YOUR INFORMATION
Privacy notice
This notice covers this website, correspondence and the current LangChat app, including internal testing. The website has no registration or checkout.
Who is responsible
Youssef Kmaira, Youssef Kmaira Softwareentwicklung, trading as LangChat, Eichelkamp 25, 38440 Wolfsburg, Germany. Email support@lang-chat.com or call +49 177 4497795.
Visiting this website
Your browser sends technical information needed to deliver and secure the pages, including your IP address, request time, requested address, browser and operating-system information, and any referrer transmitted by your browser. We use Cloudflare Pages and Cloudflare's delivery and security network, provided by Cloudflare, Inc., USA, as our hosting processor.
This processing serves our legitimate interests in providing a reliable, secure website and preventing abuse (GDPR Article 6(1)(f)). Technical request data is necessary to load the pages. We do not maintain a separate visitor database or export individual visitor logs. Cloudflare processes operational and security records for as long as necessary for those service purposes and its contractual or legal obligations. See its data processing terms.
Cookies and external content
We do not use advertising, visitor analytics, tracking pixels, newsletter forms or externally loaded fonts. The pages do not store optional cookies or local-storage identifiers. Cloudflare may use a technically necessary security cookie if a security challenge is needed; such protection serves delivery of the requested service (§ 25(2) no. 2 TDDDG). Links to other websites only take you there when you choose to follow them.
Contacting LangChat
When you email us, we process your email address, name if supplied, message, attachments and technical delivery information to answer you. Our support mailbox uses Google Workspace, supplied by Google Cloud EMEA Limited, Ireland, and its processing providers. Please avoid sending passwords, payment-card details or unnecessary sensitive information.
We use Article 6(1)(b) when your request concerns a contract or steps you request before one, Article 6(1)(c) when handling a legal obligation such as a privacy-rights request, and Article 6(1)(f) for our legitimate interest in answering other enquiries. Providing information is voluntary, but we need a contact address and enough detail to respond.
How long correspondence is kept
We review and delete ordinary resolved enquiries within 12 months of resolution. If a specific legal retention duty or unresolved claim requires longer storage, we keep only the relevant records for that duty or claim and restrict their use. Google may retain remaining service copies during its contractual deletion cycle, which allows up to 180 days after an irreversible deletion instruction, subject to applicable legal requirements. Its processing terms explain this cycle.
Processing outside the EEA
Cloudflare's global network and Google and their subprocessors may process data in the United States and other countries outside the European Economic Area. For transfers not covered by an applicable adequacy decision, their processing terms provide European Commission Standard Contractual Clauses and the accompanying safeguards. You can read the linked terms or contact us for information about the safeguards relevant to your data. An EU business address does not mean all processing stays in the EU.
Your rights
Subject to the applicable conditions, you may request access and a copy, correction, erasure, restriction or portability of your personal data. You may object to processing based on legitimate interests for reasons relating to your situation. Where processing relies on consent, you may withdraw it for the future. This website does not make automated decisions producing legal or similarly significant effects about you.
Send requests to support@lang-chat.com. We request identity evidence only where necessary and proportionate, and normally respond within one month. You can complain to a supervisory authority, including LfD Niedersachsen or the authority where you live or work.
The LangChat app
The current iOS and Android app, including internal testing, also processes account/login identifiers, language and learning preferences, optional avatars, saved vocabulary, practice messages, generated replies and feedback, learning activity, your plan (Plus or Pro) and subscription status. Supabase provides authentication and storage; the current internal-testing project is in Ireland. RevenueCat checks subscription status using the LangChat account identifier. Apple and Google provide the selected login and store services. Hetzner hosts the backend in Germany. Resend delivers authentication email through Supabase SMTP, with an Irish sending region and open/click tracking disabled. Sentry receives minimized crash and diagnostic data with EU storage and scrubbing configured. Shorebird (Code Town, Inc., USA) delivers app updates. When the app starts, it sends Shorebird a random installation ID, the app version, the platform, the processor type and the current update number. When it installs an update, it also reports whether that worked, with an error message if not. Shorebird receives the device’s IP address. No account or learning data is sent.
AI practice
Before AI practice, the app asks for your permission to share. Under Who receives my data? it names the recipients: OpenAI and, while speech input in talks is available, AssemblyAI. OpenAI receives your practice messages (including text recognized from your speech), the necessary conversation context and your language settings to write replies, suggestions and feedback. When you ask for a translation, it receives the selected text, its surrounding message and the two languages. If you create your own scenarios (part of Pro), it receives your description and answers to check them for safety and to build the scenario. We request OpenAI processing with store=false; that setting does not eliminate every provider operational or security record. See OpenAI’s API data controls.
