Skip to content

Legal

Privacy Policy

Last updated: November 6, 2026

LinguaCap is published by BaursaqApps, an individual entrepreneur registered in Kazakhstan, under the developer name Baursaq ("Baursaq", "we", "us", "our"). We operate the LinguaCap iOS app, the LinguaCap Android app, the LinguaCap Chrome extension and the linguacap.com website (together, the "Services"). This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our Services.

We are committed to protecting your privacy. We do not sell your personal data, we do not use it for advertising, and we do not track you across other companies' apps or websites. We do use analytics services to understand how our own apps are used; they are described in sections 1.8 (iOS app) and 1.25 (Android app).

Some practices differ between our apps and our Chrome extension. Where this is the case, sub-sections marked iOS App, Android App and Chrome Extension say which product the information refers to.

1. Information We Collect

2. How We Use Your Information

Data CategoryPurposeLegal Basis
Account info (email, name, user ID)Account creation, authentication, profile display, support repliesContract performance
Learning profile (languages, level, goal)Tailoring translations and lessons to your level and language pairContract performance
Saved words, flashcards & learning statsCore functionality, progress tracking, cross-device syncContract performance
Watch history, bookmarks & transcriptsResume playback, quick access to content, cross-device syncContract performance
Subtitle / translation text (sent for processing)AI punctuation correction and translationContract performance
Subscription status & billing eventsFeature access management, entitlement verification, accountingContract performance; legal obligation
Support messages and attached imagesAnswering your support requestsContract performance
Push notification tokenNotifying you when support repliesConsent
Product analytics & session replay — iOS appUnderstanding how the App is used, fixing usability problems, A/B testingConsent (opt-out available)
App analytics — Android appUnderstanding which screens are used and whether notifications arriveLegitimate interest
Video-open events — Android appChoosing when to ask for a ratingLegitimate interest
IP address & request diagnosticsSecurity, abuse prevention, rate limiting, debuggingLegitimate interest
Approximate country (from IP)Showing region-appropriate help and support informationLegitimate interest
Anonymous user ID — ExtensionTranslation request rate limitingLegitimate interest

3. Data Storage and Security

3.1 Local Storage

  • iOS App: words, history, bookmarks, and learning stats are stored on your device using Apple's SwiftData framework and UserDefaults. Authentication tokens are stored in the iOS Keychain with kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly protection.
  • Android App: words, history, bookmarks, books and learning stats are stored in the App's private storage (a local database and app preferences), which other apps cannot read. Sign-in tokens are kept in the App's private preferences. If Android backup is turned on in your system settings, Android may include the App's data in your Google backup.
  • Chrome Extension: saved words, preferences, and session tokens are stored locally in chrome.storage.local.

3.2 Server Storage

Our backend runs on our own servers, hosted with OVH in Germany (European Union). If you are signed in, the following is stored there:

  • Profile information (email, name, avatar URL, learning profile);
  • Subscription status, plan, expiry, and billing events;
  • Saved words, flashcard progress and settings;
  • Watch history and its transcripts (from the iOS app), and translation history;
  • Support messages, attached images and push notification tokens;
  • Video-open events used for rating requests (from the Android app);
  • Per-feature usage counters.

3.3 Security Measures

  • All network communication uses HTTPS / TLS encryption;
  • Every API request is authorised against your own account; endpoints only ever return your own rows;
  • Refresh tokens are stored as hashes, never in plain text, and are rotated on each use;
  • IP addresses used for country lookup are cached under a SHA-256 hash, not as raw addresses;
  • Passwords are never collected — sign-in is delegated to Apple, Google, or a one-time email code.

4. Third-Party Services

If you allow web analytics in Analytics settings, Google Analytics uses cookies and measures visits and interactions on the LinguaCap website and web app. You can change this choice in Analytics settings on either website.

We use the following third-party services. Each is bound by its own privacy terms and is required to protect your data to a standard equivalent to this policy. We do not authorise any of them to sell your data or use it for their own advertising.

ServicePurposeData SharedPrivacy Policy
Apple (Sign-In, In-App Purchase) — iOSAuthentication, paymentsApple ID token; purchase dataApple Privacy
Google Play (Billing, In-App Review) — AndroidPayments, rating requestsPurchase dataGoogle Privacy
Google Analytics 4 — WebWebsite traffic and interaction statisticsAnalytics cookie identifiers, page views, campaign parameters and selected interactionsGoogle Privacy
Google (Sign-In)AuthenticationGoogle OAuth tokenGoogle Privacy
RevenueCat — iOS and AndroidSubscription managementUser ID, entitlements, purchase eventsRevenueCat Privacy
PostHog — iOSProduct analytics and session replayUser ID, email, subscription status, learning profile, in-app events, masked recordings of the onboarding and paywall screensPostHog Privacy
Google Firebase — iOS and AndroidPush notifications (Cloud Messaging), feature experiments (Remote Config, iOS) and app analytics (Google Analytics for Firebase, Android)Push token, app-instance identifier; on Android also screen views, device and app details, and the advertising ID where your settings allow itFirebase Privacy
IPinfoDetermining approximate country from IPIP addressIPinfo Privacy
GroqAI translation, punctuation correctionSelected text / subtitle linesGroq Privacy
OpenAIAI translation fallbackSelected text / subtitle linesOpenAI Privacy
DeepSeekAI translation fallbackSelected text / subtitle linesDeepSeek Privacy
Google TranslateBasic word and line translationSelected textGoogle Privacy
YouTubeVideo content and subtitlesVideo requestsYouTube / Google Privacy
ResendSending sign-in codes and account emailsEmail addressResend Privacy
Stripe — webCard payments for the web/Extension subscriptionEmail, subscription identifiers. Card details go directly to Stripe and never reach usStripe Privacy
Kaspi — web, KazakhstanBank transfer paymentsPayer name and payment amount for matching your paymentKaspi
OVHServer hosting (Germany, EU)All server-stored data listed in section 3.2OVH Privacy

