Privacy Policy

Last updated: October 14, 2026

This Privacy Policy describes what information Language Fun collects, how it is used, with whom it is shared and for how long it is retained, in the context of using the platform. It should be read together with our Terms of Service.

1. Information collected at sign-up

When you sign up, we collect your first name, last name and e-mail address. If the sign-up happens through a referral link (/r/<identifier>), we also record which link was used, for referral attribution purposes (see section 6 below).

2. Account and authentication data

Your account's authentication is managed by Supabase Auth. This includes your e-mail, a password stored in protected form (never in plain text) and the technical session metadata needed to keep you logged in.

Cookies: the platform uses only cookies strictly necessary for its operation. There are two:

• a login session cookie (authentication via Supabase), set when you log in to your account;
• a technical anti-abuse cookie on the "Forgot my password" page, set even without a login and valid for 1 hour, used only to limit repeated password-reset attempts. It does not identify you, does not follow your browsing and is not used for any other purpose. That same protection mechanism temporarily records the IP address of the request, for at most 30 minutes and exclusively to count repeated attempts; that record is separate from the statistics described in section 3-A, which use no IP address at all.

We do not use tracking, advertising, third-party or analytics cookies, and we do not use any persistent browser identifier. The statistics described in section 3-A are collected without cookies.

3. Lesson progress and activity

We record information about your use of the platform, such as lesson progress and completion and pronunciation assessment results (where the language offers that feature), so that your learning experience can continue where it left off and to grant access to content according to your membership (Free or Premium).

3-A. Public page statistics (no cookies)

To understand how the site and the sign-up page perform, we count views of the public pages (home page, sign-up, login, this Privacy Policy and the Terms of Service). This measurement is aggregated and cookie-free.

What is recorded, and only this: the page name, the date (in the America/New_York calendar) and an approximate two-letter country code. We keep only one counter per page, per day and per country, never a record per visit.

The country is approximate and may be wrong: it is derived from the IP address of the request by the network infrastructure, so using a VPN, a proxy or corporate routing indicates the exit country of the connection, not where you actually are. When the country cannot be determined, we record "unknown".

What is neither collected nor retained: no analytics cookie, no browser or device identifier, no IP address (neither in its original form nor in an encrypted or hashed form), no user agent, no member identity, no individual browsing history, no referrer URL, query parameter or token. Since nothing identifies who visited, two visits by the same person and one visit by each of two people are indistinguishable to us, which is why we do not report "unique visitors", only page views.

Member-area pages, lessons and administrative pages are not measured. The password-flow and e-mail-verification pages are not measured either, precisely because their addresses may contain recovery codes.

Retention: these aggregated counters are automatically deleted after 12 months. Purpose: to understand how the site and the sign-up page perform. These statistics are not sold, do not feed advertising profiles and are not associated with member accounts. Since the data is aggregated and identifies no one, it is not possible to locate, export or delete a specific person's share of it.

4. Subscription, payment and payment providers

We do not directly collect or store your payment card details. Payment processing is done by Stripe or PayPal, depending on the method you choose; the collection of the payment data itself happens entirely on the pages hosted by those providers, subject to Stripe's and PayPal's own privacy policies.

We store the subscription metadata needed to operate the service: subscription and customer identifiers provided by Stripe/PayPal, subscription status, applicable amount (including the locked price, if any) and the history of relevant payment events (successful charge, failure, cancellation, refund or dispute), as reported by the providers.

5. Commissions and payout information (referral program)

If you take part in the referral program, we keep a record of the balance of accrued, paused or paid commissions associated with your account. If you set up a payout method (a PayPal account), we store the information you provide for that purpose; that information is visible only to you and, when needed to process a payment owed or for the platform's administrative purposes, to the Language Fun administration.

6. Referral attribution (no cookies)

Referral attribution (who referred a new member) is made from the referral link (/r/<identifier>) used at the moment of sign-up, and durably recorded in the database as soon as the account is created. That attribution does not depend on tracking cookies in your browser: no cookie is used to identify which link brought you to the sign-up page.

7. E-mail communications

The platform's e-mails are sent through Postmark, our e-mail delivery provider. We send two kinds of e-mail:

• Transactional: sign-up verification, password reset, account security, payment/subscription confirmations, commission receipt notifications and referral events. These e-mails are not subject to unsubscribing, as they are necessary to operate your account.
• Marketing/lifecycle: welcome messages and promotions for accounts on Free membership. These e-mails can be unsubscribed from at any time through the unsubscribe link included in them.

8. Infrastructure and service providers

Language Fun uses the following service providers to operate the platform:

• Supabase: database, authentication and data access control (hosted in the United States, East region). This is where the aggregated counters of section 3-A are stored.
• Vercel: hosting of the web application. Its network infrastructure also provides the server with the approximate country code described in section 3-A, from the IP address of the request; that address is neither read by the application nor stored by us.
• Postmark: delivery of transactional and marketing/lifecycle e-mails.
• Stripe and PayPal: payment and subscription processing.

Each of these providers processes only the data strictly necessary for the function it performs for the platform.

9. Data retention and account deletion

Aggregated public-page statistics (section 3-A) are automatically deleted after 12 months. Because they are aggregated and identify no one, they are not affected by the deletion of an account: there is nothing in them tied to a person to delete.

When you delete your account (a process described in our Terms of Service), the closure requested by the member is immediate and final. Personal profile data is deleted or anonymized; only the data needed to complete payments or refunds and to meet retention obligations remains. Deletions scheduled by the administration may have a 30-day recovery period. We do not delete information that must legitimately be retained for legal, accounting, tax, security, fraud-prevention or regulatory reasons; those retained records are associated with an anonymized internal identifier, never with your active identity, and are not used to recreate the deleted account or to restore any lost benefit (referrals, locked price, lesson progress, among others).

Once an e-mail address no longer needs to stay restricted for a legitimate retention reason, it becomes available again for a new sign-up, as an entirely new member identity, with no history of the previous account.

To tell repeated e-mail confirmation requests apart, we keep a counter associated with a protected fingerprint of the address, without storing the address in that record. That pseudonymized data may remain after the account is deleted and expires after 30 days without a new request, being removed by the daily clean-up routine. It does not recover data, benefits or history of the previous account.

10. Security

We adopt technical and organizational measures to protect your data, including database-level access control (Row Level Security), data transmission always over an encrypted connection (TLS), protected credential storage and authenticity verification of the notifications received from the payment providers. No system is entirely free of risk, and we strive to keep these protections up to date.

11. Your rights

These rights apply to the personal data we hold about you. They do not reach the aggregated statistics of section 3-A: since we keep no identifier, we have no way to locate a specific person's contribution to a counter, neither to show it nor to remove it.

You may request access to, correction of or deletion of your personal data. Account deletion is available directly on the platform, under "My account". For other requests related to your data, contact us at the e-mail address given below. We seek to fulfil these requests in accordance with applicable data-protection law.

12. Changes to this Policy

We may update this Privacy Policy from time to time. When that happens, we will update the "Last updated" date at the top of this page.

13. Contact

For questions about this Privacy Policy or to exercise your rights over your personal data, contact us by e-mail at contact@languagefun.org.

Also read the Terms of Service or go back to the home page.