Privacy policy
Last updated 14 September 2026.
This policy describes what the application actually does today. It has not been reviewed by a lawyer; that review is outstanding and is the operator’s responsibility before public release.
Who is responsible
Lingua Doctor is operated by the account holder who publishes it on Google Play. For privacy questions, data access and deletion requests, email [email protected].
What is collected
Account
Email address, display name, a password hash (never the password itself), the language you are learning, your interface language, your role and your plan. You need an account because your progress has to belong to someone.
Learning activity
Your answers, scores, mistakes, the CEFR objectives those mistakes map to, review scheduling, placement results and exit-exam results. This is the product: without it there is no mastery model and no personalised practice.
Speaking and the microphone
Two different things happen, and they are worth separating:
- Pronunciation and dictation practice. Speech is turned into text by your device’s own speech recogniser. Only the resulting text is sent to our server. Your recording is not uploaded and is not stored by us.
- Live voice conversation. This is a real-time call with an AI model. Audio is streamed to the AI provider for the duration of the call so it can respond. We do not keep a recording; a transcript of the conversation is stored so you can review the session and so corrections can be produced.
The microphone is only used while a speaking feature is open, and the operating system asks your permission first. Declining leaves every other part of the app working.
Sign-in links and usage records
If you sign in with Google, the provider name, your Google account identifier and the Google email address are stored against your account. Per-period usage counts (tutor messages, voice minutes, writing assessments), the length and status of each live-voice session, and a log of AI requests made for you (feature, provider, model, outcome and size, not the content) are kept to apply plan limits and monitor cost.
Subscriptions
Purchases are handled by Apple, Google and RevenueCat. We receive whether you hold an entitlement and when it expires. We never receive or store your card details. Access granted to you by the operator at no charge (for example a trial) is recorded with its type and expiry.
Error reports (optional)
If you turn on "Product analytics consent" in Account, the app can send a short report when it crashes or hits an unexpected error: the app version, the platform and operating-system version, whether the app closed, the type and a redacted text of the error, a technical stack trace, and the name of the screen. Email addresses, tokens and the query part of links are removed before it is stored. It never contains your answers, text you typed, audio or a device identifier. The report is kept with your account for 30 days, is included in your data export and is deleted with your account. With the switch off, nothing is sent.
Technical
Server logs record a request id, the route, a status code, a duration and a salted one-way hash of your IP address used for rate limiting. The raw IP address is not stored.
What is not collected
- No analytics SDK and no third-party crash-reporting service.The app contains neither. The only error report is the optional one described above. No behavioural analytics profile is built about you.
- No advertising identifier. Advertising is disabled in the shipped build and the advertising-ID permission is removed from the app package. If ads are ever enabled, this policy and the store data-safety declarations will be updated before that build is released.
- No contacts, photos, location or device identifiers.
Who processes your data
- Railway — application server and PostgreSQL database.
- Cloudflare — DNS, encryption and network delivery for linguadoctor.com and its API. Sees your IP address and request metadata, and forwards mail sent to @linguadoctor.com addresses.
- Resend — sends account email: address verification, password reset and account-deletion confirmation. Receives your email address and the message.
- OpenAI — AI tutor replies, conversation practice, live voice, speech transcription and generated speech. Receives the text of your practice, and live-call audio while a call is in progress.
- ElevenLabs — generated lesson speech. Receives the lesson text to be spoken, not your voice.
- RevenueCat, Apple and Google — subscription state.
- Google Sign-In — only if you choose to sign in with Google, and only to verify your identity token.
These providers operate outside your country in most cases. Using the app means your practice text is processed by them.
Generated voices
Every voice you hear is synthetic. It is labelled as AI-generated in the interface and does not imitate any real person.
How long it is kept
Account and learning data are kept while your account exists. Generated audio is cached so the same sentence is not re-synthesised, and that cache expires on its own. Deleting your account removes your account record, your learning history and your conversation transcripts.
Your choices
- Export. The app can produce a copy of your data: account, preferences, progress, every kind of practice and exam record, conversation and teacher transcripts, sign-in links, usage and voice records, AI request logs, complimentary-access records and subscription state. Password hashes, session and reset tokens and internal operator notes are not included.
- Deletion. The app can delete your account and its data from the account screen. This is immediate and cannot be undone.
- Consent. Voice recording consent and analytics consent are separate settings you control.
- Microphone. Revocable at any time in your device settings.
Children
The app is not directed at children under 13, and accounts are not knowingly created for them.
Changes
Material changes will be shown in the app before they take effect. The date at the top of this page always reflects the current version.