DRAFT — needs review. This page has not been reviewed yet and will change before launch.

Last updated: 2026-09-29

Privacy Policy

This explains what MyOwnLingo keeps about you, why, who helps us run it and what you can ask us to do. The short version: we keep what the games need to work, nothing more. No ads, no tracking, and we never sell your data.

1. Who is responsible

Faresay Ltd, trading as Robin of Loxley, registered in England and Wales (company number [company number]), is the controller of your personal data for MyOwnLingo. Contact us about anything in this policy at hello@myownlingo.com.

2. What we keep

Your account: your username, your email address (and whether you have confirmed it), your password as a one-way hash (bcrypt: we can't read your password), when you joined and when you were last active, whether your scores are private, and the language the site speaks to you in.
How you play: your level in each language, each round you play (game, level, score, when) with your answers and how long they took, what you have mastered, your practice cards, your daily-challenge streak, and the friends groups you start or join.
Paid plans: when you subscribe, we keep Stripe's reference numbers for you and your subscription, its status, its renewal or end date, whether you've cancelled, when you ticked the box agreeing to immediate access, and the country you told us you live in, so we can unlock the paid games and show you your plan. We ask for the country for tax reasons: where we may sell, and which tax rules apply. Stripe collects your card details, email address and billing country (and address, where tax rules need it) on its own payment page. We never see your full card number.
Reminder emails (only if you turn them on): which reminders you want (the daily reminder, the streak warning, or both), the hour, your time zone and the languages to remind you about, and a record of each reminder we sent (which one and on what day) so nobody gets the same email twice.
Technical logs: like any website, our hosting provider records requests to the site, including your IP address and browser type, for security and to fix faults. To stop abuse of the password-reset form we keep a scrambled (hashed) form of your IP address for up to a day.

We don't ask for your real name, your date of birth or where you live.

3. Why we use it, and our legal basis

To provide the service you signed up for (contract): your account, your games, scores, mastery and progress, password resets, and the emails that go with them.
To keep MyOwnLingo safe and working (legitimate interests): logs, rate limits, preventing cheating and abuse, and counting how many people use each language and game so we know what to improve. These counts are totals, not profiles of you.
To meet legal duties (legal obligation): for example, keeping records of sales and VAT for the tax authorities.
Reminder emails (consent): the daily reminder (today's challenge and your streak, at the hour you choose) and the warning that a streak is about to end. Both are off until you turn them on on your account page, and we only send them to an address you have confirmed. To stop them, untick them on your account page or use the one-click unsubscribe link in every reminder; they stop at once. Stopping them doesn't affect emails already sent, and we never send marketing.

Scoreboards show your username and scores to other players unless you make your scores private. Friends groups show your scores to the members of that group.

4. Who helps us (processors)

We use a small number of providers, each under a contract that only lets them use your data to provide their service to us:

Vercel (Vercel Inc., USA): hosts the website and keeps its request logs.
Neon (Neon Inc., USA): runs our database. [decide: confirm the region, e.g. EU (Frankfurt) or US]
Resend (Resend Inc., USA): sends account emails such as address confirmations and password resets, and the reminder emails if you turn them on.
Stripe (Stripe Payments UK, Ltd. and Stripe, Inc., USA): processes payments, hosts the payment page and the customer portal, and emails receipts and invoices for us. For some payment data (for example fraud prevention, and meeting its own financial and legal duties) Stripe is an independent controller, under Stripe's privacy policy.

Where data goes to the USA, it is protected by the UK's adequacy regulations for the UK-US data bridge or by the international data transfer agreement or addendum approved by the ICO.

We don't sell or rent your data, we don't show ads, and we don't share your data with anyone else unless the law requires it.

5. Cookies and your device

MyOwnLingo sets one cookie: a session cookie that keeps you signed in and holds the round you're playing. It is strictly necessary for the site to work, so the law doesn't require us to ask for consent, and there is no cookie banner. There are no analytics, advertising or third-party cookies.

The site can be installed as an app; your browser then keeps a copy of the site's files on your device so it opens quickly. Spoken words use your browser's own voice, on your device; nothing you hear is sent to us.

6. How long we keep it

Your account and play data: for as long as you have an account. When you delete your account, it is deleted from our live database straight away, and it drops out of our database backups within [7] days. [decide: match Neon's restore window]
Inactive accounts: [decide] we may delete an account nobody has signed in to for three years, after emailing you first if we have your address.
Hosting logs: kept by Vercel for a short time (usually days, never more than [30] days).
Hashed IP addresses for rate limiting: one day.
The record of reminder emails sent: 60 days. Your reminder settings go when you turn reminders off or delete your account.
Sales records: kept by us and by Stripe as tax law requires (in the UK, six years). When you delete your account, our record of your subscription is kept without the link to your account, for the same reason.

7. Your rights

Under UK data protection law (the UK GDPR and the Data Protection Act 2018) you can ask us to:

give you a copy of your data (the "Download my data" button on your account page does this straight away);
correct it;
delete it (the "Delete my account" button does this straight away);
restrict or object to how we use it;
give it to you in a portable format (the download is JSON).

For anything the buttons don't cover, write to hello@myownlingo.com. We'll answer within one month, and it's free.

If you're unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113. If you live in the EU you can also complain to the data protection authority where you live.

8. Children

MyOwnLingo is for people aged 13 and over. If you believe a child under 13 has made an account, tell us and we will delete it.

9. Security

Passwords are stored only as bcrypt hashes, the site is served only over HTTPS, your session cookie is signed so it can't be forged, and access to the database is limited to the people who run MyOwnLingo. If something goes wrong that puts your data at risk, we'll tell you and the ICO when the law requires it.

10. Changes

We'll update this policy when what we do changes. The date at the top shows the latest version, and we'll tell you by email or on the site about any change that matters.