At a glance. Lengio is built privacy-first. Your vocabulary, photos, and study progress stay on your device. We don't require an account, run advertising SDKs, sell data, or track you across other companies' apps and websites.
The App does record anonymous usage events — which screens you open, which lessons you finish — so we can see what is worth building next. They carry no name, no email, no advertising identifier, no IP address and no location, and you can switch them off in Settings. Optional AI features run on our servers only when you choose to use them, and your voice is turned into text on your device before anything is sent.
This page explains exactly what does — and does not — happen with your information.
This Privacy Policy ("Policy") describes how Lengio ("Lengio", "we", "us", or "our") processes information when you use the Lengio mobile application (the "App") or visit the Lengio website at lengio.app (the "Site"), collectively the "Services".
This Policy applies to all users of the Services worldwide, with additional disclosures for residents of specific regions (see Region-Specific Disclosures). It does not apply to third-party services you reach through links inside the Services — those are governed by their own privacy policies.
By using the Services you confirm you have read and understood this Policy. If you do not agree, please do not use the Services.
For the purposes of EU/UK General Data Protection Regulation, similar laws, and CCPA/CPRA, the data controller (or "business") responsible for the limited information we process is Lengio. You can reach us at [email protected] for any privacy-related question, request, or complaint.
We have not appointed a statutory data protection officer because our processing does not require one, but the contact above is monitored by a person with responsibility for privacy matters.
We have intentionally designed Lengio to collect as little personal information as possible. The categories below describe everything we receive.
The App records a small number of anonymous usage events so we can see which features are worth building and where people get stuck. This is our own pipeline, running on servers we operate. There is no third-party analytics SDK, no advertising SDK, and no advertising identifier anywhere in the App.
Each stored event contains only:
iPhone16,1 — the same string for millions of devices).Event names are things like app_open, lesson_complete, paywall_view and purchase_success. We do not record the words you study, anything you type, anything you say, your photos, or the content of AI conversations.
Your IP address is not stored. Our servers necessarily receive it in order to answer the request, as every web server does, but it is never written to the analytics archive. We do not record your country, region, or any other location. We removed the country field in July 2026 specifically so that this sentence would be true.
You can turn this off. Open the App → Settings → Share Usage Data. Switching it off stops collection immediately and discards anything still waiting to be sent from your device. Every feature behaves identically either way — nothing is withheld from you for opting out.
If you choose to use the AI Chat Coach (described on our website as the AI Speech Partner), the App captures audio from your microphone only while the feature is active and converts it to text on your device, using Apple's on-device speech recognition. The audio never leaves your iPhone — not to us, not to Apple's servers, not to anyone. Only the resulting text is sent, through a server we operate, to our AI provider so it can generate the tutor's reply, which is streamed back to your device.
You can replace the picture on any vocabulary card. Tapping the picture offers Choose Photo, which uses your own photo library and sends nothing anywhere, and Search Images, which opens Google Image Search inside an in-app browser.
If you use Search Images, your search term — the word you are studying — goes to Google directly, along with your IP address, under Google's own privacy policy. We do not see the search or the results, and the image you pick is saved only on your device.
The following information lives on your device only and is never transmitted to us. iOS encryption and sandboxing apply.
If you have iCloud Backup enabled at the iOS level, this data may be included in your encrypted iCloud backup managed by Apple.
If you are signed in to iCloud, the App also syncs a small set of values — your streak, daily-goal progress, lesson completions, bookmarks, and game records — through Apple's iCloud key-value store, so a second device picks up where the first left off. That store belongs to Apple and is tied to your Apple ID; we have no access to it. Lengio operates no account system and no server-side sync of its own, so there is no copy of your study progress on any server we control.
The limited information we collect is used for the following purposes only:
We do not use your information for advertising, profiling, automated decision-making with legal effects, or to train external machine-learning models.
If you are in the European Economic Area, United Kingdom, Switzerland, or any region with similar law, we rely on these legal bases under Article 6 GDPR (or its local equivalent):
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
We do not sell or rent personal information. We do not share information with advertisers. We share information only with the parties below, and only as needed to operate the Services or comply with law:
The Services rely on the third parties below. We disclose them so you can review their practices independently:
We integrate no third-party advertising SDKs, third-party analytics SDKs, marketing pixels, or session-replay tools inside the App. The only usage data collected is the first-party, anonymous event stream described in Section 4.3, which goes to servers we operate and is shared with nobody.
The Site is a static website that does not set marketing or analytics cookies. Your browser may use functional storage (e.g. cache) as part of normal operation. The App does not use web cookies because it is a native iOS application.
Our hosting provider may set short-lived security cookies (e.g. to mitigate denial-of-service attacks). These are strictly necessary and exempt from consent under the ePrivacy framework.
We use technical and organisational measures appropriate to the nature of the data we process. These include:
No method of transmission or storage is 100% secure. We cannot guarantee absolute security. If we discover a breach affecting personal information we will notify you and any regulator as required by law.
Lengio operates internationally. When you contact us by email, or when our service providers process server logs, your information may be transferred to and processed in countries outside your country of residence, including jurisdictions that may not provide the same level of data-protection law as your own.
