Privacy

Langons is a language-learning app run by Thore Mainart Bücking, a private individual in Sweden, who is responsible for your data under the EU General Data Protection Regulation (GDPR). Write to [email protected] about anything on this page.

In short: Langons keeps what it needs to sign you in and to remember your learning. It shows no ads, sells nothing about you, and uses no tracking cookies.

What Langons keeps, and why

• Your email address, to sign you in with a code, and for the few emails the app sends (sign-in codes, and notices when a passkey is added or the account deleted).
• Sign-in data: passkeys (a public key, a device description such as “Safari on iPhone”, and when it was added and last used) and your signed-in sessions. Codes and session tokens are stored only in a scrambled (hashed) form.
• Your learning: your language, level and settings, the words and grammar you plant, your flashcard answers, the texts written for you, your progress, questions you report, words whose pronunciation you corrected, and your friends.
• Usage counts per day (AI requests, read-aloud characters, emails), to keep within the daily limits.

These are needed to provide the app you signed up for (GDPR Art. 6(1)(b)). Texts expire after a week, and parts of a serial after a year.

Security and error reports

• Your IP address is in the server's logs for 14 days, and is used to slow down repeated sign-in attempts.
• Cloudflare Turnstile checks that a request for a sign-in code comes from a person rather than a script.
• Error reports go to Sentry: what went wrong, your browser, and your account number (never your email). When an error happens, a replay of the screen is attached, with all text and typing masked. They are kept for up to 90 days.

These rest on the legitimate interest in keeping Langons secure and working (Art. 6(1)(f)).

Who else handles your data

These services process data on Langons' behalf, and only for running it:

• Google Cloud (servers and backups, in the USA) stores everything above.
• Cloudflare (USA) carries all traffic to langons.com and runs Turnstile.
• Resend (USA) sends Langons' emails, so it gets your email address.
• Sentry (data stored in the EU) receives the error reports.
• AI services write texts and answer lookups: Moonshot AI (Kimi, China), Vercel's AI Gateway (USA) and the model it passes requests to (OpenAI, USA), and Inworld (USA) for reading aloud. They receive the text of a request (words you tap or look up, sentences, articles you pick, your language and level), never your email or account.

Transfers outside the EU rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. The app also looks up single words on Wiktionary and fetches the articles it retells, pages you paste included, from their sites; the server does this, so those sites don't see you.

Other learners see your email only if you send them a friend request; friends you accept see your weekly progress numbers.

Cookies and storage

One cookie keeps you signed in; it is strictly necessary and needs no consent. Your browser also remembers a few display choices (such as read-aloud speed) on your device only. There are no advertising or analytics cookies.

How long it is kept

Your account data stays until you delete your account (You → Your data → Delete account), which removes it at once. Backups roll over, so it is gone from them within 30 days. Server logs are kept for 14 days and error reports for up to 90.

Your rights

You can see and download your data (You → Your data → Download your data, as a file other services can read), correct it, delete it, and object to or restrict its use. For anything the app doesn't do itself, write to [email protected]. You can also complain to the Swedish Authority for Privacy Protection (IMY, imy.se) or the authority where you live.

Age

Langons is for people aged 16 or older.

Changes

If this page changes, the date at the top changes too. For a change that affects how your data is used, you'll be told by email before it takes effect.