1. About this Privacy Policy
iLinga is an AI language-training service. You talk to an AI trainer in the language you are learning, the trainer replies in voice, and iLinga tells you what to fix — corrections, pronunciation scores, vocabulary and progress over time.
iLinga is operated by Mindcraft Inc., 3 Germay Dr, Unit 4 #2316, Wilmington, DE 19804, USA.
This policy explains what information we collect, why we collect it, who processes it on our behalf, and what you can do about it. It applies to:
- our website at ilinga.com;
- the iLinga application at app.ilinga.com;
- our API at https://api.ilinga.com, which the application uses;
- the emails we send you.
It does not apply to services we link to but do not run.
We have written this in plain English rather than legal boilerplate, and we have written it from what the software actually does. Where we cannot state something precisely, we say so instead of guessing.
2. Information we collect
Account information
When you create an account we store your email address. If you sign in with Google we also receive and store the name on your Google profile. We store the date your account was created and last updated, an account role (ordinary user or administrator), and an unguessable token used to build your unsubscribe links.
We do not ask for or store a password. See section 3 of the Terms and "Accounts and sign-in" below.
Profile and language preferences
We store the native language you choose during onboarding, whether you have completed onboarding, which trainer and voice you have selected, and your per-category email preferences.
Training and learning information
This is the substance of the product, so it is the largest category. We store:
- a record of each practice session: an internal session identifier, the language, when it started and ended, and how many minutes it used;
- the text of your conversations — what you said (as transcribed) and what the trainer replied;
- corrections generated from your speech: the original phrase, the corrected phrase, an explanatory note, and the grammar rule it relates to;
- vocabulary, grammar and pronunciation progress: which words and rules you have met, how you answered, your recall strength over time, and which items are scheduled for review;
- pronunciation results: a score out of 100 for a target word, plus accuracy, fluency and completeness sub-scores, the text the speech service recognised, and per-phoneme scores;
- your daily practice streak and the last calendar day you practised;
- reports and summaries generated from the above.
Voice and conversation information
Section 3 covers this in full, because it deserves its own explanation.
Transaction information
When you buy minutes we store which package you bought, how many minutes it added, the amount and currency, whether it was a card payment or a promotion, the Stripe Checkout Session ID, the Stripe PaymentIntent ID, your Stripe customer ID, and the date. We also store your current minute balance.
We do not receive or store your card number, expiry date or security code. See section 6.
Communications
We store a record of the transactional emails we have sent you: which template, when, whether delivery succeeded, and the merge values used to fill it in (for example the amount on a receipt). If you email support, we hold that correspondence in our support mailbox.
Device, security and technical information
We store, per device you sign in from, a device fingerprint hash, the browser user-agent string, a hash of your IP address (not the address itself), and when that device was last seen.
Our servers keep operational request logs — method, path, response status, duration and a request identifier — and an audit log of security-relevant events such as sign-ins, webhook receipts, email sends and deletion requests. The audit log records email recipients as a one-way hash rather than as an address.
3. Voice and AI processing
This section describes what actually happens to your voice, because it is the question most worth answering precisely.
When you speak in a practice session. Your microphone audio is captured in your browser and streamed over a secure WebSocket connection to our real-time service. From there it is forwarded live to Deepgram, our speech-to-text provider, which returns a transcript. The transcript is what drives the conversation: it goes to OpenAI, which generates the trainer's reply, and that reply is turned back into speech by a text-to-speech provider (Deepgram, Inworld or Microsoft Azure, depending on the voice) and streamed back to you.
When you practise pronunciation. Your recorded clip is sent to our API, converted in memory to the audio format the scoring service expects, and sent to Microsoft Azure's pronunciation assessment service. What comes back — an overall score, accuracy, fluency and completeness sub-scores, the words Azure recognised, and per-phoneme scores — is what we store.
What iLinga stores itself. We store the transcripts of your conversations, the corrections derived from them, and your pronunciation scores. We keep these because they are the product: they are what your reports, your review schedule and your progress are built from.
What we do not store. iLinga does not write your recorded voice to disk or to any storage bucket. There is no code path in the service that saves learner audio. Your audio exists while it is in flight to the speech provider and in memory while it is being processed, and it is not persisted by us afterwards.
We can tell you what our own systems do. We cannot make promises on behalf of the speech and AI providers listed above about what they do with audio or text once it reaches them — their own terms and privacy policies govern that, and you should read them if this matters to you.
Audio that we do store is audio we generated, not audio you recorded: synthesised trainer speech, example sentences and word pronunciations are cached in object storage so that we do not pay to re-synthesise the same sentence twice. That cache is keyed by the text that was spoken, and it contains no recording of you.
Automated systems, not people. The trainers are AI systems. Your trainer's replies, corrections, explanations, pronunciation feedback, reports and review scheduling are generated automatically by software, not written by a human teacher. They can be wrong. Nobody at iLinga listens to your sessions as part of normal operation.
4. How we use information
We use the information described above to:
- provide the language-training service and run your practice sessions;
- operate the conversational trainers and generate their replies;
- generate corrections, pronunciation feedback, reports and review schedules;
- keep your vocabulary, grammar and pronunciation progress and your streak;
- create and authenticate your account and keep you signed in;
- process purchases and keep an accurate minute balance;
- send you transactional and security emails;
- send you optional lifecycle emails, where you have not opted out;
- detect, investigate and prevent abuse, fraud and payment abuse, and enforce our Terms;
- diagnose faults, keep the service secure and available, and understand which parts of the product work;
- meet legal, tax and accounting obligations.
