Privacy Policy

Effective date: July 27, 2026 Last updated: July 27, 2026

This Privacy Policy explains what information Russian Learning App collects, why we collect it, who we share it with, how long we keep it, and what control you have over it.

We have tried to write this in plain English rather than legal shorthand. If anything here is unclear, email us at support@russianlearning.app and we will explain it.

The short version

• We collect your email address and password (or your Google account, if you sign in that way), the profile details you choose to add, and a record of your learning activity — lessons completed, words saved, streaks, and settings.
• When you use translation, pronunciation, speech, or photo translation, the text, audio, or image you submit is sent to OpenAI to be processed and sent straight back to you. OpenAI acts as our service provider and does not use this data to train its models.
• Translations and pronunciation audio are cached and reused so we do not pay to generate the same answer twice. Cached entries are stored without any link to your account.
• We do not run advertising, do not use tracking or analytics cookies, do not build advertising profiles, and do not sell or share your personal information.
• Your data is stored in the United States. If you are outside the US, we rely on Standard Contractual Clauses to transfer it there lawfully.
• You can access, correct, export, or delete your data at any time. Email support@russianlearning.app and we will action it.

1. Who we are and how to contact us

Russian Learning App (the "Service", "we", "us", "our") is operated by PostSocial, LLC, a limited liability company organised in the United States.

For the purposes of the EU General Data Protection Regulation ("GDPR") and the UK GDPR, PostSocial, LLC is the data controller of the personal data described in this policy.

Privacy contact: support@russianlearning.app Website: https://www.russianlearning.app

We are a small, independent operation. There is no dedicated privacy team — privacy requests go directly to the founder and are handled personally.

2. Scope of this policy

This policy applies to:

• the website at russianlearning.app and www.russianlearning.app, including the marketing pages;
• the Russian Learning App web application itself, including your account, lessons, dictionary, translation tools, saved items, and profile settings; and
• our email correspondence with you, including account and support email.

It does not apply to third-party services you reach from our Service (for example, Google's sign-in screen or Stripe's checkout page). Those services have their own privacy policies, which govern what they do with your information. Section 15 says more about this.

3. Information we collect

3.1 Information you give us

3.2 Information created as you use the app

This is the record of your learning. We store it so your progress survives when you close the app or switch devices.

• Learning progress — which letters, lessons, and words you have started or completed; accuracy scores; and the CEFR level (A1, A2, B1…) associated with your account.
• Streaks and daily activity — the dates you practised, how many minutes you practised, and whether you met your daily goal.
• Saved items — words, phrases, translations, letters, whole lessons, and photo translations you choose to save, together with a snapshot of the content so the saved card still renders later.
• Photos you save from photo translation — see Section 5.3, which explains an important detail about how these are stored.
• Settings — your daily practice goal.
• Subscription state — your plan, status, billing interval, current period end, and the identifiers your payment processor gives us. See Section 3.4.

3.3 Information collected automatically

• IP address. Our servers see your IP address on every request, as all web servers do. We use it in memory to enforce rate limits on the translation, speech, and pronunciation endpoints so that no single visitor can run up unlimited AI costs. These rate-limit counters live only in server memory, are not written to a database, and disappear when the server instance restarts.
• Standard request data. Our hosting provider (Vercel) and our database provider (Supabase) generate operational logs that may include IP address, timestamp, requested URL, HTTP status, user agent, and error details. We use these to keep the Service running and to debug faults.
• Device and browser information. Your browser sends a user-agent string and similar headers with every request. We do not use this to fingerprint or track you across sites.

3.4 Information from third parties

• Google. If you sign in with Google, Google tells us your Google account identifier, email address, name, and profile picture URL. We do not receive your Google password, and we do not gain access to your Gmail, Drive, contacts, or anything else in your Google account.
• Stripe (payments). When paid subscriptions launch, Stripe will process your payment and tell us your Stripe customer identifier, subscription identifier, plan, subscription status, billing interval, and renewal date. We never receive or store your full card number, CVC, or bank details — those go directly to Stripe and stay there.

3.5 Information we do not collect

To be explicit about things people reasonably worry about:

• We do not collect your date of birth, government identification, phone number, or physical address.
• We do not collect precise geolocation.
• We do not use advertising cookies, tracking pixels, session recording, heatmaps, or third-party analytics products.
• We do not buy personal data about you from data brokers.
• We do not access your device's microphone, camera, or photo library except at the moment you actively tap the microphone or camera button in the app, and only for that one action.

4. How we use your information

We use your information for the purposes below, and only for those purposes.

