Privacy Policy
Lingomir — operated by HomeDea LLC
Version 1.0 · Last updated: September 5, 2026
This Privacy Policy explains how HomeDea LLC ("the Operator", "we", "us") collects, uses, shares, and protects your personal data when you use Lingomir at https://lingomir.com (the "Service"), and the rights you have.
We process personal data in accordance with the EU General Data Protection Regulation (GDPR) for users in the EU/EEA, and with other applicable data-protection laws in the regions we serve. Where this policy refers to GDPR rights, we extend equivalent rights to all users regardless of location.
1. Who is the controller
The data controller is:
HomeDea LLC — a limited liability company registered in the State of Wyoming, United States of America Registered address: 30 N Gould St, STE R, Sheridan, WY 82801, USA Registration number: LLC, State of Wyoming, USA · Tax ID: 61-2344206 (EIN) Privacy / data-protection contact: support@homedea.com General contact: support@homedea.com
We have not appointed a statutory Data Protection Officer because we are not required to; you can nonetheless reach our data-protection contact at support@homedea.com for any privacy matter.
2. Data we collect
We collect only what we need to run the Service. We do not use advertising trackers, and we do not sell or share your data with advertisers.
We use two analytics tools, and they are very different from each other:
- Umami, which we host ourselves on our own server. It counts page views and records the referring website and any campaign parameters in the link you followed. It sets no cookies, does not track you across other websites, and stores no data that identifies you personally.
- Microsoft Clarity, a product-analytics service run by Microsoft. It builds heatmaps of where people click and scroll, and records session replays — a reconstruction of your interactions with our pages (mouse movement, clicks, scrolling, and the pages you moved between). Clarity sets cookies and shares this data with Microsoft as an independent recipient. It is configured to mask text you type, and the content of your practice conversations with characters is marked in our code as hidden so it is excluded from recordings. A replay is still data about you. See Sections 4 and 9, and how to opt out.
| Category | Examples | Source |
|---|---|---|
| Account & identity | Email address, hashed password (bcrypt), optional display name; for guests, an anonymous account identifier | You / created for you |
| Learning data | Lessons completed, spaced-repetition (SRS) state, vocabulary progress, quiz/assessment results | Generated by your use |
| Practice-conversation data | Messages you send to AI characters, AI responses, and related grading/translation results | You / generated by your use |
| Gamification data | Experience points (XP), level, rank, streaks, quests, places/achievements, leaderboard standing | Generated by your use |
| Subscription & billing status | Plan, trial status, renewal date, subscription/payment status, top-up balance, and a payment-processor reference. We do not store your full card number | You / payment processor |
| Web-push subscription | The push endpoint/keys from your browser, if you opt in to notifications | You (opt-in) |
| Product-analytics & session replay | Pages viewed, clicks, scrolling and mouse movement on our pages, approximate location (country/region from IP), device, browser and screen size — collected by Microsoft Clarity | Generated by your use |
| Acquisition attribution | Where your account came from the first time you opened the Service: campaign parameters in the link (utm_*), the referring website's address without its query string, the page you landed on, an advertising-network click identifier if the link carried one, your device type, browser language and country | Derived from your first visit |
| Technical & security data | IP address, device/browser type, timestamps, and server logs used for security, abuse prevention, and debugging | Automatic |
| Support data | Messages you send us and their contents | You |
We do not intentionally collect special-category data. Please do not enter sensitive personal information into practice conversations.
