OpaLingo is provided by Gerra Labs AB, the data controller for the personal data described in this policy, which covers the OpaLingo website and the OpaLingo apps. Company details are in section 14.

Questions or requests about your data: contact@opalingo.com.

2.1 Account information

When you sign in with Google, Apple or Discord, we receive your name, email address, profile picture and a unique account ID from that provider. If you use Apple's "Hide My Email", we only receive the private relay address. We never receive your password for those services.

2.2 Profile and community

• Display name, username (and previous usernames), bio and profile customisations
• People you follow, Opa! reactions you send and receive, and users you block
• Phrase collections you create or share
• Reports you submit about profiles or content, and reports others submit about you

2.3 Learning data

• Lesson and module progress, game results, reviews and word mastery
• XP, levels, streaks, milestones, daily goal and active learning time
• Settings and preferences, including your time zone (used for streaks and reminders)

2.4 Purchases

If you buy Premium or Streak Tokens, we store a customer reference from the payment provider, your plan, subscription status and renewal date, and your Streak Token balance and history. We never see or store your card details. On the website, payments are handled by Stripe. In the iPhone and Android apps, purchases go through Apple's App Store or Google Play, and we use RevenueCat to check them; we receive your subscription status, plan, renewal date and a purchase reference, never your payment details.

2.5 Notifications and devices

If you allow notifications in the app, we store your device's push notification token (from Apple on iPhone, or from Google's Firebase Cloud Messaging on Android; and a Live Activity token while a Live Activity is running on iPhone) so we can send reminders and updates.

2.6 Messages to us

If you use the contact form or email us, we receive your name, email address and message. If you report a problem with content (for example an audio clip), we store the report.

2.7 Usage and technical data

• Website analytics (only with your consent): Google Analytics, using cookies, to understand how the site is used. We do not send your name, email or account ID to Google.
• Privacy-friendly statistics: cookieless statistics from our hosting provider, which do not identify you.
• Feature statistics: counts of events such as lessons viewed or profiles shared. Some profile statistics (views, shares, follows) are linked to the accounts involved.
• Platform and activity: whether you use OpaLingo on the website, the iPhone app or the Android app, and the last day you used each. Stored with your account.
• Sign-up source (website, only with your consent): if you accept analytics cookies, we note the website that sent you to us, any campaign tags in the link (such as utm_source) and the first page you visited. This is saved once with your account when you sign up. The app does not collect it.
• How you heard about us (optional): when you set up your account, we ask how you heard about OpaLingo (for example Google search or a friend). You can skip it. Your answer is stored with your account and only used for statistics on how people find OpaLingo.
• Subscription statistics: when a free trial or subscription starts, renews, is cancelled or ends, recorded under the payment provider's subscription ID (not your name or email), to understand how many trials become subscriptions.
• Server logs: IP address, browser or device type and requested pages, used for security, abuse prevention and fixing errors.

2.8 Microphone (Say It)

Say It, a pronunciation game in the iPhone and Android apps, uses your microphone. The app only asks for microphone access when you open Say It, and only listens while you are using it. Your speech is checked on your device by a speech model that the app downloads once. Your recordings are not uploaded, not stored on our servers and not shared with anyone. Only your most recent recording is kept on your device, so you can play it back, and each new recording replaces it. You can turn off microphone access at any time in your phone's settings.

2.9 Using OpaLingo without an account

If you learn without signing in, your progress is stored on your device. If you later create an account, we can move that progress into your account.

We use your data only for the purposes below, each with a legal basis under the GDPR:

• Providing OpaLingo — your account, saving progress, streaks, reviews, leaderboards, social features and Premium. Basis: performance of our contract with you.
• Purchases and accounting — processing payments and keeping records. Basis: contract and legal obligation (Swedish accounting law).
• Reminders and emails — streak and lesson reminders, the weekly recap and occasional product news. Basis: legitimate interest (you can turn each off in Settings, and push notifications need your permission).
• Safety and moderation — handling reports, blocking, preventing abuse and keeping the service secure. Basis: legitimate interest and legal obligation.
• Improving OpaLingo — feature, platform and subscription statistics, how people heard about us, and fixing errors. Basis: legitimate interest.
• Website analytics — Google Analytics cookies and your sign-up source. Basis: consent, which you can withdraw at any time.
• Support — answering your messages. Basis: legitimate interest.

