lexkite

Privacy Policy

Applies to the Lexkite web app (lexkite.com), the Lexkite iOS/Android apps and the “Lexkite” browser extension. Effective date: October 17, 2026. See also our Terms of Use.

This policy was prepared from a template and describes how Lexkite currently works. It is not legal advice and does not replace review by a qualified lawyer.

Data controller: MODIAN LUXURY JEWELRY LLC, a Wyoming limited liability company, 30 N Gould St Ste R, Sheridan, WY 82801, USA (“Lexkite”, “we”). Contact: [email protected] or the contact form.

1. Summary

2. Data we collect

DataWhenWhere it is stored
Words you look up or save, the sentence around them, and the title and address of the page or video where you saved them; learning progress (review schedule, XP, streaks, statistics) and settingsWhile you studyOn your device (browser storage, app storage or extension storage)
Google account name, email address and profile photo, and a Firebase user IDOnly when you choose “Sign in with Google”Firebase Authentication (Google); your name, email address and user ID are also kept in our account table on Cloudflare D1, with the date you first and last synced, how many times you synced and the platform (web, iOS, Android, extension)
A copy of your learning data (the same data as in the first row)Only while you are signed in, to sync between devicesOur database on Cloudflare D1; only your own signed-in account can read or write it
Visitor identifier: a random code created on your device (it contains no personal information)When you open the web app, the mobile apps or the extensionOn your device; sent with usage statistics. When you sign in, it is sent once and stored together with your account ID so we can measure how many visitors create an account
Usage statistics for each visit: first page opened, current page, referring website (domain only), country (determined by Cloudflare from your IP address; the IP address itself is not stored), device type, platform, interface language, time spent, number of pages viewed, page load speed and whether you are a returning visitorWhen you use the web app or the mobile apps (statistics may be collected from only a sample of visitors)Our database on Cloudflare D1
Extension usage counts: number of lookups, saved words, popup and new-tab opens per day, extension version and interface language, with the visitor identifier; installs, updates and uninstalls (counted per day, without an identifier) and the optional reason you choose on the uninstall pageAbout once a day while the extension is installedOur database on Cloudflare D1
Technical error reports: error message, code location, page within the app and app versionWhen the app hits an errorOur database on Cloudflare D1 (identical errors are grouped and counted; no identifier is attached)
Abuse-prevention data: a one-way hash of your IP address, a random device code created by the app, and your account ID if you are signed in, together with usage counts per featureWhen you use AI feedback, Roleplay, QR transfer, the contact form, problem reports, sync or the leaderboardShort-term counters at Cloudflare’s edge and in our database on Cloudflare D1
Text you submit for AI feedback (essays, speaking transcripts, Roleplay messages, and text you ask the extension’s “Deep explanation” to explain)Only when you ask for AI feedback, use Roleplay or tap “Deep explanation”Sent to Google Gemini or Cloudflare Workers AI for processing. We store the AI result (not your text) together with a one-way hash of the request, so the same text is not scored twice
Microphone audio for speaking practiceOnly when you tap the microphone buttonConverted to text by your browser’s or device’s speech recognition (see section 4). We do not record or store audio on our servers. If you turn on on-device recognition (Whisper), audio is processed only on your device
Name, email address and message you send through the contact form, with your interface language and a one-way hash of your IP addressOnly when you send a messageOur database on Cloudflare D1 and our support mailbox
Problem reports (“Report a problem”): category and description you write, an optional screenshot, your email only if you ask for updates, your account ID if you are signed in, a one-way hash of your IP address, and technical details (page within the app, app language and version, platform, screen size, browser version, recent app errors; in the browser extension only the domain of the current site, never the full address or page content)Only when you send a reportOur database on Cloudflare D1. The report and screenshot are analysed automatically by Cloudflare Workers AI. For serious bugs, a short summary of your description, with email addresses, phone numbers, links and codes removed, may be published as an issue in our public GitHub repository; your screenshot, email and identity are never published there
Leaderboard: the nickname you choose, your weekly XP, league and groupOnly if you are signed in and choose to join the weekly leaderboardOur database on Cloudflare D1; your nickname and weekly XP are visible to the other members of your group
QR transfer (move data to another device without signing in)Only when you create a transfer codeEncrypted on your device before upload; the decryption key stays in the QR link and never reaches our server. The encrypted copy is deleted after it is read once or after 10 minutes

We do not ask for and do not knowingly collect sensitive data (such as health, religion or financial information). Please do not include such information in texts you submit for AI feedback, problem reports or messages.