3. How and why we use your data, and our lawful bases
| Purpose | Data used | Lawful basis (GDPR Art. 6) |
|---|---|---|
| Create and operate your account; save and sync your progress | Account, learning, gamification data | Contract (Art. 6(1)(b)) |
| Provide AI practice, grading, translation, and text-to-speech | Practice-conversation data, learning data | Contract (Art. 6(1)(b)) |
| Process subscriptions, trials, top-ups, renewals, and refunds | Subscription & billing status | Contract (Art. 6(1)(b)); legal obligation for tax/accounting records (Art. 6(1)(c)) |
| Send transactional/service messages (security, billing, important notices) | Account & billing data | Contract (Art. 6(1)(b)) / legitimate interests (Art. 6(1)(f)) |
| Keep the Service secure; prevent fraud and abuse; debug | Technical & security data | Legitimate interests (Art. 6(1)(f)) |
| Improve and develop the Service, understand feature use | Learning & usage data, in aggregated/pseudonymized form where feasible | Legitimate interests (Art. 6(1)(f)) |
| Count visits and see which channel brought you here | Page views, referring site, campaign parameters (Umami — no cookies) | Legitimate interests (Art. 6(1)(f)) |
| Understand how our pages are actually used — heatmaps and session replay | Product-analytics & session-replay data (Microsoft Clarity — uses cookies) | Legitimate interests (Art. 6(1)(f)) — to find what is broken or confusing in the interface. You can switch this off at any time; Section 9 says how |
| Send marketing email (tips, offers, news) | Email, display name | Consent (Art. 6(1)(a)) — opt-in, withdrawable anytime |
| Send web-push notifications | Push subscription | Consent (Art. 6(1)(a)) — opt-in, withdrawable anytime |
Where we rely on legitimate interests, we have weighed those interests against your rights and use the minimum data necessary; you may object as described in Section 8.
4. Processors and who we share data with
We do not sell your personal data. We share it only with service providers ("processors") who process it on our behalf under a data-processing agreement and only on our instructions, and with authorities where legally required.
| Processor | Role | Data shared |
|---|---|---|
| netcup GmbH (Germany, EU) | Cloud hosting and database infrastructure | All data stored by the Service |
| OpenAI | AI provider that generates practice conversations, grading, and translation | The text you send to AI characters and related learning context |
| Stripe | Payment processing for subscriptions and top-ups | Billing identifiers, subscription/payment data (card data is handled directly by the processor) |
| Our SMTP email delivery provider | Sending transactional and (if opted in) marketing email | Email address, display name, message content |
| Microsoft (Clarity) | Product analytics: heatmaps and session replay | Pages viewed, clicks, scrolling and mouse movement, approximate location from IP, device and browser information |
AI processing — important. When you use practice conversations, AI grading, or translation, the content of your messages and related learning context is sent to our AI provider (currently OpenAI) to generate a response. The AI provider processes this content to return output to you. We instruct our AI provider by contract not to use your content to train its general models except as permitted by our agreement, and we send only what is needed for the feature. Text-to-speech audio is likewise generated from lesson and practice text by our AI provider. Please do not submit sensitive personal data, passwords, or confidential information in AI conversations.
We may also disclose data if required by law, to enforce our Terms, to protect our or others' rights and safety, or in connection with a merger, acquisition, or sale of assets (with continued protection of your data).
The specific processors may change; we will keep this list current and, where required, notify you.
5. International transfers
The controller is established in the United States, and our processors may process data outside the EU/EEA, including in countries that may not provide the same level of data protection. Where we transfer personal data of EU/EEA users internationally, we rely on appropriate safeguards — principally the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, an adequacy decision (such as the EU-U.S. Data Privacy Framework where a processor is certified) — and we take additional measures where needed. You can request more information about these safeguards at support@homedea.com.
6. How long we keep data (retention)
We keep personal data only as long as necessary for the purposes above, then delete or anonymize it. Retention periods below are our current defaults and may be adjusted where operationally or legally justified.
| Category | Retention |
|---|---|
| Account, learning, and gamification data | Until you delete your account (plus a grace period — see Section 8 and Delete Account) |
| Practice-conversation (dialogue) logs | 24 months from creation, then deleted or anonymized (this period is adjustable and may be shortened) |
| Guest accounts | Removed after an extended period of inactivity if not converted |
| Subscription & billing / accounting records | Retained as required by applicable tax and accounting law — generally up to 7–10 years depending on jurisdiction — even after account deletion, then deleted |
| Web-push subscription | Until you disable notifications or delete your account |
| Marketing consent records | Until you withdraw consent, plus a short record of the withdrawal to honour it |
| Technical & security logs | Typically up to 12 months, longer only if needed for a security incident or legal claim |
| Backups | Purged on a rolling cycle, typically within 30 days |
When you delete your account, we erase or anonymize your personal data after the grace period, except records we must keep by law (such as billing/accounting records) and residual copies in backups pending their rolling deletion.
