Privacy Policy

1. Who we are

SnapLing (“SnapLing”, “we”, “us”) is a language-learning product operated from Ukraine. Until a sole proprietorship (FOP) or other legal entity is registered, SnapLing is operated by an individual in Ukraine. This page will be updated with the registered operator’s legal name and city when that happens.

For privacy requests, email [email protected].

2. What this policy covers

This policy applies to:

• the marketing website at snapling.app;
• the SnapLing web application (the “App”);
• the SnapLing browser extension (the “Extension”).

The App and the Extension use the same account and the same backend. There is one privacy policy for the whole product.

3. Information we collect

Account and identity

When you create an account we collect your email address, name, password (stored as a hash), and whether the email is verified. If you sign in with Google, we receive the name, email, and profile image URL that Google provides, plus OAuth tokens needed to keep that sign-in working. We store your preferred native language and timezone when you set them.

Session and security

We store session tokens in HTTP-only cookies. For each session we may store IP address and browser user-agent to protect the account. We also keep short-lived tokens for email verification and password reset.

Learning content you create

We store folders, decks, flashcards (the word, optional surrounding excerpt, languages, translations, examples, mnemonics, image prompts), your edits, uploaded images, and AI-generated text and images. The Extension may send a selected word or phrase and a short surrounding excerpt from the page. We do not store the full page URL on the flashcard.

We distinguish material you submit, such as a private source excerpt, uploaded image, deck name, or personal edit, from translations, examples, mnemonics, illustrations, and other output produced by the Service. Section 6 explains when eligible generated output may be reused without identifying the account that requested it.

Study activity

We store spaced-repetition state, study sessions, and answer events (including whether the answer was correct, how long you took, study mode, and the local date in your timezone). This is how reviews, limits, and statistics work.

Files

Uploaded and AI-generated images are stored in our object storage together with file metadata (path, type, size, original filename). Temporary uploads that are never attached are removed automatically.

Payments

If you pay, we store plan and entitlement records, provider customer and subscription IDs, payment amounts, currency, status, invoice metadata, and webhook payloads from the payment provider. These records may include buyer name, email, billing country, tax information, and refund or dispute details returned by the provider. We do not receive or store full card numbers. Crypto checkout may include invoice identifiers and addresses in provider metadata.

Support and operations

If you email us, we receive whatever you send. Our servers write operational logs (for example request identifiers, user id, procedure name, duration, and errors) to run and debug the service. We do not use a third-party product analytics SDK.

What we do not collect

• We do not sell personal information.
• We do not use your cards, page excerpts, or study history for advertising.
• We do not run advertising or tracking pixels.
• The Extension does not collect your full browsing history.
• The Extension does not read cookies of websites other than SnapLing.

4. How we use information and legal bases

Where the GDPR or similar laws apply, we process personal data on these bases:

• Contract. Creating and running your account, storing cards, study, Extension sync, AI generation you request, pronunciation, and paid access.
• Legitimate interests. Securing accounts, preventing abuse, debugging, keeping session metadata, developing a reusable educational-content library, making eligible generated learning materials discoverable, and operating the service in a way you would reasonably expect. We do not rely on this basis to publish private source excerpts or identify which account requested a generation.
• Legal obligation. Keeping payment and accounting records where the law requires it.

We do not send marketing newsletters. Study-reminder email is not active today; if we add it, we will update this policy first.

5. Browser extension

The Extension exists to capture words from web pages and YouTube subtitles and turn them into flashcards in your SnapLing account. It cannot provide that core function without a signed-in account.

On pages where it is enabled, the Extension can:

• read the text you select;
• read a short surrounding excerpt (on the order of a few words on each side, capped at 240 characters) so the AI can disambiguate meaning;
• on YouTube, read subtitle text when you use the capture toolbar there;
• match the page URL against site allow/block patterns that you configure locally — the URL is used for that check and is not stored as flashcard source metadata;
• send the word, excerpt, languages, and destination deck or inbox to our servers when you add a card or preview a translation;
• read SnapLing authentication cookies on our domain so API requests can use your session. It does not read cookies of other sites.

A content script may run on http and https pages so capture can work wherever you read. Transmission of page text to our servers happens when you take an action (add a word, preview a translation), not as background scraping of every page.

Kept only on your device unless you sync related data to the App:

• toolbar and theme settings, site patterns, target language;
• a short-lived translation preview cache;
• a local word index used to detect duplicates;
• cached API responses and pronunciation audio with time limits.

The Extension does not load remote code, does not show ads, and does not send data to analytics companies.

Capturing a word with the Extension does not make your source excerpt, deck, account, or generated card public. We do not publish or index raw page text received through the Extension. If you later request generation through the Service, eligible Generated Content may be reused as described in section 6, but it is not attributed to your account and must not expose the private source excerpt.

Chrome Web Store Limited Use

SnapLing’s use and transfer of information received through the Extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. We use this information only to provide or improve the user-facing flashcard, translation, synchronization, authentication, security, and support features described in this policy. We transfer it only to processors needed to provide those features, for security, when the law requires it, or as otherwise allowed by that policy. We do not use it for personalized advertising or credit decisions. Human access is limited to user-requested support, security or abuse investigation, legal obligations, and aggregated or de-identified internal operations allowed by the policy.

