Privacy Policy

1. Who we are

Ellaword is an app for learning Swedish from the films, series, books and texts you want to understand (an iOS app, this website, and the service behind them). This policy explains what personal data we process, why, who else is involved, how long we keep it, and your rights.

The controller responsible for your personal data is Mehmet Alp Güler, the individual who operates Ellaword, based in Sweden. Contact us about privacy at [email protected]. Our geographic address and trader details are shown on Ellaword’s page in the App Store.

2. What we collect

• Account: the username you choose, your email address, a hashed password (we never store the password itself), whether your email is verified, and when you last changed your password.
• Profile and settings: your avatar — a generated character you can adjust, or your initial; you cannot upload a photo of yourself — the language pairs you study, your time zone, theme and display settings, and your notification preferences and reminder time.
• Learning: the words you know and are learning, your review history and schedule, your answers in practice, which sources you follow and how far you have got, and game progress — XP, streaks, active days, league standing and collected reward cards.
• Content you bring in: when you paste text, upload a subtitle or document, scan a page or import a YouTube video, the text is read once to build your word list and is then not kept. What we keep is the list of words, how often each occurs, and up to five short example sentences per word taken from your text, as written there — with their capitals and punctuation; only spacing and subtitle formatting are tidied — these are the lines shown when “Sentences from your own content” is on. Content you added before 25 September 2026 keeps them lower-cased and without punctuation. We also keep the title, description and source link you give it, and a cover image if you add one.
• Words the dictionary does not know: when your content contains a word our dictionary cannot find, that single word is added to a shared list we use to improve the dictionary. It is stored without any link to you and is not part of your account.
• Scanned pages (camera and photo library): you photograph a page, or pick one from your library, and mark the parts to read. Only those parts are read, and the text is recognized on your device. The picture is never uploaded; the crops are kept in the app's temporary storage and deleted once read or when you discard the scan, and photos in your library are never changed. Only the recognized text reaches us, where it is handled like pasted text (above).
• Pronunciation practice (microphone and speech recognition): when you tap Speak, your iPhone's own speech recognizer listens and turns what you said into text, on your device. The audio is not recorded, not stored, and not sent to us or to Apple; only the comparison with the word is shown to you.
• Listening: words and sentences are read aloud by your device's built-in voice. Nothing is sent anywhere.
• Subscription: your subscription status and the identifiers Apple gives us for your purchase (transaction ids, product, environment, renewal and cancellation status). We never receive your card or payment details.
• Notifications: a push token and the app's identifier for your device (Apple's identifier for vendor), if you allow notifications.
• Reports you send us: if you report a piece of content, your report and message.
• Security and technical data: server logs of requests to our service, and short-lived counters of sign-in attempts (keyed by a scrambled form of the IP address or email) that we use to stop password guessing.
• Usage statistics and crash reports — only if you allow them. See section 5.

3. What other learners can see

Ellaword has friends, leagues and leaderboards, so some of your data is visible to other signed-in users. Choose a username you are happy for others to see — it does not have to be your real name, and the app suggests one. You can share an invite link that shows your username; anyone who opens it can find your public profile.

• Anyone signed in can find you by searching for your username, and can open your profile, which shows: your username and avatar, the language you study, when you joined, your current streak, how many words you know, your total XP, your activity over the last seven days, friends you have in common, and the catalog titles on your My List. Your own uploads are never shown.
• Leaderboards: your username, avatar and score (XP, words or streak) can appear on the global top-100 lists for your language, and your username, avatar and XP are shown to the other members of your league group. Your league group can also include simulated learners, which are run automatically by our software and are not real people, so no person sees your data through them.
• Your choice: Settings → “Hide me from global leaderboards and search” leaves you out of the global top-100 lists and of username search. Your friends and the members of your league group still see you.
• Everything else — your email, your content, your word lists, your subscription — is never shown to other users.

If you see a username that is offensive, you can report it from that person's profile or by long-pressing their name on a leaderboard. A moderator can change the name or suspend the account.

4. Why we use your data, and on what legal basis

• To provide the service you signed up for (performance of our contract with you): your account, sign-in, learning features, review schedule, progress, friends, leagues and leaderboards, your subscription, and service emails such as verification, password recovery and privacy-request emails.
• With your consent: usage statistics and crash reports (section 5), and push notifications, which your iPhone asks you to allow. You can withdraw consent at any time in the app's settings or your iPhone's settings; withdrawing does not affect what was done before.
• Our legitimate interests, which we have balanced against yours: keeping the service secure and preventing abuse (server logs, sign-in limits), handling reports, and improving the dictionary from words it did not know (stored without any link to you). You can object to processing based on legitimate interests by writing to us.
• Legal obligations, where the law requires us to keep or disclose something.

We do not show ads, build advertising profiles, track you across other apps or websites, or sell your personal data. We make no decisions about you by automated means that have legal or similarly significant effects.

