Privacy

1. The short version

• Use the app without signing in and nothing at all is sent to us. Your progress lives in your own browser.
• There is no analytics, no advertising and no third-party tracking on any page — not on the lessons, not on the marketing pages.
• An account is optional. It exists so a lost phone does not cost you a year of work, and it stores the smallest set of records that can do that.
• A class link stores a nickname a pupil chooses and which lessons they have done. It never asks a child for an email address, a password or a real name.
• We never see card details. Payment is taken on the payment provider’s own checkout page.

2. Who is responsible

Fotolingo is open-source software licensed under AGPL-3.0, and this notice describes the copy you are reading. Whoever runs this site is the data controller. They have not published a legal name and address here — if that matters to you, ask before you create an account.

No contact address has been published for this site. Everything on this page that you can do for yourself, you can do from your account page without asking anybody.

3. Using Fotolingo without an account

This is the default and it is the whole app: every lesson, every language, every practice mode. In this mode no personal data is transmitted to us. What the app remembers, it remembers in your browser’s local storage under these keys:

• mf.progress, mf.srs, mf.scores, mf.streak, mf.savedLessons, mf.daily — which words you have met, when they are next due, practice results, your streak, saved lessons and today’s puzzle.
• mf.settings, mf.theme, mf.lastCourse, mf.srsConfig — the language you speak, the course you are in, script and voice choices, light or dark.
• mf.profile — a display name, only if you typed one.
• mf.lex.* — a cached copy of the word pack for the language you learn from, so the app works offline and does not re-download it.

Clearing your browser’s site data erases all of it, permanently and immediately. There is no copy anywhere else, which is the trade: privacy by absence, at the cost of a new phone starting from zero.

The app sets no cookies and there is no cookie banner, because there is nothing to consent to.

4. If you create an account

An account unlocks no lesson. It exists to copy the list above to a server so a second device, or a replaced one, can read it. If you sign in we store:

• Your email address and password, handled by Supabase Auth. The password is hashed by them and is never visible to us or to this application.
• A display name, if you gave one, and your setup answers — the language you speak, whether you are here to speak or read, and which characters.
• Your learning record: which concepts you have met, the review schedule for each, practice scores, your streak, and saved lessons.
• Which plan you are on — free, Plus or School. You cannot set this yourself and neither can any other user; it is written only by the billing process.

That is the complete list. There is no profiling, no scoring of you as a person, no inference about your age or location, and none of it is sold, shared or used to train anything. The legal basis is the contract you enter by creating the account: you asked for your progress to be kept, and this is what keeping it requires.

The database itself refuses to hand one learner’s records to another. That separation is enforced by the database, not left to the app to remember.

5. Classes, and children

A teacher with a School licence can create a class and hand out a link. A pupil opening that link types a nickname and starts work. We then store, for that class: the nickname, an identifier for the browser being used, and which assigned lessons have been completed.

A pupil is never asked for an email address, a password, a real name or a date of birth, and there is no way for one to be collected — the join form has one field. Nothing about a pupil is advertised against, and there is no analytics on any page they see.

Because a nickname is whatever the child types, a school can run this with no personal data at all by asking for initials or a number. If a class chooses to use real first names, those first names are personal data and the school is the controller of them; the teacher can delete a class, and everyone in it, at any time from their classes page.

Anyone holding a class code can join it under any name. That is a deliberate trade — it is what removes three hundred consent forms from a term — and it means a teacher’s report is a record of work done, not an attendance register. Do not put anything in a nickname you would not write on the outside of an exercise book.

6. Payments

Subscriptions are taken on the payment provider’s own hosted checkout. Card numbers, billing addresses and the rest never touch this site, which has nowhere to put them. All that comes back to us is the fact that a given email address has paid for a plan.

7. Who else touches the data

• Vercel — hosting. Serves the pages and keeps short-lived operational request logs, which include IP addresses, as any web server does.
• Supabase — the database and authentication behind accounts and classes. Only used when you sign in or join a class.
• The payment provider — only if you subscribe, and only on their own checkout page.

Nobody else. No analytics vendor, no advertising network, no session recorder, no error-reporting service, no font or script loaded from a third party.

The speech you hear is generated by your own browser or operating system. No audio is uploaded, recorded, or sent anywhere, and the app never asks for microphone access.

8. How long it is kept

Account data is kept until you delete it. Delete your account and everything above is removed immediately by the database itself — the tables cascade from your user record, so there is no stray copy left behind. Class records are removed when the teacher deletes the class or their account.

There is no backup archive holding a shadow copy for years, and no “soft delete” that quietly keeps a copy.

9. What you can do about it

You have the right to see your data, correct it, take it elsewhere, and have it erased. Three of those need no request and no waiting:

• See and export it — your account page downloads everything held about you in one file, which you can keep or take elsewhere.
• Erase it — the same page deletes your account and everything stored with it. It cannot be undone.
• Correct it — the settings sheet and the account page edit everything that is editable.

10. Changes

The date at the top of this page moves when the document changes, not when the site is redeployed. Material changes to what is collected will be announced on the account page before they take effect.