Privacy Policy — Octolingo
Last updated: October 4, 2026
This Privacy Policy explains how Octolingo ("we", "us", "the App") collects, uses, and protects your information when you use our mobile application. Octolingo is operated by TIE d.o.o., Rudarska cesta 6, 3320 Velenje, Slovenia, European Union, company registration number 3713091000 ("we", "Data Controller").
If you have questions about this policy, contact us at support@octolingoapp.com.
1. Information We Collect
1.1 Information you provide
- Account information, if you create an account: email address, username, display name (optional)
- Google account information, if you sign in with Google: your Google identifier, name, and profile picture as provided by Google
- Password (if registering with email/username), stored only in one-way hashed form — never stored or accessible in readable form, including by us
- Onboarding responses (e.g. vocabulary level, known grammar tenses, daily learning goals)
- Your voice, when you use the AI conversation practice feature. This audio goes from your device straight to our AI provider and is not stored by us — see Sections 3 and 4
- Payment information, if you purchase a subscription (processed by our payment provider — see Section 3; we do not store your card details)
1.2 Information collected automatically
- App usage data: cards reviewed, listening time, streak/progress statistics, feature interactions
- Device information: device type, operating system version, app version
- Approximate performance/diagnostic data (crash logs, errors), if applicable
1.2b Cloud backup (signed-in users only)
If you are signed in, your learning progress (cards, review history, streak, achievements) is backed up to our server at specific moments — when you sign out, and when you switch to a different account, so it is not lost if you change devices or reinstall the App. This backup is accessible only through your authenticated account. If you are not signed in, no backup occurs — your device is the only place your progress is stored.
Usage events are recorded against a pseudonymous device identifier — a random value generated on your device. It does not contain your name or email, but it does allow activity from the same device to be linked together over time, so it remains personal data. When you are signed in, these events are linked to your account instead to help us understand usage and improve the App.
1.3 Guest use
You can use the App without creating an account. If you choose not to sign in, we do not collect any of the account information described in Section 1.1, and your learning progress remains only on your device. We do not access your contacts, photos, or other apps on your device.
2. How We Use Your Information
We use the information collected to:
- Provide and personalize the learning experience (spaced repetition scheduling, content recommendations)
- Track your progress, streaks, and daily goals
- Process voice input for AI conversation practice and generate feedback
- Provide grammar explanations via AI-generated content
- Process subscription payments
- Improve app performance and fix errors
- Communicate with you about your account or the service, if you have provided contact information
We do not sell your personal information to third parties.
2.1 Legal bases for processing (GDPR Article 6)
Under the GDPR we must tell you not only what we do with your data, but on what legal basis. Each purpose below has one:
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and running your account | Email, username, name, hashed password, Google identifier | Performance of a contract (Art. 6(1)(b)) — we cannot give you an account without it |
| Cloud backup of your learning progress | Cards, review history, streak, statistics | Performance of a contract (Art. 6(1)(b)) — this is a feature of the signed-in service |
| Spaced-repetition scheduling and personalisation | Your review results and progress | Performance of a contract (Art. 6(1)(b)) — it is the core of what the App does |
| AI speaking practice | Your voice; the episode title, transcript and your level sent as session context | Performance of a contract (Art. 6(1)(b)) — you start this feature yourself and it cannot work without processing what you say. You are free never to use it |
| Feedback on sentences you say, and word explanations | The sentence or word, as text | Performance of a contract (Art. 6(1)(b)) |
| Translating words and text you look up | The text you tap or paste | Performance of a contract (Art. 6(1)(b)) |
| Searching the podcast catalogue | Your search term | Performance of a contract (Art. 6(1)(b)) |
| Understanding how the App is used, so we can improve it | Usage events tied to a pseudonymous device identifier (Section 1.2) | Legitimate interests (Art. 6(1)(f)) — our interest in knowing which features work. We use this only for our own product decisions, never for advertising, profiling or sale, and you can object at any time (Section 6) |
| Keeping the service secure and fixing errors | Diagnostic and error data | Legitimate interests (Art. 6(1)(f)) |
| Processing subscription payments | Purchase data (handled by Google Play) | Performance of a contract (Art. 6(1)(b)) — not yet active in the App |
We do not rely on consent for any of the above. Where a feature requires processing in order to exist at all, consent would be misleading: refusing it would simply mean the feature cannot run. You remain free not to use any individual feature, and you can delete your account at any time (Section 6).
Transcription of podcast episodes does not appear above because no personal data is involved — only the published audio of the episode itself (Section 3).
