Privacy Policy

Who we are

Loquelo is provided by LOQUELO LTD, a company registered in England and Wales (company number 17476753), registered office 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. LOQUELO LTD is the controller of the personal data described in this policy. You can reach us about anything in it at contact@loquelo.com.

We are based in the United Kingdom. People in the European Union can contact us about their data at contact@loquelo.com.

1. Information we collect

When you use Loquelo, we collect the information we need to provide the service:

• Account information: your email address and username, and your name if you sign in with Apple or Google and they pass it to us
• Your year of birth (only the year) and, if you are under 13, a parent's or guardian's email address (see Children)
• Learning progress and performance: lessons, answers, reviews, scores and awards, and how well you know each word, including the highest level each word has reached
• When you write your own answer in an exercise (fill in a gap, answer a question you hear, write down a sentence you hear, rewrite a sentence, or give a word with the same or the opposite meaning) and it is not marked fully correct, the text you wrote, with the exercise and the result. We use it only to check that we grade these exercises correctly, and delete it after 30 days
• Your ratings of lessons (thumbs up or down), if you give them. The people who write our lessons see only the totals for each lesson, never who rated it
• Notes you write on cards. Only you can see them
• Daily counts of how you use Loquelo's features: for example, how many definitions you opened, how often you tapped the speaker or the slow-speech button, the hints you viewed or bought, your likes, notes and skipped cards, how often you opened the catalogue, a draw, the shop or the reading section, and how many minutes you spent reading. We keep only the numbers for each day, never what you read, wrote or said
• Your preferences and settings, including the answers you give when you start (why you are learning, your interests, your level)
• Where you first came to Loquelo from: the campaign tags in the link you opened (for example utm_source), the website that sent you there (only its address, such as www.google.com, never the page you were on), the page you first opened and when, on Android the reference Google Play passes to an app when it is installed, and your answer to "How did you hear about Loquelo?". We use it only to learn which ways of finding Loquelo work
• Whether you opened a notification we sent you
• If you cancel a subscription, the reason you pick in the app, if you pick one
• The invite link your account was created with, your own invite links and whether they have been used, and the free months you have earned
• When you enter an invite code: a record of the attempt, with a one-way, salted hash of your IP address. We never store the address itself. We use it only to stop people guessing codes. For some shared codes we also record the same hash, without your account, each time the code is used, so one connection cannot take all of a code's places
• Subscription records: your plan, its status and renewal dates, and where you bought it. We never see your card number
• If you subscribe on our website: a record of what you agreed to when you bought the subscription (including whether you asked for your access to start at once), the plan and the price, and, if you withdraw from the contract, a record of the withdrawal and of the refund. These records carry the customer and subscription references Stripe gives us
• Reports you send us about a card or a lesson, with the technical details of the app they were sent from
• Which version of the app you last used on each kind of device (web, iPhone, Android) and your device's language setting, so that we can tell whether you have the latest update and write to you in your language
• A device token, if you turn on reminders, so that the reminder reaches your device
• Voice recordings during speaking exercises – when you tap the microphone, your speech is sent to our speech-recognition provider (ElevenLabs, a US company, see section 4) to transcribe and grade your answer. Nothing is sent until you have said yes: the first time you tap the microphone, the app asks your permission and names ElevenLabs. If you say no, you type your answers instead, and you can change your answer at any time in Account → Privacy. We keep a record of your answer and when you gave it. When a spoken answer is not marked fully correct, that record includes the text the speech recognition heard, so we can tell a misheard answer from a wrong one and fix exercises that grade too strictly; it is text only, never the audio, and it is deleted after 90 days like every answer text. We do not store your recordings ourselves, and we do not build a voice profile of you

Newsletter and waiting list

If you sign up for our newsletter or waiting list on our website, or ask for updates on our internship page, we keep your name and email address to send you news about Loquelo. You do not need an account for this. If you made a Loquelo account before October 2026, your name and email address are on the same list, so that we can tell you about Loquelo's launch in the app stores. Every email from the list has an unsubscribe link; unsubscribing, or writing to contact@loquelo.com, deletes your name and email from it. If you also have a Loquelo account with the same email address, deleting the account removes them too.

