Privacy Policy
Applies to the Lexkite web app (lexkite.com), the Lexkite iOS/Android apps and the “Lexkite” browser extension. Effective date: October 17, 2026. See also our Terms of Use.
This policy was prepared from a template and describes how Lexkite currently works. It is not legal advice and does not replace review by a qualified lawyer.
Data controller: MODIAN LUXURY JEWELRY LLC, a Wyoming limited liability company, 30 N Gould St Ste R, Sheridan, WY 82801, USA (“Lexkite”, “we”). Contact: [email protected] or the contact form.
1. Summary
- You can use Lexkite without an account. Your learning data (saved words, context sentences, review progress, settings) is then stored only on your device.
- If you sign in with Google, a copy of your learning data and a basic account record (name, email address) are stored on our servers so they can sync between your devices.
- We measure how the product is used with our own statistics, without cookies. They use a random identifier stored on your device; if you sign in, this identifier is linked to your account (see section 2).
- Text you submit for AI feedback is processed by Google Gemini or Cloudflare Workers AI.
- We do not sell your personal data. Lexkite shows no advertising today; advertising is planned for the mobile apps and the website and will only be personalised with your consent (section 7).
- The browser extension does not collect your browsing history or page content; only the word or text you actively choose is sent to the lookup services listed below.
- You can export your data, delete it on your device and ask us to delete the server copy at any time: see How to delete your data.
2. Data we collect
| Data | When | Where it is stored |
|---|---|---|
| Words you look up or save, the sentence around them, and the title and address of the page or video where you saved them; learning progress (review schedule, XP, streaks, statistics) and settings | While you study | On your device (browser storage, app storage or extension storage) |
| Google account name, email address and profile photo, and a Firebase user ID | Only when you choose “Sign in with Google” | Firebase Authentication (Google); your name, email address and user ID are also kept in our account table on Cloudflare D1, with the date you first and last synced, how many times you synced and the platform (web, iOS, Android, extension) |
| A copy of your learning data (the same data as in the first row) | Only while you are signed in, to sync between devices | Our database on Cloudflare D1; only your own signed-in account can read or write it |
| Visitor identifier: a random code created on your device (it contains no personal information) | When you open the web app, the mobile apps or the extension | On your device; sent with usage statistics. When you sign in, it is sent once and stored together with your account ID so we can measure how many visitors create an account |
| Usage statistics for each visit: first page opened, current page, referring website (domain only), country (determined by Cloudflare from your IP address; the IP address itself is not stored), device type, platform, interface language, time spent, number of pages viewed, page load speed and whether you are a returning visitor | When you use the web app or the mobile apps (statistics may be collected from only a sample of visitors) | Our database on Cloudflare D1 |
| Extension usage counts: number of lookups, saved words, popup and new-tab opens per day, extension version and interface language, with the visitor identifier; installs, updates and uninstalls (counted per day, without an identifier) and the optional reason you choose on the uninstall page | About once a day while the extension is installed | Our database on Cloudflare D1 |
| Technical error reports: error message, code location, page within the app and app version | When the app hits an error | Our database on Cloudflare D1 (identical errors are grouped and counted; no identifier is attached) |
| Abuse-prevention data: a one-way hash of your IP address, a random device code created by the app, and your account ID if you are signed in, together with usage counts per feature | When you use AI feedback, Roleplay, QR transfer, the contact form, problem reports, sync or the leaderboard | Short-term counters at Cloudflare’s edge and in our database on Cloudflare D1 |
| Text you submit for AI feedback (essays, speaking transcripts, Roleplay messages, and text you ask the extension’s “Deep explanation” to explain) | Only when you ask for AI feedback, use Roleplay or tap “Deep explanation” | Sent to Google Gemini or Cloudflare Workers AI for processing. We store the AI result (not your text) together with a one-way hash of the request, so the same text is not scored twice |
| Microphone audio for speaking practice | Only when you tap the microphone button | Converted to text by your browser’s or device’s speech recognition (see section 4). We do not record or store audio on our servers. If you turn on on-device recognition (Whisper), audio is processed only on your device |
| Name, email address and message you send through the contact form, with your interface language and a one-way hash of your IP address | Only when you send a message | Our database on Cloudflare D1 and our support mailbox |
| Problem reports (“Report a problem”): category and description you write, an optional screenshot, your email only if you ask for updates, your account ID if you are signed in, a one-way hash of your IP address, and technical details (page within the app, app language and version, platform, screen size, browser version, recent app errors; in the browser extension only the domain of the current site, never the full address or page content) | Only when you send a report | Our database on Cloudflare D1. The report and screenshot are analysed automatically by Cloudflare Workers AI. For serious bugs, a short summary of your description, with email addresses, phone numbers, links and codes removed, may be published as an issue in our public GitHub repository; your screenshot, email and identity are never published there |
| Leaderboard: the nickname you choose, your weekly XP, league and group | Only if you are signed in and choose to join the weekly leaderboard | Our database on Cloudflare D1; your nickname and weekly XP are visible to the other members of your group |
| QR transfer (move data to another device without signing in) | Only when you create a transfer code | Encrypted on your device before upload; the decryption key stays in the QR link and never reaches our server. The encrypted copy is deleted after it is read once or after 10 minutes |
We do not ask for and do not knowingly collect sensitive data (such as health, religion or financial information). Please do not include such information in texts you submit for AI feedback, problem reports or messages.
