Privacy Policy

What we collect

• When you sign in with Apple: the user identifier Apple provides, your email address (which may be an Apple private relay address) and your name (only the first time you authorise us, and only if you choose to share it).
• Learning data: your saved items (words together with the sentences and articles you saved them from, sentences, articles), how many free uses you have spent, and your membership status (whether it is active, when it ends, where you subscribed, whether it renews).
• Sign-in sessions: a session token (we store only its hash), the kind of device (web or iOS) and related timestamps.
• An Apple authorisation token, used to revoke HeadLingo's access when you delete your account.
• Web readers who aren't signed in: a random guest ID (kept in a cookie) and the free uses spent with it. It contains no name, email or similar information.
• Preferences such as text size, font, light or dark mode and learning direction, stored only in your browser or on your device.
• Technical data: our hosting provider processes your IP address and request details to deliver the service and keep it secure. To prevent abuse of AI features we keep counters keyed by a hash of your IP address and delete them after about two days.
• Purchases: purchases on the web are processed by RevenueCat and Stripe, and in-app purchases by Apple. We only receive your subscription status and never see your card details.

If you use the iOS app without signing in, your saved items and free uses stay on your device and are not sent to us. We don't use advertising or third-party analytics trackers, and we don't sell personal data.

How we use it

• To provide the service (performing our contract with you): signing you in, syncing saved items, free uses and membership between the web and the app, and handling subscriptions.
• Legitimate interests: security, preventing abuse (for example rate-limiting the AI features), fixing problems, and counting free uses for guests.
• Legal obligations: keeping transaction and tax records as required by law.

We don't use your information to send marketing emails.

AI features

When you tap a word, the word is sent to our server to look it up in the dictionary. Definitions for words that aren't in the dictionary, and the meaning of a word in its sentence, are generated by AI providers (OpenAI and DeepSeek). We send them only the word and the sentence from the article, never your account or other personal information.

Who we share it with

• Vercel: website hosting (United States)
• Neon: database (United States)
• Apple: Sign in with Apple and in-app purchases
• RevenueCat: subscription management (United States); Stripe: web payments
• OpenAI and DeepSeek: generating dictionary definitions, receiving only words and sentences (see above)

These providers may only process information on our instructions. We may also disclose information to authorities where the law requires it.

International transfers

Your information is stored on servers in the United States. When it is transferred from the UK or the European Economic Area, we rely on safeguards recognised by applicable law, such as standard contractual clauses or the UK International Data Transfer Addendum.

How long we keep it

• Your account, saved items and free-use records: until you delete your account.
• Sign-in sessions: they expire after 180 days without use and are deleted when you sign out or delete your account.
• Guest free-use records: linked only to a random ID, so that free uses add up over time.
• Rate-limit counters: deleted after about two days.
• Transaction records: kept by RevenueCat, Stripe and Apple under their own policies and legal requirements.

Deleting your account

You can delete your account at any time from Settings in the app or the account menu on the web. Your account, sessions, saved items and free-use records are deleted together, and we revoke HeadLingo's access with Apple. Deleting your account doesn't cancel a subscription: cancel a web subscription under Manage subscription first, and an app subscription in iPhone Settings → Apple Account → Subscriptions.

Your rights

Under the UK GDPR and other applicable laws you have the right to access, correct and delete your personal data, to restrict or object to our processing, and to receive a portable copy. Email wangchengfengx@gmail.com to exercise these rights; we will respond within the time the law requires. You can also complain to the UK Information Commissioner's Office (ICO) or the data protection authority where you live.

Cookies

We only use cookies that the service needs to work:

• hl_session: keeps you signed in (180 days)
• hl_guest: counts free uses when you aren't signed in (400 days)
• hl_apple: a security check while you sign in with Apple (10 minutes)
• hl_prefs and hl_course: reading preferences and learning direction (1 year)

At checkout, RevenueCat and Stripe may set their own cookies for payments and fraud prevention. We don't use advertising cookies.

Children

HeadLingo is not directed at children under 13, and we don't knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

Security

All data is encrypted in transit (HTTPS), session tokens are stored only as hashes, and we collect only what the service needs.

Changes to this policy

When we update this policy we change the date at the top. We will point out significant changes on the website or in the app.

Contact us

NORA'S DREAM LTD. Email: wangchengfengx@gmail.com