3. Third-Party Services
To provide certain features, we share limited data with the following third-party service providers. Each operates under its own privacy policy:
| Service | Purpose | Data shared |
|---|---|---|
OpenAI — speaking practice (gpt-realtime) | Live AI conversation practice | Your voice, streamed from your device directly to OpenAI (it does not pass through our server), together with context we send to start the session: the title and transcript of the episode you listened to today, your approximate known-word count and the verb tenses you are confident with |
OpenAI — transcription (whisper-1) | Producing word-by-word transcripts of podcast episodes | No personal data. Only the published podcast audio, downloaded by our server from the podcast’s own feed. Your voice is never sent here |
| Anthropic (Claude API) | Word and grammar explanations; feedback on sentences you say in speaking practice | Text only — never audio. The word or sentence concerned. For feedback on speaking practice, the chain is: your voice goes to OpenAI, OpenAI returns a text transcript, and only that text is then sent to Anthropic. No account identifiers are sent |
| Google Cloud Translation | Translating words and text you look up | The word or text you tap or paste. No account identifiers are sent |
| Taddy | Podcast catalogue and episode lists | Your search term, when you search for a podcast. No account or device identifiers are sent; the request is made by our server, not by your device |
| Hetzner Online GmbH (Germany, EU) | Hosting our server and database | Provides the servers on which everything we store (Sections 1.1, 1.2, 1.2b) resides. Hetzner provides infrastructure only and does not use your data for its own purposes; processing takes place in the EU |
| Google Play | App distribution and, in future, payment processing | Purchase data and device identifiers, handled by Google. Subscriptions are not yet active in the App |
Some of these providers are located outside the European Economic Area (EEA), including in the United States. Where this is the case, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission, or the provider's participation in an equivalent legal data transfer framework, to ensure your data remains protected.
3b. AI-Generated Content
Some audio content in the App — our own educational podcast episodes — was narrated using AI voice synthesis. All of these episodes have already been produced and we no longer generate new ones, so no data is sent to a voice-synthesis provider when you use the App. Our AI conversation practice feature involves direct interaction with an AI system, not a human. Where required by applicable law (including the EU AI Act), we clearly indicate in the App when you are interacting with an AI system or engaging with AI-generated content.
4. Data Retention
We keep data only as long as it serves the purpose it was collected for:
| Data | How long we keep it |
|---|---|
| Account (email, username, hashed password) | Until you delete your account. If you do not sign in for 24 months, we delete the account and its cloud backup |
| Cloud backup of learning progress | Until you delete your account, or 24 months of inactivity. Each new backup replaces the previous one — we do not keep a history of backups |
| Usage events (analytics) | 14 months from the event, then deleted. Events are anonymised immediately if you delete your account |
| Your voice | Never stored by us — see below |
| Learning progress on your device | Until you delete your account or uninstall the App |
You may request deletion at any time (Section 6).
Voice recordings never reach our server. During speaking practice, audio is streamed from your device directly to OpenAI, which processes it to generate a spoken reply. We do not receive, store or have access to that audio. Retention of the audio is governed by OpenAI’s own policies, not ours. What we do receive and store is the text of the sentences you said, as part of your learning progress, and the usage statistics described in Section 1.2.
5. Data Security
We take reasonable technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.
6. Your Rights
6.1 If you are in the European Economic Area (GDPR)
You have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data ("right to be forgotten")
- Request a copy of your data in a portable format
- Object to or restrict certain processing. In particular, you may object to the analytics processing described in Section 2.1, which relies on our legitimate interests — write to us and we will stop it for you
- Withdraw consent at any time, where processing is based on consent
- Lodge a complaint with your local Data Protection Authority (in Slovenia: Informacijski pooblaščenec, www.ip-rs.si)
If you have an account, you can delete your account and all associated server-side data at any time directly in the App (Settings → Delete Account). This is immediate and does not require contacting us. Deleting your account also erases the learning progress stored on the device you are using — your cards, streak and statistics — and this cannot be undone.
To exercise these rights, contact us at support@octolingoapp.com.
6.2 If you are a California resident (CCPA/CPRA)
You have the right to:
- Know what personal information we collect and how it is used
- Request deletion of your personal information
- Opt out of the "sale" or "sharing" of personal information (note: we do not sell your data)
- Non-discrimination for exercising these rights
To exercise these rights, contact us at support@octolingoapp.com.
7. Children's Privacy
Octolingo is intended for users aged 16 and over. We do not knowingly collect personal data from anyone under 16. We set the limit at 16 rather than 13 deliberately: the speaking practice feature sends your voice to an external AI provider (Section 3), and we would rather not process children’s voices at all than build a parental-consent process we could not meaningfully verify.
If you believe someone under 16 has provided us with personal data, contact us at support@octolingoapp.com and we will delete it.
8. International Users
Octolingo is operated from Slovenia, European Union. If you use the App from outside the EU, your information may be transferred to and processed in Slovenia and in the countries where our third-party providers (Section 3) operate, including the United States.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the App after changes constitutes acceptance of the updated policy.
10. Contact Us
If you have questions or requests regarding this Privacy Policy or your personal data, contact:
TIE d.o.o.
Company registration number: 3713091000
Rudarska cesta 6, 3320 Velenje, Slovenija
Email: support@octolingoapp.com