7. How we protect your data
We use technical and organizational measures appropriate to the risk, including encryption in transit (HTTPS), hashing of passwords (bcrypt), access controls, and contractual safeguards with processors. Card data is handled by our payment processor under its own security standards; we do not store full card numbers. No system is perfectly secure, but we work to protect your data and to notify you and the competent authority of a personal-data breach where the law requires.
8. Your rights
Under the GDPR (and equivalent applicable laws) you have the right to:
- Access — obtain confirmation of and a copy of your personal data;
- Rectification — correct inaccurate or incomplete data;
- Erasure ("right to be forgotten") — have your data deleted, subject to legal retention;
- Restriction — restrict processing in certain cases;
- Portability — receive certain data in a structured, machine-readable format and, where feasible, have it transmitted to another controller;
- Objection — object to processing based on legitimate interests, and to direct marketing at any time;
- Withdraw consent — withdraw consent (marketing, push) at any time, without affecting processing already carried out;
- Not be subject to solely automated decisions producing legal or similarly significant effects — we do not make such decisions about you.
How to exercise your rights:
- Marketing / push consent: turn off in your profile settings or use the unsubscribe link in any marketing email.
- Account deletion / erasure: use in-app account deletion (when available), the web request path at https://lingomir.com/legal/delete-account (see Delete Account), or email support@homedea.com.
- Any other right (access, rectification, portability, objection, restriction): email support@homedea.com or support@homedea.com.
We respond within the legal time limit (generally one month, extendable for complex requests). We may need to verify your identity first. Exercising your rights is free unless a request is manifestly unfounded or excessive.
Complaints. You have the right to lodge a complaint with a supervisory authority. If you are in the EU/EEA, you may complain to your local Data Protection Authority; residents of other regions may contact the data-protection or consumer-protection authority competent for their place of residence. We would appreciate the chance to address your concern first at support@homedea.com.
9. Cookies and local storage
Essential storage. We store your authentication token, basic session/preference data, and the acquisition attribution described in Section 2 in your browser's local storage so you can stay signed in and the app can function. This is essential to provide the Service you request and does not require consent.
Analytics storage. We do not use advertising cookies and we run no cross-site advertising trackers. Our own analytics tool (Umami, self-hosted) is cookie-free. However, Microsoft Clarity sets cookies on your device in order to recognise a returning session and to link the pages of one visit into a single replay.
Your choice. Clarity is non-essential. You can switch it off at any time, and doing so costs you nothing in the Service:
- Use Microsoft's opt-out page at https://clarity.microsoft.com/optout, which applies across every site that uses Clarity; or
- Block third-party scripts, or clear cookies for this site, in your browser settings — most ad- and tracker-blocking extensions already block Clarity.
We do not use Clarity data to make any decision about you as an individual, to profile you, or to advertise to you. If we ever introduce advertising cookies or any cross-site tracking, we will update this policy and ask for your consent first.
You can clear local storage in your browser at any time; doing so will sign you out and may reset guest progress that is not linked to a registered account.
10. Children
The Service is intended for users aged 16 and over. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us personal data, contact support@homedea.com and we will delete it.
11. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email and/or in-app and update the "Last updated" date above. Your continued use of the Service after the changes take effect constitutes acceptance, except where consent is required.
12. Contact
Privacy / data-protection contact: support@homedea.com General contact: support@homedea.com · Support: support@homedea.com Operator: HomeDea LLC, 30 N Gould St, STE R, Sheridan, WY 82801, USA
See also our Contact page.
Related documents: Terms of Service · Privacy Policy · Refund & Cancellation Policy · FAQ · Contact · Delete Account