Privacy Policy

Last updated: August 2026

Article 1 — Data controller

Article 2 — Data collected

2.1 Identity data

• First name, last name (or pseudonym)
• Email address

2.2 Progress data

• Experience points (XP) and Gems
• League level and ranking
• Lessons completed, success rate, learning time
• Day streaks
• Language preferences and active units

2.3 Technical data and identifiers

• Unique user identifier (UUID generated by Supabase)
• IP address (automatically anonymized after 30 days)
• Device identifier — Device ID (iOS/Android)
• Operating system and app version
• Anonymized session logs and crash reports

2.4 Payment data

Banking details are processed exclusively by Apple, Google, or Stripe and are never transmitted to nor stored by Kreyolang on its own servers. We only retain the confirmation of subscription status (active / inactive / plan type) through RevenueCat.

2.5 Information visible to other users

As part of league rankings and community spaces, the following information is visible to other users viewing your profile or the leaderboard: your username, the languages you are learning, your total experience points (XP), the number of words learned, your league rank, and your Premium status where applicable. No other personal data (email address, age, contact details) is visible to other users.

Article 3 — Purpose of processing

Purpose	Legal basis
Account creation and management	Contract performance
Progress synchronization (Supabase cloud)	Contract performance
Premium subscription management (RevenueCat)	Contract performance
Sending progress notifications and reminders	Consent
Anonymized usage analytics (service improvement)	Legitimate interest
Compliance with legal and accounting obligations	Legal obligation

Article 4 — Sub-processors

Kreyolang uses the following providers, selected for their GDPR compliance guarantees and certified security:

Provider	Role	Location & safeguards
Supabase	Database, authentication, cloud storage	EU / USA — Standard Contractual Clauses (SCCs), SOC 2 certified
RevenueCat	Premium and mobile subscription rights management (iOS & Android)	USA — Standard Contractual Clauses (SCCs), data minimization
PostHog	Behavioral progress analytics (subject to prior consent)	EU — EU Cloud, GDPR compliant, anonymized data
Stripe	Secure web payment processing	USA / EU — PCI-DSS Level 1 certified
Sentry	Error monitoring and app stability	EU — EU hosting, minimal data (userId + email only)
Sign in with Apple	Authentication via Apple ID (sign-in option)	USA — Apple framework, minimal data (optional anonymous email)
Expo / FCM / APNs	Push notification delivery (Expo uses Google FCM and Apple APNs as transport infrastructure)	USA — Only push token and notification content transmitted
Resend	Transactional email delivery (welcome, confirmation)	USA — Only the recipient's email address is transmitted

Article 5 — Retention period

Article 6 — User rights

6.1 Right of access

You may request a complete copy of all personal data we hold about you, within 30 days.

6.2 Right of rectification

You may correct inaccurate information directly from your profile settings in the app, or by contacting us by email.

6.3 Right to erasure — "Right to be forgotten"

You may request the complete and permanent deletion of your account and all your personal data. This action is irreversible: it permanently erases your progression, XP, Gems, streaks, and learning history.

Deletion can be initiated:

• From the app: Settings → My Account → Delete my account
• By email: contact@kreyolang.com

6.4 Right to portability

You may request the export of your progress data in a structured, readable format (JSON) via contact@kreyolang.com.

6.5 Right to object and to restrict

You may object to the processing of your data for analytics purposes, or request its restriction, at any time from your privacy settings or by contacting us.

Article 7 — Minor users

Users under 15 years of age use Kreyolang under the responsibility and with the prior consent of a parent or legal guardian (see Art. 2.1 of the Terms). To reinforce the protection of these users:

• Only a username is used and displayed in rankings and community spaces — no real name is required or made visible to other users.
• The parent or legal guardian may at any time request access to, rectification of, or deletion of their child's data by writing to contact@kreyolang.com, upon simple proof of the parental relationship.
• No sensitive data (precise geolocation, biometric data) is collected from minor users.

Article 8 — Cookies and trackers

8.1 Strictly necessary cookies

These cookies enable secure authentication (JWT tokens via Supabase) and store your preferences. They are essential to the operation of the service and do not require your consent.

8.2 Analytics cookies (opt-in)

Used via PostHog EU Cloud to analyze aggregated usage and improve the learning experience. These cookies require your prior consent via the dedicated banner. They may be declined without impacting your use of the service.

8.3 No advertising cookies

Kreyolang uses no third-party advertising cookies. No browsing data is shared with advertising networks.

Article 9 — Policy changes

We reserve the right to modify this policy to reflect legal, regulatory, or functional changes to our service.

In the event of a substantial change affecting your rights, you will be notified by email at least 30 days before the new provisions come into effect. The current version is always available on this page.