Privacy Policy

1. Introduction

Fluexo ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application ("App").

Fluexo is an English language learning application that helps users build vocabulary, master grammar, and improve reading comprehension through spaced repetition and interactive exercises.

By using the App, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use the App.

2. Data Controller

For any privacy-related questions or to exercise your data rights, please contact us at the email address above.

3. Data We Collect

3.1 Information You Provide

Data Type	Examples	Purpose
Account Information	Email, name (via email registration, Apple Sign-In, or Google Sign-In)	Account creation & authentication
Anonymous Account Identifier	A randomly generated user UUID created on first launch (Supabase anonymous auth) so your progress can be saved to our servers before you sign up. Lawful basis: legitimate interest (Article 6(1)(f) GDPR) — necessary to provide cross-reinstall progress recovery once you link an account. No email, name, or other identifier is collected at this stage.	Cloud sync of progress for guest users; preserved across app sessions
Device Identifier	A UUID generated on first launch and stored in the iOS Keychain / Android Keystore. Survives app uninstall on the same device.	Content preview eligibility, abuse prevention, optional progress recovery after reinstall
Vocabulary Progress	Words learned, quiz scores, SRS review data	Core app functionality
Grammar Progress	Completed topics, quiz results, lesson history	Core app functionality
Story Progress	Read stories, comprehension scores	Core app functionality
Preferences	Language, notification settings, TTS accent (US/UK), daily goal	Personalization

3.2 Information Collected Automatically

Data Type	Examples	Purpose
Device Information	Device model, operating system version	App functionality & support
Usage Data	Daily study time, session duration, streak data	App improvement & gamification
Advertising Identifiers	IDFA (only with your explicit consent via ATT prompt)	Personalized advertising (free users only)
IP Address	Your IP address, collected automatically by server infrastructure	Security, fraud prevention & analytics
Device Identifiers	Anonymous device IDs generated by RevenueCat and ad services	Subscription management & ad attribution

3.3 Information We Do NOT Collect

3.4 Speech recognition

Optional speaking exercises require microphone permission and, on iOS, Apple Speech permission. Apple Speech and Android speech services (such as Google) process audio on your device when supported; otherwise their servers may process it according to the provider’s policies. Fluexo does not store audio, upload it to its servers, or send transcripts to analytics. Transcripts are used temporarily on your device to check the exercise and are discarded when it closes. Only exercise outcome counts may enter analytics. You can disable speaking in Settings, choose listening, or revoke permission in device settings.

3.5 Public leaderboard display name

You choose the public display name shown with your rank and score on the Arena leaderboard. This is separate from your sign-in name and email. You can opt out of leaderboard display in Settings. Other users can report or block names using the ⋯ button or a long press on a leaderboard row; reports are reviewed for moderation. Do not include private information in your public name.

4. How We Use Your Data

• Provide Core Service: Track your vocabulary, grammar, and reading progress across the Learn Path
• Spaced Repetition: Schedule word reviews at optimal intervals based on your performance
• Sync Data: Keep your learning progress synchronized across devices when signed in
• Send Notifications: Remind you about daily study goals and streak maintenance (with your permission)
• Process Subscriptions: Handle premium subscription transactions via the App Store
• Display Advertisements: Show ads to free-tier users via Google AdMob
• Improve the App: Analyze anonymized usage patterns to enhance features and fix issues
• Customer Support: Respond to your inquiries and requests

5. Legal Basis for Processing

Under GDPR Article 6

Processing Activity	Legal Basis
Account creation & authentication	Contract performance (Art. 6(1)(b))
Vocabulary, grammar, story tracking	Contract performance (Art. 6(1)(b))
Spaced repetition scheduling	Contract performance (Art. 6(1)(b))
Push notifications	Legitimate interest (Art. 6(1)(f))
Advertising (personalized)	Consent (Art. 6(1)(a))
Analytics & app improvement	Consent (Art. 6(1)(a))
Subscription processing	Contract performance (Art. 6(1)(b))

6. Advertising & Tracking

Fluexo displays advertisements to free-tier users through Google AdMob. Here is how advertising and tracking work in our App:

6.1 App Tracking Transparency (ATT)

On iOS 14.5 and later, we request your permission via Apple's App Tracking Transparency framework before collecting your Identifier for Advertisers (IDFA). You can choose to:

• Allow Tracking: You will see personalized ads relevant to your interests
• Deny Tracking: You will see non-personalized (contextual) ads only. The IDFA will NOT be collected.

You can change your tracking preference at any time in your device Settings > Privacy & Security > Tracking.

6.2 SKAdNetwork

We use Apple's SKAdNetwork for privacy-preserving ad attribution. This does not identify you personally.

