Privacy policy

Last updated: 9 October 2026 (version 2026-10)

Your privacy matters to us, and to the parents and guardians of our younger learners. We have a few simple principles:

• We collect only what we need to run ScalaLingua, and we keep it only for as long as we need it.
• We do not sell your information.
• You decide how you appear to others: by username, by a generated pseudonym, or not at all.
• You can download your data or delete your account at any time, from inside the app.

This policy explains, as plainly as we can, what we collect, why, who we share it with and what your rights are.

1. Who we are and what this policy covers

ScalaLingua is run by , ("ScalaLingua", "we" or "us"). We are the controller of your personal data under the EU General Data Protection Regulation (GDPR). You can reach us about anything in this policy at [email protected] or through our contact form. Further details are in our legal notice.

This policy covers:

• the ScalaLingua app, whether you use it on the web at app.scalalingua.com or on a phone or tablet;
• our sign-in service at auth.scalalingua.com; and
• this website, scalalingua.com, including the contact form.

ScalaLingua is offered to learners in the European Union and the European Economic Area.

2. Information we collect

Your sign-in account

When you sign up, our sign-in service (which we run ourselves, using the open-source software Zitadel) stores:

• your email address, and whether you have verified it;
• the name you enter on the sign-up form;
• your password, stored only in a scrambled (hashed) form that cannot be turned back into the password, or your passkey's public key; and
• if you choose to sign in with Google or Apple, an identifier from that provider and the name and email address it shares with us. Google and Apple then also know that you use ScalaLingua; see their own privacy policies.

The learning service itself does not store your email address or name: it knows you only by a random identifier from the sign-in service.

Your learner profile

• the username you choose, and a pseudonym we generate for you (such as "Swift Otter 4821");
• the month and year of your birth (never the day) and your country, which we need to apply the age rules in section 4;
• your settings: time zone, app language, daily goal, leaderboard privacy mode, whether you can be found by username, your character, sound and timer preferences.

Your learning activity

• the courses you follow, the lessons you play, your answers, scores, how long you took, stars, experience points (XP), streaks and leaderboard positions.

Friends and community

• your friends, friend requests and invite links, and the people you block;
• reports you make about other learners' usernames or pseudonyms, including any optional explanation you write, and reports other learners make about yours;
• the in-app notifications we send you, for example about the outcome of a report.

Parental consent

If a learner needs a parent or guardian's permission (see section 4), we ask for the parent's email address. We use it only to send the consent emails and delete it as soon as each email is sent. We keep a scrambled (hashed) version of the address so that the parent can confirm it later, together with the times consent was requested, given or withdrawn, the version of this policy the parent saw, and the IP address from which consent was given, as a record that consent was obtained.

Information collected automatically

• Server logs. Like most online services, our servers record technical information about each request, such as the IP address, the time, the page or function requested, the result and the browser or app version. We use this to keep the service running and secure.
• Network and security. Connections to our websites and the app pass through Cloudflare, which protects us against attacks and abuse and delivers our pages quickly. To do this, Cloudflare processes the same technical information about each request, including your IP address, on our behalf.
• Sign-in session. On the web, a cookie keeps you signed in; see section 10.

We do not currently use analytics or advertising tools, we do not track you across other websites or apps, and we do not collect your precise location.

When you contact us

If you use our contact form or email us, we receive your email address, the name you give (if any), the topic and your message. The contact form also uses your IP address, held only in memory for an hour, to limit how many messages can be sent.

This website

scalalingua.com sets no cookies of its own, runs no tracking or analytics and loads nothing from other companies' servers. Our servers keep the usual server logs described above, and the site is delivered through Cloudflare as described above.

3. How and why we use information

The GDPR requires us to tell you the legal basis for each use of your personal data. Here they are:

Where we rely on legitimate interests, you can object; see section 11. We do not sell your information. At present we do not show adverts or send marketing emails. If we introduce either, or paid features, we will update this policy before we start, and ask for your consent where the law requires it. We will never show adverts based on profiling to learners we know to be under 18.

4. Children and parental consent

Learning is for everyone, so younger learners are welcome, with their parent or guardian's permission:

• Learners must be at least 8 years old.
• Each EU and EEA country sets a "digital age of consent" between 13 and 16. Learners younger than the age for their country need permission from a parent or guardian before they can start learning. We email the parent a link; they confirm on a page that explains what we collect and links to this policy.
• Until permission is given, we collect nothing beyond the basic account, and the account is deleted automatically if permission has not been given within 14 days.
• Until they reach the age of consent, younger learners cannot show their username on public leaderboards, cannot be found by username search, can add friends only through invite links, and cannot write free text in reports.
• The parent's confirmation email contains a private link they can use at any time to download the learner's data or withdraw permission. Withdrawing permission deletes the learner's account.

If you believe a child is using ScalaLingua without the permission they need, please contact us and we will act promptly.

