Privacy policy

What we store

Your account: e-mail address, a password hash if you use one, or the identifier your Google account gives us, and your display name and time zone.
If you sign in with Apple: the identifier Apple gives us for your Apple Account, your e-mail address (or, if you choose Hide My Email, a private relay address at privaterelay.appleid.com that Apple forwards to you), and, the first time only, the name you choose to share. Apple does not give us your password. The sign-in page loads Apple's sign-in script from Apple's servers.
If you choose Hide My Email, we keep Apple's relay address and show it as "Apple ID (email hidden)"; mail we send reaches you through Apple's relay. When you connect Apple or Google to an account, we store only that provider's identifier for your account (Apple's sub, Google's user id) to recognise you. If you join a new, empty account to an existing one, the empty account is signed out and deleted.
Your notebooks: the words, meanings, examples and notes you write or generate, and the learning progress of each word.
Practice history: the day and result of each review, used for the schedule, the streak and the progress screen.
Sessions: the devices you are signed in on, so you can sign one out.
Reports you send about something the AI wrote: the reason, your note if you add one, a copy of the text you reported and where in the app it was shown, so we can review it. They belong to your account and are deleted with it.
If you buy Pro inside the iPhone app: Apple's identifiers for your subscription and its payments, the plan, its dates and status, and the price Apple charged, which our server reads from Apple to give you Pro. The app tells Apple which Lexpad account the purchase is for, as a code made from your account's identifier. Apple takes the payment under its own privacy policy; we never see your card or your Apple Account password.
If you buy Pro inside the Android app: Google Play's identifiers for your subscription (the purchase token and order number), the plan, its dates and status, which our server reads from Google Play to give you Pro. Google takes the payment under its own privacy policy; we never see your card.
If you buy Pro on the web: Paddle, our merchant of record, takes the payment and your billing details under its own privacy policy. We keep Paddle's identifiers for your subscription and payments, the plan, its dates, status and price. We never see your card.
Notes you send from Settings → Send feedback, and reports of a shared notebook: the text you wrote, the link you reported, and non-personal context (the app's version, the screen, the interface language and your notebook's two languages). They belong to your account and are deleted with it.
Conversations with Lex, the AI tutor: your questions and Lex's answers, so you can come back to them. Delete a conversation in Lex and it is gone; all of them are deleted with your account.
Your answers to two questions you see before you create your account: what you are learning for (up to three reasons) and where you meet new words. The app uses them to plan your daily practice, and we keep them with your account to understand what learners need; the team looks at them as totals across new accounts. We never sell them and do not pass them on to anyone. They are included in the copy of your account's data that you can ask us for, and they are erased with your account.
Answers to a questionnaire in the app. Lexpad sometimes sends a short questionnaire with a notification; answering it is your choice. Your answers are personal data: they are stored with your account, and Lexpad staff can read them account by account and export them. Each export is recorded. Each questionnaire can be answered once, and an answer cannot be changed after it is sent. Your answers are included in the copy of your account's data that you can ask us for. When your account is erased at the end of the 30-day grace period, the answers you wrote in your own words are erased with it. Choices and ratings are kept without any link to you, with only their date and the kind of device they came from, so we can count the results.

What we do not do

No advertising, no advertising trackers, no cookies used to follow you.
We never sell your data. We pass it on only to run the features you use, as this page explains: the text needed for AI help goes to the AI providers named above, and an assistant you connect sees what you allow it to.
We do not read your notebooks except to operate the service or when you ask us for help.

