Privacy Policy

Last updated: 10/16/2026

In short: we store what’s needed for the app to work and for your progress not to get lost: your learning activity and, if you create an account, what Apple or Google shares with us when you sign in. There are no ads, we don’t track you across apps, and we don’t sell or share your data. You can delete everything from the app, in Profile → Settings → Delete account and data, or from this page. You can also create your account with an email and password.

1. Who is the controller

The controller of your data is Artsessions, S.L.U., with Spanish tax ID (NIF) B64848997 and registered address at C/ Llull 240, 08005 Barcelona, Spain. For any privacy question, you can write to hello@replai.net.

2. What data we process

Even if you don’t have an account, to save and sync your progress:

Random identifiers for your device and your user, created by the app. They are not Apple’s or Google’s advertising identifier and can’t be used to find out who you are.
Technical data about your phone (iPhone or Android): model, operating system and version, language and region settings, preferred languages, time zone, app version and a few display and accessibility settings (dark mode, text size, whether you use a screen reader and whether you reduce motion).
Your preferences: your language, the languages you’re learning and when you started each one, your daily goal, your reminder time and, if you tell us, your name and how you’d like us to address you (man, woman or prefer not to say), which we use only to teach you words in the form that applies to you.
Your learning activity: lessons completed, the result of each exercise, the answers you type and, in speaking exercises, the text your phone recognized from what you said, XP, streak, gems, lives and the pending review for each word.
Problems you report to us from an exercise.

If you create an account with Sign in with Apple: the identifier Apple assigns to Parlumi and your name, if you choose to share it. Apple also tells us your email address (or its private relay address, if you choose to hide it): we store it to identify your account and help you if you contact us (only the Parlumi team can see it, never other users), together with an encrypted, irreversible fingerprint (hash) that’s used to confirm your identity if you ask to delete your account from the website. We never receive your Apple password.

If you create an account with Google (on Android): the identifier Google assigns to your account and your name, if Google shares it with us. If Google indicates that your email address is verified, we store it just as we do with Apple: the address, to identify your account and help you (only the Parlumi team can see it), and its encrypted fingerprint (hash), to confirm your identity if you ask to delete your account from the website. We never receive your Google password or access any other data in your Google account. Sign-in is handled by Google Play services on your phone.

IP address: like any internet service, we receive it when you connect. When you tap “Start” for the first time, we use it to estimate your country and include it, along with your phone’s technical data, in an internal email notification to the Parlumi team. We don’t store it in our database. If you ask to delete your account from the website, the email address you enter also reaches the team in a notification, so we can help you if we can’t find the account.

Microphone (speaking exercises): only if you give permission, and only while you’re touching the microphone in a pronunciation exercise. What you say is converted into text by your phone’s speech recognition. On iPhone, that’s Apple’s, on the device itself whenever the language allows it (otherwise, Apple processes it under its Privacy Policy). On Android, it’s the system’s speech recognition: on the device itself when available; otherwise, your phone’s speech recognition service (usually Google’s) processes the audio under its own Privacy Policy. Parlumi doesn’t store or send the audio: only the recognized text, as your answer to the exercise. You can turn off these exercises in the app’s Settings or remove the permission in your phone’s settings.

Camera (on Android, to scan a friend’s QR code): only if you give permission, and only when you choose to scan a friend’s QR code in the app. The image is analysed on the phone itself (with Google ML Kit’s on-device barcode scanning) just to read the code: we don’t store it or send it anywhere. ML Kit may send Google technical data about the library’s usage and performance, never the images.

This website uses technical cookies, which don’t need your consent: hl, to remember the language you choose, and a security cookie on forms. If you accept it in the cookie notice, it also uses Google Analytics (Google Ireland Limited) to see which pages are visited: it stores the _ga cookies for up to 2 years, and Google may process data in the United States under the EU-US Data Privacy Framework. We don’t load it until you accept, it runs without Google Signals or ad personalisation, and you can withdraw your consent at any time in “Cookie settings” at the bottom of the page.

What we don’t process: your location, contacts or photos, or recordings of your voice. The camera is only used to read a friend’s QR code, as explained above, and we don’t keep any images. The voice in the exercises is generated by the phone itself. We don’t use third-party advertising or analytics tools.

If you create an account with email and password: your email and a hash of your password (an encrypted, irreversible fingerprint: we never store the password itself), the language you use for emails and whether you have confirmed your email. We only email you for this: the link to confirm your email, reminders that the deadline is approaching and that access has been closed, and the link to reset your password if you ask for it. After signing up you can use the app right away, but you have a few days (7 by default) to confirm your email; if you don’t, we close access to your account. Nothing is deleted when access is closed: once you confirm your email, everything opens up again. To limit failed sign-in attempts we keep, for one day, encrypted fingerprints of your email and your IP address, not the address itself. We also log each email we send you (address, type, date and whether it was sent successfully, never its content) for 12 months; the address is removed from that log when you delete your account.

If you use “Invite and earn”: we generate an invitation code for you and, if someone redeems it, we store the link between the person who invites and the person who redeems it, and how many lessons that person has done, only so we can grant the Premium reward. The person who invites never sees any data about the person invited. All of this is deleted with your account.