5. What other learners can see

You choose your leaderboard privacy mode, and can change it at any time:

• Pseudonymous (the default): other learners see your generated pseudonym, your character and your XP on public leaderboards.
• Public: they see your username instead.
• Hidden: you do not appear on public leaderboards at all.

Your friends always see your username, character, current streak, weekly XP and the courses you follow. Learners can find you by exact username unless you turn this off. We never show your name, email address, age or country to other learners.

6. Sharing information

We share information only in these limited circumstances:

• Service providers who process data for us under a data processing agreement and only on our instructions: our hosting provider, our email delivery provider and Cloudflare, which provides our network security and content delivery.
• Google or Apple, only if you choose to sign in with them.
• Legal requirements: we may disclose information if the law requires it, for example in response to a valid court order, or where we believe in good faith that disclosure is necessary to protect someone from serious harm.
• Business transfers: if ScalaLingua is ever sold or merged, your information may transfer to the new owner, who will remain bound by this policy. We will tell you beforehand.

We do not sell or rent personal information.

7. Where your information is stored

Our servers, and our hosting and email delivery providers, are located in the European Union. Cloudflare, Inc. is based in the United States and runs a global network, so information about your requests, such as your IP address, may be processed in data centres outside the EU, including the one nearest to you. Cloudflare is certified under the EU-US Data Privacy Framework, and our agreement with it includes the European Commission's standard contractual clauses.

If you sign in with Google or Apple, those companies may process your data outside the EU under their own privacy policies and similar safeguards. If we ever transfer personal data outside the EU or EEA in any other way, we will use such safeguards and update this policy.

8. How long we keep information

• Your account and learning data: until you delete your account. Deletion is immediate and permanent in our database, and removes your sign-in account too.
• Accounts awaiting parental consent: deleted after 14 days if permission is not given.
• Parents' email addresses: deleted as soon as each email is sent; the consent record is kept for as long as the learner's account exists.
• Web sign-in sessions: end after 7 days without use, and after 30 days at most.
• Server logs: about 30 days. Cloudflare keeps its own short-lived logs of requests for security and operations, in line with its data processing agreement with us.
• Messages to us: 12 months after the conversation ends, unless we need them longer to deal with a legal claim.
• Backups: deleted data may remain in encrypted backups for up to 35 days until they are overwritten.

9. Security

No online service is perfectly secure, but we work hard to protect your information. All connections are encrypted. Passwords are stored only as hashes. On the web, your sign-in tokens never reach your browser: they are kept encrypted on our servers. Only a small number of staff can access personal data, and administrators must use two-factor authentication. If a breach ever puts your information at risk, we will tell you and the supervisory authority as the law requires.

10. Cookies and similar technologies

This website sets no cookies of its own. The web app at app.scalalingua.com uses only cookies that are strictly necessary to provide the service you asked for, so no cookie banner is needed:

• __Host-sl_session: keeps you signed in (up to 30 days);
• __Host-sl_auth: protects the sign-in process (10 minutes).

Our sign-in service at auth.scalalingua.com also sets strictly necessary cookies for signing in. On phones and tablets, the app keeps your sign-in tokens in your device's secure storage so that you stay signed in.

Cloudflare may set strictly necessary security cookies on any of our sites, such as __cf_bm (tells people from automated traffic, 30 minutes) or cf_clearance (records that you passed a security check). They are not used for tracking or advertising.

11. Your rights

Under the GDPR you have the right to:

• access your personal data and receive a copy (in the app: Profile, Export my data);
• correct it if it is wrong (most of it you can change in the app);
• delete it (in the app: Profile, Delete my account);
• restrict how we use it;
• data portability: receive it in a machine-readable format (the download is a JSON file);
• object to our use of it where we rely on legitimate interests; and
• withdraw consent at any time where we rely on consent, without affecting what we did before.

To use any of these rights, use the app or write to [email protected]. We will answer within one month, and may need to confirm your identity first. Parents and guardians can exercise these rights for their child.

You also have the right to complain to a data protection supervisory authority, in particular in the country where you live or work. Our lead authority is GPDP; you can find the authority for your country on the European Data Protection Board's website. We would appreciate the chance to sort out your concern first, though.

12. Automated decisions

Your answers are marked, and your score and XP calculated, automatically. If three different learners report a username, it is automatically hidden (and the pseudonym shown instead) until one of our team reviews the reports; a person always makes the final decision on any action. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

13. Changes to this policy

We may update this policy as ScalaLingua changes or the law requires. We will change the date at the top, and if the changes are significant, we will tell you in the app before they take effect. Earlier versions are available on request.

14. Licence and credit

This privacy policy is adapted from the Automattic privacy policy, part of legalmattic by Automattic, published under the Creative Commons Attribution-ShareAlike 4.0 International licence. We have rewritten it substantially for ScalaLingua and the GDPR. You are welcome to adapt our version under the same licence; please credit Automattic and us.