Privacy Policy

The short version

This policy explains, in order: what is kept on your device, what actually leaves it, who processes it, and what you can do about it. It covers the Xolingo mobile app for iPhone and Android and the pages on this website. It does not cover the App Store, Google Play, or any third-party website you open from a link inside the app — those have their own policies.

Who we are

Xolingo is made and operated by AxoLottaLove, the developer name used for Xolingo. For the purposes of the UK GDPR, the EU GDPR, and comparable laws, AxoLottaLove is the controller for the limited information we decide how to process.

Reach us at [email protected] for anything in this policy.

What stays on your device

Xolingo is local-first. The following is written to the app's private storage area rather than to a Xolingo learner account or sync service:

• The language you speak (base) and the languages you are learning (targets), plus your self-assessed level.
• Your word bank: each saved word or phrase, its lemma, the translation shown or the one you typed yourself, notes, the sentence you first met it in, and its familiarity level.
• Your mastered-word history, reading records and positions, listening time, and arcade rounds, scores, streaks, and medals.
• Your review schedule and quiz history, daily free-tier usage counter, and locally cached purchase-entitlement status.
• Reading material you have downloaded from the Xolingo catalog, and dictionary and sentence bundles for your languages.
• Anything you import — pasted text, files you pick, or a transcript brought in through the share sheet — including its source URL, title, author, and date when available.
• App settings, including your chosen read-aloud voice and speed.

Inside the app, Settings → Reset learning data erases your word bank, learning progress, and private imported texts from that device and turns off optional Google translation. It keeps the number of free saves already used today (without the saved words), public downloads, purchase status, and report reference numbers. Downloads & storage manages downloaded content separately. Deleting Xolingo removes its live app data from that device. A report you deliberately send is a separate server-held record, as explained below.

If you have iCloud Backup or Android Backup switched on, your operating system may include Xolingo's data in a device backup. A backup can outlive the app and may restore its data later. It is controlled by you and Apple or Google under their terms; we cannot read or delete it.

Some downloaded Browse and link-import article bodies and images are temporary caches and are refreshed or removed after about 24 hours. Other local records remain until the relevant in-app deletion control is used, the operating system clears app storage, or the app is removed.

What each service receives

This table describes the app's current network connections and this website. Like any internet request, a contacted service receives an IP address and request metadata such as date, requested path, and browser or app information.

Xolingo contains no advertising, attribution, fingerprinting, social-login, or Xolingo-selected behavioural-analytics SDK. RevenueCat's purchase analytics and ML Kit's technical diagnostics and usage analytics are limited to the purposes described above.

Purchases and Xolingo Pro

Xolingo Pro is sold by Apple or Google through your existing store account and validated through RevenueCat, which acts as our service provider. RevenueCat generates a pseudonymous App User ID on first launch; it is random and Xolingo does not derive it from your email, advertising identifier, or word bank. It identifies one RevenueCat customer record and purchase history, so it is not the same thing as data that has been irreversibly anonymised.

We do not operate an app account or connect the RevenueCat record to your learning data. A support request can still be connected to a transaction if you give us an order number or other purchase details. Your learning data does not sync between devices, and an entitlement bought on iOS does not carry to Android. Restore purchases recovers eligible purchases using the same store account.

Paid features are enforced on your device. We hold no learner database and run no purchase webhook.

Read-aloud and translation

Speech

Xolingo uses the text-to-speech voices already installed on your phone; it adds no cloud speech provider of its own. Where the platform tells us, the voice picker labels a voice as working offline or as requiring the internet, and Xolingo prefers an offline voice automatically. If you choose a networked voice, the sentence being spoken is handled by that engine's provider — which may be Apple, Google, or another installed speech provider — under that provider's policy.

Translation

Bundled dictionary entries work without enabling Google translation. Before Xolingo starts Google's ML Kit translation service, it explains the model downloads and technical data described above and asks you to choose whether to enable it. You can choose Not now and keep using the dictionaries, or enable or turn off the service later in Settings. When enabled, missing words and phrases can be translated on your device. The text and resulting translation are not sent to Google, but the SDK downloads language models and sends the technical diagnostics and usage metrics listed in the service table above. Turning it off prevents new translation requests; models already downloaded may remain until you remove them using the model controls or remove the app. Machine translations carry Google attribution and can be replaced with your own wording.

Texts you bring in

Pasted text, imported files, and shared links become private reading texts on your device. Xolingo does not upload or re-host them or use them to train a model. Importing from a link makes a request from your device to that site, much as a browser would. If you later submit a content report about an imported passage, the report can include the displayed word, sentence, translation, source title, and your optional comment; the app lets you review the included context before you send it.

Please only import material you have the right to read and store — see the Terms of Use.

Content reports

Xolingo's sentences come from crowd-sourced corpora and machine translation, so some will be wrong or crude. When you flag one, the report is sent to our content manager and contains:

• the reason you picked, and your optional comment;
• the sentence, the translation shown, and the word in question;
• both languages, the text it appeared in, the corpus attribution, and the app version.

