FreeLingo

1. Overview

FreeLingo is available as a self-hosted application and as a hosted service. For self-hosted deployments, all data is stored exclusively on the operator's server and the FreeLingo project authors have no access to it. For the hosted service, the FreeLingo team acts as the data controller and this policy describes how your personal data is collected, used, and protected.

2. Data We Collect

FreeLingo is not directed at children under 16. We do not knowingly collect personal data from anyone under 16 years of age. If you are under 16, do not create an account or provide any personal data. When you create an account and use FreeLingo, the following data is stored:

• —Username, display name, and email address.
• —Hashed password (bcrypt — your plain-text password is never stored).
• —Native language preference and learning settings.
• —Optional profile avatar image.
• —Chat and conversation history with the AI tutor.
• —Flashcard decks, study progress, and spaced-repetition data.
• —Assessment results and curriculum progress.
• —Subscription status, plan type, and Stripe customer identifier (for paid service subscribers).
• —Global account memories and preferences that the AI tutor learns during conversations or that you add manually to personalize future interactions across learning languages.
• —Feature requests, bug reports, comments, and votes you submit through the feedback board. Only your username is shown publicly; all users can see published suggestions and reports.

3. How We Use Your Data

Your data is used exclusively to provide the FreeLingo learning experience:

• —Authenticating you and maintaining your session.
• —Personalizing your study plan and tutor interactions.
• —Tracking your learning progress over time.
• —Generating contextual AI tutor responses.
• —Remembering your preferences and context so the AI tutor can offer you more personalized interactions.
• —Displaying and managing community feature requests and bug reports.

Your data is never sold, rented, or shared with third-party marketing services.

4. External AI Services

In the hosted service, AI chat, voice synthesis (TTS), and voice transcription (STT) are provided via OpenAI's API. Your conversation content and audio are sent to OpenAI for processing, subject to OpenAI's Privacy Policy (openai.com/privacy). Payment processing is handled by Stripe, Inc. (USA); Stripe processes payment data directly and we do not store payment card details on our servers — your transaction data is subject to Stripe's Privacy Policy (stripe.com/privacy). For self-hosted deployments, the operator chooses the AI provider; by default a local Ollama instance is used and no data leaves the server.

5. Cookies, Local Storage & Analytics

FreeLingo uses technical and preference cookies: refresh_token (httpOnly, 30 days by default) to maintain your session, and NEXT_LOCALE and LOCALE_DETECTED (up to one year) to remember and manage the interface language. It also uses browser local storage for interface and voice preferences and the state of notices and guides, as well as session storage for temporary continuity of features. Local values remain until the application or you remove them; session values are removed when consumed or when the tab is closed. In the hosted service, we use Umami, an open-source analytics tool self-hosted on the same infrastructure as FreeLingo, to obtain anonymous, aggregate statistics about service usage and operation and improve the learning experience. This analytics uses technical usage data, does not use cookies, is not linked to accounts, and is not used to create individual profiles or for advertising. Analytics data is not sold, transferred, or shared with third parties. Umami statistics are not automatically deleted and are retained until manually removed. In self-hosted installations, analytics configuration is the responsibility of the instance operator. The cookie notice is informational; dismissing it only records that it has been dismissed.

6. Your Rights (GDPR)

If you are in the European Economic Area, you have the GDPR rights of access, correction, deletion, objection, and data portability. You can delete your account directly from Settings. Other requests are handled manually through the contact in section 8; FreeLingo does not provide an automated export tool. We process data to provide the service (Art. 6(1)(b) GDPR). OpenAI and Stripe may process data in the USA under the safeguards applicable to international transfers. You may complain to the Spanish Data Protection Authority (aepd.es) or your local supervisory authority.

7. Data Retention & Deletion

Operational data is kept while your account exists and the hosted service remains active. You can delete memories, languages, or your entire account from Settings. The operator may also delete all accounts and their data when closing the service, after whatever reasonable notice is possible. Deletion cannot be undone. After deleting the systems and copies under the operator's control, FreeLingo will not retain personal data. Stripe may retain payment and transaction information under its own policy and legal obligations.

8. Contact

For hosted-service privacy questions, use the contact form at freelingo.app while available. After closure, use the contact channel published in the FreeLingo GitHub repository and do not post personal data in public issues. For self-hosted deployments, contact that instance's administrator.

9. Severability

If any provision of this policy is found to be invalid or unenforceable, that provision will be limited to the minimum extent necessary and the remaining provisions will remain in full force and effect.