Privacy Policy

Last updated: July 15, 2026

This Privacy Policy explains how Lingo Mark ("Lingo Mark", "we", "us", or "our") collects, uses, stores, and shares information when you use the Lingo Mark web application and browser extension (together, the "Service").

By using the Service you agree to this Policy. If you do not agree, please do not use the Service.

1. Who we are

Lingo Mark is an English-learning tool that lets you clip web pages, highlight and collect vocabulary, and study words in context. It consists of a web application and a companion browser extension.

For any privacy question or to exercise your rights, contact us at privacy@lingomark.app.

2. Information we collect

We only collect what the Service needs to work. We do not sell your personal information, and we do not use it to serve advertising.

2.1 Account information

When you create an account we store:

• Your email address (used to sign in, verify your account, and contact you).
• Your name and profile picture, if you sign in with Google (provided by Google) or set them yourself. These are optional.
• A hashed version of your password if you register with email and password. We never store your password in plain text.
• Whether your email has been verified, and your current plan (Free, Plus, or Pro).

If you sign in with Google, Google returns your basic profile (email, name, profile picture) and we store the authorization tokens needed to keep you signed in. We request only basic profile and email scopes.

2.2 Content you create and clip

The core purpose of the Service is to save and study content you choose. We store:

• Wordbooks and word entries you create — the word, its lemma, phonetic transcription, and a snapshot of the built-in dictionary definition at the time you collect it.
• Example sentences you collect — the sentence text captured from the page and the source URL of the page it came from.
• Clipped reading materials — the page title, the source URL, and a one-time snapshot of the page's main article text (stored as Markdown) so you can read and mark it later inside Lingo Mark.
• Annotations — the text you highlight, your notes, and a small amount of surrounding text used to locate the highlight.
• Your settings — highlight preferences, custom external-dictionary lookup URLs you add, and their ordering.

Important: when you clip a page or collect a word, we save the URL and the text you clipped. Only clip content you are entitled to save for personal study (see the Terms of Service).

2.3 API keys and share links

• If you connect the browser extension, we generate a personal API key. We store only a cryptographic hash of the key plus its last four characters for display — never the full key. The full key is shown to you once, at creation.
• If you create a share link for a material, we store an unguessable token so anyone with the link can view that material read-only. You can disable a share link at any time.

2.4 Technical and usage information

• Session cookies / tokens to keep you signed in.
• IP address, sent to our bot-protection provider (see §4) when you sign in or register with email and password, to detect automated abuse.
• Aggregate, privacy-friendly usage analytics (page views and performance) via Vercel Web Analytics, which does not use tracking cookies and does not build cross-site profiles of you.

2.5 What the browser extension accesses

The extension can run on any page you visit (it requests broad host access so it can work wherever you read). However, it only sends data to us when you take an explicit action:

• Clipping a page sends that page's title, URL, and main article text to your Lingo Mark account.
• Collecting a word sends the selected word, the sentence around it, and the page URL to your account.

The extension does not silently track your browsing, does not read pages in the background, and does not send us your history. Your API key is stored only in the browser's local extension storage and is never exposed to the pages you visit.

3. How we use your information

We use your information to:

• Provide the Service — authenticate you, store your wordbooks, materials, and annotations, and let you study them.
• Send transactional email such as email-verification messages.
• Enforce plan limits and, in the future, manage paid subscriptions.
• Protect the Service against fraud, abuse, and automated attacks.
• Maintain, debug, and improve the Service.

We rely on the following legal bases (where GDPR applies): performance of a contract (providing the Service you signed up for), legitimate interests (security and improving the Service), consent (where required), and compliance with legal obligations.

4. Service providers (subprocessors)

We share limited data with trusted providers who process it on our behalf:

We do not use any AI or large-language-model service, and your content is not sent to any AI provider.

5. Payment

Paid plans (Plus and Pro) are sold through Creem, which acts as the merchant of record — the seller of record for the transaction. When you subscribe, checkout and recurring billing happen entirely on Creem's hosted pages; we never receive or store your card number or other payment details. Creem sends us only what we need to activate and manage your subscription — your email and subscription/order metadata (plan, status, billing period, and identifiers) — via a secure webhook. You can manage or cancel your subscription anytime through Creem's customer portal. Creem's handling of your payment data is governed by Creem's own privacy policy and terms.

6. Data retention

We keep your account and content for as long as your account exists. If you delete specific content (a word, material, or annotation), it is removed from our active systems. If you delete your account, we delete your personal data and content, except where we must retain limited records to comply with law or resolve disputes. Backups are purged on a rolling basis.

7. Data security

We protect your information with measures including encryption in transit (HTTPS), password hashing, storing only hashed API keys, and access controls. No system is perfectly secure, but we work to safeguard your data.

8. International data transfers

The Service is operated using infrastructure that may be located outside your country, including the United States. Where we transfer personal data across borders (for example, from the EEA/UK or from China), we rely on appropriate safeguards required by applicable law. By using the Service you understand that your information may be processed in these locations.

9. Your rights

Depending on where you live, you have rights over your personal information. We honor these for all users regardless of location:

• Access — get a copy of the personal data we hold about you.
• Correction — fix inaccurate data (you can edit most of it in Settings).
• Deletion — delete your content or your entire account.
• Portability — receive your data in a usable format.
• Object / restrict — object to or restrict certain processing.
• Withdraw consent — where processing is based on consent.

If you are in the EEA or UK (GDPR): you also have the right to lodge a complaint with your local data-protection authority.

If you are in California (CCPA/CPRA): you have the right to know, delete, and correct your personal information, and to not be discriminated against for exercising these rights. We do not sell or "share" your personal information as those terms are defined under California law.

If you are in mainland China (PIPL): you have the rights of access, copying, correction, and deletion described above, the right to withdraw consent, and the right to an explanation of our processing rules. We process your personal information based on your consent and the necessity of providing the Service, and we obtain separate consent for cross-border transfers where the law requires it.

To exercise any right, email privacy@lingomark.app. We may need to verify your identity before responding.

10. Children's privacy

The Service is not directed to children. We do not knowingly collect personal information from children under 14. If you believe a child has provided us personal information, contact us and we will delete it.

11. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you. Your continued use of the Service after changes take effect means you accept the updated Policy.

12. Contact us

Questions or requests about this Policy or your data:

• Privacy: privacy@lingomark.app
• General support: support@lingomark.app