Where required, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and adequacy decisions. A copy of the safeguards used is available on request from [email protected].
Subject to local law, you may have the following rights regarding your personal information. Because most data stays on your device, you can exercise many of these yourself directly inside the App.
A note on usage analytics. The events described in Section 4.3 are keyed only to a random install identifier that is not linked to you, your email, your device, or your Apple ID, and the App does not display it. We therefore cannot locate "your" events in order to export or delete them, and the law does not require us to collect additional information about you for the sole purpose of being able to (GDPR Article 11). If you would rather they were not collected at all, turn off Settings → Share Usage Data in the App. Every other right in this section applies in full to information that does identify you, such as your support email.
To make a request, email [email protected] with the subject line "Privacy Request". We may need to verify your identity (for example, by replying from the email address you used when contacting us) before responding. We will respond within the statutory time frame applicable to you (typically 30 days, extendable as permitted by law).
If you are a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) gives you specific rights. The categories of personal information we have collected in the past 12 months are: identifiers (email when you contact us), internet activity information (server logs, and the anonymous in-app usage events described in Section 4.3), and limited commercial information (purchase confirmations from Apple). We have not collected sensitive personal information — including precise or coarse geolocation — as defined by CPRA in the past 12 months.
We have not sold or shared personal information for cross-context behavioural advertising in the past 12 months and have no intention to do so. We do not use or disclose sensitive personal information for purposes that would require us to offer a "Limit the Use of My Sensitive Personal Information" link.
You may exercise California rights — to know, delete, correct, opt out of sale/share, and not be retaliated against — by emailing [email protected]. An authorised agent may make a request on your behalf with written authorisation.
Shine the Light. California Civil Code § 1798.83 permits California residents to request information about disclosure of certain categories of personal information to third parties for direct-marketing purposes. We do not disclose information for such purposes.
The legal bases on which we process personal information are described in Section 7. You have the GDPR rights described in Section 14. You also have the right to lodge a complaint with your local supervisory authority. We are not currently required to appoint an EU/UK representative under Article 27 GDPR; if this changes we will list the representative here.
Brazilian users have rights equivalent to those described in Section 14 under Lei Geral de Proteção de Dados. Email [email protected] to exercise them.
Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Iowa (ICDPA), Tennessee (TIPA), Indiana (INCDPA), New Jersey (NJDPA), Delaware (DPDPA), New Hampshire (NHDPA), and other states with consumer-privacy laws have rights of access, deletion, correction, portability, and opt-out of targeted advertising or sale. We do not engage in targeted advertising or the sale of personal information. To exercise other rights, email [email protected].
Where local law gives you additional rights — for example the Australian Privacy Principles or Canadian PIPEDA — we will honour them. Contact us for specifics.
The Services are not directed to children under the age of 13 (or the equivalent minimum age in your jurisdiction — 14 in Spain, 15 in the Czech Republic and France, 16 in Germany and the Netherlands, and similar national variants under GDPR Article 8). We do not knowingly collect personal information from children below those ages.
Lengio is rated 4+ on the App Store and contains no objectionable content, but parents are responsible for supervising their child's use. If you believe a child has provided us with personal information, please email [email protected] and we will delete it promptly.
Lengio lets you attach personal photos to vocabulary entries. These photos remain on your device. We have no access to them and they are not transmitted to our servers. If you choose to share screenshots with our support team, the images become part of your support correspondence and are governed by this Policy.
We strongly discourage including sensitive personal information (e.g. images of identification documents, payment cards, health records) in support correspondence. If you do, we will treat it confidentially and delete it once your support inquiry is resolved.
The App may send local notifications (e.g. daily study reminders). These are scheduled and delivered entirely on your device by iOS based on settings you control. We do not see when notifications are delivered or opened. You may disable notifications at any time in iOS Settings.
We do not send marketing emails. We will reply to support correspondence you initiate, and may send transactional emails strictly necessary to resolve an inquiry.
Because neither the Site nor the App tracks you across other companies' apps or websites, Do-Not-Track signals (DNT) and Global Privacy Control (GPC) have no behavioural effect. We honour these signals where they are legally required by treating them as a valid opt-out of any future sale or share of personal information.
The equivalent control for the App's own anonymous usage events is the Share Usage Data switch described in Section 4.3.
We may update this Policy from time to time to reflect changes to our practices, technology, legal requirements, or for other operational reasons. The "Last updated" date at the top of the page indicates the most recent revision.
For material changes that affect your rights, we will provide additional notice — for example, an in-app message, a prominent notice on this page, or an email to known support contacts — before the change takes effect. Continued use of the Services after the effective date constitutes acceptance of the revised Policy.
For any privacy question, request, or complaint, please contact us:
We aim to acknowledge requests within 5 business days and resolve them within 30 days, or sooner where required by law. If you are not satisfied with our response, you may contact your local data-protection supervisory authority.
Disclaimer. This Policy is provided in good faith and reflects our practices as of the effective date above. It is not legal advice. Where translation conflicts with the English original, the English version controls. If a provision is held unenforceable, the remaining provisions remain in full effect.