Legal
Privacy Policy
Last updated: 20 October 2026
In short
- No ads, no tracking, no analytics tools, and we never sell your data.
- We store what Lorolingua needs to work for you: your account, the articles you save and the words you learn — so they are the same on all your devices.
- Our servers are in the EU. A few services outside the EU help us (listed below).
- You can ask us at any time what we hold about you and have it corrected or deleted — or delete your account yourself in the app.
1. Who is responsible
The controller under the General Data Protection Regulation (GDPR) is:
[name — to be added]
[street — to be added]
[postcode and city — to be added]
Austria
Email: hola@lorolingua.com
Write to this address for anything about your data. We have not appointed a data protection officer, as the law does not require one for a service of our size.
2. Visiting lorolingua.com
The website is delivered by Cloudflare (see section 10). To show you the page and to protect it against attacks, Cloudflare processes technical data of each request: your IP address, the address of the page, date and time, and your browser's identification. We do not see these requests in a log of our own, and we use no analytics or tracking on the website.
When you pick a language on the website, your browser remembers the choice (ll-locale in its local storage). It never leaves your device.
Legal basis: our legitimate interest in delivering a secure website (Art. 6(1)(f) GDPR).
3. Your account
To create an account you give us your email address and a password. You may also add your name. Sign-in runs on our own sign-in service on our server; your password is stored only as a secure hash and our app never sees it. We also store when the account was created, when you last signed in and used the app, your interface language, and — if you set them up — your passkeys.
During the closed beta, an account works only if its email address is on our invitation list. We keep that list with a short note on how you were invited. Deleting your account removes your address from it.
Emails about your account (confirming your address, resetting your password, security notices) are sent through Brevo. We do not send newsletters; if we ever do, only with your separate consent.
Legal basis: providing the service you signed up for (Art. 6(1)(b) GDPR).
4. Your library and your learning data
When you are signed in, we store on our server:
- Articles you save — their text, title, the web address they came from, your notes and highlights, and how far you have read.
- Your vocabulary — the words you looked up and their review schedule, the words you have read, and the level you set for each language.
We keep this so your library and progress are the same on every device you use. Nobody else can see it. You can delete single articles in the app; deleting your account deletes all of it.
The desktop app also keeps copies of your articles and vocabulary on your computer, so it works offline.
Legal basis: Art. 6(1)(b) GDPR.
5. Looking up words and translating
When you look up a word or translate a text, the app may send the word, sentence or paragraph and the language pair to our server to get the answer. These requests are not stored with your account: the server keeps recent answers in its memory only, to answer the same question faster, and forgets them when it restarts. We do not write the text you look up into our logs.
When you import an article from a web address, our server fetches that page for you, because browsers cannot do this themselves.
If the app crashes or runs out of memory on your device, it sends our server, at most once a day and without your account, what your browser reports about the device (memory size, number of processor cores), when and at which step the app failed, and how long its slowest steps took. The server uses this only to decide how much work the app does on your device; it stores none of it and does not write it into its logs. The same record stays in your browser's storage.
Legal basis: Art. 6(1)(b) GDPR.
6. Chatting with Chiki
The online chat sends your messages to an AI service to write Chiki's replies. With each message, the app includes what Chiki needs to answer at your level: your level, the words you are practising, a list of words you already know, an excerpt of the article you are reading (about a paragraph), and the conversation so far. Our server forwards this to Groq, Inc. in the USA and passes the reply back. We do not store the content of your chats on our server; we only count how many chat requests you make each day, to keep the free limit fair. Under Groq's terms for API customers, Groq does not use this content to train its models.
On the desktop app you can instead run the chat entirely on your own computer; then nothing leaves your device.
Legal basis: Art. 6(1)(b) GDPR. You start each chat yourself, and the app tells you before your first online chat that it uses an online service.
7. Problem reports and emails
When you send a report from the app ("Any trouble?"), we receive your description, the app version, the platform and browser, the screen you were on, your language settings and — unless you untick it — the app's recent log. Before sending, the app removes sign-in tokens, passwords, email addresses, web-address parameters and your computer's user name from the log; it can still contain titles and addresses of articles you opened and words you looked up. Reports are linked to your account, used only to find and fix problems, and deleted after 90 days. Deleting your account deletes your reports.
Legal basis: your consent when you choose to send the report (Art. 6(1)(a) GDPR); you can withdraw it at any time by asking us to delete the report.
