Privacy Policy
Last updated: 12 August 2026
1. Who this policy covers, and what
LanguCard is built and published by Yasin Enis. This policy covers both the web app at langucard.app and the LanguCard Android app published on Google Play (app.langucard.mobile). Both use the same account and the same database.
For questions and data requests: support@langucard.app
2. Data we collect
We collect only what the app needs in order to work. The list below is complete — anything not listed here is not collected.
| Data | When it is collected | Why |
|---|---|---|
| Email address | When you sign up or sign in with Google | To identify your account and verify sign-in |
| Name | From the sign-up form or from your Google account | To show it in the app and on the leaderboard |
| Profile photo | Only if you upload one — it is optional | Shown on your account and on the leaderboard. It is resized to 160×160 pixels on your device during upload; the original file is never sent to us. You can remove it at any time from Settings |
| Profile image link | Only if you sign in with Google | To show your avatar — the image itself stays with Google, we only keep its address |
| Password hash | Only if you sign up with an email address | To verify sign-in — the password itself is never stored, only a bcrypt hash |
| Your learning data | As you use the app | Workspaces, words, cards, categories, review records and study sessions; used to compute your spaced-repetition schedule |
| Session records | When you sign in on the mobile app | The sha256 hash of the refresh token, the device name and a device id; used to keep you signed in and to let you list your devices and sign them out |
| Your preferences | When you change settings | Theme, reduced motion, sound, haptics and leaderboard participation |
When you sign up or sign in with Google
Why: To identify your account and verify sign-in
From the sign-up form or from your Google account
Why: To show it in the app and on the leaderboard
Only if you upload one — it is optional
Why: Shown on your account and on the leaderboard. It is resized to 160×160 pixels on your device during upload; the original file is never sent to us. You can remove it at any time from Settings
Only if you sign in with Google
Why: To show your avatar — the image itself stays with Google, we only keep its address
Only if you sign up with an email address
Why: To verify sign-in — the password itself is never stored, only a bcrypt hash
As you use the app
Why: Workspaces, words, cards, categories, review records and study sessions; used to compute your spaced-repetition schedule
When you sign in on the mobile app
Why: The sha256 hash of the refresh token, the device name and a device id; used to keep you signed in and to let you list your devices and sign them out
When you change settings
Why: Theme, reduced motion, sound, haptics and leaderboard participation
3. What we do not collect
These are deliberate choices — they could have been added technically, and were not:
- Location data
- Contacts, camera, photos or microphone
- The device Advertising ID
- Third-party analytics or tracking tools
- Ad network cookies — the app shows no ads
- Payment or billing details — the app is entirely free
The Android app requests a single permission: INTERNET. We never sell your data and never share it for advertising.
4. Services your data passes through
- Google — only if you choose "Sign in with Google". Google gives us your name, email address and profile image; we do not send your learning data to Google.
- MongoDB Atlas — the database service where the data is stored.
- Vercel — the infrastructure hosting the website and the API.
- dictionaryapi.dev — when you look a word up in the dictionary, only the word you searched for is sent. Your identity, account details and word list are not.
- MyMemory (mymemory.translated.net) — when you request a translation, only the text to translate is sent. Again, no identifying information travels with it.
Beyond this we share your data with no one. If we are legally compelled (by a court order, for example) we disclose only what is asked for.
5. The leaderboard
On the leaderboard and on your profile, only your name, your study score, how many cards and answers you studied, your streak (consecutive days studied), the month you joined, the badges you earned and your profile photo (if you have one) are visible. Badges summarise your study habits; they may reveal, for instance, how many days you went without a break or that you study more than one language. Which languages you study, your words and any other statistics are not shown to other users.
If you prefer not to appear, you can turn participation off in Settings; you leave the leaderboard the moment you do.
6. Keeping and deleting data
Your data is kept for as long as your account exists. When you delete your account, all of your learning data and your account record are deleted immediately and permanently — nothing is archived, nothing is kept as a "dormant account". Because no point-in-time snapshots of the database are taken, deleted data does not survive in a recoverable copy either.
Step-by-step instructions: Deleting your account →
7. Your rights
Under the GDPR and under Turkish data protection law (KVKK art. 11) you have the right to:
- Learn which of your data is processed and request a copy of it
- Have incorrect or incomplete information corrected — your name and preferences can be changed directly in Settings
- Delete your data — from inside the app, with no intermediary
- Receive your data in a portable format — you can download your workspaces as JSON or CSV from Settings at any time
- Object to processing and to lodge a complaint
To exercise these rights, writing to support@langucard.app is enough; requests are resolved within 30 days at the latest.
8. Security
Connections are encrypted over HTTPS. Passwords are stored as bcrypt hashes — no plaintext password exists in the database. For mobile sessions we store only the sha256 hash of the token, not the token itself; even if the database were compromised, those hashes could not be used to sign in.
That said, no system is 100% secure. If a security incident affects your data, we will inform you by email.
9. Children's privacy
LanguCard is not directed at children under 13 and we do not knowingly collect data from that age group. If we become aware of such an account, we delete it.
10. Changes to this policy
If the policy changes, the "last updated" date on this page is refreshed. If a material change alters the kind of data we collect or the purpose it is used for, we will tell you inside the app before the change takes effect.