The structured report deliberately includes no name, app account, device identifier, or location field. Netlify still receives the IP address and request metadata needed to accept the request, and we receive anything you type in the optional comment. An IP address can imply an approximate location. Please do not put personal information in the comment. Reports go to the content manager, not to the read-only content service.

After a successful submission, the app displays a copyable report reference. It keeps up to 100 reference numbers and dates locally under Settings → Your report references, without keeping a second copy of the report text. You can give us this reference when asking about a correction or requesting deletion. If saving the reference on your device fails, the app asks you to copy it before closing.

If you email us

When you write to [email protected], we receive your email address and whatever you choose to include. We use it to answer and administer your request. We retain the thread while the request is active and afterwards only while it is reasonably needed for follow-up, disputes, security, or legal recordkeeping. We do not add you to a mailing list.

What Xolingo never does

• It does not require or offer an account, and does not ask for your name, email, phone number, or date of birth.
• It does not show advertising and contains no ad SDK.
• It does not include advertising or Xolingo-selected behavioural analytics and does not track you across other companies' apps or websites. RevenueCat purchase analytics and ML Kit technical metrics are described above and are not used by Xolingo for tracking.
• It does not read your contacts, photos, calendar, microphone, or location.
• It does not sell or share personal information for behavioural advertising, under any definition used by the CCPA/CPRA or comparable state laws. There is no learner profile to sell.

Children

Xolingo is a general-audience app for independent learners. It is not directed at children under 13, we do not knowingly collect personal information from them, and the app is not distributed through Apple's Kids Category. Some catalog texts come from encyclopaedias written for younger readers, but that is a reading-level choice, not an invitation to children.

If you believe a child has sent us personal information by email, an optional report comment, or another support channel, write to [email protected] and we will delete it where we can identify it.

Your choices and rights

The controls in your hands

Rights under the GDPR, UK GDPR, and US state laws

Depending on where you live, you may have rights of access, correction, erasure, restriction, objection, and portability, and the right to complain to a supervisory authority. There is an honest limit to how we can serve them: we have no learner account or server copy of your word bank. For email, include the address you used. For a purchase record, include the store and order number if available, or the copyable purchase support ID shown under Settings → Xolingo Pro. For a content report, include its reference from Settings → Your report references. If you used an older app version or no longer have the reference, give the approximate date, languages, sentence, and comment; we may then be unable to match the report with certainty.

Where we process the small amount of data described above, we rely on: performance of our contract with you (delivering the app and your purchase), and our legitimate interests in running a working, non-abusive service and improving faulty content. Optional Google translation starts only after your choice in the app and can be turned off in Settings. We do not use your data for automated decision-making or profiling.

If you are in California, the categories above are the whole picture: we do not sell or share personal information, and exercising any right will never get you a worse version of Xolingo.

Retention

• On-device data — kept until you use the relevant deletion control or remove the app from that device. Resetting learning data has the limited scope described above; report reference history is capped at the latest 100 submissions. A device backup follows Apple or Google's retention and deletion controls.
• Content reports — kept while a report is open and afterwards only while needed to verify a correction, prevent a regression, or document moderation. The current queue does not expire reports automatically; we delete them manually when no longer needed, and you may request earlier deletion using the details above.
• Support email — kept while the request is active and afterwards only while needed for follow-up, a dispute, security, or legal recordkeeping, then deleted under the email provider's controls.
• Purchase records — retained by Apple, Google, and RevenueCat under their published retention rules and as needed for entitlement restoration, fraud prevention, refunds, disputes, and legal or accounting obligations. A deletion request cannot override records a provider must keep by law.
• Website, CDN, and endpoint logs — retained under the relevant hosting provider's security and operational settings, then deleted or aggregated by that provider. We do not use access logs to create learner profiles.

Where data is handled

Our providers — Cloudflare, Netlify, RevenueCat, Apple, Google, and the provider that hosts this website — operate globally, so the limited data described here may be processed outside your country, including in the United States. Where required, transfers use safeguards maintained by those providers, such as Standard Contractual Clauses or an applicable adequacy framework.

We require service providers that handle data for Xolingo to protect it consistently with this policy and applicable store rules. Their own policies and data-processing terms also apply: RevenueCat, Cloudflare, Netlify, Google, and Apple.

Security

Network requests use HTTPS. Your learning data sits in the app's own storage area, protected by your device's platform sandbox and, on a modern phone, by full-device encryption — so a passcode and up-to-date OS are the strongest protections available to it. No method of transmission or storage is perfectly secure, and we do not claim otherwise.

Changes to this policy

If Xolingo starts doing something this policy does not describe — optional accounts and cross-device sync are the obvious future candidates — we will update this page and change the effective date above before that feature ships. Material changes will also be noted in the app's release notes.

Contact

See also the Terms of Use and the support centre.