In short
You do not need an account. Without one, we do not ask for your name, email address or age, and your answers and progress stay in your browser. If you create an account, we keep your email address, an optional name and your lesson progress so you can use them on any device. Outside the EU, the EEA, the UK and Switzerland, lesson pages show advertisements from MGID, which may use cookies; in those regions no advertisements are shown. We use Google Analytics to see how the site is used: in the EU, the EEA, the UK and Switzerland only if you allow it, elsewhere unless you decline. Optional lesson measurement starts only if you allow it.
What stays in your browser
Your answers, lesson progress, review list, preferences, game scores and sound-pair results are saved in your browser’s local storage. They are not sent to us unless you are signed in (see Accounts), except that the answers to an exercise are sent to our server when you check them. Text you type in a writing task stays in your browser and, if you are signed in, is also saved to your account. The spelling and grammar check of a writing task runs in your browser with the open-source Harper checker; your text is not sent to us or to anyone else for it. The daily reminder on the review page is made in your browser and saved in your own calendar; we keep no reminder time. If you choose Google Calendar, Google receives the event you create there. If you press Record on the summary of a dictation lesson, your browser asks for permission to use the microphone; the recording stays in that page so you can play it back, is never uploaded or saved, and is deleted when you leave the page. If you then choose Check, the recording is turned into text on your device by the open-source Whisper speech-recognition model and compared with the sentence; it is not sent to us or to anyone else. The first time, and only after you agree, your browser downloads the model (about 77 MB) from Hugging Face, which receives your IP address and the usual information about your browser under its own privacy policy, and keeps it in this browser’s cache for next time.
Dictionary links
Listening lessons and Review today link words to the Cambridge Dictionary. A link opens Cambridge’s own page in a new tab; Cambridge then receives the word you look up and the usual information about your browser and connection, under its own privacy policy. We send Cambridge nothing ourselves, not even the address of our page.
Accounts
If you create an account, we store your email address; the display name you choose, if any; your password as a salted scrypt hash, never the password itself; whether and when you confirmed your email address; the lesson answers, results, writing, review list and level choice from this site, with the time each changed; and your sign-in sessions, each a random identifier stored as a hash with its creation and expiry times. Progress saved in your browser before you sign in is added to your account. We use this information only to run your account and keep your progress, because you asked us to.
Continue with Google
If you continue with Google, Google shares your Google account identifier, email address, name and profile picture link with us after you agree on its sign-in page. We store the identifier and email address, and the name only if it becomes your display name. We do not store the picture link and do not receive your Google password, contacts or other Google data. Google processes your sign-in under its own privacy policy.
Checks against automated sign-ups
The sign-up and password reset forms use Cloudflare Turnstile to tell people from automated programs, and the sign-in form asks for the same check after several failed attempts for one address. When you open one of these forms, Turnstile runs a short check in your browser, and Cloudflare processes information about your browser and connection for it under its own privacy policy. We only receive whether the check passed; we do not use it to identify or track you.
Emails about your account
We send account emails, such as a link to confirm your email address or to reset your password, through Resend, an email delivery provider that processes your address and the message to deliver it. We do not send newsletters or marketing emails.
Checking your answers
When you check or reveal an answer, our server compares your text with the lesson and returns the result. We do not store the text you typed.
Optional practice measurement
If you choose Allow measurement on a lesson page, we record visits to the lesson library and lessons, lesson starts, completed lessons and audio errors. Each record contains a random browser identifier, a random visit identifier, the lesson, the time, fixed campaign labels from the link that brought you here, the placement number of a paid ad link and whether you used a mobile or desktop screen. It does not contain your answers, name, email address, IP address or the full address of the page you came from. We use this only to understand which lessons work, on the basis of your consent.
How long we keep measurement data
Measurement records are deleted after 30 days. Daily backup copies are kept for 14 days and then deleted; copies in cloud storage are permanently removed within about two more days. A record can therefore remain in a backup for up to about 16 days after it is deleted from our database. You can withdraw your consent at any time with Turn off and remove my events on a lesson page; this deletes the events from this browser and stops new ones.
Anonymous usage counts
Our server also adds up, for each day, how many answers are checked, how many of them are right, how many hints and answers are shown, how many lessons and level checks are finished, how many game and sound-pair rounds are started and how many accounts are created, for each part of the site or game, level and interface language. In the same way it counts how often words are saved, tapped or looked up in the dictionary, lists of new words are opened, recordings are checked with speech recognition, sounds of the day are finished and shared, and worksheets are printed or shared to Google Classroom: only the tool and the interface language, never the word, lesson or answer. These are totals only: they contain no identifier, IP address, lesson, answer or account, so they cannot be linked to you and need no consent. We use them to see whether the lessons are used and keep them for up to 400 days, with the same backups as measurement records.