Measuring and fixing

Page counts on this site and in the web app come from Cloudflare Web Analytics, which sets no cookies, stores no identifier in your browser and shows us only totals such as how many people opened a page.
When the app or the server hits an error, a report goes to Sentry so we can fix it. Reports carry the technical details of the failure and never your name, e-mail address, notebook content, cookies or network address; they are processed in the United States.
To find the steps where new learners get stuck, the app counts which screens of the introduction are reached before an account exists. It sends only the screen's name and the kind of device (web, Android, iPhone or desktop), once per install. We keep a daily total and nothing about you: no account, no device identifier, none of your answers.
With your account we keep the time of a few firsts: your first word, your first AI card, your first practice answer and the first time you came back on a later day. We work them out from what your account already holds, look at them only as totals across new accounts, and erase them with your account.
When an import ends, we keep a short record that names nobody: the kind of file (for example CSV, an Anki deck or a Kindle file), the kind of device, whether it worked, a short reason if it failed, and how many rows it had. Never the file's name or its words. Because it is not linked to you, it is kept after your account is erased, so we can see which imports fail.
We count AI card requests that fail, by language pair, to fix the languages where AI help works badly. The count never includes the words that were asked for.
When the app shows you Lexpad Pro, we note with your account where it was shown (for example on the Plan page or in Lex), whether you opened it and whether you began a checkout, at most once a day for each. We use it to see which places are useful, and it is erased with your account. Payments are never part of it; they come from the shop that sold the plan.
When Google or your browser tells us a notification can no longer reach a device (usually because the app was removed), we stop sending to it, note the date on that device's record, and add one to a daily count per kind of device that names nobody.
When you turn the daily reminder, product news, e-mail notes, the weekly summary or news by e-mail on or off, we add one to a daily count that names nobody, with which of our notes, if any, we sent you in the three days before. We also count, as totals, how many people practise within a day after each note.
We use these counts only inside Lexpad, to decide what to fix and build. We do not track your clicks or the screens you open in general, and none of this goes to advertisers or any other company.

Notifications

The daily reminder is set by the app on your phone and needs no server. Other notifications in the Android and iOS apps, such as a note after a few days away, product news, gifts and notes about your plan (for example that a card was declined or a refund is on its way), are delivered by Google's Firebase Cloud Messaging. To reach your phone we keep a notification token for each app install you sign in to. It is removed when you sign out, and Firebase receives only that token and the text of the notification, never your notebook. You can turn product news off in Settings, and turning the daily reminder off also stops the notes after time away.

A notification may carry a button. It opens a questionnaire in the app, a screen in the app, or a page in your browser. Such a page is only ever on lexpad.app or in an app store. Nothing that identifies you is added to the link. A link to buy Pro outside the App Store is never shown on an iPhone: an account used only on an iPhone is not sent it, and the iPhone app shows such a message without its button.

AI features

Lexpad's AI features are written by the AI providers we work with: OpenAI, and Anthropic (Claude) when OpenAI cannot answer, so the features keep working while one of them is down. Each request goes to one of them, which processes what we send only to answer it and does not use it to train its models. The apps ask you once on each device before anything is sent, and send nothing if you say no. What is sent, and only when you use the feature:

AI cards (Fill with AI, Improve with AI, AI cards): the word or phrase you typed, your notebook's two languages and, if you add one, your hint.
Words worth keeping: the text you paste, to pick out the words worth a card. The sentence a word came from is saved with the words you keep.
Use it in a sentence: the word and the sentence you wrote, to check it.
Lex: your question, the recent part of the conversation and some of your most recent words, so Lex can talk about them.

The providers never receive your name, e-mail address or password. You can report anything the AI wrote from the screen that shows it.

Voice input

When you tap the microphone, the speech recognition of your phone or browser turns what you say into text: Apple's on iPhone, your phone's own recogniser on Android (usually Google's), and the browser's on the web. That service may process the audio on its own servers under its own privacy policy. Lexpad receives only the text, keeps no recording, and listens only while the microphone is open.

Browser extension

The Lexpad extension, published for Chrome, Edge and Firefox, adds a word you select on a page to your notebook. During normal browsing, when you do nothing, it never sends what is on the pages you read. While it is connected, it asks our servers for the list of your notebooks when a page loads, so it can offer the right one; that request carries nothing from the page. When you open the meaning card for a selection, the selected text and the sentence around it are sent so the same AI provider as above can write the meaning, even if you then close the card without adding. When you add the word, the page's address and title are saved with it as a private note on where you met it.

On YouTube, the extension reads the subtitle shown on the video only while your pointer is on it, inside your browser, to underline the words you can click; it keeps no record of what you watch. A word you click is handled like a selection: the word and its subtitle line are sent when the card opens, and when you add the word, the video's title and its address with the moment you clicked are saved with it as the private note. Nothing about the video is sent while you only watch. You can turn this off in the extension's menu.

The extension never sees your password. You allow it from the signed-in web app, it receives a sign-in of its own, and it appears under Settings → Signed-in devices, where you can sign it out at any time. Its sign-in is kept only in your browser's extension storage and is removed when you disconnect or uninstall it. The extension contains no analytics or trackers.

ChatGPT and Claude

If you connect an assistant such as ChatGPT or Claude to Lexpad, it acts for you with the permissions you approved on Lexpad's own approval page.

