Privacy Policy

1. Who we are

The data controller is James C. Yarbrough, based in New York, United States. For any privacy question or to exercise your rights, contact us at lumina@jamesconary.com.

2. What data we collect

Account data: your name, email address, and — if you sign up with email/password — a securely hashed password. If you sign in with Google, we receive your basic Google profile (name, email, account identifier).

Learning data: your chosen native and target languages, difficulty level, lesson and quiz results, response times, points ("lumens"), streak/momentum, and progress history.

Voice and conversation data: when you use the live Speak feature, your microphone audio is streamed in real time to Google’s Gemini API to power the AI tutor, and the resulting transcript of your conversation is stored so you can review your history.

Billing data: when you subscribe, our payments provider Paddle processes your payment. We store only billing metadata (a Paddle customer/subscription identifier, plan tier, status, and renewal date). We never receive or store your full card number.

Usage and technical data: metered voice-minute usage, and standard technical data such as your approximate language (from your browser), and cookies needed to keep you signed in and remember preferences.

Consent record: when you sign up, we record that you accepted this Policy and the Terms, with a timestamp and policy version.

3. How we use your data and our legal bases

To provide the service — create your account, run lessons, generate exercises, power the AI voice tutor, and track your progress (legal basis: performance of a contract).

To process voice audio through Google Gemini so the tutor can hear and respond (legal basis: performance of a contract, and your consent given at sign-up for processing voice).

To take payment and manage your subscription (legal basis: performance of a contract).

To send essential account emails such as email verification and password resets (legal basis: performance of a contract / legitimate interests).

To keep the service secure, prevent abuse, and enforce fair-use limits (legal basis: legitimate interests).

We do not sell your personal data, and we do not use it for third-party advertising.

4. AI and voice processing

The AI tutor is powered by Google’s Gemini models. Your text prompts and, in the Speak feature, your live microphone audio are sent to Google to generate responses. Transcripts of your conversations are stored in your account so you can review them.

Google processes this data as our sub-processor to deliver the AI response. Please do not share sensitive personal information (health, financial, government-ID, or similar) during conversations. You can delete your conversation history, or your whole account, at any time (see "Your rights").

5. Who we share data with

We share data only with the service providers ("processors") we need to run the service:

• Google — AI tutoring and real-time voice processing (Gemini), and optional Google Sign-In.
• Paddle — payments and subscription management, acting as Merchant of Record for your purchase.
• Neon — managed database hosting where your account data is stored.
• Vercel — application hosting and content delivery.
• Resend — sending transactional emails (verification, password reset).

We may also disclose data if required by law, or to protect our rights and the safety of users.

6. International transfers

Our providers are primarily located in the United States. Where your data is transferred outside the EEA/UK, that transfer is protected by appropriate safeguards such as the EU Standard Contractual Clauses (and the UK Addendum) operated by those providers.

7. Cookies

We use only the cookies necessary to run the service: a session cookie to keep you signed in, and a small preference cookie to remember your theme. Our payments provider may set cookies during checkout. We do not use advertising or third-party tracking cookies.

8. How long we keep your data

We keep your account and learning data for as long as your account is active. When you delete your account, we permanently erase your profile, learning history, conversation transcripts, and usage records, and we cancel any active subscription. Limited billing records may be retained by Paddle as required by tax and accounting law.

9. Your rights

If you are in the EU/EEA or UK, you have the right to access, correct, delete, restrict, or object to the processing of your data, and the right to data portability and to withdraw consent.

You can exercise the main rights directly in the app: edit your details in Profile, download a copy of your data ("Download my data"), and permanently delete your account ("Delete account") in the Profile → Danger zone.

For any other request, contact us at lumina@jamesconary.com. You also have the right to lodge a complaint with your local Data Protection Authority.

10. Payments

Payments are handled by Paddle, which acts as the Merchant of Record and independent controller for the payment transaction. Paddle’s own privacy terms govern how it processes your payment details. We receive only the billing metadata described in Section 2.

11. Children

The service is not directed to children under 16, and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.

12. Security

We use industry-standard measures to protect your data, including encryption in transit, hashed passwords, and access controls. No method of transmission or storage is completely secure, but we work to protect your information.

13. Changes to this policy

We may update this Policy from time to time. When we make material changes we will update the date above and, where appropriate, notify you. Continued use after changes take effect means you accept the updated Policy.

14. Contact

Questions or requests: lumina@jamesconary.com.