LangSprout
Privacy policy
This policy explains how the LangSprout app handles data on iOS and Android, including the versions distributed through the App Store and Google Play. Features differ by platform and release; the notes below apply when you use the matching feature. The app works without an account and without a network connection. Signing in (with Google, or with Apple on iOS) and syncing your data are optional.
Data kept on your device
Your words, pronunciations, meanings, example sentences and their translations, and grammar points; your decks and language pairs; your review history; your XP, streak and garden; your settings, interface language and reminders are stored in a local database on your device. If you do not sign in, we do not receive this data. Offline dictionary packs you download, and the words read aloud by the device text-to-speech voice, are handled on your device only.
Account and sync (optional)
If you choose to sign in with Google or Apple, we use Google Firebase Authentication to handle your account and store your account identifier, email address, display name and login-provider identifier. With Sign in with Apple you may share a real or a private relay email address, and Apple sends your name only on the first sign-in; we save it as your display name. When you are signed in, your pairs, decks, notes, review logs and garden are synced to our servers (hosted on Google Firebase) so they follow you across your signed-in devices. Sign in and sync are optional; you can use the app entirely offline.
Friends and study groups (optional)
If you use the Friends feature, we store a nickname, an avatar, a friend code, your friends and friend requests, the people you block, and any reports you file. In study groups we store the group name, code, members, join requests and the decks shared inside the group. When you share a deck, its file is stored in Google Firebase Cloud Storage and the recipient downloads it through a short-lived signed link.
Other people can see: your nickname and avatar; your weekly activity (only if you keep activity sharing on); your deck reviews once a moderator approves them; and any deck you share with them or with a group you are both in. Your email address is never shown to other users.
Deck ratings and reviews (optional)
If you rate or review a deck in the library, your rating is kept privately under your account. Your review text is kept privately and, once approved, a public copy with your nickname appears on the deck page. Our team reads private ratings, pending review texts and reports to moderate content. Reviews are moderated before they appear, and you can report or block other users at any time.
Notifications and push (optional)
If you turn on notifications, we store this device's push token through Google Firebase Cloud Messaging so we can send you review reminders and friend or group notifications. You can turn notifications off at any time in Settings; we then stop sending them and remove the token.
Crash reports and diagnostics
The app uses Firebase Crashlytics to receive crash reports and improve stability. When something goes wrong, the service may process a stack trace, the time and app state, the app version, operating-system and device information, and installation and session identifiers. We attach your account identifier to your reports. Database and sign-in errors are sent only as their error type and code, never the text of your cards or your email address. Crash reporting is on by default, is never sent from debug builds, and can be turned off under Settings > "Send crash reports"; when you turn it off, unsent reports on the device are deleted and no new reports are sent. Google deletes crash data according to its own retention.
Abuse prevention and app integrity
The app uses Google Firebase App Check (on iOS with Apple App Attest or DeviceCheck, on Android with Google Play Integrity) to confirm that requests to our servers come from a genuine app. That service may process app and device attestation information, your IP address and request information to fight abuse. Public requests that anyone may make (the deck library and offline dictionary packs) are rate limited using the caller's IP address, which is kept only in memory for a short window and is never written to a database.
What we do not collect
LangSprout has no analytics software, no advertising, no in-app purchases and no cross-app or cross-website tracking. We do not ask for your location, your contacts, your photos or your microphone. We do not sell your personal data.
Service providers and where data is stored
We rely on a small number of providers to run the app: Google Firebase (accounts, database, file storage, push messaging, crash reporting and app integrity), Apple (Sign in with Apple and, on iOS, app attestation), and Vercel (this website). These providers process data on servers that may be located outside your country, under their own terms. We choose providers that commit to protecting personal data to a standard equivalent to this policy, and we share only what each provider needs.
How long we keep data
Data on your device stays until you delete it in the app, clear the app's data or uninstall the app. Synced data stays until you delete your account. Crash data follows Google's retention. Reports you file are kept for moderation but are anonymised (your account is removed). Server request logs kept by our providers follow their own policies.
Your choices and rights
You are in control: sign out at any time; turn off "Send crash reports"; turn off notifications; turn off activity sharing for friends; and delete your account and its synced data in the app. Depending on where you live, you may have the right to access, correct, export or delete your data, to object to or restrict processing, to withdraw consent, and to complain to a data-protection authority. You can view and delete your data in the app; for anything else, including an export, email us at the address below.
Delete your account
Open Settings > Account and Forest > Delete account. After you sign in again to confirm, your account and its synced data are deleted from our servers. The words and progress on this device stay; remove them by clearing the app's data or uninstalling the app. Apple sign-in access is revoked. See the account deletion page for details and for how to ask by email if you no longer have the app.
Children
LangSprout is made for a general audience and is not directed at children. It is not intended for children below the minimum age shown for the app on the App Store or Google Play, and we do not knowingly collect data from children below that age. If you believe a child has provided us with personal data, contact us and we will delete it.
Changes and contact
If this policy changes, the effective date above is updated. For anything about privacy, or to make a request, email langsprout.support@muka-studio.com. Please do not post personal data in a public place.