Where we rely on legitimate interests, we have considered whether our interest is overridden by your privacy rights, and we have limited the processing accordingly — for example, rate-limit counters are held in memory rather than stored, and cached translations are stored without any link to your account.

We do not use your personal information to train artificial intelligence models, our own or anyone else's. See Section 5.5.

We do not make decisions about you that have legal or similarly significant effects using solely automated processing.

5. AI processing — what happens to your text, voice, and photos

Several features of the Service work by sending what you submit to OpenAI, L.L.C., which processes it and returns a result. This section explains exactly what leaves your device, feature by feature, because we think you should know before you use them.

OpenAI acts as our processor (a "service provider" under US privacy laws): it processes this data on our instructions, to deliver the feature you asked for, and for no other purpose of its own.

5.1 Text translation

When you type or paste a phrase into Translate, we first try to answer it for free from our own dictionary and from our translation cache. If neither has the answer, the text you typed is sent to OpenAI, which returns the translation, pronunciation respelling, and word-by-word breakdown. Submissions are limited to roughly 280 characters.

5.2 Speech and pronunciation

• Pronunciation audio (text-to-speech). When you tap to hear a word or phrase, we check our audio cache first. On a miss, the text is sent to OpenAI, which returns an audio file. We store that audio file so nobody has to generate it again.
• Dictation and Live Conversation. When you tap the microphone, the audio you record is sent to OpenAI to be transcribed and, in Live Conversation, translated. We do not store your voice recordings. The recording is used to produce the transcript and is then discarded. The synthesised audio of the translated reply may be cached as described above.

5.3 Photo translation

Photo translation works in two stages, and the privacy consequences differ:

• Reading the text (OCR) normally happens in your browser. We use the open-source Tesseract library, running on your own device, to find the text in your photo. In this normal path, the photo itself never leaves your device — only the lines of text that were read off it are sent to OpenAI for translation.
• If on-device OCR fails or finds nothing, we fall back to sending the photo itself to OpenAI, which reads and translates it with a vision model.
• If you choose to save a photo translation, the photo is uploaded to our storage and kept in your Saved tab until you delete it.

Please read this carefully. Saved photos are stored in a storage bucket that is configured as public-read. The file path includes your account identifier and a file name, which makes the address hard to guess, but anyone who has or discovers the direct URL of a saved photo can view it without signing in. Treat saved photos as "unlisted", not "private". Do not save photos containing anything you would not want a stranger to see — identity documents, bank statements, medical records, or images of other people who have not agreed to it. We are working to move this storage to a fully private, signed-URL model; until this policy says otherwise, the description above is accurate.

5.4 Shared caches — an important detail

To keep the Service affordable, we store translation results and pronunciation audio in shared caches that serve every user:

• The translation cache stores the phrase you submitted, a normalised form of it, the direction of translation, and the result.
• The audio cache stores the text that was spoken and a link to the generated audio file.

These cache entries contain no user identifier. They are not linked to your account, and we cannot look at a cache entry and tell who submitted it. But they are shared: if another learner later submits the same phrase, they receive the cached answer, and the phrase you submitted is what produced it. Cached entries are retained indefinitely so that the answer stays instant and free.

5.5 What OpenAI does and does not do with this data

OpenAI processes this data under its API terms and its data processing addendum, which we have accepted on your behalf as the controller. Under those terms:

• OpenAI does not use data submitted through its API to train or improve its models.
• OpenAI may retain API inputs and outputs for a limited period (currently up to 30 days) for abuse and misuse monitoring, after which they are deleted, unless a longer period is required by law.
• OpenAI is contractually bound to protect the data and to process it only on our instructions.

If OpenAI materially changes these commitments, we will update this policy and tell you.

5.6 Please do not submit sensitive information

The translation, speech, and photo features are built for learning Russian — menus, signs, conversation practice, vocabulary. Please do not submit information you need to keep confidential, including passwords, financial account details, health information, government identifiers, or other people's personal information, into any of these features. Submitted text may be cached and served to other learners as described in Section 5.4, and we cannot retrieve or delete an individual cache entry on request unless you can tell us the exact phrase you submitted.

6. Cookies, local storage, and similar technologies

We use the minimum necessary to make the app work. We do not use advertising, marketing, retargeting, or analytics cookies. Because we set no non-essential cookies, we do not show a cookie consent banner.

6.1 What we store on your device

All of these are strictly necessary for the Service to function or to remember a preference you set.