5. Service providers
Running iLinga means other companies process information on our behalf. We use service providers where they are necessary to operate the service.
| What they do | Provider | What may reach them |
|---|---|---|
| Speech-to-text | Deepgram | Live microphone audio during a session |
| Text-to-speech | Deepgram, Inworld, Microsoft Azure | The text the trainer is about to speak |
| Pronunciation scoring | Microsoft Azure | The pronunciation clip you record, and the target word |
| Conversation and language AI | OpenAI | Conversation transcripts and prompts |
| Payments | Stripe | Your payment details, email and purchase amounts |
| Email delivery | Our SMTP provider (MXroute) | Your email address and the content of the email |
| Object storage | Cloudflare R2 | Synthesised audio we generated; no learner recordings |
Our databases and application servers run on infrastructure we operate ourselves.
We do not sell your information. We do not share it for advertising. We may disclose information if we are legally required to, if we need to establish or defend legal claims, or to protect the rights and safety of our users or the public.
We do not currently run analytics or product-telemetry services in production. If that changes, we will update this policy before turning one on.
6. Payments
Payments are handled by Stripe. When you buy minutes you are taken to Stripe's own hosted checkout page, you enter your card details there, and Stripe processes the payment.
Your full card number, expiry date and security code are entered on Stripe's page and go to Stripe, not to us. iLinga does not receive them and does not store them.
What we keep is the purchase record: the package, the minutes added, the amount and currency, whether it was a card payment or a promotion, the Stripe identifiers for the checkout session, the payment and your Stripe customer record, and the date. We use these to credit your minutes, to show you your purchase history, to send receipts, to handle refunds, and for accounting.
Stripe is an independent controller of the payment data it collects. Its handling of that data is governed by Stripe's privacy policy.
7. Communications
Transactional and security emails. These are part of having an account and you cannot opt out of them while your account exists: sign-in links, purchase receipts, payment failure notices, refund confirmations, new-device sign-in alerts and account deletion confirmations. We send them because you asked us to sign you in, or because something happened to your money or your account security.
Optional emails. Low-minute reminders, practice-streak reminders, weekly progress summaries and win-back messages are optional. Each carries an unsubscribe link, and each category can be turned off independently. Turning one off does not turn off the others, and it does not stop the transactional and security emails above.
Support. If you write to [email protected] we will hold that thread so we can answer you and to keep a record of what was agreed.
8. Data retention
We keep information for as long as we need it for the purpose we collected it, and no policy of ours overrides a legal obligation to keep something longer.
In practice:
- Account, learning and transcript data is kept while your account exists, because it is what your progress is built from. When you request deletion it is removed as described in section 9.
- Purchase and payment records are kept after the related purchase, and after account deletion where we need them for accounting, tax and dispute purposes, or where Stripe retains them as an independent controller.
- Sign-in links are stored only as a one-way hash. They expire fifteen minutes after they are issued and can be used once.
- Sessions expire on their own schedule and are deleted when you sign out or request deletion.
- Operational and audit logs are kept for the period we need them to investigate security incidents, faults and abuse.
- Synthesised audio cached in object storage is keyed by the text spoken and is retained as a cache; it contains no recording of you.
We have not set fixed retention clocks for every category, and we would rather say so than publish a number that our systems do not enforce.
9. Account deletion and your choices
Deleting your account. You can delete your account from Profile → Advanced → Delete account in the app. When you do:
- your account is immediately marked as deleted and all your active sessions are ended, so you are signed out everywhere;
- deletion is scheduled for 30 days later;
- after that period a background job permanently deletes your user record, and the database removes the data linked to it — your sessions, devices, training sessions, transcripts, corrections, vocabulary and grammar progress, pronunciation results, balances, purchase records, notifications and email records.
The 30-day gap exists so that an accidental or unauthorised deletion can be reversed. Contact [email protected] within that window if you need it reversed.
Getting a copy of your data. The application can produce a machine-readable export of your account record, your sessions, your audit-log entries, your subscription and Stripe customer records, your notifications and your usage summary. If you want data that this export does not cover — for example your conversation transcripts — write to [email protected] and we will provide it.
Email preferences. Use the unsubscribe link in any optional email, or your notification settings in the app.
Other requests. Depending on where you live, you may have rights to access, correct, export, restrict or object to our processing of your information, or to complain to a data-protection authority. Write to [email protected] and we will respond. We may need to verify that the request comes from you.
10. Security
We take reasonable technical measures to protect your information. Traffic to our websites and API is served over HTTPS. Session cookies are HTTP-only, SameSite=Lax and marked secure in production. Sign-in links are stored only as hashes, expire quickly and work once. IP addresses associated with devices are stored hashed rather than in the clear. Access to production systems is restricted, security-relevant events are recorded in an audit log, and sensitive endpoints are rate-limited.
No online service is perfectly secure, and we are not going to tell you otherwise. We cannot guarantee that information will never be accessed, disclosed, altered or destroyed by someone who should not have done so.
11. International processing
We are based in the United States, and our service providers operate in the United States and elsewhere. If you use iLinga from outside the United States, your information will be transferred to and processed in countries whose data-protection laws may differ from those where you live. By using iLinga you understand that this transfer is necessary to provide the service.
12. Children's privacy
iLinga is intended for adults. You must be at least 18 years old to create an account and to buy minutes. We do not knowingly collect information from children.
If you believe a child has created an account, write to [email protected] and we will delete it.
13. Changes to this policy
We may update this policy as the product changes. When we do, we will publish the new version at https://ilinga.com/privacy and update the effective date at the top. If a change materially affects how we handle your information, we will make a reasonable effort to tell you — for example by email or a notice in the app — before it takes effect.
14. Contact
Questions about this policy, or about your information:
Email: [email protected]
Post: Mindcraft Inc., 3 Germay Dr, Unit 4 #2316, Wilmington, DE 19804, USA
15. Effective date
This Privacy Policy is effective from 7 August 2026.