LingoFlow AI
Privacy Policy
Last Updated: April 22, 2026
This Privacy Policy explains what data is collected when you use the LingoFlow AI website and Chrome extension, how that data is processed, and what rights you have. It applies to website visitors, registered users, and end users who install the Chrome extension.
1.Data We Collect
To operate the service, LingoFlow AI collects the following categories of data:
Account Information
The email address and password you provide at sign-up are stored securely through Supabase Auth, with passwords hashed on the server side. Nobody, including the LingoFlow AI team, can access your password in plain text.
Analysis and Learning Data
The texts you translate, the words you analyze, your personal library entries, flashcard progress, and learning statistics. This content is tied to your account and is used to power your personalized learning experience.
Technical Data
IP address, browser type, operating system, language preference, usage statistics, and content fingerprints. These are processed for abuse prevention, performance monitoring, and debugging purposes.
Extension Data
The Chrome extension only processes the text snippets you actively select and submit through the “Analyze” action. It does not read the full content of the pages you visit, your browsing history, or tabs open in the background.
2.How We Use Your Data
- To provide AI-powered language analysis, translation, and grammar explanations.
- To deliver a personalized word library and flashcard learning experience.
- To help you track your progress through learning statistics.
- To keep the service running, debug issues, and prevent abuse.
- To send you important service updates and security notifications.
3.AI and Data Processing Principles
LingoFlow AI uses the Google Gemini API for its language analysis. Our approach to data privacy rests on the following principles:
- No model training:text, analysis data, and user interactions sent through the Gemini API are not used to train Google’s foundation AI models.
- Anonymization: requests to the API are sent without personal identifiers (such as email or username) and are used solely for language analysis.
- Data ownership: the analyzed text and the library entries you create belong to you. You can permanently delete them from our systems at any time.
- Purpose limitation: AI outputs are produced only to give you a learning experience; they are not shared with advertising networks or profiling services.
4.Third-Party Sharing
To deliver the service, we rely on a small set of infrastructure providers and share data with them only to the extent strictly necessary:
Google Gemini API
The text you submit is forwarded to Gemini models, in an anonymized form, solely for the purpose of language analysis. Under Google’s enterprise privacy terms, that data is not used to train their models.
Supabase
Account information and library data are stored on Supabase with Row-Level Security (RLS) policies, so that each user can only access their own data.
Your data is never sold for advertising, shared with marketing companies, or transferred to third parties for purposes outside of operating the service.
5.Data Retention and Deletion
Account information and learning data are retained as long as your account remains active. You may delete your account and all associated historical data at any time.
- You can close your account and delete your data from inside the app.
- When your account is deleted, analysis records and library data tied to your identity are permanently removed.
- Where required by mandatory legal retention obligations (for example, billing records), only the strictly necessary data may be kept for the required period.
7.GDPR Notice (For Users in the EU, EEA, and UK)
If you are located in the European Union, the European Economic Area, or the United Kingdom, your personal data is processed in line with the EU General Data Protection Regulation (GDPR) and, where applicable, the UK GDPR.
Data Controller: The LingoFlow AI team is the controller of your personal data for the purposes described in this Policy.
Legal Bases (Art. 6 GDPR): We rely on performance of a contract (Art. 6(1)(b)) to provide the service you signed up for, your consent (Art. 6(1)(a)) where explicitly requested (for example, certain optional analytics), and our legitimate interests (Art. 6(1)(f)) in securing the service, preventing abuse, and improving the product.
International Transfers: Our infrastructure providers (such as Google and Supabase) may process data outside of the EEA/UK. Where this happens, transfers rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) and the UK’s International Data Transfer Addendum.
Your rights under the GDPR / UK GDPR include:
- Right of access to your personal data (Art. 15).
- Right to rectification of inaccurate or incomplete data (Art. 16).
- Right to erasure – the right to be forgotten (Art. 17).
- Right to restriction of processing (Art. 18).
- Right to data portability in a structured, machine-readable format (Art. 20).
- Right to object to processing based on legitimate interests (Art. 21).
- Right to withdraw consent at any time, without affecting prior lawful processing (Art. 7(3)).
- Right to lodge a complaint with your local data protection supervisory authority.
To exercise any of these rights, please contact us using the email address in the Contact section below.
8.CCPA / CPRA Notice (For California Residents)
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with the following rights regarding your personal information:
- Right to know what personal information we collect, use, disclose, and the sources and purposes of that collection.
- Right to delete the personal information we have collected about you, subject to certain legal exceptions.
- Right to correct inaccurate personal information that we maintain about you.
- Right to opt out of the sale or sharing of your personal information.
- Right to limit the use and disclosure of sensitive personal information to what is necessary to provide the service you requested.
- Right to non-discrimination when exercising any of the above rights.
California residents can exercise these rights by contacting us at the email address in the Contact section. You may also designate an authorized agent to make a request on your behalf, subject to verification of their authority.
9.KVKK Notice (For Users in Türkiye)
The following notice is provided for users residing in Türkiye under the Turkish Personal Data Protection Law (Law No. 6698, “KVKK”).
Data Controller: The LingoFlow AI team.
Purpose of Processing: Establishing and managing membership, providing the AI-powered language learning service, tracking learning performance, and improving the service.
Legal Basis: Performance of a contract (the membership agreement) and the explicit consent of the user.
Transfers: Personal data is processed through our service providers Google (Gemini API) and Supabase, limited to the purposes above. It is not shared with third parties for advertising.
Your Rights: under Article 11 of the KVKK you are entitled to learn whether your personal data is being processed, to request information about any such processing, to ask for incomplete or incorrect data to be corrected, to ask for your data to be deleted or destroyed, and to request that such actions be communicated to third parties. You can exercise these rights through the contact address below.
10.Your Rights (Summary)
- Request access to your data and obtain a copy of it.
- Request correction of inaccurate or incomplete data.
- Request deletion of your data or restriction of its processing.
- Withdraw consent where processing is based on explicit consent.
- Be notified in the event of a potential data breach.
11.Changes to This Policy
We may update this Privacy Policy from time to time as the service evolves or as needed to comply with legal requirements. Material changes will be announced through appropriate channels (in-app notification or email) before they take effect. The latest revision date is shown at the top of this page.
12.Contact
For privacy, KVKK, or other data-related requests, please reach out to us by email: