Privacy Policy

Bilingue (“Bilingue,” “we,” “us,” or “our”) is a speak-first language-learning service operated by Bilingue, LLC, a Delaware limited liability company based in Auburn, Washington. This policy applies to our website at bilingue.com, our app at app.bilingue.com, and our iOS and Android apps (together, the “Service”).

For people in the EEA, the UK, and similar jurisdictions, Bilingue, LLC is the data controller for personal information handled through the Service. You can reach us any time at privacy@bilingue.com.

We collect only what we need to run the Service and help you learn.

Account information

• Your email address and a password (your password is handled by Firebase Authentication and stored only in hashed form — we never see or keep your actual password).
• If you sign in with Google, the basic profile Google shares with us — your name, email, and profile picture.
• Optional profile details you choose: a display name, avatar, and color/icon.
• Learner profiles. An account owner can create additional learner profiles (for example, for family members), each with its own display name and avatar.

Learning activity

• Your language, learning goals, and daily goal, and your study progress — which exercises you've seen, your self-grades (“Repeat” / “Got it”), review timestamps, streaks, daily counts, and mastery toward real-world “can-do” goals.
• The spaced-repetition (FSRS) schedule we keep for you — the state, difficulty, and next-due date of each exercise — so reviews come back at the right time.
• How long you actively spoke and listened, recorded as durations (a number of milliseconds), and which exercises you've pinned or starred.

Voice recordings

When you practice a speaking exercise, your device's microphone records you so you can hear yourself against the model audio. These recordings stay on your device and are not collected by us — this matters enough that it gets its own section below (Section 3).

Subscription and payment information

• Your plan and status — free, a time-limited Pass, or a Pro subscription — including tier, billing cycle, trial and renewal dates, and a history of purchases (amount, date, currency, and status).
• Payments are handled by Stripe. You enter your card details on Stripe's checkout, not in Bilingue — we never receive or store your full card number. We keep a Stripe customer/subscription identifier so we can manage your plan.

Support, feedback, and reports

If you report a problem with an exercise (for example, the audio, translation, or phrasing) or contact us, we receive what you send — your message, the reason, a snapshot of what you were looking at, and basic context like app version and platform.

Device and usage information (collected automatically)

• Your device and browser type, operating system, app version, language, and IP address (which also tells us your approximate region).
• Your time zone, detected from your browser, so daily goals and review limits line up with your day.
• Product analytics events (for example, that an audio clip loaded, or that a difficulty level changed) and the identifiers our analytics tools assign. See Cookies and tracking technologies.
• If you turn on push notifications, a device token so we can send them.
• Anti-abuse signals. We use Google reCAPTCHA Enterprise (through Firebase App Check) to confirm requests come from the real app and not an automated script. This involves your IP address and interaction signals being processed by Google.

Here is exactly what happens when you record yourself:

• When you tap record, your browser or app captures audio using your microphone. Your device's operating system asks for microphone permission the first time, and you can revoke it whenever you like in your settings.
• The recording is held only in your device's memory and is used for two things, both local: to play your voice back to you next to the model audio so you can compare, and to estimate how long you spoke.
• We do not upload your recording to our servers, and we do not store it, transcribe it, run speech recognition on it, score your pronunciation, or send it to any third party or AI service.
• When you grade the exercise and move on — or leave the session — the recording is discarded. Nothing about the audio is kept.
• The only thing saved from a speaking exercise is the length of time you spoke (a number of milliseconds), added to your practice totals. The audio itself never leaves your device.

Because we never receive or retain your recordings, we can't extract a “voiceprint” or use your voice to identify you, and there's no stored audio for us to lose, share, or hand over.

We use the information above to:

• Provide the Service — create and secure your account, sync your progress across devices, schedule your reviews with spaced repetition, and track your learning.
• Generate the model audio you compare yourself against. We pre-generate exercise audio with Google Cloud Text-to-Speech; your own voice is never sent to it.
• Process payments and manage your subscription or Pass through Stripe.
• Communicate with you — send account and transactional messages (sign-in help, email verification, receipts, and important notices), learning reminders if you enable them, and, if you opt in, occasional product updates. You can opt out of non-essential messages at any time.
• Improve the Service — understand which features help, fix bugs, and develop new content and functionality.
• Keep the Service safe — detect and prevent fraud and abuse, enforce our Terms, and protect against unauthorized access.
• Comply with the law and respond to lawful requests.