5. Usage statistics and crash reports — your choice

The first time you open the app we ask whether you allow usage statistics and crash reports. Nothing is collected unless you say yes. You can change your answer at any time under Settings → “Share usage statistics and crash reports”.

• What: usage statistics are a fixed set of events — for example finishing onboarding, choosing a source, starting or finishing a practice, viewing coverage, and steps in the subscription screen — with device and app details (model, operating system, app version, language, country-level location). Crash reports contain the technical details of a crash or error (where in the code it happened, device model, operating system and app version).
• Who: both are processed by Google through Firebase (Google Analytics for Firebase and Firebase Crashlytics). A copy of the usage statistics is exported to Google BigQuery, in our own Google Cloud project, where we analyze it to improve the app.
• Not linked to you: they are tied to an identifier for the app on your device, never to your account. We never send your name, email, account id, the text of your content, titles, links or purchase receipts. They are never used for advertising: ad features, Google Signals and the advertising identifier (IDFA) are off.
• Turning it off stops collection from then on and resets the identifier on your device. It does not delete what was already collected; that is removed on the schedule in section 8. Your choice is stored on your device, so after reinstalling the app you will be asked again.

6. Who else processes your data

These providers process data on our behalf, only to run the service:

• Google Cloud — hosting, database and file storage, in the EU (Sweden).
• Google Firebase — usage statistics and crash reports, only with your consent (section 5).
• Apple — the App Store, in-app purchases and subscription status, and delivery of push notifications to your iPhone.
• Expo (650 Industries) — app updates and sending push notifications. A notification's text passes through Expo and Apple on its way to you — for example “Start practicing the words from <the title of your upload>”.
• Mailjet — sending service emails (verification, password recovery, privacy requests).
• Cloudflare — hosting this website.

Your device also connects directly to some services, without going through us — so they see your IP address as they would on any visit, and we send them nothing about you:

• YouTube (Google) — when you import a YouTube video, the app fetches its subtitles and thumbnail from YouTube, using the video's id.
• Expo — the app checks Expo's servers for updates.

Text recognition for page scanning (Google ML Kit), speech recognition, the reading voice and the drawing of avatars all run on your device and send nothing to anyone.

7. Where your data is stored, and transfers outside the EU

Your account, learning data and files are stored on Google Cloud in the European Union (Stockholm, Sweden). Some of the providers above — Google, Apple, Expo and Cloudflare — are based in, or may process data in, the United States or other countries outside the EU/EEA. Where that happens, the transfer relies on the European Commission's adequacy decision for the EU–US Data Privacy Framework for providers certified under it, and otherwise on the Commission's Standard Contractual Clauses. You can ask us for more information about these safeguards at [email protected].

8. How long we keep it

• Your account and everything in it: while your account exists. When you delete it (section 9), everything linked to you — including your avatar, cover images and any data export — is permanently deleted after a 14-day grace period.
• Backups: copies of the database are kept for about 7 days, so deleted data may remain in a backup for up to that long. Backups are only used to restore the service.
• Server logs: 30 days. Sign-in attempt counters: 1 day.
• Data exports: the download file is deleted 7 days after it is created.
• Usage statistics: up to 14 months in Google Analytics, and up to 26 months in the copy we analyze in Google BigQuery. Crash reports: about 90 days. Deleting your account does not remove these, because they are not linked to it.
• Kept after you leave, without your identity: words added to the dictionary-improvement list (section 2), and reports you sent about content, with your details removed.

9. Your rights

You have the right to access your data, to have it corrected or deleted, to receive it in a portable format, to restrict processing, to object to processing based on legitimate interests, and to withdraw consent at any time.

• Get a copy: request an export in the app. We email you a link to a downloadable file; the link works once and expires after 15 minutes, and you can request a new one.
• Delete your account: in the app, or through our account deletion page. You confirm by email (the link is valid for 24 hours); your account is then deleted after 14 days, and you can cancel until then. Deleting your account does not cancel an App Store subscription — cancel that in your Apple account settings.
• Anything else, or if the app does not let you do what you need: write to [email protected]. We answer within one month.

You can complain to the Swedish Authority for Privacy Protection (IMY, imy.se) or to the data protection authority where you live.

10. Children

Ellaword is for people aged 16 or over, and our Terms require it. We do not ask for your age, so we cannot verify it; if we learn that someone under 16 has an account, we will delete it. If you believe a child has given us personal data, contact us.

11. Security

Passwords are hashed, connections are encrypted, access to data is restricted and authenticated, and your data is stored in the EU. Changing or resetting your password ends your other sessions (within an hour at most). No system is perfectly secure; if a breach puts your rights at high risk, we will tell you.

12. This website

We set no cookies on ellaword.com, run no analytics or tracking scripts on it, and serve its fonts from our own site. Our hosting provider (Cloudflare) processes the technical data needed to deliver the pages.

13. Changes

When we change this policy we update the date at the top. If a change materially affects how we use your data, we will tell you in the app or by email before it takes effect.

14. Contact

Questions about this policy or your data: [email protected].