpenAI and Bria) | A description of a word's meaning; no personal data |
| Word meaning lookup | Wikidata (Wikimedia Foundation) | A single word; no personal data |
| HD voice pronunciation (AI), and audio and image storage | Google Cloud (Text-to-Speech, Cloud Storage) | Words and example sentences; generated audio and images |
| Sign-in | Google Sign-In; Sign in with Apple | Sign-in identifiers and email address |
| Subscriptions and payments | RevenueCat; Apple App Store; Google Play | Your account's numeric ID, purchase and subscription status |
| Email delivery | Amazon Web Services (Amazon SES) | Your email address and the email's content |
| Push notifications | Expo; Apple Push Notification service; Firebase Cloud Messaging (Google) | Your push token and the notification text |
| Crash and error diagnostics | Sentry | The diagnostics described in Section 2.5 |
| Bot protection on Site forms | Cloudflare (Turnstile) | Technical browser signals, IP address |
| Site analytics, only with your consent | Google Analytics | Site usage and cookie identifiers (see Section 6) |
We may also disclose information:
- To comply with the law, a court order, or a valid request from a public authority
- To enforce our Terms, or to protect the rights, property, or safety of our users, the public, or us
- If flangu is sold or merged with another business. In that case we'll tell you before your data becomes subject to a different privacy policy.
6. Cookies and similar technologies (Site)
This section covers the Site, including our documentation and blog. The App doesn't use browser cookies; see Section 2.6 for what it stores on your device.
| Cookie / storage | Purpose | Type | Lifetime |
|---|---|---|---|
sessionid |
Keeps you signed in during a session | Strictly necessary | Up to 14 days |
csrftoken |
Protects forms against cross-site request forgery | Strictly necessary | 1 year |
cookie_consent |
Remembers your cookie choice | Strictly necessary | 180 days |
__cf_bm (Cloudflare Turnstile) |
Tells humans from bots on the registration, waitlist, and contact forms | Strictly necessary | 30 minutes |
htmx-history-cache (browser local storage) |
Caches pages for faster back and forward navigation in our documentation and blog | Functional | Until you clear your browser storage |
_ga, _ga_T7L54E48Q3 (Google Analytics) |
Aggregate Site traffic statistics | Analytics, only with your consent | Up to 2 years |
Strictly necessary and functional storage runs automatically because the Site can't work properly without it. Google Analytics cookies are set only after you click Accept in the cookie banner shown on your first visit.
You can change or withdraw your choice at any time with the "Cookie settings" link in the Site footer. Withdrawing consent removes the Google Analytics cookies. For more on Google Analytics, see Google's Privacy Policy and how Google uses information from sites that use its services.
7. How long we keep your data
| Data | How long we keep it |
|---|---|
| Your account and its content (profile, flashcards, decks, review history, statistics, settings, translation reports, push tokens) | Until you delete your account. We then delete it immediately. |
| Database backups | 7 days. Backups are overwritten on a rolling basis, so deleted data is gone from all backups within 7 days. |
| Server logs (including IP addresses) | Up to 90 days |
| Crash and error reports (Sentry) | Up to 90 days |
| Support messages and feedback | Until we've resolved your request, and then up to 2 years in case you contact us again. Messages sent from your account's email address are deleted when you delete your account. |
| Waitlist signups | Until the launch email has been sent; then deleted |
| Subscription records at RevenueCat | Until you delete your account. We then ask RevenueCat to delete them. |
| Purchase records at Apple and Google | Kept by Apple and Google under their own policies. We can't delete them. |
| Text sent to the Gemini API | 55 days at Google, for abuse monitoring (see Section 4) |
Shared translation cache. To keep translations fast and consistent, we store each translated word or phrase, with the content generated for it (including its vocabulary image and pronunciation audio), in a cache shared by all learners. Cache entries don't record who created them and aren't linked to your account, so they remain after you delete your account. This is one more reason not to type personal details into the translator.
8. Delete your account
Delete your account in the App
Open the App and go to Settings → Delete account. Type DELETE to confirm. Deletion is immediate and can't be undone. It removes:
- Your profile, settings, decks, flashcards, review history, statistics, and translation reports
- Your sign-in credentials, push tokens, and subscription records
- Support messages sent from your account's email address
We also revoke your Sign in with Apple authorization (if you used it) and delete your customer record at RevenueCat. We send you an email to confirm the deletion. Within 7 days, the deleted data also leaves our backups. Section 7 lists the few things that remain: crash reports until they expire, purchase records kept by Apple and Google, and the shared translation cache.
Delete your account without the App
If you no longer have the App, email contact@flangu.app from the email address on your flangu account, with the subject "Delete my account". If you can't send from that address, tell us and we'll find another way to confirm the account is yours. We'll delete the account and everything listed above within 30 days, and usually much sooner, and confirm by email.
