Privacy Policy
In short: you can use H1 Lingo without an account, and then your progress stays in your browser. If you create an account, we keep only what's needed to sync your progress and run friends. We never sell your data, and there are no ads or tracking cookies. This page lists everything we collect, why, who handles it, how long we keep it, and what you can do about it.
1. Who is responsible (the "controller")
Manuela Heinz and Padraig Heinz-Ward ("we", "us"), private individuals, run H1 Lingo and decide how your personal data is used. Contact: [email protected]. This policy follows the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018. H1 Lingo is a free beta for people aged 18 or over.
2. Without an account
Your progress, settings, answers, saved corrections, Puffin chats, drafts, and any details you type in about yourself are stored only in your browser on your device. We do not receive them. This is true of the claude.ai version (which has no accounts) and of the web version until you sign in.
3. Everything we collect if you create an account (web version only)
| Data | Why | Legal basis |
|---|---|---|
| Your email address | To create your account and send you sign-in links. There is no password. | Contract (the service you asked for) |
| The nickname you choose | To identify you to friends you accept. Please don't use your real name. | Contract |
| When you confirmed you are 18 or over, and which version of the Terms you accepted | To keep a record that you accepted the Terms and the 18+ rule | Legitimate interests (proving the rules were accepted) |
| Study progress: XP, streak, flashcards, lesson progress, exam marks, mistakes, study plan and settings | To sync your progress between your devices | Contract |
| Daily XP totals | To build the weekly friends leaderboard | Contract |
| Friends: requests, who you are friends with, who you have blocked | To run friends and keep people safe | Contract and legitimate interests |
| Reports you send about another user | To handle safety reports | Legitimate interests |
| Sign-in records kept by our provider (for example the time and IP address of a sign-in) | To keep accounts secure | Legitimate interests (security) |
Not synced, even with an account: Puffin chats, drafts, photos, saved corrections, and the "about me" details you can give Puffin. Those stay in your browser only.
We do not collect your real name, phone number, address, date of birth, school, location, contacts or payment details.
4. AI features (Puffin and Photo check)
- claude.ai version: what you send goes to Anthropic through your own Claude account, under your Claude account's terms and privacy policy. We do not receive it.
- Web version: when the AI features are switched on, what you send goes through our own server (run on Cloudflare) to OpenAI to produce the answer. We do not store the text or photos. OpenAI checks messages for harmful content and does not keep these requests for training. Our server counts how many requests each visitor makes per day, using a temporary counter tied to the IP address that expires after about a day, to apply fair limits and control costs.
- Puffin and Photo check are AI. You are not talking to a person. Marks and grade estimates are a study guide only. No decision with a legal or similarly significant effect on you is made automatically.
- Please don't put personal details about yourself or anyone else into messages or photos.
5. What other people can see
- Friends you accept can see your nickname, and your weekly XP if you have the leaderboard switched on.
- Nobody else can see your email, progress, answers, photos or chats.
6. Who handles your data (our processors)
| Provider | What they do | Where |
|---|---|---|
| Supabase | Accounts, sign-in emails and the database (progress, XP, friends) | Database in the EU (Ireland) |
| Cloudflare | Hosts the website and web app, runs our AI server, forwards email sent to us, and counts website visits with Cloudflare Web Analytics, which uses no cookies, does not store your IP address and does not follow you across sites | Global network |
| OpenAI | Produces Puffin's answers and Photo check corrections in the web version, when switched on | May involve processing outside the EEA, including the United States |
| Anthropic | Hosts the claude.ai version and powers its AI through your own Claude account | Anthropic's own terms apply |
Where personal data goes outside the European Economic Area, it is protected by safeguards such as the EU's Standard Contractual Clauses or an adequacy decision. We do not sell your data, share it for marketing, or give it to anyone else, except where the law requires it.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account, nickname, 18+ record, progress, XP, friends and blocks | Until you delete your account. We also delete accounts that have been inactive for 12 months. |
| Reports | Up to 12 months. If you delete your account, your name is removed from any report about you or by you. |
| Emails you send us | Up to 90 days after the beta ends, or sooner if you ask |
| Provider logs and the AI daily counters | Short periods set by the provider, normally under 90 days. The counters expire after about a day. |
| Backups | Deleted data can remain in our provider's backups for a short period, then is overwritten |
| Data in your browser | Until you delete it |
8. Your rights, and how to use them
You have the right to access your data, correct it, delete it, restrict how we use it, object to our use based on legitimate interests, and receive a copy in a portable format.
- Get a copy: Me, then Your account, then Download my data. It downloads everything we hold for your account and everything saved in your browser.
- Delete your account: Me, then Your account, then Delete my account. This deletes your account, nickname, progress, XP, friends and blocks straight away.
- Delete what's in your browser: Me, then Privacy and data, then Delete my data on this device, or clear this site's data in your browser.
- For anything else, email [email protected]. We reply within one month. We may ask you to prove it is you.
If you are unhappy with how we handle your data, you can complain to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, dataprotection.ie. We would appreciate the chance to put it right first.
9. Age: 18 and over only
- H1 Lingo is only for people aged 18 or over, and is not aimed at children.
- We do not check your age or ask for ID. We rely on what you tell us. If you give a false age, you break the Terms (see section 2 of the Terms of Use), and we may delete your account without notice.
- If we find out, or are told, that a person under 18 has an account or has sent us personal data, we will delete it promptly. If you are a parent or guardian and think a child has signed up, email [email protected].
- No wording on this page removes any legal duty we have towards a child, or any right a child or their parent has under the law.
10. Security
We protect your data with encryption in transit, database rules that let each user read and change only their own data, and secret keys kept out of the app. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the Data Protection Commission as the law requires. Keep your email account secure, because sign-in links go there.
11. Cookies and local storage
We use only the browser storage the app needs to work and to keep you signed in. We use no advertising or tracking cookies. See the Cookies and local storage notice.
12. Changes
We may update this policy. The version and date are at the top. If a change is important, the app will ask you to accept the new version.
13. Contact
Manuela Heinz and Padraig Heinz-Ward · [email protected]