3. Why we use your data (purposes and legal bases)
- Providing the service (learning features, account, sync between devices, AI feedback you request, QR transfer, leaderboard you join, replying to your messages and reports): performance of our contract with you (GDPR Art. 6(1)(b)).
- Usage statistics, error reports and improving the product: our legitimate interest in understanding how Lexkite is used and fixing problems (Art. 6(1)(f)). You can object at any time (section 9).
- Security and abuse prevention (rate limits, spam checks, temporary blocks): our legitimate interest in keeping free features available to everyone (Art. 6(1)(f)).
- Optional features you switch on (for example “Advanced check” in the extension, on-device speech recognition, joining the leaderboard) and personalised advertising when it is introduced: your consent (Art. 6(1)(a)), which you can withdraw at any time.
- Legal obligations (for example answering lawful requests from authorities): Art. 6(1)(c).
We do not use your data for automated decisions that have legal or similarly significant effects on you. AI scores are practice feedback only.
4. Service providers and third-party services
We use the following providers. Some process data on our behalf (processors); others, such as Google Translate or speech recognition built into your browser, receive the request directly from your device and handle it under their own privacy policies.
| Provider | What for | Data involved |
|---|---|---|
| Cloudflare (privacy policy) | Hosting (Pages), server functions, database (D1), Workers AI, Turnstile anti-spam check on the contact form, email routing, audio and image delivery (audio.lexkite.com, media.lexkite.com) | All server-side data described above; technical request data such as IP address and browser type |
| Google Firebase Authentication / Google Sign-In (Firebase privacy, Google privacy policy) | Signing in | Name, email address, profile photo, user ID |
| Google Gemini API (Gemini API terms) | AI feedback and Roleplay (sent from our server); requests sent directly from your device only if you add your own Gemini API key | The text you submit. When requests are processed under Google’s free (unpaid) tier, Google may use them to improve its products and human reviewers may read them, so do not include personal information |
| Google Translate (translate.googleapis.com) and Google Fonts | Meanings, definitions, sentence translation; fonts | The word or sentence you look up; technical request data from your device |
| Speech recognition built into your browser or device (for example Google in Chrome, Apple in Safari/iOS) | Turning your speech into text during speaking practice | Microphone audio, sent by your browser to its provider |
| YouTube (youtube-nocookie.com embeds) (Google privacy policy) | Showing video clips; in the extension, loading subtitles of the YouTube video you are watching | Technical request data; YouTube may store data on your device when you play a video |
| Free Dictionary API, Wiktionary and Wikimedia Commons (Wikimedia privacy policy), Tatoeba, Datamuse, MyMemory, Openverse | Pronunciation, definitions, images, example sentences, related words, backup translation (Openverse is called through our server) | Only the word or sentence you look up; technical request data |
| LanguageTool (privacy policy) | Grammar check, only when you tap “Check grammar” or turn on “Advanced check” in the extension | The text in the box you are checking |
| GitHub (privacy statement) | Backup host for audio files (GitHub Pages); public issue tracker for summaries of serious bug reports | Technical request data; the cleaned summary described in section 2 |
| Resend and Brevo (Resend, Brevo) | Sending status updates about your problem report, only if you ask for them | Your email address and the update |
| Google (Gmail) | Our support mailbox, which receives contact-form messages and report alerts | Your message, name and email address |
| jsDelivr and Hugging Face | Downloading the open-source speech recognition model, only if you turn on on-device recognition | Technical request data |
| Google AdMob and Google AdSense (how Google uses data for ads) | Advertising: planned, not active yet (section 7) | When enabled: device advertising identifier, IP address, app and device information, consent choices |
Some features run entirely on your device and send nothing to us: Chrome’s built-in AI (used by the extension when available), text-to-speech in the mobile apps, local study reminders and on-device speech recognition (Whisper).
5. Cookies and local storage
Lexkite does not use cookies for statistics, tracking or advertising. Instead, the app stores data in your browser’s local storage and IndexedDB, in the app’s storage on your phone, or in the extension’s storage:
- Strictly necessary / functional: your learning data and settings, interface language (including a country code detected once from our own server to choose the default language), sign-in session (stored by Firebase Authentication), offline copies of the app and audio files (service worker cache), and the state of features you use.
