Privacy Policy

1. Overview

FluencyLab ("we", "us", or "our") provides a language-training web application and a companion Chrome extension (together, the "Service"). This Privacy Policy explains what information we collect, how we use it, with whom we share it, and what choices you have.

The FluencyLab Chrome extension has a single purpose: helping learners study spoken language on YouTube by connecting video captions to the FluencyLab practice flow. It captures subtitle text from supported YouTube pages, highlights useful expressions, and sends the selected caption context to the FluencyLab app so users can review, save, and practise real phrases through listening and speaking exercises.

By using the Service you agree to the practices described below. If you do not agree, please discontinue use and contact us to delete your account.

2. Information We Collect

2.1 Account Information (Web App)

When you create a FluencyLab account we collect your email address and a hashed password. Passwords are never stored in plain text. Account information is collected only through the web application; the Chrome extension does not create or manage accounts.

2.2 Study and Learning Data (Web App)

• Language preferences and study plan — target language, native language, proficiency level, daily study time, and weekly study days.
• Task and exercise history — completed tasks, exercise attempts, self-ratings, and pronunciation scores.
• Spaced-repetition queue — review items, review attempts, and calculated next-review timestamps.
• Knowledge strength — per-phrase strength scores, practice counts, and recall-confidence metrics derived from your exercise history.

2.3 Focus Timer Data (Web App)

Session start/end times, cycle counts, and XP earned during focus sessions are stored to power the focus-timer feature and the gamification system.

2.4 Gamification Data (Web App)

Total XP earned, current level, and earned badges are stored per user account.

2.5 Audio Recordings (Web App)

When you complete speaking exercises in the web app, your microphone audio is sent over HTTPS to a speech-to-text provider for transcription and pronunciation scoring. We do not permanently store your raw audio; only the resulting transcript and score are persisted. The Chrome extension does not record audio.

2.6 Chrome Extension Data

The Chrome extension collects only the data needed to power the YouTube caption study flow. In the Chrome Web Store data-usage disclosures we declare the following categories:

• Website content — subtitle text from the YouTube video you are actively studying. Subtitle text is used to generate expression highlights and translations for that session and may be cached by content (not by user) to avoid repeated processing when the same video is studied again.
• User activity — interactions with the extension's own UI (for example, clicking a highlighted expression or opening the caption overlay). This activity is used only to drive the study experience; it is not sold, shared with advertisers, or used to build a behavioural profile.

The extension does not collect personally identifiable information, health information, financial or payment information, authentication credentials, personal communications, location, or general web-browsing history.

When you sign in to the FluencyLab web app, a short-lived bearer token can be issued to the extension so it can request your language preferences and study plan through our API. Only token hashes are stored on our servers; the raw token is shown to the extension once and never transmitted to any third party.

2.7 Cached Service Responses

To reduce costs and improve performance we cache derived content keyed to the input that produced it — not to the user who requested it. Caches may include synthesised speech audio, expression highlights generated from subtitle text, and translation results. Cached entries do not contain personally identifiable information and are shared across all users who encounter the same source content.

2.8 Browser Storage

The extension and web app use browser-local storage mechanisms:

• Chrome extension storage — stores UI state, language preferences, focus-timer phase, and gamification totals local to the extension.
• Web app localStorage / sessionStorage — stores UI preferences and short-term session state so the app can display immediately before the server responds.

Data held in browser storage stays on your device unless explicitly sent to our servers as described above.

3. How We Use Your Information

• Authenticate you and secure your account.
• Generate your personalised study plan and daily exercise sessions.
• Schedule spaced-repetition reviews based on your recall performance.
• Surface teachable expressions in YouTube subtitles via the Chrome extension.
• Power the focus timer, gamification system, and progress dashboards.
• Generate AI-based exercise content tailored to your level and context.
• Send review-due push or email notifications (only if you opt in).
• Improve the Service through aggregate, non-identifying analytics.

We do not use your information to build advertising profiles, fingerprint your device, track you across unrelated sites, or determine creditworthiness or eligibility for lending.

4. Data Storage and Security

Personal data is encrypted in transit (TLS) and at rest. Access to production data is restricted, and access controls ensure each user can only read and modify their own records. Session tokens are stored using mechanisms that reduce the risk of cross-site scripting (XSS) access wherever possible.

5. Service Providers

We rely on a small number of vetted service providers to operate the Service. Each provider receives only the minimum data required to perform its function and is contractually bound to appropriate confidentiality and data-protection terms. Provider categories include:

• Cloud hosting and database — to host the application and store user accounts and learning data.
• Authentication — to manage sign-in, password hashing, and sessions.
• Text-to-speech and speech-to-text — to synthesise audio for prompts and transcribe user recordings during speaking exercises.
• AI language models — to generate exercise content and expression highlights from subtitle text.
• Translation — to translate captions and expressions into your chosen language.
• Email delivery — to send review-reminder emails when you opt in.
• Payments — to process subscription payments. Card details are handled entirely by the payment provider; we never see or store them.

We do not sell, rent, or trade your personal information, and we do not transfer it to third parties for purposes unrelated to the functionality of the Service.

6. Chrome Extension — Permissions

The FluencyLab Chrome extension requests only the permissions required to deliver its single purpose. These match the permissions declared in our Chrome Web Store listing:

• alarms — to drive time-based study features such as the focus timer and to restore time-dependent state when the extension's background service worker resumes.
• scripting — to inject the study interface on supported YouTube pages and on the FluencyLab web app so captions can be detected and the study overlay rendered.
• storage — to save user preferences and temporary study state such as selected content and UI state.
• tabs — to identify the active supported tab and coordinate the companion flow between YouTube and the FluencyLab web app.
• declarativeNetRequestWithHostAccess — to support the extension's own network behaviour on the hosts listed below.
• Host access for supported YouTube domains — to read caption context and display the in-page study overlay on the videos you are studying.
• Host access for the FluencyLab application domain — to connect the companion study flow with your signed-in FluencyLab session.

The extension does not read, collect, or transmit data from pages other than supported YouTube pages and the FluencyLab web app.

7. Push Notifications and Email

Push notifications and review-reminder emails are entirely opt-in. You can enable or disable them at any time from your profile settings. If you revoke browser permission for push notifications, we automatically remove your push subscription from our database.

8. Data Retention

We retain your personal data for as long as your account is active. Derived, non-identifying cached content (such as synthesised audio, expression highlights, and translations) may be retained indefinitely.

If you delete your account, all personally identifiable records — including your study plan, exercise history, review queue, knowledge scores, focus sessions, and gamification data — are permanently deleted within 30 days. Shared cache entries that do not contain personal information are not deleted.

9. Your Rights

Depending on your jurisdiction you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate personal data.
• Request deletion of your personal data ("right to erasure").
• Restrict or object to certain processing activities.
• Receive a copy of your data in a portable format.
• Withdraw consent where processing is based on consent.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

10. Children's Privacy

The Service is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes, we will notify registered users via the email address associated with their account. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

12. Contact

If you have questions or concerns about this Privacy Policy or our data practices, please reach out: