Privacy notice

About this notice

Draft updated: 1 October 2026. Effective date: to be set at public launch. This notice covers Lingofirst's website, learner accounts, free lessons, and support. It describes the current release; AI conversation and subscription payments are future features.

Who is responsible for your information

Proposed operator format: [full legal name], an individual operating as Lingofirst in Indonesia. Service address: [operator's service address]. Lingofirst is the product name. The person or registered entity responsible for the service must be identified before public launch.

Information used by the service

Account information includes your email address, an internal account identifier, verification status, and authentication/session records. Supabase Auth processes the password you enter for registration, sign-in, recovery, or deletion confirmation. Never send your password or a verification code to support.

Learning information includes your chosen target language, interface and explanation languages, optional first language, goal, self-selected level, daily target, and time zone. We save unfinished onboarding preferences, enrollments, submitted choice/order/gap answers, grading results, attempts, lesson progress, saved vocabulary, review ratings and due dates, and daily activity. Visible lesson time is an estimate based on activity and page visibility, not a measure of your attention.

Requests to the website and service providers can expose technical information such as IP address, browser information, request time, and error or delivery status. The VPS and provider logging settings and retention will be recorded before launch. If you email support, we receive your sender address and whatever you choose to include.

Purposes and proposed legal grounds

We use account and learning information to provide the service you request: secure sign-in, account verification and recovery, onboarding, saved lessons and preferences, vocabulary scheduling, and daily progress. The proposed ground for this necessary processing is performing the service agreement or responding to your request to create it.

Limited security and support processing is proposed on the basis of proportionate legitimate interests in protecting accounts and resolving problems. Processing required by applicable law uses that legal obligation. These grounds must be assessed against the actual operator, purposes, and markets before publication.

Where an optional future use needs consent, we will explain that use and ask separately before enabling it. Accepting the terms does not give blanket consent to new data uses. The current release does not sell learner information or use it for targeted advertising.

Cookies and browser storage

Authentication cookies maintain your session and support confirmation/recovery flows. The browser stores your manual theme preference in local storage; public pages follow your device theme. Blocking necessary session cookies can prevent sign-in or email-link verification. Clearing the theme preference does not delete server-saved progress.

The current app has no advertising trackers or third-party analytics integration. Any later non-essential tracking will be disclosed and, where required, enabled only after your choice. Infrastructure security and delivery logs are separate from advertising tracking.

Providers and sharing

Supabase provides authentication and database services. Resend delivers Supabase Auth confirmation and recovery messages and processes the recipient address, message content, and delivery records. Production web hosting will use the selected VPS provider: [provider and processing country to be confirmed]. Only authorized operators should access account information for service, support, or security purposes.

We may disclose information when required by a valid legal obligation, to protect the service or another person's rights, or for a use you specifically authorize. Any change of operator must be disclosed with the privacy protections and choices required by applicable law. We do not make learners' private answers or progress public.

Processing locations

The VPS, Supabase, and Resend may process information in different countries. Their actual regions, subprocessors, contractual safeguards, and any necessary transfer mechanism must be documented before launch. We will identify relevant locations and protections in the published notice rather than assume all information stays in Indonesia.

Writing, speaking, and starting-level checks

Guided-writing text stays in the page's browser memory and is lost when you leave or reload. Speaking practice does not request microphone access or record your voice. Writing/speaking self-review choices and optional reading-check answers stay on the page. The server saves only a guided activity's unassessed completion marker; it does not receive your writing or spoken response.

The reading check provides an optional starting-level suggestion. It does not automatically change your lesson order or certify your ability; you choose whether to apply it. Do not include sensitive personal details or another person's private information in a support message.

Your privacy rights and controls

You can change supported learning preferences in Settings. Depending on applicable law, you can request information about processing, access or a copy, correction, deletion, restriction, portability, or an objection to processing. You can withdraw consent for a use that relies on consent and raise a complaint with the competent authority.

Email lingo@merayakan.online with the subject Lingofirst privacy request, your registered email address, and the request. We may ask for proportionate evidence that the account belongs to you. Do not send a password, one-time code, or identity document unless a secure, necessary verification process has been explained. Requests are handled within applicable legal deadlines; any limitation must be explained. Mailbox monitoring and this request process must be activated before launch.

Retention and account deletion

Account and learning records are kept while your account is active. There is no automatic inactive-account deletion schedule in this release. Settings lets you confirm account deletion with your password. Successful learner-account deletion removes the primary account, profile, enrollments, answers, progress, vocabulary schedules, and activity; it is permanent and does not delete the shared lesson library.

The launch target is to clear backup copies within 30 days after account deletion. This target is not a verified setting or a promise about every provider's logs. Backups and authentication, email-delivery, VPS, support, and security records have separate retention periods that must be confirmed before publication. Deleting a learner account does not instantly erase an already-created backup.

Shared content and editorial audit history are separate from learner progress. Necessary records may be retained for a specific legal obligation or unresolved dispute; the purpose and period must be explained. If deletion fails, or you cannot access the account, contact the privacy address for assistance. A retained backup must not be used to resume a deleted learner's account.

Security and incidents

The current app restricts private learner records through authenticated access and database permissions, and requires your password again for account removal. Public deployment must also use HTTPS, limited server access, and maintained software. No service can promise perfect security. We will investigate a suspected personal-data incident and notify affected people and authorities when required by applicable law.

Adult accounts

The initial release requires account holders to be at least 18. Registration uses self-attestation; we do not collect a birth date or independently verify age. If an underage account is reported, contact support so the operator can investigate and handle it appropriately. This product age rule remains part of the launch review.

Changes to this notice

We will date revised notices and explain material changes through the service or an account message before introducing a new use where notice is required. A change requiring consent will have its own choice. A notice update does not remove the rights you already have.

Contact and complaints

Privacy and support contact: lingo@merayakan.online. Report a suspected security issue without including passwords or live authentication links. You can contact the competent data-protection authority or use another remedy available under applicable law; contacting us first is optional. The operator must confirm that this mailbox is monitored before public launch.