6.3 Premium Users

Premium subscribers do not see any advertisements. No advertising identifiers are collected from premium users.

7. Third-Party Services

We use the following third-party services to operate our App. Each service provider maintains its own privacy policy and provides data protection that meets or exceeds the standards described in this policy:

Service	Purpose	Data Shared
Supabase	Backend infrastructure & authentication	Account data, learning progress
Google AdMob	Advertising (free users only)	Device ID, IDFA (with consent), ad interactions
RevenueCat	Subscription management	Purchase data, anonymous user ID
Apple Sign-In	Authentication	Email (optional/private relay), name
Google Sign-In	Authentication	Email, name, profile photo
Apple Text-to-Speech	Word and sentence pronunciation	None (on-device processing via AVSpeechSynthesizer)
PostHog	Opt-in product analytics to understand feature use and improve the app	Pseudonymous user/device identifiers, app and device metadata, feature usage events and exercise outcome counts; no audio or speech transcripts
Sentry	Crash reporting and diagnosing reliability problems; can be disabled in Settings	Crash stack traces, error details, app/device versions and diagnostic breadcrumbs; screenshots are disabled and personal data is scrubbed
Firebase Cloud Messaging (Google)	Delivering streak and study reminder push notifications through FCM/APNs, subject to notification permission and settings	Push registration tokens, device/platform information and notification payloads
AppsFlyer	Install attribution and campaign measurement; enabled only when both analytics and ads consent are on	Install/campaign and ad interaction data, app/device metadata, pseudonymous identifiers and IDFA only after ATT authorization on iOS

All third-party services listed above are contractually bound to protect your data and may only use it for the purposes described. Text-to-Speech is powered by Apple's built-in speech synthesis (AVSpeechSynthesizer) and processes audio entirely on your device — no data is sent to external servers for this feature.

8. Data Storage & Security

8.1 Where We Store Data

Your data is stored on Supabase cloud infrastructure (hosted on AWS). Local data (learning progress, preferences) is stored on your device using MMKV local storage. Sensitive authentication data is managed by Supabase's secure session system.

8.2 Security Measures

• All data transmitted using TLS 1.3 encryption (HTTPS)
• MMKV local storage on your device for non-sensitive learning data
• Row-Level Security (RLS) policies on all database tables
• Secure password hashing for email accounts; OAuth authentication available via Apple/Google
• Access controls and authentication for all backend systems
• Regular security reviews of our infrastructure

9. Data Retention

Data Type	Retention Period
Account data	Until account deletion
Learning progress (words, grammar, stories)	Until account deletion
Streak & gamification data	Until account deletion
Subscription records	7 years (legal requirement)
Local device data	Until app uninstall or manual reset

After account deletion, your personal data is permanently removed from our servers within 30 days, except where retention is required by law (e.g., financial records).

10. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

Right	Description	How to Exercise
Access (Art. 15)	Request a copy of your personal data	Settings > Download My Data
Rectification (Art. 16)	Correct inaccurate personal data	Settings > Account
Erasure (Art. 17)	Delete your account and all associated data	Settings > Delete Account
Portability (Art. 20)	Receive your data in machine-readable format (JSON)	Settings > Download My Data
Restrict Processing (Art. 18)	Limit how we process your data	Contact us via email
Withdraw Consent	Revoke previously given consent at any time	Settings or contact us
Lodge Complaint	Complain to a supervisory authority	Your local Data Protection Authority

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

11. California Privacy Rights (CCPA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You can request information about the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You can request deletion of your personal information, subject to certain legal exceptions.
• Right to Opt-Out: You can opt-out of the sale of your personal information. Note: We do not sell your personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise these rights, contact us at [email protected] or use the in-app "Delete Account" feature.

12. Children's Privacy

Our App is not intended for children under 13 years of age (or 16 in certain EU jurisdictions). We do not knowingly collect personal information from children under 13.

As an additional safety measure, analytics are disabled by default in our App and require explicit user consent to enable.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at [email protected] and we will promptly delete such information from our systems.

13. International Data Transfers

The App is operated from Turkey. Your data may be transferred to and processed in Turkey and other countries where our service providers (Supabase, Google, Apple, RevenueCat, PostHog, Sentry, AppsFlyer) maintain infrastructure.

For transfers from the European Economic Area (EEA) to countries outside the EEA, we rely on Standard Contractual Clauses (SCCs) and adequacy decisions where applicable to ensure an adequate level of data protection.

By using the App, you acknowledge that your data may be processed in jurisdictions outside your country of residence.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the new policy on this page
• Updating the "Last updated" date at the top
• Sending an in-app notification for significant changes

Your continued use of the App after changes are posted constitutes your acceptance of the revised policy.

15. Contact Us