OpaLingo is provided by Gerra Labs AB, the data controller for the personal data described in this policy, which covers the OpaLingo website and the OpaLingo apps. Company details are in section 14.

Questions or requests about your data: contact@opalingo.com.

2.1 Account information

When you sign in with Google, Apple or Discord, we receive your name, email address, profile picture and a unique account ID from that provider. If you use Apple's "Hide My Email", we only receive the private relay address. We never receive your password for those services.

2.2 Profile and community

• Display name, username (and previous usernames), bio and profile customisations
• People you follow, Opa! reactions you send and receive, and users you block
• Phrase collections you create or share
• Reports you submit about profiles or content, and reports others submit about you

2.3 Learning data

• Lesson and module progress, game results, reviews and word mastery
• XP, levels, streaks, milestones, daily goal and active learning time
• Settings and preferences, including your time zone (used for streaks and reminders)

2.4 Purchases

If you buy Premium or Streak Tokens, we store a customer reference from the payment provider, your plan, subscription status and renewal date, and your Streak Token balance and history. We never see or store your card details — payments are handled by our payment provider, Stripe.

2.5 Notifications and devices

If you allow notifications in the app, we store your device's push notification token (and a Live Activity token while a Live Activity is running) so we can send reminders and updates.

2.6 Messages to us

If you use the contact form or email us, we receive your name, email address and message. If you report a problem with content (for example an audio clip), we store the report.

2.7 Usage and technical data

• Website analytics (only with your consent): Google Analytics, using cookies, to understand how the site is used. We do not send your name, email or account ID to Google.
• Privacy-friendly statistics: cookieless statistics from our hosting provider, which do not identify you.
• Feature statistics: counts of events such as lessons viewed or profiles shared. Some profile statistics (views, shares, follows) are linked to the accounts involved.
• Server logs: IP address, browser or device type and requested pages, used for security, abuse prevention and fixing errors.

2.8 Using OpaLingo without an account

If you learn without signing in, your progress is stored on your device. If you later create an account, we can move that progress into your account.

We use your data only for the purposes below, each with a legal basis under the GDPR:

• Providing OpaLingo — your account, saving progress, streaks, reviews, leaderboards, social features and Premium. Basis: performance of our contract with you.
• Purchases and accounting — processing payments and keeping records. Basis: contract and legal obligation (Swedish accounting law).
• Reminders and emails — streak reminders, the weekly recap and occasional product news. Basis: legitimate interest (you can turn each off in Settings, and push notifications need your permission).
• Safety and moderation — handling reports, blocking, preventing abuse and keeping the service secure. Basis: legitimate interest and legal obligation.
• Improving OpaLingo — feature statistics and fixing errors. Basis: legitimate interest.
• Website analytics cookies — Google Analytics. Basis: consent, which you can withdraw at any time.
• Support — answering your messages. Basis: legitimate interest.

We do not use your data for advertising, and we do not make automated decisions that have legal or similarly significant effects on you.

By default, your profile is public: other users can see your display name, username, profile picture, bio, level, XP, streak, milestones and profile customisations, and you can appear on leaderboards. Your email address is never shown.

You can change this in Settings with Show Public Profile, Show on Leaderboard and Show Profile Picture. Phrase collections you choose to share can be seen by anyone with the link.

• Sign-in: Google, Apple or Discord, only if you choose that provider
• Payments: Stripe
• Analytics: Google Analytics, only on the website and only with your consent
• Hosting and database providers that run our website, app backend and data storage
• Email delivery for the weekly recap, product news and contact messages
• Push notification services from Apple, for the iOS app

All providers are bound by data processing agreements and may only use your data to provide their service to us. A list of our current service providers is available on request at contact@opalingo.com.

Payment providers and sign-in providers also act as independent controllers for the data you give them directly, under their own privacy policies.

Some of our providers are based in, or process data in, the United States. Where data is transferred outside the EU/EEA, it is protected by the EU–U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.

• Account, profile and learning data: as long as you have an account. Deleted when you delete your account.
• Feature statistics: up to 90 days.
• Audio problem reports: 30 days.
• Purchase and billing records: 7 years, as required by Swedish accounting law.
• Messages to us: as long as needed to handle your request.
• Server logs: kept for a short period by our hosting provider.

Under the GDPR you have the right to:

• Access the personal data we hold about you and get a copy of it
• Correct inaccurate data (you can edit your name, username and profile yourself)
• Delete your data (see section 9)
• Export your data in a machine-readable format (data portability)
• Object to processing based on legitimate interest, and restrict processing in some cases
• Withdraw consent at any time, for example for analytics cookies

To use these rights, email contact@opalingo.com. We answer within one month. You also have the right to complain to the data protection authority in the country where you live, or to our lead authority, the Swedish Authority for Privacy Protection (IMY).

You can delete your account at any time in Settings → Delete Account, in the app or on the website. This permanently deletes your account, profile, learning progress, streaks, social activity and Streak Tokens. Deletion cannot be undone.

If you can't sign in, email contact@opalingo.com from the address linked to your account and we will delete it for you.

Deleting your account cancels your Premium subscription. Purchase records we must keep by law (section 7) are kept separately until that period ends.

You must be at least 13 years old to create an account. Children under 13, or under the age of digital consent where they live, may only use an account with the permission of a parent or guardian. If you believe a child has given us personal data without permission, contact us and we will delete it.

• Necessary: a login session cookie, and local storage on your device for progress, settings, offline content and your cookie choice. These are needed for OpaLingo to work and don't require consent.
• Analytics (website only, with consent): Google Analytics cookies are only set if you choose Accept in the cookie banner. You can change your choice at any time with the Cookie settings link at the bottom of the website.

The OpaLingo app does not use analytics cookies or third-party tracking, and does not track you across other apps or websites.

Data is encrypted in transit (HTTPS) and at rest, access is limited to what is needed to run the service, and we keep our systems updated. No system is completely secure, but we work to protect your data.

We may update this policy from time to time. The "Last modified" date above shows when it last changed. If we make significant changes, we will let you know in the app or by email.

Email contact@opalingo.com, or use our contact form.

Gerra Labs AB, org. no. 559601-0149, Stjärnsköldsgatan 4, 506 43 Borås, Sweden.