6.2 Third-party requests your browser makes

Loading the app causes your browser to request files from a small number of third parties. Those requests necessarily reveal your IP address, user agent, and the page you are on to the provider concerned. We do not control what each provider does with that information, and each has its own privacy policy.

None of these are used by us for advertising or cross-site tracking.

6.3 Do Not Track and Global Privacy Control

Because we do not track you across websites and do not sell or share personal information, there is nothing for a Do Not Track or Global Privacy Control signal to switch off. We honour these signals by default: our behaviour is already the same as if you had sent one.

7. How we share information

We share personal information only in the situations described below. We do not sell it, rent it, or trade it.

7.1 Service providers (subprocessors)

Each provider is bound by contract to use the information only to provide its service to us. We keep this list current; if we add a provider that handles personal information, we will update this table.

7.2 Other disclosures

• Legal requirements. We may disclose information if we believe in good faith that it is required by applicable law, regulation, legal process, or an enforceable governmental request. Where we are legally permitted to do so, we will attempt to notify you first.
• Enforcement and safety. We may disclose information where necessary to investigate suspected fraud, abuse, or violations of our Terms of Service, or to protect the rights, property, or safety of our users, ourselves, or the public.
• Business transfer. If the Service is sold, merged, or transferred, your information may be transferred as part of that transaction. We will notify you by email before your information becomes subject to a materially different privacy policy, and you will have the opportunity to delete your account first.

7.3 We do not sell or share your personal information

We have not sold or shared personal information in the preceding twelve months, as those terms are defined by the California Consumer Privacy Act (as amended by the CPRA) and comparable US state privacy laws, and we have no plans to. We also do not disclose personal information for "cross-context behavioural advertising", and we do not knowingly sell or share the personal information of anyone under 16.

8. Where your information is stored, and international transfers

Your information is stored and processed in the United States. Our database and file storage run in Supabase's us-east-1 region; our hosting, email, and AI processing providers are also US-based.

If you use the Service from the European Economic Area, the United Kingdom, or Switzerland, your personal data is transferred to the United States, which has not received an adequacy decision covering all transfers of this kind. We rely on:

• the European Commission's Standard Contractual Clauses, and the UK International Data Transfer Addendum where the UK GDPR applies, incorporated into our agreements with each of our providers; and
• supplementary measures including encryption in transit (TLS), encryption at rest, row-level access controls in our database, and the data minimisation described throughout this policy.

You may request a copy of the relevant transfer mechanism by emailing support@russianlearning.app. We will provide it in a form that redacts commercial terms.

9. How long we keep information

When a retention period ends, we delete the information or irreversibly de-identify it.

10. Your choices and controls in the app

• Edit your profile. Profile → Edit profile lets you change your display name and username.
• Change your email. Profile → Email. You will need to confirm the change from the new address.
• Change your password. Profile → Password & security.
• Delete a saved item or a saved photo. Open the Saved tab and remove it. This deletes the stored record, including the stored photo file.
• Sign out. Profile → Sign out. This clears your session from the device and clears the ru_session cookie.
• Delete your account. Email support@russianlearning.app from your account email address and ask us to delete your account. We will confirm, delete your data within 30 days, and tell you when it is done. If a self-service delete button is available in your version of the app, you can use that instead.

11. Your privacy rights

11.1 Rights everyone has, wherever you live

We extend the following to every user, regardless of where you are:

• Access — get a copy of the personal information we hold about you.
• Correction — have inaccurate information fixed.
• Deletion — have your account and associated personal information deleted.
• Portability — receive your learning data in a structured, machine-readable format.
• Withdraw consent — where we rely on consent, withdraw it at any time without affecting processing already carried out.

11.2 If you are in the EEA, the UK, or Switzerland

Under the GDPR and the UK GDPR you also have the right to:

• object to processing based on our legitimate interests, on grounds relating to your particular situation;
• restrict processing in certain circumstances, for example while a dispute about accuracy is resolved;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects — we do not carry out any such processing; and
• lodge a complaint with your national supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk). A list of EEA authorities is at edpb.europa.eu. We would appreciate the chance to resolve your concern first.

We are not established in the EU or the UK and, based on the limited scale and nature of our processing, we have not appointed an Article 27 representative. If this changes, we will name the representative here.

11.3 If you are in California

Under the California Consumer Privacy Act as amended by the CPRA, you have the rights to know, delete, correct, opt out of sale or sharing, limit the use of sensitive personal information, and not be discriminated against for exercising any of them.

We do not sell or share personal information and do not use sensitive personal information for any purpose beyond providing the Service you requested, so the opt-out and limitation rights have nothing to act on — but you may still submit a request and we will confirm this to you in writing.

