Privacy Policy
Effective October 12, 2026 · Version 2026-10-12
MostSpoken (“we”, “us”) is a language-learning app. This policy explains what personal data we process, why, the legal bases we rely on under the EU General Data Protection Regulation (GDPR), and the rights you have. Questions or requests: ruslan.shchuchkin@gmail.com.
Who is responsible for your data
The data controller for MostSpoken is the operator of this app, reachable at ruslan.shchuchkin@gmail.com. We decide how and why your personal data is processed.
What data we collect
- Account data. When you sign in with Google, we receive your email address and basic profile (name, avatar). We store a user identifier, your display name, and your settings (target language, time zone, daily goal, the goals and level you pick when you start).
- Guest accounts. If you start without signing in, we create a guest account with no name or email, so your progress is saved. If you later sign in with Google, your progress moves to that account. A guest account with no activity for 30 days is deleted.
- Learning progress. The cards you study, the review state of each card (how well you know it and when it comes back), daily totals (lessons, points, streak), and your placement result.
- Data from the earlier version of the app. If you made an account before October 9, 2026, we still hold what that version stored: your chats with the AI teacher and practice partner, the words and grammar you studied, and notes the teacher recorded. The app no longer adds to this data. It is included when you export or delete your data.
- Book sign-ups. If you ask for the free word book, we store your email address and the language you picked.
- Audio. We make text-to-speech audio of the words and sentences in our lessons and pages. The app does not record your voice.
- Problem reports. When you report a wrong picture or sound, we count the report for that card. The count is not linked to you.
- Technical data. Standard server logs (IP address, request metadata) generated by our hosting provider to deliver and secure the service.
Why we use it and our legal bases
- To provide the service: running lessons, tracking progress, remembering where you are. Legal basis: performance of a contract (Art. 6(1)(b)).
- To keep the service secure and working: logging, abuse prevention, debugging. Legal basis: legitimate interests (Art. 6(1)(f)).
- To send the free word book you ask for, and one email when the full book is out. Legal basis: consent (Art. 6(1)(a)), which you can withdraw at any time.
We do not use your data for advertising, and we do not sell it.
Who we share it with (sub-processors)
We rely on the following processors, each bound by a data processing agreement. We share only what each needs to perform its function.
| Processor | Purpose | Location |
|---|---|---|
| Cloudflare | App hosting (Workers), the app database (D1: your account, sign-in sessions, cards and progress), and file storage (R2: audio clips and page cache) | Database: European Union (D1 EU jurisdiction). Requests are served from the Cloudflare location nearest to you |
| Supabase | Database for the public word pages, the free book sign-up list, and learning data from the earlier version of the app (kept only so you can export or delete it) | European Union (Frankfurt, eu-central-1) |
| OpenRouter | Text-to-speech (the audio of words and sentences) and routing text to language models | Routes to the model provider that serves the selected model (global routing; an EU-provider pin is available but not currently enabled) |
| Google sign-in (OAuth) authentication | United States / global |
International transfers
Your account and learning data are stored in the European Union (Cloudflare D1 with EU jurisdiction, and Supabase in Frankfurt for the data of the earlier app version). Cloudflare serves each request from the location nearest to you. Some processors (for example text-to-speech and Google sign-in) may process data in the United States. Where data leaves the EEA, transfers are covered by the European Commission’s Standard Contractual Clauses or an equivalent safeguard.
How long we keep it
We keep your account and learning data for as long as your account is active. When you delete your account, all of it is permanently removed from our databases, and deletion propagates to our processors under their own retention terms. Guest accounts with no activity for 30 days are deleted automatically. Server logs are retained by our hosting provider for a short period for security and diagnostics.
Your rights
Under the GDPR you can:
- Access & portability: download a copy of your data.
- Erasure: delete your account and all associated data.
- Rectification: correct your profile details.
- Restriction & objection: limit or object to certain processing.
- Withdraw consent: where processing relies on consent.
- Complain: to your local data protection authority.
You can export or delete your data yourself from your profile, or contact us at ruslan.shchuchkin@gmail.com. A book sign-up is not linked to an account, so to remove it, email us from that address.
Children
MostSpoken is not directed to children under 16. We do not knowingly collect their data; if you believe a child has provided us data, contact us and we will delete it.
Changes to this policy
We may update this policy. Material changes bump the version above, and continued use after an update constitutes acceptance of the revised policy.
See also our Terms of Service.