2. How we use it, and on what legal basis

• To provide the service you signed up for: your account, lessons, progress, reviews, reminders, speaking exercises and, if you subscribe, your subscription. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b))
• To keep the service secure and working, to find and fix errors, and to stop misuse of invite links and free months. Legal basis: our legitimate interests in running a secure, reliable service (Art. 6(1)(f))
• To keep payment and tax records. Legal basis: our legal obligations (Art. 6(1)(c))
• To keep a record of what you agreed to when you bought a subscription on our website, and of any withdrawal and refund, so that we can show we met our duties under consumer law and deal with any claim. Legal basis: our legal obligations (Art. 6(1)(c)) and our legitimate interest in establishing and defending legal claims (Art. 6(1)(f))
• To understand which features help learners and to decide our prices, from the daily counts of how you use Loquelo's features described in section 1. Legal basis: our legitimate interest in improving Loquelo and setting its prices (Art. 6(1)(f))
• To learn how people find Loquelo, whether our emails and notifications are useful, and why people cancel, from the records described in section 1. Legal basis: our legitimate interest in deciding where to tell people about Loquelo and in improving it (Art. 6(1)(f))
• To send news about Loquelo to people who joined our newsletter or waiting list. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time with the unsubscribe link in any of these emails or by writing to us
• To tell people who made a Loquelo account before October 2026 about Loquelo's launch in the app stores, by email. Legal basis: our legitimate interest in telling our own learners about Loquelo (Art. 6(1)(f)), under the "soft opt-in" for existing customers (in the UK, regulation 22 of the Privacy and Electronic Communications Regulations). Every one of these emails has an unsubscribe link
• To measure how Loquelo is used (product analytics), only if you are 16 or over and accept it. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time
• To measure how our ads perform and to show you relevant ads on other sites and apps ("Marketing"), only if you are 18 or over and allow it. See section 5, which also says which tools this involves and that none of them runs yet. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time
• To tell a parent that their child under 13 has an account. Legal basis: our legitimate interest, and our duty, in protecting children who use Loquelo (Art. 6(1)(f))
• To send you important messages about your account and subscription, such as a payment reminder or a change to these policies. These are not marketing: your email settings and the unsubscribe link do not stop them
• To send you marketing emails about Loquelo: a welcome email when you join, a reminder a week later and, a few days before your free access ends, an email that tells you the date, the price after it and how to subscribe. We do not send these to anyone who has told us they are under 16. Legal basis: our legitimate interest in telling our own learners about Loquelo (Art. 6(1)(f)), under the "soft opt-in" for existing customers (in the UK, regulation 22 of the Privacy and Electronic Communications Regulations). Every one of these emails has an unsubscribe link, and unsubscribing stops all of them
• To send you news about Loquelo by email if you have a Loquelo account: new courses and features, changes to Loquelo, and offers. We do not send these to anyone who has told us they are under 16. Legal basis: our legitimate interest in telling our own learners about Loquelo (Art. 6(1)(f)), under the "soft opt-in" for existing customers (in the UK, regulation 22 of the Privacy and Electronic Communications Regulations), or your consent (Art. 6(1)(a)) where you gave it by turning these emails on yourself. You can turn them off at any time in Settings → Notifications or with the unsubscribe link in any of these emails (Art. 21(2) and (3)); turning them off does not stop the messages your account needs
• To send you push notifications from our server: practice reminders, new lessons and announcements (marketing, only if you are 16 or over), and notices about your account, such as your free access ending. Nothing is sent unless you turn these notifications on in the app, and announcements need a separate yes. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time in the app's notification settings or your device's settings

We do not sell your data, we use it for advertising only if you allow Marketing (section 5), and we do not make decisions about you that have legal or similarly significant effects by automated means. Loquelo adapts lessons to your answers; that is how the service works, not a decision about you.