We do not use your data for advertising, and we do not make automated decisions that have legal or similarly significant effects on you.

By default, your profile is public: other users can see your display name, username, profile picture, bio, level, XP, streak, milestones and profile customisations, and you can appear on leaderboards. Your email address is never shown.

You can change this in Settings with Show Public Profile, Show on Leaderboard and Show Profile Picture. Phrase collections you choose to share can be seen by anyone with the link.

• Sign-in: Google, Apple or Discord, only if you choose that provider
• Payments: Stripe for website purchases, Apple for App Store purchases, Google for Google Play purchases
• Subscription management for App Store and Google Play purchases (RevenueCat), which links your in-app purchases to your OpaLingo account
• Analytics: Google Analytics, only on the website and only with your consent
• Hosting and database providers that run our website, app backend and data storage, including anonymous, cookie-free page-view statistics
• Email delivery for the weekly recap, lesson reminders, product news and contact messages
• Push notification services from Apple (iOS app) and Google Firebase Cloud Messaging (Android app)

All providers are bound by data processing agreements and may only use your data to provide their service to us. A list of our current service providers is available on request at contact@opalingo.com.

Payment providers and sign-in providers also act as independent controllers for the data you give them directly, under their own privacy policies.

Some of our providers are based in, or process data in, the United States. Where data is transferred outside the EU/EEA, it is protected by the EU–U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.

• Account, profile and learning data: as long as you have an account. Deleted when you delete your account.
• Feature statistics: up to 90 days.
• Subscription statistics: kept with billing records, up to 7 years. They don't contain your name or email.
• Audio problem reports: 30 days.
• Purchase and billing records: 7 years, as required by Swedish accounting law.
• Messages to us: as long as needed to handle your request.
• Server logs: kept for a short period by our hosting provider.

Under the GDPR you have the right to:

• Access the personal data we hold about you and get a copy of it
• Correct inaccurate data (you can edit your name, username and profile yourself)
• Delete your data (see section 9)
• Export your data in a machine-readable format (data portability)
• Object to processing based on legitimate interest, and restrict processing in some cases
• Withdraw consent at any time, for example for analytics cookies

To use these rights, email contact@opalingo.com. We answer within one month. You also have the right to complain to the data protection authority in the country where you live, or to our lead authority, the Swedish Authority for Privacy Protection (IMY).

You can delete your account at any time in Settings → Delete Account, in the app or on the website. This permanently deletes your account, profile, learning progress, streaks, social activity and Streak Tokens. Deletion cannot be undone.

If you can't sign in, email contact@opalingo.com from the address linked to your account and we will delete it for you.

Deleting your account cancels a Premium subscription bought on the website. A subscription bought in the app must be cancelled with the store that manages it: on iPhone in Settings → your name → Subscriptions (App Store), on Android in the Play Store app → Profile → Payments & subscriptions → Subscriptions (Google Play). Purchase records we must keep by law (section 7) are kept separately until that period ends.

You must be at least 13 years old to create an account. Children under 13, or under the age of digital consent where they live, may only use an account with the permission of a parent or guardian. If you believe a child has given us personal data without permission, contact us and we will delete it.

• Necessary: a login session cookie, and local storage on your device for progress, settings, offline content and your cookie choice. These are needed for OpaLingo to work and don't require consent.
• Analytics (website only, with consent): Google Analytics cookies, and a note in local storage of where you came from (used for the sign-up source above), are only set if you choose Accept in the cookie banner. You can change your choice at any time with the Cookie settings link at the bottom of the website.

The OpaLingo app does not use analytics cookies or third-party tracking, and does not track you across other apps or websites.

Data is encrypted in transit (HTTPS) and at rest, access is limited to what is needed to run the service, and we keep our systems updated. No system is completely secure, but we work to protect your data.

We may update this policy from time to time. The "Last modified" date above shows when it last changed. If we make significant changes, we will let you know in the app or by email.

Email contact@opalingo.com, or use our contact form.

Gerra Labs AB, org. no. 559601-0149, Stjärnsköldsgatan 4, 506 43 Borås, Sweden.