If you use “Friends & challenges” (account required): we generate a friend code for you and store your friendships, requests, blocks and challenges (duel scores and days completed in the weekly challenge), only so they work. You are only friends with someone if you both accept, and a friend only sees your name, your avatar and its frame, your streak, your weekly XP, the languages you study and since when you have been friends; never your email, your country or anything else. You can remove or block a friend at any time, and all of this is deleted with your account. When you create your account we give you an @username based on your first name (or, if we don’t have one, on the part of your email before the “@” with a few digits added; never your full email). You can change it to another one that’s free or remove it. With it, other registered users can find you by searching for it and, until you accept the friendship, they only see your @username and your avatar (with its frame). You can hide from searches in Settings (your code and your link keep working), and your @username is released when you delete your account.

If you take part in neighbourhoods (account required): each week we place you in a neighbourhood of about 20 people to build the city of Parlumi together. The other members of your neighbourhood see your @username (or “Parlumi Neighbour” if you don’t have one), your avatar and the days you contributed that week; never your name, your email or your country. They can only send you predefined cheers, never messages. You can switch neighbourhoods off at any time in Settings (“Take part in neighbourhoods”), and your neighbourhoods, cheers, titles and buildings are deleted with your account.

3. What we use it for and on what legal basis

Purpose	Legal basis (GDPR)
Providing the service: your courses, your progress, syncing across devices and your account.	Performance of the contract for using the app (Art. 6(1)(b)).
Improving the courses with accuracy statistics and by reviewing written answers so we can accept the ones that are correct.	Legitimate interest in improving the content (Art. 6(1)(f)). You can object.
Knowing when someone starts using the app (the internal notification when you tap “Start”) and giving you support.	Legitimate interest in understanding how the service is used (Art. 6(1)(f)).
Enforcing each plan’s limits, preventing abuse and maintaining security.	Legitimate interest (Art. 6(1)(f)).

We don’t make automated decisions that have legal effects on you, and we don’t build profiles for commercial purposes.

4. How long we keep it

Your account and your progress, for as long as you use the app. If you delete it (from the app or from the website), at that moment we erase everything that identifies you: the link to your Apple ID or your Google account, your email address and its fingerprint, your name, the link to your device, your sessions and anything you’ve typed. We keep only anonymous statistical data (sign-up date, languages and progress), with no link to you, so that we know, for example, how many people have signed up.
The text of your written answers and of what was recognized in speaking exercises, 90 days. After that, we only keep whether they were correct or not.
The detailed activity log, 12 months. Your progress (lessons completed, XP, streak) is kept.
If you use the app without an account and 12 months go by without any activity, we anonymize your data in the same way.
If you sign out without having an account, what you’ve done on the phone is deleted and anonymized on our servers (the app asks you to confirm first).
If you created your account with email and password, your email, the password hash and the confirmation status are deleted the moment you delete your account. Confirmation and reset links expire on their own and are cleaned up automatically.

5. Who we share it with

We don’t sell or share your data. Only the providers that deliver a service to us have access to it, under a data processing agreement:

Server hosting: [pending: hosting provider].
Email delivery (internal and admin panel notifications and, if you use email and password, the confirmation, deadline and password reset emails): [pending: email provider].

Our servers are located in the European Union. If any provider processed data outside the European Economic Area, it would do so with the safeguards required by the GDPR, such as the European Commission’s standard contractual clauses.

If you sign in with Apple or make purchases on the App Store, Apple processes your data as an independent controller under its own Privacy Policy.

If you sign in with Google, download the app from Google Play or rate it from the app on Android, Google processes your data as an independent controller under its own Privacy Policy.

We would only disclose data to authorities when required by law.

6. Minimum age

Parlumi is for people 14 years of age or older, the age from which Spanish law allows people to consent to the processing of their own data. By using the app, you confirm that you meet this age. If you’re a parent or guardian and believe that a child under 14 has given us data, write to us and we’ll delete it.

7. Your rights

You can ask us to access your data, correct it, delete it, object to its processing, restrict it or receive it in a portable format. To delete everything, you don’t need to write to us: in the app, go to Profile → Settings → Delete account and data, or without the app, use Delete your account. For anything else, write to hello@replai.net from the email address of your account (the Apple or Google one you sign in with, or the one you signed up with). If you don’t have an account, tell us your phone model and the day you started so we can locate your data. We’ll reply within one month at most.

If you believe we haven’t handled your request properly, you can file a complaint with the Spanish Data Protection Agency (AEPD) or with the data protection authority in your country.

8. Security

All communications are encrypted (HTTPS). Access to the API uses short-lived tokens, Apple credentials are stored encrypted, and access to the internal admin panel is restricted to authorized people. Passwords are stored only as a hash using an algorithm designed for that, and the links in emails are stored only as an encrypted fingerprint.

9. Changes to this policy

If we change anything important, we’ll let you know in the app. The date at the top shows the latest version. Your use of the app is also governed by the Terms of Use.