Back to home

Finglish by Iranopedia

Privacy Policy

Last updated: October 11, 2026

This page explains what we collect when you use Finglish, why, who helps us run it, how long we keep it, and what you can do about it. We wrote it in plain words on purpose. If anything is unclear, email us and a real person will answer.

Who we are. We are Finglish. We are the "controller" of the personal data described here, which means we decide why and how it is used.

Privacy contact: support@tryfinglish.com

The short version

  • We collect what we need to run your account, save your progress, schedule your reviews, take payment through Paddle, and make the lessons better.
  • We use analytics, including heatmaps and session replays where typed text is hidden, to find where lessons confuse people.
  • We do not sell your personal information, and we do not run advertising trackers or share your data for ads.
  • We may use your learning activity, after removing anything that identifies you, to improve Finglish and to build our own learning tools and datasets.
  • We do not keep your voice recordings or use them for training.
  • You can delete your account yourself, and you can email us to see, correct, export or delete your data.

1. What we collect

Information you give us

WhatDetails
AccountYour email, your first name, and a password (stored scrambled by our sign-in provider, so we cannot read it).
Leaderboard nameA nickname we make up for you, shown with your XP. You can change it or hide yourself in your account settings.
Welcome questionsIf you answer them: who you are learning for, which Persian you hear, your level, your daily goal, how soon you want to speak. These are picks from fixed lists, not free text.
Problem reports and ideasIf you tap the flag: the type of problem, your optional note, the lesson step you were on, what you typed or picked, the page, the app version, your screen size, and the last few error messages.
Support emailsWhatever you write to us, and your address, so we can reply.
WaitlistThe email you type, the date, which button you pressed, the lesson or module you were on, and which version of our sign-up promise you saw.
Marketing preferencesWhether you said yes to news and lesson emails.

Information we collect while you learn

  • Lessons and reviews: which steps you did, your answers, whether they were right, how long you took, your XP, streaks, level, and how you are doing on each word, so we can save your place and bring words back when it is time.
  • Guest play: if you try Module 1 without an account, your progress and settings are saved in your own browser (local storage). If you answer the welcome questions as a guest, they are stored against a random code made on your device, not your name. If you later create an account, we offer to move that progress over.
  • Device and usage: your IP address and approximate location (city or region level), device type, operating system, browser, language, screen size, whether you added the app to your home screen, whether sound is muted, pages you open, buttons you tap, how long pages take to load, and where you came from (for example, a link on TikTok).
  • Analytics and replay: see section 6.
  • Errors: when the app breaks, we receive the error message, the page, the time and technical details so we can fix it.

Information from Paddle (payments)

When you subscribe, Paddle collects your payment details, billing country and postcode, and calculates tax. We receive the confirmation: your email, subscription status and dates, the plan, the country, and Paddle's customer and subscription codes, so we can unlock your lessons. We never see your full card number.

Voice and speech

When you record yourself for practice, the recording stays on your device, in memory, and is not uploaded to us. When you close the page, it is gone. If we add a feature that sends your voice anywhere, we will say so here and in the app before you use it.

2. How we use your information

We use it to:

  • Run Finglish: create and secure your account, save your progress, schedule reviews, show the leaderboard, unlock Full Access, and answer your emails.
  • Take payment: through Paddle, and to keep a record of your subscription.
  • Keep Finglish safe and working: prevent fraud, abuse and cheating, find and fix bugs, and meet legal duties.
  • Understand and improve the product: see which lessons and steps confuse people, which pages load slowly, and what to teach next, using the analytics in section 6.
  • Build and improve learning tools: research how people learn Persian, and build and train our own scoring, review scheduling, recommendation, speech and AI features and datasets. For this we use learning activity in a de-identified or aggregated form (see section 4).
  • Email you: account emails you need (confirming your address, resetting a password, receipts from Paddle), and, if you said yes, news and new-lesson emails.

We do not make decisions about you that have legal or similarly significant effects by automated means.

3. Our legal bases (for people in the EU, EEA, UK and Switzerland)

Why we use your dataLegal basis
Account, lessons, saving progress, subscription, supportPerformance of our contract with you
Payments, tax and accounting recordsOur legal obligations, and performance of the contract
Analytics, heatmaps and session replayIn the EEA, UK and Switzerland: your consent (you choose in the privacy banner). Elsewhere: our legitimate interest in understanding and improving Finglish, with the notice described in section 6.
Errors, security, preventing fraud and abuseOur legitimate interest in keeping Finglish safe and working
Improving Finglish using de-identified learning dataOur legitimate interest in improving and building our product. You can object (section 9).
News and lesson emailsYour consent, which you can withdraw any time

4. Learning data, de-identification and AI

We believe Finglish gets better when it learns from how real learners learn. So we use de-identified and aggregated learning data (for example, which answers learners get wrong, which hooks help, how timing relates to remembering) to improve our lessons and to build our own learning tools, models and datasets.