When you write to us by email, we use your address and your message only to answer you. Our mailbox is hosted by Proton (see section 10). We delete the correspondence once the matter is settled, unless the law requires us to keep it longer.
Legal basis: our legitimate interest in answering you (Art. 6(1)(f) GDPR) or, where it concerns your account, Art. 6(1)(b) GDPR.
8. Downloading the desktop app
Installers are delivered directly by GitHub. When you download one, your browser connects to GitHub, which processes your IP address to deliver the file. Our server only checks that you are signed in and hands your browser a short-lived download link.
Legal basis: Art. 6(1)(b) GDPR.
9. Server logs
Our server writes technical logs to keep the service running and secure: time, the kind of request, the result, and — for signed-in requests — your account's internal ID (not your email). We do not log IP addresses, except when a request is blocked because it exceeded a rate limit (protection against abuse). We never log the text of your articles, lookups, chats or reports. Logs have a fixed size; the oldest entries are deleted automatically as new ones are written.
Legal basis: our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR).
10. Who processes data for us
These providers process data as part of running Lorolingua:
| Provider | What for | Where |
|---|---|---|
| Hetzner Online GmbH, Germany | The server that runs our app, database and sign-in | Germany (EU) |
| Cloudflare, Inc., USA | Delivering the website and the web app, secure connections, protection against attacks; storing our encrypted off-site backups | Worldwide network |
| Brevo (Sendinblue SAS), France | Sending account emails | EU |
| Proton AG, Switzerland | Our mailbox: receiving and answering the emails you send us | Switzerland |
| Groq, Inc., USA | Writing Chiki's replies in the online chat | USA |
| GitHub, Inc., USA | Delivering the desktop app installers | USA |
Where data goes to the USA, the transfer relies on the EU–US Data Privacy Framework for providers certified under it, and otherwise on the European Commission's standard contractual clauses (Art. 45 and 46 GDPR). For Switzerland, the European Commission has decided that it protects data adequately (Art. 45 GDPR).
11. What the app keeps on your device
We use no tracking cookies. The web app sets one functional cookie, locale, for one hour, so that the sign-in page shows your language. Everything else the app keeps on your device stays there unless described above:
- your sign-in session (in the browser tab's session storage; on the desktop app, in a file only your user account can read),
- your settings, chosen languages and reading positions,
- the language data the app downloads, and a cache of recent answers,
- a copy of your vocabulary, so the app works without waiting for the server,
- the internal ID of the account this data belongs to, so it is removed before another account uses the device,
- a record of crashes and slow steps on this device (section 5),
- on the desktop app, a small activity log, read only when you send a problem report.
This storage is strictly necessary for the app to work, so it needs no consent (§ 165(3) Telekommunikationsgesetz 2021). Signing out removes your data from the device: the vocabulary copy, the cache of answers, your chosen languages, levels and reading positions, and on the desktop app your saved articles. The downloaded language data stays, as do the theme and interface language you chose and the desktop app's activity log. If a different account signs in on the same device, the previous account's data is removed first. To remove the downloads too, clear the site data in your browser or uninstall the desktop app.
12. How long we keep data
- Account, library and vocabulary: until you delete them or ask us to delete your account.
- Problem reports: 90 days.
- Emails to us: until the matter is settled, unless the law requires us to keep them longer.
- Backups: our server makes a daily backup, kept for 14 days; an encrypted copy is stored off-site for up to 90 days. Data you deleted disappears from backups within that time.
- Logs: until they are overwritten by newer entries (see section 9).
13. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on legitimate interest (Art. 15–21 GDPR). Where you gave consent, you can withdraw it at any time; this does not affect processing before the withdrawal.
You can delete your account and all its data yourself in the app: Settings → Account → Delete account (you confirm with your password). To use any of the other rights — or if you prefer — write to hola@lorolingua.com from the email address of your account. We answer within one month.
You also have the right to complain to a data protection authority, in particular in the EU country where you live (Art. 77 GDPR). Ours is the Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, Austria.
14. Children
Accounts are for people aged 16 and over. We do not knowingly collect data of younger children; if you believe a child has created an account, please tell us and we will delete it.
15. Security
All connections are encrypted (HTTPS). Passwords are stored only as hashes, the sign-in service encrypts its data, and backups are encrypted before they leave our server.
16. Changes to this policy
When we change how we process data, we update this page and the date at the top. We tell you in the app or by email about changes that affect you.
See also: Terms of Service · Legal notice