Lingmah — Privacy Policy

Last updated: 21 July 2026. Lingmah is operated by the Lingmah team ("we", "us"). Contact: support@lingmah.com. See also our Terms, Competition Rules, and lingmah.com.

This document is a plain-language policy provided for transparency and App Store submission. It is not legal advice; have it reviewed by a qualified lawyer before public release, especially for Kazakhstan (Law "On Personal Data and its Protection") and, if you serve EU/UK users, the GDPR/UK GDPR.

1. What we collect

• Phone number — for sign-in via a one-time SMS code (optional; the app can be used as a guest).
• Email address — if you choose to sign in with email instead of SMS. We store the address and a securely hashed password; we never store your password in readable form.
• Profile — the name/nickname you enter, chosen native language, English level, and avatar color.
• Learning data — your word lists, practice results, XP, levels, streaks, mastery progress, mission/season progress, placement-test results, and battle/class activity.
• Audio — for Speaking practice and the placement test, short voice recordings you choose to make are sent to a speech-to-text service to score your answer. They are processed to produce a transcript and are not used to identify you.
• Purchases — your subscription/entitlement status (managed by the app stores and RevenueCat). We never receive your card number.
• Device & usage — device language (to choose the UI language), device region (to pick a sensible sign-in method and default learning language), app version, and basic in-app activity needed to run features (e.g. notification preferences). We do not sell your data or use it for third-party advertising.
• Competition integrity — when you take part in a prize competition we record a device identifier and your learning history so we can detect multi-accounting, automation, and other cheating. This is how we keep prize competitions fair, and it is the basis on which a winner is verified before a prize is sent. We rely on our legitimate interest in preventing fraud; if you do not want this processing, do not enter competitions — the rest of the app works without it.

2. How AI is used

Lingmah generates learning content (definitions, examples, exercises, reading/listening/writing/speaking tasks) and grades some answers using third-party AI providers. To do this, the word or your answer text/audio is sent to those providers to produce the result. AI-generated content is a learning aid and may contain mistakes; it is not authoritative.

3. Service providers (processors)

We share the minimum data needed with:

• Supabase — authentication, database, and backend hosting.
• Anthropic and OpenAI — AI content generation, text-to-speech, and speech-to-text.
• Twilio — sending the SMS verification code.
• RevenueCat, and Apple / Google — processing and validating subscriptions.

These providers process data on our behalf under their own security and privacy terms.

4. International transfers

Some providers process data on servers outside Kazakhstan (including the United States and the EU). By using Lingmah you understand your data may be processed in those countries under appropriate safeguards.

5. Retention & your rights — including deletion

We keep your data while your account is active. You can delete your account and personal data at any time from Profile → Settings → Delete account in the app; this permanently removes your profile and personal learning data. Some records required for financial or fraud-prevention reasons (e.g. that a promo code was redeemed) may be retained in anonymized form. You may also request access, correction, or deletion by emailing support@lingmah.com.

6. Children & students

Lingmah is an educational app used by students. It is not directed to children under the age required for consent in their country (for example, under 13 in some regions, or under 16 in parts of the EU) without appropriate parental/guardian or school consent. If you are below that age, use Lingmah only with the consent and supervision of a parent, guardian, or school. If you believe a child has provided personal data without proper consent, contact us and we will delete it.

7. Security

Data is protected in transit and at rest, access to backend data is restricted per-user by row-level security, and privileged operations run only on our servers. No system is perfectly secure, but we work to protect your information.

8. Changes

We may update this policy; material changes will be reflected here with a new date.

9. Contact

support@lingmah.com