Privacy Policy

1. What this covers

This Privacy Policy explains what information EnglishNest (the "Service") collects, why, and what your choices are. It should be read together with our Terms of Service.

2. Information we collect

Account information

Name, email address, and password (stored securely, hashed — we never see it in plain text) when you sign up.

Onboarding survey

Study mode, study context, target IELTS band, and how you heard about us — asked once after signup, all optional beyond what's required to continue.

Study data

Word lists, vocabulary items, and reading passages you create or paste in; your review history, spaced-repetition progress, streaks, personal notes, and "hard" flags on individual words.

Usage & analytics

Page views and in-app events (e.g. completing a review session), tied to a randomly generated identifier stored in your browser before you sign up, and to your account afterward. We use this to understand how the Service is used — we do not sell it to advertisers or third parties.

Feedback

The category, message, and page you were on when you use the in-app feedback form.

Cookies and local device storage

We use one strictly-necessary cookie to keep you signed in (set by our authentication provider) — it's required for the Service to work and isn't used for tracking or advertising. Preferences like theme, ambience-player settings, and sound on/off are stored separately, only in your browser (localStorage), not on our servers.

3. How we use this information

• To provide the Service — running spaced-repetition scheduling, showing your lists and progress, generating word/meaning suggestions;
• To review and approve new accounts;
• To send in-app notifications (e.g. review reminders, milestones) and respond to feedback you submit;
• To understand feature usage and improve the Service.

4. AI processing (Google Gemini)

When you use AI-assisted features — suggesting a word's meaning, extracting vocabulary from a pasted reading passage, generating example sentences — the relevant word(s) or passage text is sent to Google's Gemini API for processing. We do not send your name, email, or other account identifiers as part of that request. Google processes this data under its own terms and privacy policy, which we don't control; consult Google's published policies for how Gemini API data is retained or used on their side.

5. Who we share information with

We don't sell your personal information. We share it only with the service providers that operate the Service on our behalf, currently:

• Our database and authentication provider — hosts our database and handles account authentication;
• Google (Gemini API) — processes text for AI-assisted features, as described above;
• Our cloud hosting provider — hosts the application itself.

We may also disclose information if required by law, or to protect the rights, safety, or security of the Service or its users.

6. Data retention

We retain your account and study data for as long as your account is active. If you request deletion (see "Your rights" below), we delete or anonymize your personal data within a reasonable period, except where we're required to keep it longer by law.

7. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, or to object to certain processing. To exercise any of these, contact us using the details below — we'll handle the request manually while the Service doesn't yet have a self-service export/delete option.

8. Children's privacy

Some of our users are under 16. If you are, you may only use the Service with a parent or legal guardian's knowledge and consent (see Terms of Service, "Eligibility and accounts") — we don't independently verify this, so that consent is between you and them. We don't collect any category of information specific to children beyond what section 2 already describes for every user, and we don't knowingly collect more than what's needed to operate the Service.

9. Security

We use industry-standard measures (encrypted connections, access-controlled database policies) to protect your information, but no method of transmission or storage is 100% secure, and we can't guarantee absolute security.

10. Data breach notification

If we become aware of a security incident that puts your personal data at risk, we'll investigate promptly and, where required by applicable law, notify you and the relevant authority within the required timeframe.

11. Changes to this policy

We may update this Privacy Policy from time to time; the "Last updated" date above will change accordingly. Material changes will be highlighted at your next login where practical.

12. Contact

Questions about this Policy, or requests regarding your data, can be sent to: