Privacy

Who we are

Langvie is operated from Vienna, Austria, and is the controller for everything described on this page. One address handles every question about it.

What we collect and why

The rule we work to is collecting only what a flashcard schedule needs.

Without an account, that is nothing. Langvie opens on a welcome screen offering to continue without signing up. Take that path and no data about you reaches a server.

With an account, four things:

• Your login. An email address and a password hash. Sign in with Google and Google returns the email address, nothing more.
• Your settings. Display name, the language you are learning, the language you read translations in, your level, your daily goal.
• Your deck. Each word you have met, its stage on the 3, 7, 14 and 30 day ladder, when it is next due, and how often you have reviewed or missed it.
• Your reviews. One row per card you rate, holding the word, whether you knew it, and the time. The streak counts those rows.

All of it runs your account and syncs your deck between devices, which is Article 6(1)(b) of the GDPR, performing a contract. Keeping the service up and stopping abuse rests on Article 6(1)(f), our legitimate interest in a working app. Nothing runs on consent, which is why no cookie banner appears.

An email address is the only thing you have to give, and only if you want an account. There is no profiling and no automated decision making. The schedule is arithmetic on your own answers.

What we never collect

No analytics, no advertising, no third party cookies, no fingerprinting, no session recording. Langvie loads no script from anyone else's domain. It is free and has no payment step, so no card details exist. It never asks for your location, contacts, camera, microphone or photos.

We do not sell or rent your data, hand it to advertisers, or train machine learning models on it.

What is stored on your device

Langvie sets no tracking cookies. It writes four things to local storage, all of them functional.

• The session token that keeps you signed in.
• Your settings and deck, when you use Langvie without an account.
• Your place in a film, so a session resumes where you stopped.
• A flag recording that you have seen the welcome screen.

Signing out clears the token, and clearing site data clears all four. Without an account that erases your deck for good, because no copy exists anywhere else.

When we share it

Three companies process account data for us, each under a data processing agreement.

The database sits inside the European Union. Vercel's edge network can serve a request from outside it, which Vercel covers with the European Commission's Standard Contractual Clauses.

Building a film's deck also touches OpenSubtitles, OMDb, IMDb and DeepL. None of them receives a user id, an email address or a review history, because indexing runs on the server against a film long before you open it.

How long we keep it

Your account and everything attached to it lasts as long as the account does. Deleting it drops your rows from all four tables at once, because each is keyed to your user id and cascades. There is no soft delete and no archive. Supabase's routine backups may hold a copy briefly, and those expire on their own schedule.

There is no delete button in the app yet. Until there is, email us and the account goes within 30 days, usually the same week. Resetting progress inside the app is a smaller thing, which clears the deck and leaves the account standing.

Your rights

Under the GDPR you can ask for a copy of your data (Article 15), a correction (16) or deletion (17). You can also request a portable export (20), a pause on processing (18), or object to anything resting on legitimate interest (21).

Email us. There is no form, the answer comes within 30 days, and it costs nothing.

If that answer does not satisfy you, complain to the Austrian supervisory authority, the Österreichische Datenschutzbehörde, Barichgasse 40 to 42, 1030 Vienna, at dsb.gv.at. You can complain to the authority where you live instead.

How we keep it safe

Every table runs behind Postgres row level security, so a signed in user reaches only rows carrying their own user id. The database enforces that rather than the app, so a bug in the app cannot open someone else's deck.

Traffic runs over HTTPS, and Supabase stores passwords as hashes nobody can read back. The OpenSubtitles and OMDb keys sit in server side secrets and never reach the browser.

No system is airtight. If you find a hole, email us and we will treat it as urgent.

Changes and questions

The date at the top is the last change. Anything that alters what we collect, or who processes it, appears in the app before it takes effect.

Write to olesia.borysova@gmail.com for a data request, a deletion, a correction or a security report. The companion document is the terms of use.