Privacy Policy

• Phone number — required to create an account and verify your identity via one-time password (OTP).
• Display name — chosen by you during onboarding or in settings.
• Profile picture — optional image you upload; stored on Amazon Web Services (AWS) S3.
• About text — an optional short bio visible to your contacts.

With your permission, Langu reads the phone numbers stored in your device's contacts list and sends them to our servers to identify which of your contacts also use Langu. Phone numbers that do not match a Langu account are used only for this matching process, are discarded immediately afterwards, and are never stored. We retain only the phone numbers of contacts who are Langu users so we can show them to you as suggested connections. You can decline contacts access and still use the app.

Before a text message is accepted, Langu applies automated, on-server rules designed to reject a narrow set of high-confidence threats, self-harm encouragement, and sexual solicitation. This check runs within Langu's own service and does not send the message to an additional third party. A rejected message is not published to the conversation.

If you block another user, we store that block so we can prevent further direct interaction. If you report a user or human-authored content, we store the selected reason, optional note, the reported user or message identifiers, and—when a specific message is available—a snapshot of only that reported item, limited to 4,000 characters. We do not copy unrelated conversation history into the report.

If you report an AI-generated output, we store the selected reason, the applicable AI feature, a snapshot of only the reported output limited to 4,000 characters, and limited output/request identifiers, provider/model information, app version, and platform when available. Human operators use reports to review possible violations and to inform justified filtering, prompt, or provider changes; reports are not used for automatic model retraining or automatic legal decisions.

We also keep the case status, priority, outcome, timestamps, operator actions, a bounded external-reference identifier for a manual child-safety escalation when applicable, and privacy-safe notification-delivery records. Notification payloads do not contain report notes or evidence.

All messages you send and receive through Langu are stored on our servers to provide the chat service, enable message delivery to recipients who are temporarily offline, and support real-time translation. A message stays on our servers for as long as the chat it belongs to exists unless its sender deletes it for everyone during the app's 48-hour window or account erasure replaces the sender's authored content with the normal deleted-message placeholder. Managed copies in the Langu app synchronize that authoritative deleted state; screenshots, downloads, exports, or other independent copies outside Langu's control may remain.

Langu lets you record and send voice messages. With your permission, the app uses your device's microphone to record audio while you hold the record button. You can decline microphone access and keep using the rest of the app — only recording is disabled. Here is exactly what happens to a recording:

• It is uploaded and stored. When you send a voice message, the audio file is uploaded to our media storage (Amazon S3) and kept there so the people in the chat can play it. Recordings are limited to 10 minutes and 10 MB. Playback uses a long, randomly generated link that is not listed or indexed anywhere — but anyone who obtains that link can play the recording.
• It is transcribed when a recipient unlocks it. A voice message is not transcribed automatically. If a recipient chooses to unlock the transcript, we send the audio file to OpenAI, which converts the speech to text. We store the resulting transcript on our servers and reuse it for anyone else in the same chat who unlocks the same recording, so the audio is sent for transcription only once.
• The transcript is translated. The transcript is then sent to Google Cloud Translationto be translated into the recipient's learning language for that chat. Transcripts and their translations are stored on our servers so the same text is not sent to the provider again.
• We record who unlocked what.We store which of your voice messages each user has unlocked and when, so a repeat unlock is free and does not consume the user's quota.
• Deletion.Deleting a voice message for everyone — which the app allows the sender to do for 48 hours after sending — deletes the audio file from our media storage, together with its stored transcript and translations. That removal completes within 30 days, including residual copies in our backups. Managed Langu app records synchronize the deletion; independently saved copies outside Langu's control may remain.

We do not use your recordings, transcripts, or messages to train AI or speech models, and we do not use them for advertising or profiling.

We store your chosen interface language, your fluent language, and fluency signal data (e.g. messages read and written per day) to provide the fluency tracking and progress features. When available, we send your device's IANA time-zone name (for example, a region/city zone) when you create a direct or connected-platform chat and store it on that chat so streak days follow local calendar boundaries. If the device cannot provide a time-zone name, the server stores UTC instead. We do not use the time-zone name to determine your physical location. Language and fluency data is retained as long as your account exists; the chat's time-zone setting is retained for the chat's lifetime and may remain on an archived shared chat without a link to your deleted account.