Cancel your subscription first
Deleting your account does not cancel a flangu Pro subscription. Apple and Google handle billing, and only you can cancel it there:
- iPhone: Settings → your name → Subscriptions → flangu → Cancel Subscription
- Android: Google Play Store → profile icon → Payments & subscriptions → Subscriptions → flangu → Cancel
If you don't cancel, the store keeps charging you after your account is deleted.
9. Data security
We protect your data with encrypted connections (HTTPS/TLS) between the App, the Site, and our servers; hashed passwords; secure on-device storage for your sign-in token; access controls on our infrastructure; and rate limits against brute-force and automated attacks. No method of storage or transmission is completely secure, so we can't guarantee absolute security. If a breach puts your rights at high risk, we'll tell you and the authorities as the law requires.
10. International data transfers
We're based in Poland, in the European Union. Some of our providers process data outside the European Economic Area (EEA), mainly in the United States. When personal data leaves the EEA, the United Kingdom, or Switzerland, we rely on an adequacy decision (such as the EU–US Data Privacy Framework, for providers certified under it) or on the European Commission's Standard Contractual Clauses, as GDPR Chapter V requires. To get a copy of the safeguards for a particular provider, email contact@flangu.app.
11. Your privacy rights
11.1 Everyone
Wherever you live, you can:
- See and update your name, languages, and settings in the App
- Delete individual flashcards or decks, or your entire account (see Section 8)
- Turn off push notifications in the App's settings or your device's settings
- Email us at contact@flangu.app with any privacy request
11.2 EEA, UK, and Switzerland (GDPR)
You have the right to:
- Access the personal data we hold about you and get a copy
- Rectify inaccurate data
- Erase your data
- Restrict our processing of your data
- Object to processing based on our legitimate interests (Section 3). We'll stop unless we have compelling legitimate grounds or need the data for legal claims.
- Data portability: receive the data you gave us in a structured, machine-readable format (we send a JSON file)
- Withdraw consent at any time, where we rely on consent. This doesn't affect processing that happened before.
To use these rights, email contact@flangu.app. We answer within one month; for complex requests the law lets us take up to two more months, and we'll tell you if we need to. We may ask you to confirm your identity, usually by replying from your account's email address.
You also have the right to complain to a data protection authority. Ours is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl). You can also complain to the authority where you live or work.
11.3 California and other US states
If you live in California or another US state with a consumer privacy law, you have the right to:
- Know what personal information we collect, use, and disclose, and get a copy of it
- Delete your personal information
- Correct inaccurate personal information
- Opt out of the "sale" or "sharing" of personal information, and of targeted advertising. We don't sell or share your personal information or use it for targeted advertising, as those laws define these terms.
- Not be discriminated against for using these rights
In the past 12 months we collected these categories of personal information, for the purposes in Section 3, and disclosed them only to the service providers in Section 5:
- Identifiers: email address, name, account ID, IP address, push token
- Commercial information: subscription and purchase status
- Internet or other electronic network activity: usage of the Service, crash diagnostics, and, with consent, Site analytics
- Content you create: flashcards, translations, Personal Tutor messages, support messages
- Sensitive personal information: account sign-in credentials, used only to sign you in
To make a request, email contact@flangu.app. We'll verify your identity before acting on it. You can use an authorized agent; we'll ask for proof of their authorization.
11.4 Other countries
If you live in another country with data protection law (for example Canada, Brazil, or Australia), we'll honor requests that are consistent with your local rights. Email contact@flangu.app.
12. Children
flangu is a general-audience service. It isn't directed at children under 13, or under a higher minimum age set by the law where you live (for example 16 in some EU countries, including Poland). You must meet that age to create an account (see our Terms of Use). We don't knowingly collect personal data from children below it. If you believe a child has given us personal data, email contact@flangu.app and we'll delete it promptly.
13. Third-party services
The providers listed in Section 5 handle data under their own privacy policies:
- Google Privacy Policy (Gemini API, Google Cloud, Google Sign-In, Google Play, Firebase Cloud Messaging, Google Analytics)
- Gemini API terms
- Apple Privacy Policy
- Railway Privacy Policy
- fal.ai Privacy Policy
- OpenAI Privacy Policy
- Wikimedia Foundation Privacy Policy
- RevenueCat Privacy Policy
- Amazon Web Services Privacy Notice
- Expo Privacy Policy
- Sentry Privacy Policy
- Cloudflare Privacy Policy
14. Changes to this policy
We may update this policy when our practices, the Service, or the law change. The "Last updated" date at the top shows when it last changed. If a change materially affects how we use your data, we'll tell you in the App or by email before it takes effect. Where the law requires your consent to a change, we'll ask for it.
15. Contact us
For any question or request about this policy or your personal data:
Rafał Darnobid (flangu) Herburtów 80, 37-700 Przemyśl, Poland Email: contact@flangu.app