AI providers are used for a single request at a time: the text you send is processed in real time to produce your translation, and we do not retain it afterwards. We send only the word, phrase, or subtitle line being translated — never your email, name, or account identifiers. How each provider handles data it receives through its API is governed by that provider's own terms, linked above.

5. App and Extension Permissions

5.1 Chrome Extension

The Chrome Extension requests the following permissions:

  • webRequest — to detect subtitle file downloads (VTT/SRT) from streaming services;
  • storage — to save your preferences and dictionary locally;
  • activeTab — to interact with the current tab's video player;
  • alarms — to periodically check whether linking the Extension to your account has completed;
  • host_permissions (*://*/*) — required because subtitle URLs vary across streaming platforms and CDN domains; the Extension only activates its features on supported sites (YouTube, Netflix, Bilibili, Spotify, Yandex Music and other sites with VTT/SRT subtitles).

5.2 Android App

  • Internet and network state — to reach our servers and the video sites you open in the App;
  • Notifications — optional, to tell you when support replies (Android 13 and later ask you first);
  • Google Play Billing — to buy and restore LinguaCap Pro;
  • Advertising ID — added by Google Analytics for Firebase, see section 1.25.

6. Data Retention

  • Local data — retained on your device until you uninstall the App / Extension or clear its data;
  • Account and learning data — retained as long as your account exists, then deleted as described in section 7;
  • Subscription and billing records — retained after account deletion where accounting or tax law requires it;
  • Support messages — retained while your account exists so we can follow up on your requests;
  • Request diagnostics (IP, endpoint, status) — held only in an in-memory buffer of the most recent requests and discarded whenever our server restarts;
  • IP-to-country cache — stored under a SHA-256 hash and expires automatically after 24 hours;
  • Rate-limit and usage counters — expire automatically after their window (12 hours to one day);
  • Analytics events and session replays — retained by PostHog (iOS app) and Google Analytics for Firebase (Android app) according to our projects' retention settings, and deleted on request;
  • Processed text (translations, punctuation) — not retained after real-time processing, except transcripts saved with your watch history as described in section 1.3.

7. Your Rights

You have the following rights regarding your personal data. To exercise any of them, use the App where indicated or email us at [email protected]; we respond within 30 days.

  • Access: You can view your profile and saved data within the App, and request a full copy from us;
  • Correction: You can update your learning profile in the App and your name and email through your Apple or Google account;
  • Deletion: You can delete your account and all associated data from the settings of the iOS or Android app. Deletion is permanent and removes your server-stored data within 30 days, except records we must keep for accounting purposes. Deleting your account does not cancel a subscription: cancel it in the App Store or Google Play. For the Extension, uninstalling it removes all local data;
  • Export: Contact us to request a machine-readable copy of your data;
  • Opt out of analytics: You can ask us to disable product analytics and session replay in the iOS app for your account by emailing us, and we will opt your profile out and delete the events and recordings already collected. On Android, you can reset or delete your advertising ID in your Android settings, and ask us to delete the analytics data linked to your device. Opting out never limits any paid or free feature;
  • Withdraw other consent: Turn off notification permission in iOS or Android settings to stop push notifications, or sign out and delete your account to withdraw consent entirely;
  • Object or complain: If you are in the EEA or UK you may object to processing based on legitimate interest and lodge a complaint with your local data protection authority.

8. Children's Privacy

LinguaCap is not directed at children under 13 years of age (or the applicable minimum age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

9. International Data Transfers

Our own servers are located in Germany (European Union). Some of the third-party processors listed in section 4 — including PostHog, Google (Firebase and Google Play), RevenueCat, IPinfo, Groq, OpenAI, Resend, and Stripe — process data in the United States or other countries. Where such a transfer leaves the EEA or UK, it relies on the safeguards offered by that provider, such as the European Commission's Standard Contractual Clauses. You can review each provider's terms through the links in section 4.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the App or Extension. The "Last updated" date at the top reflects when this policy was last revised.

11. Contact Us

If you have questions or concerns about this Privacy Policy or your data, contact us at:

Email: [email protected]
BaursaqApps
Astana, Kazakhstan