We collect your device's Expo push notification token to send you message notifications. This token is associated with your account and updated each time you log in. When you are offline and a message arrives, the notification we send through the Expo Push Notification Service contains the sender's display name and the text of the message, so that it can be shown on your lock screen. You can disable notifications at any time in your device settings.

If you purchase a Plus or Pro subscription or a boost pack, we record your subscription tier, purchase date, expiry date, and usage quotas. For mobile purchases, RevenueCat receives purchase history and an account-linked opaque customer identifier so it can validate receipts, provide subscription entitlements, and produce purchase analytics. Payment processing is handled by Stripe or the Apple App Store / Google Play — we do not store your card number, bank details, or any payment instrument data.

Our servers automatically log standard technical information when you use the app, including IP address, device platform (iOS or Android), and timestamps of API requests. This data is used for security, fraud prevention, and debugging.

The mobile app sends crash reports, performance measurements, and technical diagnostics to Sentry. These events can include your internal Langu user ID, app and device metadata, error stack traces, and the names and timing of app screens or API operations. We apply filtering to JavaScript reports to remove authentication values, request and response bodies, and chat content, and disable default PII collection, screenshots, and view-hierarchy capture. These filters do not guarantee that native crash reports contain no personal information.

Starting with app version 1.0.5, builds with Expo Observe enabled also send diagnostics to Expo: app and device metadata, installation and session identifiers, screen names and navigation timing, startup and native performance measurements, unexpected errors, and native crash reports. Events may be stored temporarily on your device and sent in batches when connectivity permits.

Observe receives raw error messages, stack traces, and native crash reports without the JavaScript redaction applied to Sentry. If personal information appears in an error or crash report, it may therefore be included. We filter navigation parameter values and do not intentionally add message text, chat or user identifiers, file paths, or upload URLs to our custom performance events; this does not make all diagnostic reports anonymous or guarantee that incidental personal data is removed.

Our custom events measure local-storage startup, media-upload duration and outcome, and chat loading, duration, and message counts. If enabled for a sampled Android installation, additional numeric memory and resource measurements help investigate slowdowns; these are not recordings of the screen or copies of messages. We do not enable session replay. Collection and delivery vary by app version, platform, and diagnostic configuration. Notification permission and AI content-sharing settings do not control these diagnostics. To object to or request restriction of this processing, contact us using the details in Section 8.

• Your account record: phone number, display name, profile-picture reference, and about text.
• The text, translations, captions, transcripts, photos, and voice recordings you authored are removed for all participants through the normal deleted-message placeholder. Uploaded files are queued for deletion from our storage within the same original deadline.
• Your saved contact matches — the Langu users we had linked to your account.
• Your language settings, fluency signals, and progress data, including the grammar explanations and conversation suggestions generated for you.
• Your push notification token, so no further notifications can be sent to you.
• Your record of which voice messages you had unlocked.
• Links from moderation reports to your deleted account. The case and action audit metadata may remain for safety and legal accountability without your account profile; the bounded evidence follows the 90-day expiry or legal-hold rule above.
• The AI writing corrections and translation revisions saved alongside your messages — both the ones you applied yourself and the ones someone else applied to a message you wrote — together with any suggestions that were previewed but never applied, whoever asked for them.
• Your billing and subscription records held by Langu. We attempt to cancel any active Stripe subscription as part of deletion and submit the account-linked RevenueCat customer for provider deletion; contact support if billing continues. Apple and Google subscriptions remain managed through those stores.

• Conversation shells and other participants' own content. Direct chats may be archived, and group ownership may pass to the longest-standing remaining member, but your authored messages are content-free tombstones. Other participants keep messages they authored themselves.
• The chat's streak time-zone setting. It may remain on an archived shared chat without a link to your deleted account so the remaining participants keep the same streak calendar.
• Copies outside Langu's control.Managed records in the Langu app converge to content-free deleted-message placeholders when they synchronize. We cannot remove screenshots, downloads, exports, or other independent copies another person created outside Langu's control.
• A deletion audit record. We keep the deletion timestamps and a one-way cryptographic hash of your phone number — not the number itself — as proof that the deletion was carried out.
• AI processing cost records. The internal records of what the translation and AI features cost us are kept for accounting, with your user and chat identifiers removed so they no longer identify you.
• Payment records held by payment providers.RevenueCat, Stripe, the Apple App Store, and Google Play may keep transaction records under their own policies and legal obligations. Langu's account-linked RevenueCat customer is submitted for deletion, but we do not claim that provider or store records follow Langu's retention schedule.