Plain language, no lawyer padding. If something here is unclear, write to us and we will explain it.
Last updated: 31 July 2026
The short version. We ask for an email address and a password so your progress can follow you between your phone and the web. We do not sell anything about you, we do not share your data with anyone except the services listed below, and you can delete everything yourself at any time.
Lumolingo is built by an independent developer based in Italy. Contact: [email protected]. Because we operate from the EU, the GDPR applies to everyone who uses Lumolingo, wherever they are.
| What | Why | Legal basis |
|---|---|---|
| Email address | It identifies your account and lets you reset your password. | Performance of a contract |
| Password | To sign you in. We never store the password itself — only a one-way hash (PBKDF2-SHA256, 300,000 rounds) that cannot be turned back into your password. | Performance of a contract |
| Your name (optional) | Only to greet you. Leave it blank and nothing breaks. | Consent |
| Lesson progress pages read, quiz results |
So you can carry on where you left off, on any device. | Performance of a contract |
| Device identifier a random id we generate |
To enforce the 3-device limit and show you which devices are signed in. It is not your phone's hardware id and cannot identify you elsewhere. | Legitimate interest |
| IP address temporarily |
To stop password-guessing attacks. Kept only as a counter of failed attempts, cleared after 15 minutes. | Legitimate interest (security) |
The free tier of the Android app shows ads through Google AdMob. AdMob may use a device advertising identifier to choose which ads to show. You can reset or delete that identifier in Android Settings → Google → Ads. Paid plans show no ads at all.
Google's own policy: policies.google.com/technologies/partner-sites
| Service | What it handles | Where |
|---|---|---|
| Cloudflare | Hosting and the account database | EU |
| Zoho / ZeptoMail | Sends password-reset emails | EU |
| Google AdMob | Ads in the free Android tier | Global |
| Google Play | Purchases, if you buy a plan. We never see your card. | Global |
That is the whole list. We do not sell or rent your data, and we do not hand it to advertisers, data brokers or anyone else.
For as long as your account exists. Delete the account and everything tied to it goes immediately and permanently — see below. Failed-login counters clear themselves within 15 minutes.
You can do it yourself, without asking us:
Full instructions: lumolingo.com/delete-account.html
Under the GDPR you can ask us to show you a copy of your data, correct it, delete it, or hand it over in a portable format. Write to [email protected] from the address your account uses and we will answer within 30 days. You also have the right to complain to your national data protection authority.
Lumolingo is not aimed at children under 13 and we do not knowingly create accounts for them. If you believe a child has signed up, write to us and we will remove the account.
If we change something that matters, we will update the date at the top and tell you in the app before the change takes effect.