You can withdraw sharing in Settings → Privacy, stopping new requests and retries. A request already sent may finish. Withdrawal does not delete past conversations, delete the account or cancel a subscription. AI output can be inaccurate; fictional practice details are usually sufficient.
Speech in talks
When you record speech in the app, such as a reply in a talk or a sentence you repeat with Say it in a talk or its review, the app streams that recording’s microphone audio through LangChat’s backend to AssemblyAI (AssemblyAI Inc., USA), which turns it into text. The talk’s language is sent with the audio. Unless you turn off Recognition hints in the talk’s speech settings, a list of key words from the talk, such as its target words and words from the partner’s recent lines, is sent too, to improve recognition. Hands-free is on by default: after the partner speaks, the microphone opens by itself, and recording stops when you pause. With hands-free off, you tap the microphone to record. Either way, your recognized reply appears briefly and is then sent as a practice message; tap it before then to edit it. LangChat’s backend does not store the audio. It stores the replies you send, like typed ones, and for each recording a usage record (talk time and provider cost) and diagnostic data without audio or text. Speech input is part of AI practice and uses the same permission. You can always type instead, and if speech input is unavailable, you type your replies.
LangChat uses AssemblyAI’s EU endpoint, so audio and transcripts are processed in the EU. AssemblyAI stores account and usage data in the US, and its support staff and subprocessors can access data from outside the EU; transfers are covered by the EU–US Data Privacy Framework or Standard Contractual Clauses under its data processing addendum. AssemblyAI states that it does not retain streamed audio or transcripts, keeping only metadata for logging and billing. We have opted out of AssemblyAI using our data to improve its models.
The conversation partner’s voice runs on your phone, so playback text is not sent to a speech provider. Until the voice model is ready, the partner may speak with your phone’s built-in Android/iOS voice.
After you sign in, the app downloads the voice model from LangChat’s model server (models.lang-chat.com, delivered through Cloudflare). The download sends your device’s IP address and normal request information to that server. It does not include your account, audio or practice text. The model stays on your device; uninstalling the app removes it.
We do not claim exclusively EU processing or zero retention across every provider. App suppliers and subprocessors can process data outside the EEA, including in the US; applicable transfers use contractual safeguards such as Standard Contractual Clauses or an applicable adequacy framework. Contact us for the safeguards relevant to your information. An Irish email sending region alone does not remove Resend’s published US processing.
App purposes, retention and deletion
Necessary account, learning, speech and subscription functions use Article 6(1)(b), applicable legal duties use Article 6(1)(c), and proportionate security/abuse handling uses Article 6(1)(f). Where processing relies on consent, you may withdraw it. Before you start, the app records your 18-or-older declaration (without asking for a birth date), your acceptance of the Terms of Use and this notice, and your AI sharing choice, each with its version and time. Talk-time accounting stores active practice time and provider-operation metadata to apply your plan’s daily talk time, the free-preview minutes and fair-use limits, without storing audio or practice text in that ledger. If you start without a plan, we record which learning path your free preview uses and when, so each account gets the preview once.
Account and learning records remain available while you maintain the account, subject to deletion. The app also holds account-specific local learning data on your device. We keep the latest sharing choices and at most 100 choice events per account. Voluntary AI reports, including selected content, reason, optional note and source/account identifiers, expire after 90 days or with the account. Settled provider-operation details expire after 90 days and monthly usage wallets after 13 months; unknown costs remain reserved for reconciliation within that wallet period. Scenarios you create are kept with your account; unfinished drafts and failed attempts are deleted after 7 days. Account deletion removes account-linked eligibility, consent, free-preview and usage records. The minimal erasure case expires 30 days after the cleanup is completed.
Private custom decks, words and dependent examples/translations are removed with the account. Previously published catalog contributions receive a separate review for personal content or an applicable retention exception; removing an account identifier alone is not treated as anonymization. Store purchase evidence, provider security records and backups follow their separate legal and operational retention rules. Sentry’s current plan normally retains new diagnostics for 30 days; its backup policy allows 90 days after backup creation. We do not promise immediate erasure from every provider or backup.
Use Settings → Delete account or our account and data deletion instructions. Manage store renewal separately through Apple or Google; account deletion does not automatically cancel billing. The rights and contact routes above apply to app data as well.