Join the list

Legal

Privacy policy

Last updated 2026-10-19

This policy explains what personal data Portuglot uses, why, and what you can do about it. It covers the iOS and Android apps and the website at portuglot.com, including the email list. The terms of service cover the contract, subscriptions, and the course.

Who is responsible

Portuglot is published by Leduc IT OÜ, an Estonian private limited company (osaühing). Registry code 14574207. Registered address: Harju maakond, Tallinn, Lasnamäe linnaosa, Sepapaja tn 6, 15551, Estonia. The register entry is on the Estonian e-Business Register.

Contact [email protected].

Leduc IT OÜ is the controller of the personal data described here. We have not appointed a data protection officer. Write to [email protected] for a privacy request.

What we use

We keep what we need to run an account, teach the course, and answer you.

  • Account. Your email address, and a password stored by Supabase in a form that cannot be read back as the password you typed. If you use Google, or Sign in with Apple, that company confirms who you are and may send an identifier, your name, your email address, and a profile photo URL. We save the name and the photo URL on your profile when they are provided. Google sign-in is available. Sign in with Apple is shown in the iOS app and on the web log-in screen.
  • Learning. Your level, progress, streak, review schedule, and answers. A stored answer is cut to 200 characters. If you tell us why you are learning, it is one of five choices: living in Portugal, work, travel, family, or an exam. You can leave that empty.
  • Reports. If you report an exercise, we store the exercise, the lesson, the text you send (up to 500 characters), and the app version.
  • Plus. Whether a subscription is active, the plan, and whether it came from Apple or Google. We do not receive your card number. Apple or Google take the payment. RevenueCat reads the store subscription for your account id and our server stores the result.
  • Email list. If you join the list on this website, we store the address and the time you ticked the box. The tick is consent for one email, when the apps are available. That email is sent by our email provider. We do not use the address for other messages.
  • On the phone. Lessons and audio can be saved on the device so they work offline. Reminder choices are saved on the device. A note of whether we already asked for a store review is saved on the device.

Microphone and speech

A speaking exercise can use the microphone. The recording stays on the phone so you can listen back during that exercise. We do not upload the recording. What we save from the exercise is your own rating (close, or needs practice), not the audio and not the words the phone heard.

The phone can also turn your speech into words so you can see them while you practise. The app asks for on-device recognition in European Portuguese (pt-PT) first. If that cannot start, it asks the phone's speech service again without requiring on-device recognition. In that case Apple (on iPhone) or Google (on Android) may process the audio under their own rules. The words are shown in the exercise and are not saved to your Portuglot account.

You can refuse the microphone. The exercise then says the microphone is off. Pronunciation pairs and other listening exercises play our recordings. They do not use the microphone. This website does not ask for the microphone.

Reminders

On iPhone and Android you can turn on a lesson reminder. The app then schedules a local notification on that phone. Our servers do not send it. The text can say that a short lesson is waiting, and it can include how many review words are due. You can turn reminders off in Settings, or from the notification. Snooze schedules another local notification in an hour. The time you pick stays on the device. A browser does not schedule these notifications.

Analytics and crashes

We do not put a third-party analytics tool or a crash-reporting tool in the apps or on this website. There is no advertising. After a streak of 7, 30, or 100 days, or after you pass a unit, the app may ask Apple or Google to show their review dialog. We do not receive what you write. The phone remembers that we asked, so we do not ask again for about 90 days.

Why the law allows it

  • Contract. Running your account, teaching the course, and keeping your progress. This is GDPR article 6(1)(b).
  • Legitimate interests. Keeping the service reliable, limiting abuse, and securing accounts. This is GDPR article 6(1)(f). The email-list and log-in limits store a hash of an address or an IP address for a short time, not the address or the IP itself on the email-list row.
  • Consent. The email list, because you tick the box. This is GDPR article 6(1)(a). You can withdraw that consent by emailing [email protected]. We then delete the address.
  • The stores. Apple and Google keep payment records for their own legal duties. We keep the subscription status while the account exists.

Who else handles it

  • Supabase. Accounts, the database, and the email-list row. The production project is in London, United Kingdom (region eu-west-2).
  • Google. Google sign-in, and Google Play for subscriptions, cancellation, and refunds.
  • Apple. Sign in with Apple when that provider is used, and the App Store for subscriptions, cancellation, and refunds.
  • RevenueCat. Reads the store subscription for your account id so Plus can be switched on. The secret key stays on the server. The app only has the public key.
  • Cloudflare. Hosts this website, stores course audio (R2), and sees request logs, including IP addresses. Account email is sent by Cloudflare Email Service from [email protected]. That covers confirmation, password reset, a log-in link, and the notice when an address already has an account.
  • Capgo. The iOS and Android apps can download an update of the app bundle so a fix can reach the phone without a store release. When a native build starts, and when it checks for an update, the updater sends Capgo a device id (a random id the plugin stores on the phone), the app id, the platform (iOS or Android), and version numbers for the app, the operating system, and the plugin. It does not send your name, your email, or your account. The speech and recording plugins run on the phone. They are not a place we upload audio to.

Course audio is prepared before it is published. The text-to-speech step receives lesson text, not your account.

How long we keep it

  • Your account, profile, progress, settings, and subscription status: until you delete the account.
  • Raw answers: 180 days, then deleted by a daily job.
  • Review history: 2 years, then deleted by that job.
  • Short-lived rate-limit rows, including email-list limits: 1 day.
  • Store event ids that stop the same offline update being applied twice: 60 days.
  • Email-list addresses: 24 months after you join, or sooner if you ask.
  • An exercise report: until the account is deleted.
  • A recording from a speaking exercise: on the phone for that exercise, so you can listen back. It is not stored on our servers.

Delete your account, and your other rights

In the app, open Settings, then Delete account. You can delete the account even if a subscription is still billing. Deleting the account removes the account and the learning data stored with it. It also removes that account's downloaded lessons on the device. It does not cancel an Apple or Google subscription. Cancel that in the store if you want charges to stop. A reminder setting saved on the phone is separate and stays until you turn reminders off.

You can also email [email protected] and ask us to delete the account. We do the same deletion.

You can also:

  • Download your data. In the app, open Settings, then Download my data. That is a JSON file of the account data we hold.
  • Correct your name, level, and settings in the app, or ask us by email.
  • Ask us to restrict or stop a use that is based on legitimate interests.
  • Withdraw email-list consent. Email [email protected] and we delete the address.
  • Complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, [email protected], https://www.aki.ee. You can complain to them whether or not you have written to us first. If you live in another EU country, you can also complain to the authority there.

Children

Portuglot is for people aged 13 and over. Estonian law lets a child aged 13 or older consent to an information-society service when consent is the legal basis (Personal Data Protection Act § 8). We do not ask for a date of birth, so the app cannot check that age. If you believe a child under 13 has an account, email [email protected] and we will delete it.

International transfers

Supabase hosts the production database and authentication in London, United Kingdom (region eu-west-2). The United Kingdom has a European Commission adequacy decision, so that transfer relies on the adequacy decision.

Some of these companies may process data outside the European Economic Area. Supabase, Cloudflare, RevenueCat, Capgo, Google, and Apple each publish a standard data processing agreement. Those standard terms, including the standard contractual clauses in them, apply to the personal data they process for Portuglot.

Changes

If this policy changes, the date at the top changes. The current text is always at https://portuglot.com/privacy.