- Statistics: the random visitor identifier and sampling settings used for our own usage statistics (section 2).
- Abuse prevention: a random device code sent with requests to AI feedback, Roleplay and QR transfer.
Third-party content may set its own cookies or storage: Cloudflare Turnstile when you open the contact form, YouTube when you play an embedded video and Google when you sign in. You can delete all Lexkite data stored in your browser at any time by clearing the site data for lexkite.com in your browser settings (this also deletes unsynced learning data).
When advertising is introduced, the ad providers will use cookies or the device advertising identifier; in the European Economic Area, the United Kingdom and Switzerland we will ask for your consent first through Google’s consent tool (section 7).
6. AI features
- AI feedback on essays and speaking, and Roleplay replies, are generated by Google Gemini or Cloudflare Workers AI (Meta Llama models). Requests are sent from our server; your name and email are not included.
- Free AI features have daily limits. To apply them, we count requests by account ID, random device code and hashed IP address.
- AI output can be wrong. It is practice feedback only and is not an official score (see our Terms of Use).
- In the app and the extension, you can optionally add your own Gemini API key; it is stored only on your device and requests are then sent directly from your device to Google using your key.
7. Advertising (planned)
Lexkite currently shows no ads and loads no advertising code. We plan to show ads in the iOS and Android apps (Google AdMob) and possibly on the website (Google AdSense) to keep Lexkite free. When ads are enabled:
- Ads will not appear during lessons, tests or reviews, and the browser extension will never show ads.
- Google may collect your device advertising identifier, IP address and device information to show, measure and limit ads. In the EEA, the UK and Switzerland, ads will be personalised only with your consent, collected through Google’s User Messaging Platform (UMP); otherwise only non-personalised ads will be shown. You can change your choice in the app’s privacy settings.
- On iOS, we will ask for permission before accessing the advertising identifier (App Tracking Transparency), where required.
- US state privacy laws (including the CCPA/CPRA): we do not sell your personal information for money. Once personalised ads are introduced, sharing data with ad providers may count as “sharing” for cross-context behavioural advertising; we will provide a “Do not sell or share my personal information” option in the app and honour Global Privacy Control signals on the web.
- We will update this policy before ads are enabled.
8. How long we keep data
| Data | Retention |
|---|---|
| Learning data on your device | Until you delete it, clear the site data or uninstall the app or extension |
| Synced learning data, account record and the link between your visitor identifier and your account | While you use your account; deleted within 30 days of your deletion request |
| Usage statistics for each visit | Automatically deleted after about 400 days |
| Extension daily usage counts | Kept for product statistics; no automatic deletion period is in place yet. They contain only counts and the random identifier |
| Technical error reports | Until the error is fixed and the log is cleared |
| Problem reports and screenshots | Up to 24 months, then deleted automatically. Summaries published on GitHub remain until we delete the issue; you can ask us to delete them |
| Contact-form messages | As long as needed to handle your request and follow-up; you can ask us to delete them |
| AI results cache (results only, not your text) | Kept to avoid scoring the same text twice; it does not contain your name, email or account ID |
| Abuse-prevention counters | Daily counters are deleted after about 8 days; temporary blocks last at most 7 days |
| QR transfer data | Deleted after the first read or after 10 minutes |
| Leaderboard data | The current week and your nickname are deleted when you leave the leaderboard; all leaderboard data is deleted when you ask us to delete your account data |
9. Your rights and how to delete your data
Export: Settings → Export backup downloads all your learning data as a file.
Delete data on your device: Settings → Delete all study data deletes your flashcards, progress, XP and statistics on that device. You can also clear the site data for lexkite.com in your browser, uninstall the mobile app, or remove the extension (this deletes the data stored in it).
Delete your account and server data: in the web app or the mobile app, open Settings → account card → Delete account (or go to lexkite.com/app/#/settings?delete=account), sign in again to confirm, and your synced learning data, account record, the link between your visitor identifier and your account, your leaderboard data and your sign-in record in Firebase Authentication are deleted immediately; problem reports you sent are kept without your email or account ID. You can also email [email protected] with the subject “Delete my Lexkite data” from the email address you sign in with, or use the contact form with that address. We will delete your synced learning data, account record, the link between your visitor identifier and your account, your leaderboard data, your sign-in record in Firebase Authentication and, on request, your problem reports and messages, within 30 days, and confirm by email. Your Google account itself is not affected. Anonymous statistics that are not linked to your account may be kept for the periods in section 8.
Stop syncing: sign out at any time; your data then stays only on your device. You can also remove Lexkite’s access to your Google account at myaccount.google.com/permissions.
Your rights: depending on where you live (for example under the GDPR, UK GDPR, the CCPA/CPRA or Vietnam’s personal data protection law), you may have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to its processing (including our usage statistics), to withdraw consent, and to opt out of the sale or sharing of personal information. We will not treat you differently for using these rights. Contact us to exercise them; we reply within 30 days and may need to verify your identity. You can also complain to your local data protection authority.