3. Data security

We use appropriate technical and organisational measures to protect your personal data from unauthorised access, alteration, disclosure or destruction. Data is encrypted in transit and at rest, and access to it is limited to the people and systems that need it.

4. Who we share it with

We use a small number of service providers. Each acts as our processor, under our instructions and a data-processing agreement, unless we say otherwise below. Your account and learning data are stored in the European Union. Some of the services below are US companies that process data outside the EU: ElevenLabs receives your voice recordings when you use a speaking exercise, the lesson text it turns into the audio you hear, and, because live speech recognition connects straight from your device, your IP address, and it processes them on its servers in the United States; Cloudflare Turnstile sees your IP address at the moment you submit a protected form; RevenueCat receives your account identifier and store purchase history; and Microsoft delivers our website and web app through its global network, so it receives your IP address and browser details when you load a page, wherever its nearest server is. None of these providers receives your learning progress except Microsoft, which hosts it for us in the EU.

• Microsoft Azure (Microsoft Ireland Operations Limited) – our backend: it hosts, in the European Union (Ireland), the database that stores your account and learning progress, the servers that run the app, and the files and audio it uses. This is where the data described in section 1 lives
• Microsoft Entra External ID (Microsoft Ireland Operations Limited, data held in the European Union) – runs our email-and-password sign-in. It holds your email address and a securely hashed form of your password, never the password itself, and checks them when you sign in
• Google Authentication and Sign in with Apple (optional sign-in methods) – governed by Google's and Apple's own privacy policies. When you use one, Google or Apple confirms who you are and we check that confirmation ourselves; for Sign in with Apple we keep a token Apple gives us, so that deleting your account also disconnects Loquelo from your Apple ID
• Cloudflare Turnstile (Cloudflare, Inc., United States) – the bot check on the sign-up, sign-in and password-reset forms, and on the newsletter and internship forms on our website. It receives your IP address and basic browser signals to tell a person from a script. It is not used for advertising and does not track you across sites
• Microsoft Azure Communication Services (Microsoft Ireland Operations Limited, data held in the European Union) – sends our email: your address is used to send the verification, password-reset, reminder and billing messages you have asked for or that your account needs, and the marketing emails described in section 2
• ElevenLabs (ElevenLabs, Inc., United States) – speech services: when you use a speaking exercise, your voice recording is sent to ElevenLabs' servers in the United States to be transcribed, and lesson text is sent to generate the audio you hear. Live speech recognition connects from your device straight to ElevenLabs, so it also receives your IP address. Recordings are processed to grade your exercise, not to identify you
• Microsoft Azure Static Web Apps – delivers our website and the web version of the app through Microsoft's global network; it receives your IP address and browser details when you load a page
• Apple Push Notification service and Google Firebase Cloud Messaging – deliver the reminders you turn on in the app. They receive a device token, not your learning data
• Stripe (Stripe, Inc. and its group companies) – takes payment if you subscribe on our website. We never see your full card number. Stripe also uses payment data for its own fraud prevention and legal obligations, as an independent controller under its own privacy policy
• Apple (App Store) and Google (Google Play) – if you subscribe in the iPhone or Android app, you buy from Apple or Google, not from us. They take the payment and handle your billing details as independent controllers under their own privacy policies. They tell us, through RevenueCat, which subscription is active on your account; they do not give us your card details
• RevenueCat (RevenueCat, Inc., United States) – manages App Store and Google Play subscriptions for us. It receives your Loquelo account identifier, your store purchase and renewal history, and basic app and device information, so that we know whether your subscription is active on every device you use, and so that we can move a renewal date back when you earn a free month
• Sentry (Functional Software, Inc., EU data region) – error and crash reporting, so we can find and fix defects; see section 5
• PostHog (PostHog, Inc., EU Cloud) – product analytics and session replay, and only if you are 16 or over and accept it; see section 5
• YouTube (Google Ireland Limited) – our website shows a video hosted on YouTube. Nothing is loaded from YouTube until you press play. When you do, the player loads from youtube-nocookie.com, and Google receives your IP address and browser details and may store data on your device, as an independent controller under Google's own privacy policy

