Privacy Policy

Last updated: 31 October 2026

This policy explains what information Malingo (“we”, “us”) collects when you use the website and app at malingoapp.com (the “Service”), how it is used, and the choices you have. The Service is operated by Malik Al Khrissat, who is the data controller. Contact: [email protected].

1. Information we collect

Account information. When you create an account we ask for an email address, a password, a display name, your age, your country and your first language (English or Arabic). Your password is stored only as a one-way hash; we cannot read it.

Learning data. As you use the Service we record your progress: lessons completed, answers given (including mistakes), vocabulary strength, experience points, streaks, hearts, gems, achievements, daily goals, settings, and how much time you spend learning. This is what makes the Service work and lets you continue where you left off.

Technical data. Our hosting and security providers automatically log the IP address, browser type, device type, pages requested and timestamps of visits, as is standard for any website. We use this only to keep the Service secure and running.

Speech. Listening and speaking exercises use the speech features built into your browser. When you use a speaking exercise, your browser (for example Google Chrome or Apple Safari) may send your voice to its provider for recognition, under that provider's privacy policy. We receive only the recognised text, which we compare with the expected answer and do not store as audio. Speech features are optional and can be turned off in Settings.

Profile picture. You may optionally upload a photo. It is stored on our server, shown next to your name inside the app (for example on rankings), and can be removed at any time from your Profile. Please only upload a picture you have the right to use.

Rankings. Your display name, country and XP appear on the in-app country and worldwide rankings so learners can compare progress. Your email is never shown. You can hide yourself from rankings at any time in Settings → Show me on rankings.

We do not collect payment details ourselves (see Paddle below), nor precise location, contacts or photos.

2. How we use information

  • To provide the Service: sign you in, save your progress, and personalise lessons and reviews.
  • To keep the Service secure, prevent abuse and fix problems.
  • To understand, in aggregate, how the Service is used so we can improve it.
  • To respond when you contact us.

The legal bases for this processing (where the GDPR applies) are performance of our contract with you, our legitimate interest in running a secure and useful service, and your consent where we ask for it.

3. Cookies and local storage

Strictly necessary. When you sign in we set one cookie (malingo_session) that keeps you signed in for up to 30 days. It contains a random identifier only. The Service cannot work without it, so it does not require consent.

Preferences. We store a few settings in your browser's local storage: your interface language, light or dark theme, chosen voice, and your cookie choice. These never leave your device.

Advertising and analytics. We do not use analytics cookies. Malingo Plus members never see ads, and we never show ads to learners under 16.

Ads on the website. The free website may show ads from Google AdSense. Advertising cookies are only set after you agree in the cookie banner.

Ads in the Android app. The free Google Play app shows ads from Google AdMob: a full-screen ad after some finished lessons, and an optional video you can choose to watch for an extra heart. To show, measure and protect these ads, Google's software in the app collects your device's advertising ID, approximate location (from your IP address), device and app information, ad interactions and crash diagnostics, and sends them to Google. In the EEA, the UK and Switzerland you are asked for consent first and can choose "Do not consent"; you can change this later in the app under Settings → Ad privacy. When you watch a video for a heart, Google confirms to our server that the video was watched, using a one-time code linked to your account; we keep that record to apply the daily limit. You can reset or delete your advertising ID in your phone's settings (Settings → Google → Ads or Privacy → Ads), and opt out of personalised advertising at Google Ads Settings and aboutads.info. See how Google uses information from apps that use its services.

You can change your cookie choice at any time by clearing the Service's site data in your browser, after which the banner appears again.

4. Who we share information with

We do not sell your personal information. We share it only with the service providers needed to run the Service, who process it on our behalf:

  • Railway Corp. (United States) hosts the application and database.
  • Cloudflare, Inc. (United States) provides the network, security and DNS layer in front of the Service and therefore sees connection data such as IP addresses.
  • Google Fonts is used to load the typefaces; your browser requests them directly from Google.
  • Flagcdn.com serves the small country-flag images shown on rankings; your browser requests them directly, without cookies.
  • Google LLC (United States) provides "Sign in with Google" and, for free users who are 16 or older, advertising through Google AdSense (website) and Google AdMob (Android app), as described in section 3. See Google’s privacy policy.
  • Paddle.com Market Ltd (United Kingdom) is the merchant of record for Malingo Plus. If you buy Plus, Paddle collects your email, country and payment details directly in its checkout and shares with us only your email, the plan you bought and its status. We never receive card numbers. See Paddle’s privacy policy.
  • Google Play (Google LLC) sells Malingo Plus inside the Android app. Google collects your payment details; we receive only a purchase code, the plan you bought and its status, which we check with Google and keep with your account to give you Plus and to handle renewals, cancellations and refunds. We never receive card numbers.

We may also disclose information if required by law or to protect the rights and safety of users or the public.

5. International transfers

The Service is hosted in the United States. If you use it from another country, your information is transferred there. Our providers rely on standard contractual clauses and equivalent safeguards for such transfers.

6. Retention

Your account and learning data are kept for as long as your account exists. Session cookies expire after 30 days. Server logs are kept for a short period for security purposes and then deleted.

7. Your rights

Depending on where you live you may have the right to access, correct, export or delete your personal information, to object to or restrict certain processing, and to withdraw consent. You can update your name and settings in the app at any time. To delete your account and all associated data, see Delete your account. To exercise any other right, email [email protected] from the address on your account; we respond within 30 days. You also have the right to complain to your local data protection authority.

8. Children

The Service is a general-audience educational tool. We ask for your age at sign-up so we can adapt content. If you are under 13 (or under 16 in the European Union) you may only use the Service with the involvement and consent of a parent or guardian, and we do not knowingly show personalised advertising to children. If you believe a child has created an account without consent, contact us and we will delete it.

9. Security

All traffic is encrypted with HTTPS, passwords are hashed with bcrypt, sign-in attempts are rate-limited, and access to the database is restricted to the operator. No system is perfectly secure, so please use a unique password for your account.

10. Changes

We may update this policy as the Service evolves. The date at the top shows the latest revision, and significant changes will be announced inside the app.

11. Contact

Malik Al Khrissat
[email protected]