When we say "de-identified", we mean we have removed your name, email, account ID, IP address and other direct identifiers and taken reasonable steps so that the data cannot reasonably be linked back to you. We publicly commit that we will keep this data in de-identified form and will not try to re-identify any person from it. If we ever give de-identified or aggregated data, statistics or research to a partner, we require them by contract to do the same.

We do not put your voice recordings, your free-text messages or your email in these datasets.

5. Who we share it with

We share personal information only with:

WhoWhat forWhat they get
SupabaseDatabase and sign-in. Hosting your account and learning data. Servers are in the United States (Amazon Web Services, us-east-1).Account, progress, answers, reports, waitlist
VercelHosting and web analytics. Delivering the site and counting visits.Requests and IP addresses (in server logs), page views
PostHogProduct analytics. Showing us how people use Finglish.Page views, clicks, lesson-step events, replay recordings with typed text hidden, web performance
PaddlePayments. Selling Full Access as our Merchant of Record. Paddle is an independent controller of your payment data and uses it under Paddle's privacy notice.Your payment, billing and tax details
ResendEmail. Sending our emails and holding the waitlist.Your email address, and delivery data such as whether an email arrived
Google WorkspaceOur support mailbox. Receiving and answering your emails.Whatever you send us
SentryError monitoring. Telling us when something breaks.Error messages, page, time and technical details, which may include your IP address
Professional advisers, and authoritiesLawyers, accountants and insurers; and the government, a court or the police where the law requires or to protect rights and safetyOnly what is needed
A buyer of the businessIf Finglish is sold or merges, your data may go to the new owner, who must keep to this policyAccount and learning data

Except for Paddle, these companies act as our "processors" or "service providers": they handle data only to provide their service to us and under written terms.

We do not sell your personal information. We do not "share" it for cross-context behavioral advertising, and we do not use advertising pixels or ad networks. We do not give your data to anyone else except as described on this page. We do not knowingly sell or share the personal information of anyone under 16.

6. Cookies, analytics and session replay

We use three kinds of storage and tracking.

A. Needed to make Finglish work (no choice needed)

NameWhat it doesHow long
sb-…-auth-tokenKeeps you signed in (cookie)Until you sign out or the session ends
finglish_*, learner_persona_v1, guest_*, speak_ratings_v1Your progress, settings, sound on/off, guest progress, privacy choice (local storage, and similar)Until you clear them

B. Product analytics and session replay

We use PostHog, a product analytics service, through our own web address (/ingest) so it does not involve advertising networks. It records page views, which buttons you tap, where you look and click (heatmaps), when taps do nothing ("dead clicks"), how fast pages load, and which lesson steps you view and answer (the step type, whether you were right, and how long you took). It also records session replays, a recreated video of your visit.

In replays we hide everything you type. We also hide your email address and the first name you gave us wherever the app shows them as a label, greeting or account detail. A lesson that works your first name into a sentence can still show it in a replay. We can see what else is on the screen, such as lesson words and the buttons you press. PostHog sets a cookie and local-storage entries (named ph_…) to recognise your browser between visits. We do not link this to your name or email.

  • If you are in the EU, EEA, UK or Switzerland: analytics, heatmaps and replay stay off until you tap "Accept". Until then PostHog stores nothing on your device. If you tap "No thanks", it stores nothing and counts you only as an anonymous visit with no recording.
  • Everywhere else: analytics and replay run by default, and the first time you visit we show you a notice that says so. You can turn them off at any time with Privacy choices in the footer, and we stop recording right away.
  • Global Privacy Control and Do Not Track: California and some other states require us to honor the Global Privacy Control signal as a request not to sell or share your personal information. We do not sell or share personal information (section 5), so the signal does not change what we do. We do not respond to Do Not Track signals either. Our analytics provider acts as our service provider under a written agreement and may not use your data for its own purposes. If you want analytics and replay off, use Privacy choices.

C. Vercel Web Analytics

Counts page views without cookies. Visitors are told apart by a hash of the request that Vercel discards after 24 hours, and Vercel stores approximate location and device type, not your identity. In the EU, EEA, UK and Switzerland we load it only after you accept.

We do not use advertising cookies, social-media pixels or cross-site tracking. You can also block or delete cookies in your browser settings; some of Finglish will not work without the ones in section A.

7. Email

We send account emails you need, such as confirming your address, resetting a password, and Paddle receipts. We send news and new-lesson emails only if you said yes (when you joined the waitlist or by ticking the box when you made your account). Every one has a one-click unsubscribe link. We act on unsubscribes within 10 business days, and usually immediately. If you unsubscribe, we keep your address on a suppression list so that we do not email you again by mistake.