What it receives: the notebooks, words, meanings, examples, notes and practice information it asks for while you use it. It never receives your e-mail address or password.
What it can do: only what you approved: read your words, add and change words and meanings, star or retire words, record practice answers and, if you gave that permission separately, delete words. It cannot delete your account or a notebook, change your password or make payments.
What we keep: a record of each connection (the assistant's name and site, the permissions, when it connected and when it was last used) and a one-way fingerprint of its access tokens, never the tokens themselves. Words it saves are marked as added by an assistant.
What we do not receive: your conversations with the assistant. What the assistant does with the words it receives is covered by its provider's own privacy policy.
Ending a connection: we e-mail you and add a note to the bell in the app whenever a new assistant connects. See and end connections in Settings, under Connected apps. Changing your password or deleting your account ends them all.

Inviting friends

When you invite a friend, you both get days of Pro once they start learning. We keep only what is needed to run this and to stop it being misused.

Your invitation link: a short random code that stays the same. It does not contain your name, e-mail address or account number.
Before you sign up: if you arrive through a link that names where it came from (a friend's invitation, or a short word such as the site that linked to us), the app keeps that word on your device, in the browser's local storage on the web. When a link names nothing, the word is the name of the site that sent you (such as google, chatgpt or reddit), read from the browser's referrer: the site's name only, never the page's address or anything you searched for. This site keeps the same word in your browser's local storage for up to 30 days and adds it to its links into the app and to Google Play, so a visit across a few pages keeps it. The app sends it to our server once after you sign in and then removes it, and it is dropped unsent after 30 days. When the app knows nothing about where you came from, a new account gets a word for how it reached us instead: direct (the web app with no link and no referrer), site (this site), appstore, play, desktop-app or extension. The Android app (from 1.0.70) also asks Google Play once where it was installed from and keeps only the source word in Play's answer (play when you found Lexpad in the store); nothing else Play returns is kept or sent.
Where an account came from: for a new account we record that word once, as where the sign-up came from, and do not change it later. It is a short word only, never an address or anything about your visit.
The invitation: which account invited which, whether the friend has joined, received the days, did not start in time or was set aside, and the days each side received.
Stopping self-invitations: to tell a friend from a second account of your own, we check whether the two accounts have used the same app install, whether their e-mail addresses look like the same mailbox, and, at sign-up, whether the inviter used the same network address within a day. These checks compare information we already hold for your account and signed-in devices. We store only the result, such as "same device", never the details compared.
What each side sees: the person who invited you is never shown your name or e-mail address, only how many friends have joined and been rewarded, and short notes in the bell such as "A friend joined Lexpad". You are not shown theirs either.
Counting where people open it: for each day we count how often Invite friends was opened from each place (such as Settings or an e-mail). These counts contain no account and nothing about who opened it.
Who else sees it: Lexpad's administrators can see the invitations to check rewards and take back one that broke the rules.
How long: these records are kept while the accounts exist. When either account is permanently erased, the invitation and code that belong to it are erased with it.

Where it lives

Your data is stored on your device so the app works offline, and on our servers in the European Union so it syncs between your devices. Connections are encrypted.

Your control

Export your whole notebook with its progress at any time, from Settings.
Delete your account from Settings. It closes at once; your notebooks, progress and personal details are erased after a 30-day grace period in which you can ask us to restore it. Step by step: how to delete your account or part of your data.
When you delete your account, the app may ask an optional question, "Why are you leaving?". Skipping it changes nothing. If you answer, your reason and any note you write are stored with your account, and Lexpad staff can read them. With the reason we also keep a few coarse facts about the account from that moment: what you were learning for, the kind of device it was made on, how many days old it was and whether an import had been tried. When the account is erased at the end of the 30-day grace period, the note is erased with it, and the reason and those facts are kept without any link to you, with only its date and the kind of device it came from, so we can count why people leave.
After you cancel a paid Pro plan, the app may ask once, "Why did you cancel Pro?", with a few one-tap answers and no note. Skipping it changes nothing. If you answer, we keep the reason with your account, with the same coarse facts as above, and when your account is erased the reason and those facts are kept without any link to you.
During those 30 days you can also restore the account yourself: sign in again and choose Restore my account, or start a new, empty account instead. If you signed in with Apple, we keep the token Apple issues for your sign-in, encrypted, only so that when you delete your account we can ask Apple to revoke Lexpad's access to your Apple ID; we do that when you delete it.
Ask us to delete your account and everything is removed within 30 days. Erasing your learning progress is a tap away in Settings.
Questions or requests: e-mail hello@lexpad.app, or message Reza on LinkedIn.