3. Why we use your data (purposes and legal bases)

We do not use your data for automated decisions that have legal or similarly significant effects on you. AI scores are practice feedback only.

4. Service providers and third-party services

We use the following providers. Some process data on our behalf (processors); others, such as Google Translate or speech recognition built into your browser, receive the request directly from your device and handle it under their own privacy policies.

ProviderWhat forData involved
Cloudflare (privacy policy)Hosting (Pages), server functions, database (D1), Workers AI, Turnstile anti-spam check on the contact form, email routing, audio and image delivery (audio.lexkite.com, media.lexkite.com)All server-side data described above; technical request data such as IP address and browser type
Google Firebase Authentication / Google Sign-In (Firebase privacy, Google privacy policy)Signing inName, email address, profile photo, user ID
Google Gemini API (Gemini API terms)AI feedback and Roleplay (sent from our server); requests sent directly from your device only if you add your own Gemini API keyThe text you submit. When requests are processed under Google’s free (unpaid) tier, Google may use them to improve its products and human reviewers may read them, so do not include personal information
Google Translate (translate.googleapis.com) and Google FontsMeanings, definitions, sentence translation; fontsThe word or sentence you look up; technical request data from your device
Speech recognition built into your browser or device (for example Google in Chrome, Apple in Safari/iOS)Turning your speech into text during speaking practiceMicrophone audio, sent by your browser to its provider
YouTube (youtube-nocookie.com embeds) (Google privacy policy)Showing video clips; in the extension, loading subtitles of the YouTube video you are watchingTechnical request data; YouTube may store data on your device when you play a video
Free Dictionary API, Wiktionary and Wikimedia Commons (Wikimedia privacy policy), Tatoeba, Datamuse, MyMemory, OpenversePronunciation, definitions, images, example sentences, related words, backup translation (Openverse is called through our server)Only the word or sentence you look up; technical request data
LanguageTool (privacy policy)Grammar check, only when you tap “Check grammar” or turn on “Advanced check” in the extensionThe text in the box you are checking
GitHub (privacy statement)Backup host for audio files (GitHub Pages); public issue tracker for summaries of serious bug reportsTechnical request data; the cleaned summary described in section 2
Resend and Brevo (Resend, Brevo)Sending status updates about your problem report, only if you ask for themYour email address and the update
Google (Gmail)Our support mailbox, which receives contact-form messages and report alertsYour message, name and email address
jsDelivr and Hugging FaceDownloading the open-source speech recognition model, only if you turn on on-device recognitionTechnical request data
Google AdMob and Google AdSense (how Google uses data for ads)Advertising: planned, not active yet (section 7)When enabled: device advertising identifier, IP address, app and device information, consent choices

Some features run entirely on your device and send nothing to us: Chrome’s built-in AI (used by the extension when available), text-to-speech in the mobile apps, local study reminders and on-device speech recognition (Whisper).

5. Cookies and local storage

Lexkite does not use cookies for statistics, tracking or advertising. Instead, the app stores data in your browser’s local storage and IndexedDB, in the app’s storage on your phone, or in the extension’s storage:

Third-party content may set its own cookies or storage: Cloudflare Turnstile when you open the contact form, YouTube when you play an embedded video and Google when you sign in. You can delete all Lexkite data stored in your browser at any time by clearing the site data for lexkite.com in your browser settings (this also deletes unsynced learning data).

When advertising is introduced, the ad providers will use cookies or the device advertising identifier; in the European Economic Area, the United Kingdom and Switzerland we will ask for your consent first through Google’s consent tool (section 7).