Google Analytics
We use Google Analytics 4, a service of Google, to count visits and see which pages and lessons are used, how people arrive (for example from a search engine or a campaign link) and whether pages work on phones and computers. When it runs, Google Analytics receives the address and title of each page you open, including your search words on the search page, the address of the page you came from, scrolls, clicks on links to other websites, the practice steps you take (starting a lesson, checking an answer and whether it was right, asking for a hint or showing an answer, finishing a lesson or the level check, sharing a result and creating an account, with the section, lesson, level and interface language), your browser, device, screen size and language, and an approximate location derived from your IP address; Google Analytics does not log or store IP addresses. It stores a random identifier in the _ga cookies so that it can recognise repeat visits. It does not receive what you type in answers or writing, your name or your email address, and it never runs on the pages that open from links in account emails. Advertising features are off: we do not allow Google to use this data for ads or personalisation. In the EU, the EEA, the UK and Switzerland, Google Analytics sets no cookies until you agree in the consent window to storing information on your device and to measuring content performance with Google as a partner; before that, and if you decline, Google may still receive cookieless, aggregate signals that it uses to model visits. Elsewhere it runs unless you choose Decline, which stops its cookies and deletes them from this browser. The legal basis is your consent in the EU, the EEA, the UK and Switzerland and our legitimate interest in improving the site elsewhere. Google processes this data as our service provider under its own terms and may process it in the United States and other countries. Google keeps the data for the retention period set in our Google Analytics account, at most 14 months. You can change your choice at any time with Cookie settings at the bottom of every page.
Advertising
The lesson lists and lesson pages show native advertisements from MGID, an advertising network. To decide how to show them, your browser asks our server, which reads the country that Cloudflare derives from your IP address; we do not store the answer, and the country is kept only in our server logs (see Server and security logs). In the EU, the EEA, the UK and Switzerland, a consent window from InMobi, a consent platform that follows the IAB Transparency and Consent Framework, asks for your choices first, and the MGID script loads only if you agree to storing information on your device and to MGID (vendor 358) as a partner. Elsewhere it loads unless your country is unknown. In every region, a Global Privacy Control signal from your browser stops it. When it loads, MGID and the advertising partners it works with receive your IP address, the address of the page, the page you came from and information about your browser and device, and may set or read cookies or similar identifiers to deliver, measure and personalise advertisements, limit how often you see them and prevent fraud. They do not receive your answers, writing, name or email address from us. MGID processes this data under its own privacy policy at mgid.com, which also explains how to opt out of personalised advertising. The legal basis is your consent in the EU, the EEA, the UK and Switzerland and, elsewhere, our legitimate interest in keeping the lessons free. The home page, the information pages, account pages and the stories for children, with their list, show no advertisements.
How long we keep account data
We keep your account until you delete it. Delete account on your account page removes your account, progress and sessions from our database immediately; daily backup copies are deleted within about 16 days, as for measurement records. Sessions expire 30 days after your last visit or when you sign out. Links in account emails expire after 48 hours (email confirmation) or one hour (password reset) and work once.
Server and security logs
Every request passes through Cloudflare, which delivers and protects the site, and reaches our server hosted by DigitalOcean in Singapore. Our server logs record the IP address and the country that Cloudflare derives from it, the time, the page address without query parameters, the response status and size, and the user agent your browser sends, which names the browser, its version and the operating system. We use these logs for security, troubleshooting and telling people from automated programs, and keep them for 14 days. Cloudflare processes connection information under its own privacy policy.
Emails you send us
If you write to [email protected], Cloudflare Email Routing forwards your message to our mailbox at Google Gmail. We use your email address and message only to reply and to handle your request, such as a correction or a rights concern, and keep them only as long as that requires.
Where information is processed
Our server, including the account database, is in Singapore. Backup copies of account data and measurement records are kept on that server and in encrypted Amazon Web Services storage in Singapore. Cloudflare handles requests and forwards email in its data centre closest to you, Google stores the emails you send us, handles Google sign-in and runs Google Analytics, Resend delivers account emails, and MGID and its partners deliver advertisements from their own servers, which may be in other countries.
Cookies
We set cookies to keep you signed in to an account and to protect a Google sign-in while it is in progress. Google Analytics sets its own cookies as described above, and MGID and its advertising partners may set theirs when advertisements are shown. See the Cookie Policy and Cookie Declaration for the cookies and browser storage we use.
Your choices and questions
You can allow or decline Google Analytics with Cookie settings at the bottom of every page; in the EU, the EEA, the UK and Switzerland the same button reopens the consent window, where you can also change or withdraw your advertising choices. You can refuse or withdraw lesson measurement on any lesson page and keep practising. You can stop advertising cookies by blocking third-party cookies in your browser; turning on Global Privacy Control also stops the MGID script from loading. You can delete everything stored in your browser by clearing this site’s data in your browser settings. You can change your account details, see and sign out your signed-in devices, download a copy of your account data and delete your account on your account page at any time. Measurement records are not linked to accounts, so the removal control on a lesson page is the reliable way to delete them. For any other privacy question, use the Contact page.
Changes to this policy
We will update this policy before we change how information is collected, for example before showing advertisements in more regions. The date at the top shows the latest version.