10. Children
Lexkite is not directed to children under 13, and we do not knowingly collect personal data from children under 13. In the EEA and the UK, users under 16 (or the lower age set by their country) should sign in only with the consent of a parent or guardian. If you believe a child has given us personal data, contact us and we will delete it. When advertising is introduced, we will not show personalised ads to users we know are under the applicable age.
11. International transfers
Lexkite is operated from the United States and uses providers (Cloudflare, Google, GitHub and others) that process data in the United States and other countries. Cloudflare serves requests from data centres around the world. Where data from the EEA, the UK or Switzerland is transferred, we rely on the safeguards offered by these providers, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
12. Security
All data is sent over encrypted connections (HTTPS). Each account can read and write only its own synced data, verified with Google-signed sign-in tokens. IP addresses used for abuse prevention are stored only as one-way hashes. QR transfers are encrypted on your device. Access to our systems is limited to authorised administrators, and administrative actions are logged. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as required by law.
13. Browser extension
- The extension does not collect or send your browsing history or page content. Only the word or text you actively double-click, select or tap is sent to the lookup services in section 4. Optional on-page features (highlighting words you have saved, underlining academic words) run entirely on your device.
- Writing check (off by default). If you turn on “Writing check”, the text you type in a text box is checked for English mistakes on your device (Lexkite rules and, if your Chrome has it, Chrome’s built-in AI proofreader). Only if you also turn on “Advanced check” is the text of the box you are typing in sent to LanguageTool to find more mistakes (at most 20 checks per minute); it is not sent to us. Password, email, number and payment-card fields, banking and payment sites, and sites you turn it off for are never checked. Mistakes you repeat are saved only on your device in your Mistake notebook (a short sentence excerpt), and words you often misspell may be added to your flashcards (the word only).
- Deep explanation (AI). Only when you tap “🤖 Deep explanation” in the translation card, the English text you selected and the sentence around it are explained by Chrome’s built-in AI on your device if it is already available. Otherwise they are sent to our server (lexkite.com/api/ai) with a random device identifier used only for the daily free limit, and processed by Google Gemini or Cloudflare Workers AI as described in section 2. If you added your own Gemini key, it is used only when our free AI cannot answer. Nothing is sent until you tap the button.
- Once a day the extension sends us the usage counts described in section 2. These counts never include the words you look up, page addresses, your name or email. When you uninstall the extension, a page on lexkite.com opens where you can optionally tell us why.
- Permissions: access to websites (http/https) to show the lookup card, translate selected text, look up words in YouTube subtitles and run the optional on-page features above; storage to keep your vocabulary and progress on your device; alarms and notifications for study reminders; contextMenus for the right-click “Look up / Translate selection” item; scripting to enable lookup in tabs that were already open when you installed the extension and to read the subtitle list of the YouTube video you are watching; search so the search box on the Lexkite new tab page sends your query to your default search engine. The new tab page can be turned off in the extension settings.
- Limited Use: Lexkite’s use of information received through the extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. We use this data only to provide and improve the extension’s single purpose (learning English vocabulary while you browse); we do not sell it, do not use or transfer it for advertising or to determine creditworthiness, and do not allow humans to read it except with your consent, for security or legal reasons, or in aggregated form. Information received from Google sign-in is used only to sign you in and sync your data, in line with the Google API Services User Data Policy.
14. Changes to this policy
If we change this policy, we will update the effective date at the top of this page. For important changes, such as enabling advertising or a new type of data processing, we will update this policy before the change takes effect and, where appropriate, inform you in the app.
15. Contact
For any question or request about your personal data, contact [email protected] or use the contact form. We reply within 30 days.
MODIAN LUXURY JEWELRY LLC
30 N Gould St Ste R, Sheridan, WY 82801, USA
16. Open data credits
- Core word list: NGSL 1.2 – New General Service List © Browne, C., Culligan, B. & Phillips, J., licensed under CC BY-SA 4.0 (newgeneralservicelist.com). Lexkite’s translations are released under the same licence.
- Illustrations: Creative Commons and public-domain images via Openverse; the author and licence are shown under the ⓘ button on each image.
- Academic and business word lists: NAWL 1.2 and BSL 1.20 © Browne, Culligan & Phillips, CC BY-SA 4.0; definitions and examples partly from Wiktionary via the Free Dictionary API (CC BY-SA).
- Bilingual example sentences: Tatoeba (CC BY 2.0 FR).
“IELTS” is a trademark of the British Council, IDP: IELTS Australia and Cambridge University Press & Assessment; “TOEIC” and “TOEFL” are trademarks of ETS. Lexkite is an independent product and is not affiliated with or endorsed by these organisations.