8. How long we keep it

WhatHow long
Account and learning dataWhile your account is open. After you delete it, we erase it within 30 days. Backups roll off within 90 days.
Guest data in your browserUntil you clear your browser's storage
Waitlist and marketing listUntil you unsubscribe, then your address stays on a suppression list
Problem reports24 months. If you delete your account, we unlink the report from you, but we may keep its text.
Support emails24 months after your last message
Subscription and payment records we receiveWhile your account is open and as long afterward as tax and accounting law requires
Analytics events24 months
Session replays30 days
Error reports30 to 90 days
Server logsA short period, under Vercel's standard log retention
De-identified and aggregated dataAs long as it is useful, because it no longer identifies you

We may keep some information longer where the law requires, or to resolve disputes and enforce our terms.

9. Your choices and rights

Everyone can:

  • see and change your name and nickname in your account settings;
  • hide yourself from the leaderboard in your account settings;
  • delete your account in your account settings. This removes your account, progress, XP and leaderboard entry. Some copies sit outside the account and are not removed by the button: your waitlist email, your address on our email list, analytics events and replays, error reports, and any problem reports you sent (we unlink those from you but may keep their text). Email us and we will erase those too. If you have an active subscription, cancel it first (the Manage subscription link is in your account and in any Paddle receipt), or email us and we will help;
  • unsubscribe from marketing emails with the link in any email;
  • change your privacy choices in Privacy choices in the footer;
  • email support@tryfinglish.com to ask for a copy of your data, to have it corrected or deleted, or to ask any question.

If you live in the EU, EEA, UK or Switzerland, you also have the right to: access your data; correct it; erase it; restrict how we use it; receive it in a portable format; object to uses based on our legitimate interests (including improving Finglish); withdraw consent at any time (without affecting what we did before); and complain to your local data protection authority. We reply within one month. In the UK, that authority is the Information Commissioner's Office.

If you live in California, or another US state with a privacy law, you may have the right to know what we collect and why; to get a copy of your data; to correct it; to delete it; to opt out of the sale or sharing of your personal information (we do neither); to limit use of sensitive personal information (we use it only to run your account); and not to be treated worse for using these rights. To use a right, email support@tryfinglish.com from the address on your account. We may ask you to confirm it is you. We reply within 45 days (and may extend once by another 45 days if we tell you why). You can have an authorized agent make a request for you by sending us written permission. If we decline a request, you can appeal by replying to that email, and if you are still not satisfied, you can contact your state attorney general.

We do not charge you for using these rights.

10. California notice at collection

In the last 12 months we collected the following categories of personal information, for the purposes in section 2. We do not sell or share any of them.

Category (California law)Examples from FinglishDisclosed to
IdentifiersName, email, IP address, account ID, device or browser ID, nicknameSupabase, Vercel, PostHog, Resend, Sentry, Paddle, Google Workspace
Customer records and commercial informationSubscription status, plan, Paddle customer codesPaddle, Supabase
Internet or other electronic network activityPages, clicks, lesson answers, timing, replaysPostHog, Vercel, Supabase, Sentry
Approximate geolocationCity or region from IP addressVercel, PostHog
InferencesYour level and which words you find hardSupabase
Sensitive personal informationAccount login (email with password), handled by our sign-in providerSupabase

We keep personal information for the periods in section 8.

11. Children

Finglish is for people 13 and older. We do not ask how old you are, and we do not knowingly collect personal information from children under 13. If you think a child under 13 has given us their details, email support@tryfinglish.com and we will delete them. In some countries the age at which a person can consent to online data use is higher than 13 (up to 16); there, a parent or guardian needs to agree for you if you are under that age. People under 18 may use Finglish only with a parent's or guardian's permission, and only adults may subscribe. We do not sell or share the personal information of anyone under 16. We do not accept voice recordings for improvement from anyone under 18.

12. Where your data goes

We are in the United States, and our providers process data in the United States and other countries. If you are in the EU, EEA, UK or Switzerland, your data is sent to the US under the safeguards our providers use: the EU-US Data Privacy Framework and its UK and Swiss extensions where the provider is certified, and otherwise the EU Standard Contractual Clauses and the UK addendum.

13. Security

We use encryption in transit, access controls, and passwords stored in scrambled form, and we limit who on our side can see personal data. No system is perfectly secure, so please use a strong password that you do not use elsewhere. If a breach affects you, we will tell you and the authorities as the law requires.

14. Changes and contact

If this page changes in a way that matters, we will say so in the app or by email, and the date at the top will change.

Questions or requests? Email support@tryfinglish.com. You can also read our Terms of Service and Refund Policy.

Operator: Finglish