6. AI features

7. Advertising (planned)

Lexkite currently shows no ads and loads no advertising code. We plan to show ads in the iOS and Android apps (Google AdMob) and possibly on the website (Google AdSense) to keep Lexkite free. When ads are enabled:

8. How long we keep data

DataRetention
Learning data on your deviceUntil you delete it, clear the site data or uninstall the app or extension
Synced learning data, account record and the link between your visitor identifier and your accountWhile you use your account; deleted within 30 days of your deletion request
Usage statistics for each visitAutomatically deleted after about 400 days
Extension daily usage countsKept for product statistics; no automatic deletion period is in place yet. They contain only counts and the random identifier
Technical error reportsUntil the error is fixed and the log is cleared
Problem reports and screenshotsUp to 24 months, then deleted automatically. Summaries published on GitHub remain until we delete the issue; you can ask us to delete them
Contact-form messagesAs long as needed to handle your request and follow-up; you can ask us to delete them
AI results cache (results only, not your text)Kept to avoid scoring the same text twice; it does not contain your name, email or account ID
Abuse-prevention countersDaily counters are deleted after about 8 days; temporary blocks last at most 7 days
QR transfer dataDeleted after the first read or after 10 minutes
Leaderboard dataThe current week and your nickname are deleted when you leave the leaderboard; all leaderboard data is deleted when you ask us to delete your account data

9. Your rights and how to delete your data

Export: Settings → Export backup downloads all your learning data as a file.

Delete data on your device: Settings → Delete all study data deletes your flashcards, progress, XP and statistics on that device. You can also clear the site data for lexkite.com in your browser, uninstall the mobile app, or remove the extension (this deletes the data stored in it).

Delete your account and server data: in the web app or the mobile app, open Settings → account card → Delete account (or go to lexkite.com/app/#/settings?delete=account), sign in again to confirm, and your synced learning data, account record, the link between your visitor identifier and your account, your leaderboard data and your sign-in record in Firebase Authentication are deleted immediately; problem reports you sent are kept without your email or account ID. You can also email [email protected] with the subject “Delete my Lexkite data” from the email address you sign in with, or use the contact form with that address. We will delete your synced learning data, account record, the link between your visitor identifier and your account, your leaderboard data, your sign-in record in Firebase Authentication and, on request, your problem reports and messages, within 30 days, and confirm by email. Your Google account itself is not affected. Anonymous statistics that are not linked to your account may be kept for the periods in section 8.

Stop syncing: sign out at any time; your data then stays only on your device. You can also remove Lexkite’s access to your Google account at myaccount.google.com/permissions.

Your rights: depending on where you live (for example under the GDPR, UK GDPR, the CCPA/CPRA or Vietnam’s personal data protection law), you may have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to its processing (including our usage statistics), to withdraw consent, and to opt out of the sale or sharing of personal information. We will not treat you differently for using these rights. Contact us to exercise them; we reply within 30 days and may need to verify your identity. You can also complain to your local data protection authority.

10. Children

Lexkite is not directed to children under 13, and we do not knowingly collect personal data from children under 13. In the EEA and the UK, users under 16 (or the lower age set by their country) should sign in only with the consent of a parent or guardian. If you believe a child has given us personal data, contact us and we will delete it. When advertising is introduced, we will not show personalised ads to users we know are under the applicable age.

11. International transfers

Lexkite is operated from the United States and uses providers (Cloudflare, Google, GitHub and others) that process data in the United States and other countries. Cloudflare serves requests from data centres around the world. Where data from the EEA, the UK or Switzerland is transferred, we rely on the safeguards offered by these providers, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

12. Security

All data is sent over encrypted connections (HTTPS). Each account can read and write only its own synced data, verified with Google-signed sign-in tokens. IP addresses used for abuse prevention are stored only as one-way hashes. QR transfers are encrypted on your device. Access to our systems is limited to authorised administrators, and administrative actions are logged. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as required by law.

13. Browser extension

14. Changes to this policy

If we change this policy, we will update the effective date at the top of this page. For important changes, such as enabling advertising or a new type of data processing, we will update this policy before the change takes effect and, where appropriate, inform you in the app.

15. Contact

For any question or request about your personal data, contact [email protected] or use the contact form. We reply within 30 days.

MODIAN LUXURY JEWELRY LLC
30 N Gould St Ste R, Sheridan, WY 82801, USA

16. Open data credits

“IELTS” is a trademark of the British Council, IDP: IELTS Australia and Cambridge University Press & Assessment; “TOEIC” and “TOEFL” are trademarks of ETS. Lexkite is an independent product and is not affiliated with or endorsed by these organisations.