Privacy Policy — Language Hub

1. Who handles your data

The data controller is Luigi Cantone
Sorbolo Mezzani (PR), Italy
Email: lcantone90@gmail.com

For any question about this policy, or to exercise your rights, write to lcantone90@gmail.com, or use the «Write to me» form inside the app.

Language Hub is a personal, independent project. There is no company behind it: there is a person.

2. What we collect

• To give you an account: your name, your email address and a password, which we never keep in readable form — only as an encrypted fingerprint.
• What you create while studying, which stays yours: flashcards, grammar notes, reading texts, journal entries, lists of things to watch or listen to, recordings of your voice, and your challenge progress.
• How you use the app: when you study, what you review, how long a session lasts. This is what lets you see your own progress and makes challenges work.
• Your preferences: interface language, light or dark theme, and a few smaller choices about what you see.
• If you write to us: the text of your message, along with the page you sent it from, the app version, your browser and your language. They let us understand a problem without having to ask you more questions.
• Technical data, for security: your IP address when you accept the legal documents, when you try to log in and when you try to register. How long we keep it is in section 6.

About voice recordings. We keep them so that you can listen to yourself. We do not use them to recognise you, we never compare them with anything, and no other user can play them: they are served to you alone, after we have checked that it is you.

3. Why we process it, and on what legal ground

• Account, licence and what you create — to give you the service you asked for: performance of a contract, Art. 6(1)(b).
• Record of your consent — because the law requires us to be able to prove you accepted: legal obligation, Art. 6(1)(c) and Art. 7(1).
• Login and registration attempts, anti-bot check — to stop someone from getting into your account or flooding the service: legitimate interest, Art. 6(1)(f).
• Messages you send us — to answer you and fix what you report: contract and legitimate interest.

We do not profile you, we make no automated decisions about you, and we do not use your data for advertising. We do not sell it and we do not hand it to anyone for commercial purposes.

4. Who else sees your data

Only those needed to run the service, and there are few.

• IONOS SE — hosts the application and keeps the data on its servers. Processing takes place inside the European Union or the European Economic Area: IONOS has committed to this by contract, and if a transfer outside ever became necessary to provide the service, the same contract requires it to meet Articles 44 and following of the Regulation.
• Railsware Products Studio LLC (Mailtrap) — sends the app's emails, so it receives your address and the content of the messages we send you: the registration confirmation, the password reset. It is a United States company and the data is processed in the United States. The transfer takes place under the EU–US Data Privacy Framework, with the European Commission's Standard Contractual Clauses as a further safeguard.
• Cloudflare — the anti-bot check on the registration page, which receives your IP address and some technical characteristics of your browser in order to tell a person from an automated program. And, on two pages only — decks and starter packs — two technical libraries loaded from their public archive. Here too the transfer is covered by the Standard Contractual Clauses and the Data Privacy Framework.

All three process the data on our behalf and on our instructions, not for themselves, under a contract that binds them (Art. 28 of the Regulation).

Google Drive: there, you are the controller. If you choose to connect your Google Drive, the recordings go into your space, not ours. Those files are yours and stay under your control: you can delete them from Drive at any time, without coming through us. To be able to bring them to you, we keep the access keys Google issues to us: you can revoke them whenever you want, from your account page, and from that moment we no longer have access to anything.

Fonts and libraries. The typefaces and technical libraries that make up the pages are on our own server: opening the app you contact nobody else, and no third party receives your IP address simply because you are reading a page.

5. Where your data is

Your account and everything you create are on servers located in the European Union or the European Economic Area. The only things that leave them are the ones listed in section 4: the emails we send you and the anti-bot checks.

They are protected by: passwords kept as an encrypted fingerprint, an encrypted connection, database queries built so they cannot be manipulated, upload folders that cannot be reached from outside, and controls over who can read what.

Nobody else can download your voice recordings: before handing over an audio file we check that it is you asking.

6. How long we keep it

• Account and everything you created — as long as your account exists.
• IP addresses of login and registration attempts — 24 hours, then deleted automatically.
• Record of messages sent, used for the daily limit — 48 hours, then deleted automatically.
• IP addresses in the record of consent — anonymised after 30 days: the last part of the address is zeroed and can no longer be traced back to you.
• Record of consent, without the IP — as long as it is needed to prove you accepted.
• Deleted account — everything deleted immediately, audio files included.

If your licence expires, your content stays available for a grace period — currently 30 days — after which the account may be removed. The removal is carried out by the administrator: it is not an automatic operation.

7. Cookies and things stored on your device

• One session cookie, which keeps you logged in. It disappears when you close the browser, and it is indispensable: without it you could not log in.
• A few preferences saved in your browser: which deck you were studying, whether you have already seen the release notes, automatic playback. They stay on your device.
• Theme and language, instead, we keep on our server, together with your account, so you find them again on another device.

No analytics cookies, no advertising cookies, no profiling cookies. That is why you will not find a window asking you to accept cookies: there are none to accept.

8. Your rights

At any time you can:

• know what data we hold about you and get a copy of it (Art. 15);
• correct it if it is wrong (Art. 16);
• delete your account and everything in it (Art. 17) — you do it yourself, from your account settings, without asking anyone's permission;
• take your data away in a format another program can read (Art. 20) — there is a button for it;
• ask us to restrict a processing activity (Art. 18) or object to those based on legitimate interest (Art. 21);
• withdraw a consent you had given us (Art. 7(3)).

Write to lcantone90@gmail.com: we answer within 30 days.

If you think something is wrong, you can turn to the Italian Data Protection Authority — the Garante per la protezione dei dati personali (www.garanteprivacy.it) — or to the authority of the country where you live (Art. 77).

9. If this policy changes

When we change it in a substantial way, the next time you log in we show you the new text and ask you to accept it. The version number and the date shown on the page change together with the text.

We do not send emails about this: we tell you inside the app, where you are sure to see it.

10. The languages of this document

This document exists in Italian and in English. In case of any discrepancy between the two texts, the Italian version prevails.