Privacy Policy

Last updated: 17 September 2026

This policy explains what information Malingo (“we”, “us”) collects when you use the website and app at malingoapp.com (the “Service”), how it is used, and the choices you have. The Service is operated by Malik Al Khrissat, who is the data controller. Contact: [email protected].

1. Information we collect

Account information. When you create an account we ask for an email address, a password, a display name, your age, your country and your first language (English or Arabic). Your password is stored only as a one-way hash; we cannot read it.

Learning data. As you use the Service we record your progress: lessons completed, answers given (including mistakes), vocabulary strength, experience points, streaks, hearts, gems, achievements, daily goals, settings, and how much time you spend learning. This is what makes the Service work and lets you continue where you left off.

Technical data. Our hosting and security providers automatically log the IP address, browser type, device type, pages requested and timestamps of visits, as is standard for any website. We use this only to keep the Service secure and running.

Speech. Listening and speaking exercises use the speech features built into your browser. When you use a speaking exercise, your browser (for example Google Chrome or Apple Safari) may send your voice to its provider for recognition, under that provider's privacy policy. We receive only the recognised text, which we compare with the expected answer and do not store as audio. Speech features are optional and can be turned off in Settings.

We do not knowingly collect payment details, precise location, contacts or photos.

2. How we use information

  • To provide the Service: sign you in, save your progress, and personalise lessons and reviews.
  • To keep the Service secure, prevent abuse and fix problems.
  • To understand, in aggregate, how the Service is used so we can improve it.
  • To respond when you contact us.

The legal bases for this processing (where the GDPR applies) are performance of our contract with you, our legitimate interest in running a secure and useful service, and your consent where we ask for it.

3. Cookies and local storage

Strictly necessary. When you sign in we set one cookie (malingo_session) that keeps you signed in for up to 30 days. It contains a random identifier only. The Service cannot work without it, so it does not require consent.

Preferences. We store a few settings in your browser's local storage: your interface language, light or dark theme, chosen voice, and your cookie choice. These never leave your device.

Advertising and analytics. We do not currently use advertising or analytics cookies. If we introduce advertising in the future (for example through Google AdSense), such cookies will only be set after you agree in the cookie banner, and this policy will be updated first. Advertising partners may then use cookies to show ads relevant to you; you can opt out of personalised advertising at Google Ads Settings and aboutads.info.

You can change your cookie choice at any time by clearing the Service's site data in your browser, after which the banner appears again.

4. Who we share information with

We do not sell your personal information. We share it only with the service providers needed to run the Service, who process it on our behalf:

  • Railway Corp. (United States) hosts the application and database.
  • Cloudflare, Inc. (United States) provides the network, security and DNS layer in front of the Service and therefore sees connection data such as IP addresses.
  • Google Fonts is used to load the typefaces; your browser requests them directly from Google.

We may also disclose information if required by law or to protect the rights and safety of users or the public.

5. International transfers

The Service is hosted in the United States. If you use it from another country, your information is transferred there. Our providers rely on standard contractual clauses and equivalent safeguards for such transfers.

6. Retention

Your account and learning data are kept for as long as your account exists. Session cookies expire after 30 days. Server logs are kept for a short period for security purposes and then deleted.

7. Your rights

Depending on where you live you may have the right to access, correct, export or delete your personal information, to object to or restrict certain processing, and to withdraw consent. You can update your name and settings in the app at any time. To delete your account and all associated data, or to exercise any other right, email [email protected] from the address on your account; we respond within 30 days. You also have the right to complain to your local data protection authority.

8. Children

The Service is a general-audience educational tool. We ask for your age at sign-up so we can adapt content. If you are under 13 (or under 16 in the European Union) you may only use the Service with the involvement and consent of a parent or guardian, and we do not knowingly show personalised advertising to children. If you believe a child has created an account without consent, contact us and we will delete it.

9. Security

All traffic is encrypted with HTTPS, passwords are hashed with bcrypt, sign-in attempts are rate-limited, and access to the database is restricted to the operator. No system is perfectly secure, so please use a unique password for your account.

10. Changes

We may update this policy as the Service evolves. The date at the top shows the latest revision, and significant changes will be announced inside the app.

11. Contact

Malik Al Khrissat
[email protected]