Privacy

1. Who is responsible

The individual operating LingoCradle App is responsible for the app’s personal-data processing.

Controller: Álvaro Nebreda. Privacy contact: contact@lingocradle.app.

Robert Bigler’s separate business at lingocradle.com has its own privacy notice.

2. Information we use

• Account: account ID, email, profile display name and a Terms acceptance record (version, date, presented language and sign-in method), for sign-in, account management and evidence of the terms accepted.
• Learning: languages, preferences, favourites, progress and playback positions, to provide and remember your learning experience.
• Access and purchases: permissions, redeemed codes, order/payment references and subscription status, to deliver purchased access and handle queries.
• Support and security: limited authentication and error events, with an account identifier when known and broad browser/device categories, to protect access and troubleshoot problems. These are kept separately from usage statistics.

Additional usage analytics is limited to totals by course and UTC day: openings, observed plays and seconds of listening or activity. It stores no account, session or device identifiers, individual lessons, audio positions or personal histories. These submissions omit authentication cookies and page referrers; existing opt-outs are respected. Earlier individual usage history is converted to totals and removed from the active database. Functional learning data and limited support logs remain associated with accounts. These logs do not store passwords, login codes, cookies, full IP addresses, audio or transcripts. Infrastructure providers may separately process connection data.

3. Purposes and legal bases

Account and learning data are used to perform our contract and provide the service you request. Records required by tax rules or other legal duties are retained to comply with legal obligations. Limited operational logs serve our legitimate interests in securing access, preventing abuse and troubleshooting faults, with restricted access and limited retention. Creating an account is not treated as consent to optional processing.

4. Providers and transfers

To provide the service, we use technology providers for authentication, web hosting, databases, private and encrypted storage, and email. Access is limited to authorised people and providers performing their functions, alongside legally required disclosures. If you choose an enabled external sign-in method, that provider supplies the authorised account/profile information. Paddle processes its purchases under its own Privacy Policy when you use an enabled payment flow.

These services may involve processing outside the European Economic Area. The data processing agreements of Supabase and Vercel incorporate standard contractual clauses for transfers where applicable. You can request information about recipients and safeguards, including a copy of applicable safeguards, using the contact below.

5. Retention and browser storage

We retain your account and learning data while your account remains open, until you request erasure by emailing contact@lingocradle.app. The request covers account and learning data in both the database and backups. We will verify your identity and explain the scope, timing and completion of erasure. Some records may require restricted retention for legal duties or claims for the applicable period; we will explain any relevant exceptions. Reversible account archiving is not erasure.

We use cookies and local storage to sign you in and remember language, learning and installation preferences. You can manage or clear this storage in your browser; doing so may sign you out or reset your preferences. Additional usage analytics installs no cookies or persistent identifiers.

6. Your rights and contact

Where applicable, you may request access, correction, erasure, restriction or portability, object to processing, and withdraw consent where processing relies on it. Email contact@lingocradle.app. We will verify identity proportionately and respond within legal deadlines. Do not send passwords or login codes.

You may complain to the Spanish Data Protection Authority (AEPD) or another competent supervisory authority. Disconnecting an external sign-in provider does not itself erase app data.