Some of these providers are in the United States or can reach data from there. When personal data is transferred outside the UK or the European Economic Area, we protect it with one of these safeguards: the EU-US Data Privacy Framework and its UK Extension, where the provider is certified under it; or the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum for data from the UK. You can ask us for a copy of the safeguards that apply.

We may also disclose data where the law requires it, or to protect the rights and safety of our learners. If LOQUELO LTD or its business were ever transferred to another company, your data would pass to it only under the same protections, and we would tell you first.

5. Cookies, local storage & measurement

Loquelo uses cookies and browser storage that are strictly necessary to deliver the service:

• Authentication tokens to keep you signed in
• Local preferences you set yourself (theme, learning language, immersion mode, tutorial progress, haptic feedback)
• Offline cache (PWA service worker) so the app works without a connection
• Your privacy choices themselves (your answers on analytics and on marketing, and whether you allowed voice recognition by ElevenLabs) – kept in browser storage and, for signed-in users, on your account so they follow you across devices

Error monitoring (always on). When the app crashes or hits a technical error, a report is sent to Sentry (EU data region) so we can fix it. These reports contain technical context – device model, operating system, app version and what went wrong – and, if we know you are 13 or over, your account identifier (a random ID), so we can tell whether one person keeps meeting the same error. For an account under 13, or whose age we do not know yet, no account identifier is sent. We do not include your email or name, and IP addresses are not stored. Legal basis: our legitimate interest in keeping the service secure and working.

Anonymous counts. We count how many people open pages of our website and tap its buttons, and how many come back to Loquelo from one of our emails or notifications, together with the kind of site that sent them (for example a search engine). Each count is a number for the day and nothing more: it holds nothing that identifies anyone, and nothing is stored on your device for it. Legal basis: our legitimate interest in knowing how people find Loquelo (Art. 6(1)(f)).

Product analytics. If you are 16 or over and accept it, we send usage events (for example "lesson completed") to PostHog (EU Cloud), so we can see which parts of Loquelo work well and which don't. Once you sign in, these events are linked to your account identifier (a random ID, never your email or name). We ask once, the first time you open the app or visit the site, and Loquelo works exactly the same whether you accept or decline – declining costs you nothing. Until you accept, nothing is sent and the analytics code is never even downloaded. You can change your mind at any time in Account → Privacy. With the same consent we record how you use the app (session replay): what you tap and what is on your screen, so we can find what confuses learners or breaks. Everything you type is hidden in the recording and email addresses are blanked out; recordings are kept for 30 days. A consent you gave before 27 October 2026, when we added recording to this notice, does not turn it on: you have to accept again. With the same consent, we may sometimes show two versions of a screen to different learners to see which works better; without it, you always see the usual one. Legal basis: consent, withdrawable at any time.

Marketing (off unless you allow it). If you are 18 or over and allow Marketing, we may use advertising tools from Google (Google Ads and Google Analytics), Meta (Facebook and Instagram) and TikTok, to measure how our ads perform and to show you relevant ads on other sites and apps. If you have an account, this can include giving these platforms a coded (hashed) version of your email address so they can match it to their own users; they do not receive the address itself. None of these tools runs yet: until we switch one on, the Marketing choice only records your answer, and we will update this section before any of them starts. We never offer Marketing to anyone we know to be under 18, whatever they choose. Declining costs you nothing, and you can change your mind at any time in Account → Privacy, or through "Privacy choices" at the bottom of our website. Legal basis: consent, withdrawable at any time.

The YouTube video on our website loads nothing from YouTube until you press play (see section 4).