Bilingue's lessons are created with the help of AI. We use Google's generative AI (Gemini) to author learning content — exercises, example sentences, and stories used for reading and listening practice — which we then store and serve to learners.

• This content generation happens in our backend as part of building the course. We do not send your voice recordings, your email, or other account identifiers to AI providers.
• Some practice content can be tailored to your level and the vocabulary you've learned. Where that happens, it uses learning data (such as which words you know) — not your identity or your recordings.
• We do not use AI to score your pronunciation or to make automated decisions that have legal or similarly significant effects on you.

We do not sell your personal information for money. We share information only in these situations:

Service providers who process data for us

• Google / Firebase (Google Cloud) — authentication, database (Firestore), file storage, serverless functions, analytics, abuse protection (App Check / reCAPTCHA Enterprise), Cloud Text-to-Speech for model audio, and Gemini for content generation. Google hosts the Service.
• Stripe — payment processing and billing.
• Google (on our marketing site) — on bilingue.com we use Google Analytics and Google Ads tags to measure how our site and ads perform. See Cookies and tracking technologies and Your California privacy rights.
• Meta (on our marketing site) — on bilingue.com we use the Meta Pixel to measure how our Facebook and Instagram ads perform. See Cookies and tracking technologies and Your California privacy rights.

These providers may act as our processors or, for analytics and advertising, as independent businesses under their own privacy policies.

Legal, safety, and business transfers

• When required by law or legal process, or to protect the rights, safety, and property of Bilingue, our users, or the public.
• In connection with a merger, acquisition, financing, or sale of assets — in which case we'll continue to protect your information and notify you of any change in control or policy.

With your direction

When you ask us to, or use a feature that involves a third party at your request.

We may also share aggregated or de-identified information that can't reasonably be used to identify you.

We and our providers use cookies, local storage, and similar technologies. The main ones:

• Essential. The bilingue_authed and bilingue_account cookies keep you signed in and let the site show the right options for your account, and your browser's local storage holds your settings, theme, saved email, and small interface preferences. The Service won't work properly without these.
• Analytics. In the app we use Firebase Analytics to understand usage and performance. On our marketing site we use Google Analytics.
• Advertising. On our marketing site (bilingue.com) we use Google Ads conversion tags and the Meta Pixel to measure ad performance. This privacy page does not load advertising tags.

You can control cookies through your browser settings, and you can opt out of Google-based personalization through Google's Ad Center and Meta-based ad personalization through Meta's ad settings. Where the law requires it, we honor the Global Privacy Control (GPC) browser signal as a request to opt out of “sharing” for advertising — see Section 10.

• Active accounts. We keep your account and learning data for as long as your account is active, so your progress and schedule are there when you come back.
• After deletion. When you delete your account, we remove your personal data from our active systems within 30 days. Copies may persist briefly in routine backups, which age out on a rolling schedule.
• Voice recordings. Not retained at all — they're discarded on your device after each exercise and are never stored on our servers.
• Legal and financial records. We may keep some information longer where the law requires it (for example, transaction and tax records).
• Analytics. Usage data is retained according to our analytics providers' standard retention settings.

You have control over your information, wherever you live. Depending on your location, some of these are also legal rights (see Sections 10 and 11).

• Access and update. View and edit your profile and settings in the app at any time.
• Delete a learner profile. An account owner can delete an individual learner profile in the app, which removes that profile's data.
• Delete your account. To delete your whole account and associated personal data, email us at privacy@bilingue.com and we'll take care of it within 30 days.
• Get a copy of your data. Email us at privacy@bilingue.com to request a copy of the personal information we hold about you.
• Marketing and notifications. Unsubscribe from product emails using the link in any such email, and turn push notifications on or off in your device settings.
• Microphone. Grant or revoke microphone access any time in your device or browser settings. Speaking exercises need it; the rest of the app doesn't.

