Nova Lingvo
Privacy policy
Last updated 7 September 2026 · applies to novalingvo.app and to the IDK Korean and IDK Italian apps
The short version. The dictionary works offline and signed out. If you sign in, your study data is stored in the EU so it can sync between your devices. Nothing is sold, and nothing is shared with advertisers. You can export or permanently delete everything from inside the app, without asking me.
1. Who is responsible
The data controller is Eric Ward, an individual developer trading as Nova Lingvo, contactable at eric@novalingvo.app. There is no separate legal entity and no Data Protection Officer; the address above reaches me directly and is also the address for any request under sections 7 and 8.
2. What is collected
Nothing at all, if you don't sign in
The dictionary ships inside the app. You can install it, look words up and study without an account and without a network connection. In that mode no personal data leaves your device.
If you create an account
| Data | Where it comes from |
|---|---|
| Account identifier (a Firebase user ID) and the sign-in method you chose | Created when you sign in |
| Email address, or phone number, or the name and email released by Google, Apple or Facebook sign-in | You, or the identity provider you chose. Anonymous sign-in supplies none of this. |
| Study data: your decks, the cards you made, every review you did (rating and timestamp), and the scheduling state derived from them | Your use of the app |
| Saved words, word lists and app settings | Your use of the app |
| Texts, EPUBs and subtitle files you import for reading | Uploaded by you, deliberately |
| Bug reports you submit from inside the app: your summary, description, any screenshots you attach, and your account identifier | Submitted by you, deliberately |
Usage measurement
The apps include Google Analytics for Firebase, which records which screens are opened and coarse device and locale information under an app-instance identifier. It is used to see which parts of the app are worth building out. It is not used to build advertising profiles, and no advertising SDK is present in the apps.
The apps are currently pre-release and go only to testers who asked to take part. Analytics is on in those builds; the in-app control to turn it off ships before either app is publicly released. If you are testing and would rather it were off in the meantime, email me and I'll take you out.
Server logs
Requests to api.novalingvo.app and to this website are logged
by Google Cloud with an IP address, timestamp, and the request made, as
part of running and securing the service.
What is never collected
- Contacts, photo library, calendar or location.
- Payment details — there is nothing to buy.
- Advertising identifiers. There are no ads and no third-party trackers.
- Microphone audio. The Korean pronunciation mode uses the operating system's own speech recognition and receives back only text; no recording is stored or uploaded by the app.
3. Why, and on what legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Running your account and syncing your study data between your devices | Art. 6(1)(b) — performance of the contract you enter into by creating an account |
| Storing texts you import so you can read them on any of your devices | Art. 6(1)(b) — performance of the contract |
| Handling a bug report you send | Art. 6(1)(b), and Art. 6(1)(f) — my legitimate interest in fixing the app |
| Usage measurement (Firebase Analytics) | Art. 6(1)(a) — your consent, given by joining the tester programme while the apps are pre-release, and withdrawable at any time by email |
| Server logs, abuse prevention and security | Art. 6(1)(f) — legitimate interest in keeping the service available and secure |
There is no automated decision-making or profiling within the meaning of Art. 22.
4. Where it is stored
User content is stored in the European Union: study data in Google
Firestore in the europe-west multi-region, and imported texts
in a Google Cloud Storage bucket located in the EU. The API servers run in
europe-west4 (Netherlands), with a secondary region in
asia-south1 (Mumbai) that serves dictionary lookups only.
Firebase Authentication and Firebase Analytics are operated by Google and may process data outside the EU. Those transfers rely on the European Commission's Standard Contractual Clauses together with Google's certification under the EU–US Data Privacy Framework. A copy of the relevant terms is available on request.
5. Who else sees it
Your data is never sold, rented, or shared for advertising. It is processed by these sub-processors, each only to provide the service:
| Processor | What it handles |
|---|---|
| Google Ireland Ltd / Google LLC (Firebase, Google Cloud Platform) | Authentication, database, file storage, hosting, analytics, logging |
| Google, Apple, Meta | Only if you choose their sign-in button: they confirm your identity to the app. The app does not post anything back to them. |
| JetBrains (YouTrack) | Bug reports you submit from inside the app, including your account identifier so I can reply |
Beyond that, data is disclosed only where the law requires it.
6. How long it is kept
- Account and study data: kept until you delete your account, and erased immediately when you do.
- Imported texts: the same — deleted with the account, or individually inside the app whenever you like.
- Bug reports: kept while the issue is open and for up to two years after it is closed, so that regressions can be traced.
- Analytics events: retained by Firebase for 14 months, then deleted automatically.
- Server logs: 30 days.
7. Your rights
Under the GDPR you have the right to access your data, to have it corrected, to have it erased, to restrict or object to its processing, to receive it in a portable machine-readable form, and to withdraw consent at any time without affecting the lawfulness of processing before the withdrawal.
Erasure you can exercise yourself, immediately, without contacting me: Settings → Delete account. That screen first shows you a summary of everything the deletion will remove. See deleting your data for the detail.
Access and portability are handled by email for now — there is no self-service export button yet. Write to eric@novalingvo.app and I will send you a machine-readable copy of everything held against your account. The same address covers every other right above. I will reply within 30 days, as Art. 12(3) requires, and there is no charge.
If you think I have handled your data wrongly you may complain to a supervisory authority in the EU or UK country where you live, work, or where the problem happened. You are also free to bring a claim in court.
8. Children
The apps are not directed at children under 16 and I do not knowingly collect data from them. If you believe a child has created an account, email me and I will delete it.
9. Security
All traffic between the apps and the servers is TLS-encrypted. Study data is protected by database security rules that grant read and write access only to the signed-in account that owns it. Review history is stored append-only: even the account that owns it cannot rewrite it, only add a correction.
10. Changes
If this policy changes materially I will update the date at the top and note the change in the app's release notes. The current version always lives at novalingvo.app/privacy.