6. How long we keep it

• Your account, progress, settings, lesson ratings, card notes, daily feature-use counts and reports: for as long as your account exists. They are deleted when you delete your account
• Your invite links are not deleted with your account, because the friends who joined through them keep what they received. When you delete your account, the links no longer point to it, and a link nobody has used yet stops working
• Records of attempts to enter an invite code, with the hashed IP address: deleted once they are two days old, the next time anyone enters a code. If you delete your account, they are kept until then without any link to it
• Records of a shared code being used from a hashed IP address (no account attached): deleted once they are 31 days old, the next time anyone uses a code
• The text of your answers to exercises is deleted after 90 days, including what the speech recognition heard when a spoken answer was not marked fully correct. The text you write in the exercises where you write your own answer (see section 1) is deleted after 30 days. Whether you answered, and whether it was right, stays with your progress
• Records of your use of our paid speech services, kept to control costs: 90 days
• Where you first came to Loquelo from, your answer to how you heard about it, and whether you opened our notifications: for as long as your account exists. They are deleted when you delete your account
• The reason you gave for cancelling: kept after you delete your account, but without any link to it
• When your account was started, when you saved it and when your email was confirmed: kept after you delete your account, but without any link to it, so our counts of how many people joined do not change after the fact
• Voice recordings: we do not keep them. ElevenLabs processes them to return a transcript and keeps them only as long as its data-processing terms with us allow
• A parent's email address: for as long as the child's account exists
• Payment and subscription records, including what you agreed to when you bought a subscription and any withdrawal from the contract: for as long as tax and accounting law requires (in the UK, six years after the end of the financial year they belong to). They are not deleted when you delete your account. From then on they no longer point to your Loquelo account, but they keep the customer and subscription references Stripe gave us, which Stripe can link to your name and email
• Your name and email on our newsletter or waiting list (including accounts made before October 2026): until you unsubscribe or ask us to remove them, or delete a Loquelo account that uses the same email address
• Your email choices, including whether product news and offers emails are on, on which basis, and when you turned them off: for as long as your account exists, so that a choice to stop is kept. They are deleted when you delete your account
• Backups of our database: up to 60 days, after which they are deleted
• Error reports (Sentry) and, if you accepted analytics, usage events (PostHog): for the retention period of each service, and never with your email or name. Session recordings (PostHog): 30 days

You can delete your account at any time. What is deleted, and what is kept afterwards, is set out at www.loquelo.com/delete-account.

7. Your rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Export your data
• Object to or restrict how we use your data
• Object at any time to our use of your data for direct marketing (GDPR Art. 21(2)). If you do, we stop (Art. 21(3)). For email, the unsubscribe link in any of our marketing emails does this, and so does turning news emails off in Settings → Notifications; for push notifications, switch them off in the app or your device's settings; or write to us
• Withdraw your consent where we rely on it, at any time and without affecting what was done before
• Complain to a data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the authority where you live (in Poland, the Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl)

You can download a copy of your data at any time under Account → Download my data, and delete your account under Account → Delete account. For anything else, write to us; we answer within one month.

Children

Loquelo can be used at any age. We ask for your year of birth when you create an account, and keep only the year.

• If you tell us you are under 16, analytics is switched off and cannot be switched on, and we send no marketing emails and no marketing push notifications. The app itself shows when your free access ends and the price after it.
• If you are under 13, we also ask for a parent's email address and tell that parent that the account exists, what Loquelo does, and how to have it deleted. A parent can ask us to delete the account at any time by writing to us from that address.
• Lessons, progress and settings are processed to provide the service the account was created for, and for nothing else.
• Nothing a learner does in Loquelo is shown to other learners.

If you are a parent and have a question about your child's account, write to contact@loquelo.com.

8. Changes to this policy

We may update this privacy policy from time to time. We post the new version on this page and update the "Last updated" date, and if a change matters to you, we tell you by email or in the app before it takes effect.

9. Contact us

If you have any questions about this privacy policy or our data practices, please contact us at contact@loquelo.com.