Privacy Policy

Who is responsible

LinguaSwap is an independent project run by an individual developer based in Spain — not a company. That person is the data controller for everything described here.

For anything in this policy, including a request to see or delete your data, write to carlostorrillascasas1@gmail.com. That address is monitored and is the fastest way to reach a human.

This document is published in English only, and the English text is the authoritative version. The rest of LinguaSwap is available in seven languages; if you need any of this explained in another language, write to carlostorrillascasas1@gmail.com and we will help.

What is stored

Everything below is kept in order to run the service you asked for:

• Your account: email address, an optional display name, and whether the address has been confirmed. Your password is never stored — only a salted hash of it.
• Your content: the libraries, words, translations and notes you create or import.
• Your learning data: which words you answered and whether you were right, the spaced-repetition box each word sits in, practice sessions, and your progress through a Journey.
• Billing identifiers: if you subscribe, a Stripe customer id and subscription id. Card numbers never reach our servers — payment happens on a page hosted by Stripe.
• Ordinary server logs kept by our hosting providers, which include IP addresses, for security and debugging.

What is not done

• No advertising, and no data sold or rented to anyone.
• No third-party analytics, no tracking pixels and no advertising cookies.
• No profiling and no automated decisions that have legal or similarly significant effects.
• Your words and notes are never used to train machine-learning models.

Storage in your browser

LinguaSwap keeps a few things in your browser’s local storage rather than in cookies: your sign-in tokens, your chosen theme and interface language, and — so that practising still works with no connection — any answers waiting to be sent to the server. All of it is strictly necessary to provide the service you requested.

Because none of it is used for tracking or advertising, there is no consent banner to click. Clearing your browser storage signs you out and discards any unsent answers.

Why it is allowed (legal bases)

• Performance of a contract: running your account, storing your libraries, scheduling your reviews and taking payment.
• Legitimate interests: keeping the service secure, preventing abuse, and fixing faults.
• Legal obligation: retaining invoices and transaction records for tax and accounting.

Who else processes it

LinguaSwap runs on services that process data on our behalf, under contract:

• Supabase — the PostgreSQL database holding your account and content.
• Render — hosting for the application server.
• Vercel — hosting and content delivery for the website.
• Stripe — payment processing and subscription management. Stripe is the controller of your payment-card data, under its own privacy policy.
• Resend — delivery of transactional email such as address confirmation and password resets.

Where it goes

Some of these providers are established in, or operate infrastructure in, the United States. Where personal data is transferred outside the European Economic Area, it is covered by the safeguards those providers offer for international transfers, such as the European Commission’s standard contractual clauses.

How long it is kept

Your account and its content are kept until you delete them. Deleting your account from the Account page removes your libraries, words, practice history and statistics, and cancels any active subscription at the same time.

Records of payments are retained by Stripe and by us for as long as tax and accounting law requires, which is longer than the account itself. Server logs are kept for a short period by our hosting providers.

Your rights

If you are in the EU or UK you have the right to access your data, to correct it, to have it erased, to restrict or object to processing, and to receive a copy in a portable format.

Deleting your account is self-service on the Account page and takes effect immediately. For anything else — including a copy of your data — write to carlostorrillascasas1@gmail.com and we will respond within one month.

If you think your data has been handled improperly you may complain to a data-protection authority, in your case likely the Spanish Data Protection Agency (AEPD).

Security

• Passwords are stored only as salted hashes, using the standard ASP.NET Core Identity hashing.
• All traffic runs over HTTPS.
• Sign-in uses a short-lived access token plus a refresh token that is stored hashed, is rotated on every use, and can be revoked.
• Repeated failed sign-in attempts lock an account temporarily, and the sign-in endpoints are rate-limited.

Children

LinguaSwap is not directed at children. You must be at least 16, or the minimum age for consenting to online services in your country, to create an account.

Changes

If this policy changes materially, the date at the top changes and, where the change affects you, we will tell you by email or in the app before it takes effect.