FreeLingo

1. Overview

FreeLingo is available as a self-hosted application and as a hosted service. For self-hosted deployments, all data is stored exclusively on the operator's server and the FreeLingo project authors have no access to it. For the hosted service, the FreeLingo team acts as the data controller and this policy describes how your personal data is collected, used, and protected.

2. Data We Collect

FreeLingo is not directed at children under 16. We do not knowingly collect personal data from anyone under 16 years of age. If you are under 16, do not create an account or provide any personal data. When you create an account and use FreeLingo, the following data is stored:

• —Username, display name, and email address.
• —Hashed password (bcrypt — your plain-text password is never stored).
• —Native language preference and learning settings.
• —Optional profile avatar image.
• —Chat and conversation history with the AI tutor.
• —Flashcard decks, study progress, and spaced-repetition data.
• —Assessment results and curriculum progress.
• —Subscription status, plan type, and Stripe customer identifier (for paid service subscribers).
• —Global account memories and preferences that the AI tutor learns during conversations or that you add manually to personalize future interactions across learning languages.
• —Feature requests, bug reports, comments, and votes you submit through the feedback board. Only your username is shown publicly; all users can see published suggestions and reports.

3. How We Use Your Data

Your data is used exclusively to provide the FreeLingo learning experience:

• —Authenticating you and maintaining your session.
• —Personalizing your study plan and tutor interactions.
• —Tracking your learning progress over time.
• —Generating contextual AI tutor responses.
• —Remembering your preferences and context so the AI tutor can offer you more personalized interactions.
• —Displaying and managing community feature requests and bug reports.

Your data is never sold, rented, or shared with third-party marketing services.

4. External AI Services

In the hosted service, AI chat, voice synthesis (TTS), and voice transcription (STT) are provided via OpenAI's API. Your conversation content and audio are sent to OpenAI for processing, subject to OpenAI's Privacy Policy (openai.com/privacy). Payment processing is handled by Stripe, Inc. (USA); Stripe processes payment data directly and we do not store payment card details on our servers — your transaction data is subject to Stripe's Privacy Policy (stripe.com/privacy). For self-hosted deployments, the operator chooses the AI provider; by default a local Ollama instance is used and no data leaves the server.

5. Cookies & Session Tokens

FreeLingo uses two technical cookies strictly necessary for the service to function: a refresh_token (httpOnly, 30-day expiry) used for session authentication, and NEXT_LOCALE (1-year expiry) to remember your language preference. No tracking or advertising cookies are used. For anonymous traffic measurement, we use Umami — a self-hosted, open-source analytics tool that does not use cookies, collects no personal data, and keeps all data on our servers.

6. Your Rights (GDPR)

If you are in the European Economic Area, you have the GDPR rights of access, correction, deletion, objection, and data portability. You can delete your account directly from Settings. Other requests are handled manually through the contact in section 8; FreeLingo does not provide an automated export tool. We process data to provide the service (Art. 6(1)(b) GDPR). OpenAI and Stripe may process data in the USA under the safeguards applicable to international transfers. You may complain to the Spanish Data Protection Authority (aepd.es) or your local supervisory authority.

7. Data Retention & Deletion

Operational data is kept while your account exists and the hosted service remains active. You can delete memories, languages, or your entire account from Settings. The operator may also delete all accounts and their data when closing the service, after whatever reasonable notice is possible. Deletion cannot be undone. After deleting the systems and copies under the operator's control, FreeLingo will not retain personal data. Stripe may retain payment and transaction information under its own policy and legal obligations.

8. Contact

For hosted-service privacy questions, use the contact form at freelingo.app while available. After closure, use the contact channel published in the FreeLingo GitHub repository and do not post personal data in public issues. For self-hosted deployments, contact that instance's administrator.

9. Severability

If any provision of this policy is found to be invalid or unenforceable, that provision will be limited to the minimum extent necessary and the remaining provisions will remain in full force and effect.