6. AI processing

When you generate a card, we send the word, optional excerpt, languages, and related prompts to AI providers so they can return a translation, example, mnemonic, image prompt, or illustration. Pronunciation sends the word and language to Google Cloud Text-to-Speech.

We use those providers only to perform the generation you asked for. We do not grant them the right to use your content to train their own models for their own purposes, beyond what their own terms already require to run the API. OpenRouter may send the prompt to whichever underlying model is configured for that request.

Generated pronunciation audio is stored as a shared, content-addressed cache: the same word in the same language may reuse one audio file across users. Do not put secrets into words or excerpts.

Reuse and public indexing of Generated Content

SnapLing may reuse translations, definitions, examples, mnemonics, image prompts, illustrations, pronunciation, and other Generated Content to operate and improve the Service and to create public educational pages or libraries that search engines can index. Reuse may include the underlying vocabulary term when it is not protected or private.

Content is eligible for public reuse only when it does not expose a private source excerpt, uploaded image, deck name, personal edit, user identifier, or link to the account that requested it. Public pages present the material as SnapLing educational content, not as a contribution attributed to a particular user. We may reuse substantially similar output across accounts because AI output and common language-learning material are not unique.

7. Payments

To create a checkout, we send your email and payment identifier to the selected provider. For card subscriptions, we also send your name when available, account and plan identifiers, and billing period. We use returned billing records to manage paid access and resolve payment issues. Providers and their privacy policies are listed in section 9.

8. Cookies and local storage

We use cookies and similar storage only as needed to run the product:

• authentication session cookies;
• interface language;
• color theme;
• on the App, language and timezone preferences in local storage;
• on the Extension, the local data listed in section 5.

We do not use advertising or analytics cookies, and our sites do not request fonts from third-party font services. Fonts are provided by your operating system.

Hosted checkout pages follow the payment provider’s own cookie and privacy policies.

9. Who we share information with

We share personal data with service providers who help us run the product, only for the purposes above. We also share data if the law requires it, or to protect SnapLing, our users, or the public against serious harm or abuse.

The App and worker run on infrastructure we operate (currently deployed with Dokploy). Server logs go to that hosting environment.

10. International transfers

You may access SnapLing from many countries. Some processors are in the United States or other countries outside Ukraine and the EEA (including Google, OpenRouter, Replicate, Resend, and payment providers). When we transfer personal data there, we do it to provide the service you requested, using the provider’s contractual protections.

Database and file storage default to an EU region. That does not mean every processor stays in the EU.

11. Retention

• Account, cards, and study history: until you delete them or we delete the account.
• Sessions: until they expire or you sign out.
• Verification and reset tokens: until they expire.
• Payment records and webhook payloads: as long as needed for billing disputes, fraud, and legal record-keeping.
• Unattached temporary uploads: about one hour.
• Operational logs: for security and debugging, then discarded in the ordinary course of operations. We have not published a fixed log TTL.

Some artifacts may remain without a user id after account deletion: shared pronunciation audio for a word, AI output snapshots that the system keeps as de-identified backups, and Generated Content reused in public educational pages. We do not use those artifacts to identify you. Public Generated Content may remain after account deletion because it is not maintained as account-attributed personal content; we will remove personal information if we discover that it was included by mistake.

There is no self-service export or delete button yet. Email [email protected] from the address on the account. We will delete account data within 30 days, except records we must keep (for example certain payment records) and the de-identified leftovers above.

12. Security

We use HTTPS, hashed passwords, HTTP-only session cookies, and access controls on the database and files. No method of transmission or storage is perfectly secure. If we become aware of a breach that affects your personal data, we will notify you and regulators where the law requires it.

13. Children

SnapLing is not directed at children under 13. You must be at least 13 to create an account. Paid plans are for users 18 or older, or must be paid by a parent or other adult who is allowed to enter that contract.

We do not knowingly collect personal information from children under 13. If we learn that we have, we will delete the account. Contact [email protected].

14. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent where processing was based on consent (we do not rely on consent for the core service).

To exercise these rights, email [email protected]. We may need to verify that the request comes from the account holder. We aim to respond within 30 days.

You may complain to the Ukrainian Parliament Commissioner for Human Rights, and if you are in the EEA or UK, to your local data protection authority. GDPR rights apply when that law applies to our processing of your data (including when we offer the service to people in the EEA). Ukrainian personal data law applies because the operator is in Ukraine.

15. California

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. If you are a California resident and want to make a request that the CCPA/CPRA provides, use the same email as above.

16. Changes

We will post the updated policy on this page and change the dates and version number above. Material changes (for example a new processor, a new category of data, or a new purpose) get a new effective date. If the change affects how the Extension handles user data after install, we will also disclose that in the product as required by the Chrome Web Store. Editorial wording changes only update the “Last updated” date.

17. Contact

Privacy questions and data requests: [email protected].

Operator location: Ukraine.