Notice at collection — categories of personal information. In the preceding twelve months we have collected the following CCPA categories. We disclose each to the service providers listed in Section 7.1 for the business purposes described in Section 4. We sold or shared none of them.

Retention. We retain each category for the periods set out in Section 9.

Authorised agents. You may use an authorised agent to submit a request. We will ask for written proof of authorisation, and we may ask you to verify your identity directly.

11.4 If you are in another US state with a privacy law

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have broadly similar rights to access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and profiling. We do not carry out targeted advertising, sale, or profiling.

If we deny your request, you may appeal by replying to our decision email with the word "Appeal". We will respond to an appeal within 45 days with a written explanation. If we deny the appeal, you may contact your state Attorney General.

11.5 How to exercise your rights

Email support@russianlearning.app with what you want us to do. Please send it from the email address on your account, or tell us the account email so we can verify you.

• Verification. We verify you by confirming control of the account email address. For a deletion or access request we may send a confirmation link to that address. We do not ask for identity documents.
• Timing. We respond within 30 days (GDPR and UK GDPR), or within 45 days with one permitted 45-day extension (US state laws). If we need longer, we will tell you why before the deadline.
• Cost. Free, unless a request is manifestly unfounded or excessive — in which case we will tell you before doing anything.
• No retaliation. We will never degrade your Service, change your price, or close your account because you exercised a privacy right.

12. Children's privacy

The Service is not intended for children under 13, and we do not knowingly collect personal information from them.

• Everywhere: you must be at least 13 to create an account.
• In the EEA, the UK, and Switzerland: you must be at least 16, unless a parent or guardian consents to your use of the Service and to the processing described in this policy. Some countries set the digital consent age lower than 16 — where your country does, that lower age applies.

If you believe a child has provided us with personal information, email support@russianlearning.app. We will verify and delete the account and its data promptly.

13. How we protect your information

We take security seriously and use measures appropriate to our size and the sensitivity of the data:

• Encryption in transit — every connection to the Service uses HTTPS/TLS.
• Encryption at rest — our database and file storage encrypt stored data.
• Password handling — passwords are hashed by our authentication provider. Plaintext passwords are never stored, logged, or visible to us.
• Row-level security — our database enforces, at the database layer, that a signed-in user can read and write only their own rows. This is not left to application code.
• Secret handling — API keys for AI and payment providers are held server-side only and are never sent to your browser.
• Rate limiting — AI endpoints are rate limited to resist scraping and abuse.
• Least privilege — access to production data is limited to the operator and used only when necessary to run or repair the Service.

Two important caveats, stated honestly:

1. Saved photos are stored in public-read storage, as explained in Section 5.3. Please read that section before saving photos.
2. No system is perfectly secure. We cannot guarantee absolute security, and you are responsible for keeping your password confidential and for using a password you do not reuse elsewhere.

14. If there is a data breach

If a breach affecting your personal data occurs and is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it where the GDPR or UK GDPR requires, and we will notify affected users without undue delay by email to the address on the account. Our notice will describe what happened, what data was involved, what we are doing about it, and what we recommend you do.

15. Third-party links and services

The Service links to third-party sites and services, and uses the providers listed in Sections 6.2 and 7.1. When you leave our Service or interact with a third party — signing in with Google, paying through Stripe — that third party's privacy policy governs, not ours. We encourage you to read them:

• Google Privacy Policy — policies.google.com/privacy
• Stripe Privacy Policy — stripe.com/privacy
• OpenAI Privacy Policy — openai.com/policies/privacy-policy
• Supabase Privacy Policy — supabase.com/privacy
• Vercel Privacy Policy — vercel.com/legal/privacy-policy
• Resend Privacy Policy — resend.com/legal/privacy-policy

16. Changes to this policy

We may update this policy as the Service changes. When we do, we will update the "Last updated" date at the top.

If a change is material — for example, a new category of information, a new purpose, a new subprocessor that handles your content, or any change to how AI features handle your data — we will give you at least 30 days' notice by email before it takes effect, and where the law requires consent we will ask for it rather than assume it. Continuing to use the Service after a change takes effect means you accept the updated policy.

We keep prior versions and will supply one on request.

17. Contact us

Questions, requests, or complaints about privacy:

Email: support@russianlearning.app

We aim to reply to every privacy message within a few business days, and always within the statutory deadlines in Section 11.5. If you are in the EEA or the UK and you are not satisfied with our response, you may complain to your national supervisory authority.