We won't discriminate against you for exercising any of these rights. We may need to verify your identity before acting on a request.

If you're a California resident, the CCPA (as amended by the CPRA) gives you specific rights. In the past 12 months we've collected the categories of personal information described in Section 2, namely:

• Identifiers — such as your name, email, account ID, IP address, and device identifiers.
• Customer records and commercial information — billing details (handled by Stripe) and your subscription and purchase history.
• Internet and network activity — usage and analytics events, and approximate location derived from your IP address.
• Audio information — your speaking-practice recordings, which are processed only on your device and are not collected or retained by us.
• Inferences — for example, your learning level and progress.

We collect this from you and your device to provide and improve the Service, for the business purposes described in this policy. We share categories of personal information with the service providers listed in Section 6.

We do not sell your personal information. We also don't “share” it for cross-context behavioral advertising in the app. On our marketing site, the Google Ads tags and Meta Pixel described above may qualify as “sharing” under California law. You can opt out by using a browser that sends the Global Privacy Control (GPC) signal (which we honor), by adjusting your Google ad settings and Meta ad settings, or by emailing us at privacy@bilingue.com. We do not knowingly sell or share the personal information of anyone under 16.

You have the right to:

• Know the categories and specific pieces of personal information we've collected, and how we use and disclose it.
• Delete personal information we've collected from you.
• Correct inaccurate personal information.
• Opt out of any sale or sharing, and limit the use of sensitive personal information.
• Be free from discrimination for exercising your rights.

To make a request, email privacy@bilingue.com. You may use an authorized agent, and we'll verify your request before acting on it. If we deny a request, you may appeal by replying to our response.

If you're in the European Economic Area, the United Kingdom, or Switzerland, Bilingue, LLC is the controller of your personal information, and the GDPR (and UK GDPR) apply.

Legal bases

• Performance of a contract — to create your account and provide the Service you ask for, including syncing progress, scheduling reviews, and processing payments.
• Legitimate interests — to keep the Service secure, prevent abuse, understand usage, and improve the product, balanced against your rights.
• Consent — for optional cookies and advertising tags on our marketing site, marketing emails, microphone access, and push notifications. You can withdraw consent at any time without affecting prior processing.
• Legal obligation — to keep records (such as transactions) and respond to lawful requests.

Your rights

You have the right to access, correct, delete, restrict, or object to our processing of your personal data, to data portability, and to withdraw consent. You can exercise these by emailing privacy@bilingue.com. You also have the right to lodge a complaint with your local data protection authority, though we'd appreciate the chance to help first.

Bilingue is based in the United States, and we and our providers process information in the United States and other countries that may have different data-protection laws than yours. When we transfer personal information out of the EEA, the UK, or Switzerland, we rely on appropriate safeguards — such as the European Commission's Standard Contractual Clauses — which our major providers (including Google and Stripe) make available.

The Service is not directed to children under 13, and we don't knowingly collect personal information from them. A parent or guardian who holds an account may create learner profiles for children in their family and is responsible for those profiles and the data in them.

If you believe a child under 13 has given us personal information without parental consent, email privacy@bilingue.com and we'll delete it. Where local law sets a higher age of digital consent (for example, up to 16 in parts of the EEA), we apply that age instead.

We use technical and organizational measures to protect your information, including encryption in transit (HTTPS/TLS), access controls and database security rules, and authentication through Firebase Auth (which stores passwords only in hashed form). We use App Check to help ensure requests come from the genuine app.

No method of transmission or storage is completely secure, so we can't guarantee absolute security — but we'll notify you and the appropriate authorities of a breach where the law requires it.

We may update this policy as the Service evolves. When we do, we'll post the new version here and update the “Effective” date above, and we'll give you additional notice (such as an email or an in-app message) if the changes are significant. Your continued use of the Service after an update means you accept the revised policy.

Questions, requests, or concerns about your privacy? We're glad to help.

This policy is governed by the laws of the State of Washington, United States, without regard to its conflict-of-laws rules.