Privacy Policy

• Account data — your email address, and (if you sign in with Google) your Google account identifier. Used to authenticate you and to check your address against our approved list. Legal basis: contract.
• Access requests — when an unapproved address signs in, we record the address, the time, and whether you said you’re interested in a trip or course, so we can get in touch. Legal basis: legitimate interest / your request.
• Learning progress — stars, levels, quiz results and lesson completion. Stored in your browser; synced to our database only where the feature requires it. Legal basis: contract.
• Audio recordings — recordings made by our contributors in the studio tool, used to teach pronunciation. Legal basis: consent of the speaker.
• Security and error logs — sign-in attempt records and technical error reports, kept to protect the site. Legal basis: legitimate interest.
• Cookie choices — your consent decision and its timestamp.

We do not run advertising, and we do not sell personal information for money. We currently load no analytics or marketing trackers at all — see the Cookie Policy.

The app is designed for children learning with a parent or teacher. Accounts are created for and managed by adults; we do not knowingly collect personal data directly from a child beyond in-app learning progress tied to the adult’s account. Contact us to have any child-related data removed.

• Account and approved-email records: for as long as your access is active, then up to 12 months.
• Access requests: up to 24 months, or until you ask us to delete them.
• Security/sign-in logs: up to 12 months.
• Browser-stored progress and cached audio: until you clear your browser storage.
• Consent record: until you change it, or 12 months, whichever is sooner.

Our hosting, database and authentication providers process data on our behalf under data-processing agreements. Google receives your email address when you choose Google sign-in, and receives your IP address when your browser fetches our web fonts. We otherwise share personal data only when legally required.

Data may be processed in the United States and the European Union. EU/UK transfers rely on Standard Contractual Clauses.

• Access — get a copy of the personal data we hold about you.
• Rectification — correct anything inaccurate.
• Erasure — ask us to delete your account and data.
• Portability — receive your data in a machine-readable format.
• Objection and restriction — object to processing based on legitimate interest.
• Withdraw consent — at any time, without affecting past processing.
• Complain — to your local supervisory authority.

• Right to know — what we collect, use, and disclose.
• Right to delete — request deletion of your personal information.
• Right to correct — fix inaccurate information.
• Right to opt out of sale or sharing — use the Do not sell or share my personal information link. No account or support ticket needed.
• Global Privacy Control — we detect the GPC browser signal and treat it automatically as an opt-out of sale/sharing.
• Non-discrimination — opting out never changes your price, access, or the features you get.

In the past 12 months we have not sold or shared personal information, and we do not process sensitive personal information for inferring characteristics.

Access is invitation-only, all database tables use row-level security, sign-in uses Google OAuth or a password checked against known-breach databases, and administrative actions are restricted to verified admin accounts.

Email privacy@adameluna.com and we’ll respond within 30 days (45 days for California requests, extendable once). We may ask you to confirm control of the email address on the account.