Privacy Policy
Last updated: November 7, 2026
This policy explains what Flamelingo stores, why, for how long, and what rights you have. The short version: we store your learning profile and the chat context needed to tutor you, we use one cookie to remember who you are, and we do not sell your data to anyone.
1. What we collect
| Data | Why | Where |
|---|---|---|
| Learner identifier (random ID in the fl_uid cookie) | Remember your progress between visits | Your browser + our server |
| Learning profile (level, known words, mistakes, interests you share, XP, streak) | Personalize lessons and spaced repetition | Our server, keyed to your learner ID |
| Chat messages in a session | Sent to our AI provider to generate tutor replies; the last few messages may be attached to an abuse report as context | Processed per request; not kept as a permanent transcript |
| Usage events (timestamp, learner ID, language, event type) | Aggregate analytics: sessions per day, popular languages | Our server |
| Abuse reports you file | Moderation and safety | Our server |
| KYC data (name, date of birth, ID document, selfie), only if you apply for video features | Age and identity verification required for video practice | Our server, in a restricted directory outside the public web root |
2. Cookies
We set one functional cookie, fl_uid, containing a random identifier so your progress persists. It is not used for advertising and is not shared with ad networks. The admin area uses a standard session cookie for staff login. We do not use third-party tracking or advertising cookies.
3. AI processing
Tutor replies are generated by a third-party AI model accessed through OpenRouter. Your chat messages and learning profile are transmitted to that provider to produce responses. Do not type passwords, financial details, or sensitive health information into the chat.
4. What we do not do
- We do not sell your personal information. Ever.
- We do not share your data with advertisers or data brokers.
- We do not use your KYC documents for anything except verification and legally required record keeping.
5. Retention
Learning profiles and usage events are kept while your account is active. Abuse reports and enforcement records are kept as long as needed for safety and legal purposes. KYC documents are kept only as long as needed to verify you and to meet legal obligations, then deleted.
6. Deletion on request
You can request deletion of everything tied to your learner ID (profile, events, KYC submissions) at any time by contacting privacy@flamelingo.com (placeholder during beta) with your learner ID, or simply by clearing your fl_uid cookie to disconnect from your profile. We will complete verified deletion requests within 30 days, except for records we must keep by law.
7. Your rights (GDPR)
If you are in the EU, UK, or EEA, you have the right to access, rectify, erase, and port your data, to restrict or object to processing, and to lodge a complaint with your supervisory authority. Our legal bases are: performance of a contract (providing tutoring you request), legitimate interest (security, moderation, aggregate analytics), legal obligation (KYC record keeping), and consent (KYC submission itself, which you can refuse by not using video features).
8. Your rights (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to non-discrimination for exercising these rights. We do not sell or share personal information as defined by the CCPA, so there is nothing to opt out of.
9. Children
Flamelingo is not directed at children under 13 and we do not knowingly collect their data. Users aged 13 to 17 need guardian consent per our Terms. Video features will be strictly 18+ with ID verification. If you believe a child under 13 is using the service, report it in the app or email us and we will act.
10. Security
Data is stored on access-controlled servers. KYC uploads are written with restrictive file permissions in a directory that is not reachable from the public web. Admin access is password protected. No system is perfectly secure; if a breach affecting you occurs, we will notify you as required by law.
11. International transfers
Our servers are located in the EU (Germany). AI processing via OpenRouter may route data to providers in the United States under their applicable safeguards.
12. Changes
We will post updates here with a new date. Material changes will be flagged in the app.
13. Contact
privacy@flamelingo.com (placeholder during beta, monitored).