This policy explains what personal data associlang processes when you use the website associlang.com or the associlang apps for iPhone and Android: what we collect, why, who receives it, how long we keep it and what your rights are. It applies wherever you live.
In short: we use your data to run your account and your learning; we don't sell it for money; the associations you write stay in the course for good and help train our AI; measurement and advertising cookies load only if you agree; you can delete your account at any time; and you can write to us about anything at [email protected].
1. Who is responsible
associlang is run by an individual in Israel: Haim Hai Yakovian. They decide how your data is used and are responsible for it (the "controller"). For anything about privacy, wherever you are, write to [email protected].
2. What we collect
- Your account. With email sign-up: your email address, first and last name, and your password, which we keep only as a salted one-way hash, never as text. With Google: the email address, name and profile picture link Google shares, and Google's id for you. With Apple: the email address Apple shares (yours, or an Apple relay address that forwards to it), your name the first time only, Apple's id for you, and a token Apple issues that we keep only so that deleting your account also disconnects it from Sign in with Apple.
- Profile and settings. The display name other learners see (at first the name on your account; you can change it in Settings), interface language, time zone, daily word limit, and when you last used the service.
- Your learning. Your courses, your words, every answer (right or wrong, and how long it took), your review schedule, study days and time, streaks, level-test results and the stories you open.
- What you add to the community. Associations you write, your votes, your reports (with any details you type), and the alerts we show you about them.
- Coins and purchases. Every coin you receive or spend. For each purchase: the pack, price, currency, date, status and the payment reference at PayPal, the App Store or Google Play. You pay at PayPal, Apple or Google, and we never see your card or bank details. We keep the notices PayPal sends us about a payment, refund or dispute; they can include details of the PayPal account that paid, such as its name or email address.
- Invitations. Your invitation code, who invited you, and a fingerprint that stops one person from earning the invitation reward twice (section 7).
- Your choices. When you accepted the terms, whether and when you agreed to receive news by email, and your cookie choice (kept in your browser).
- Messages. Emails you send us, feedback you send in the app (your idea, bug report or other note, and the course you were in), and our replies.
- Technical data. Every request to our servers carries your IP address and browser details, and passes through our network and security provider. We use the IP address to limit how many requests one connection can make, and that provider uses it for the "not a robot" check when you sign up; we do not store it in our database. Our server logs record errors together with the account id involved.
- Reminders. The app schedules its daily reminders on your phone. We send no push notifications and collect no device identifier for them.
This comes from you and from how you use the service, from Google or Apple if you sign in with them, and from PayPal, Apple or Google when you pay. No law requires you to give it to us, and giving it is up to you. But some of it is needed to open an account and use the service: without an email address there is no account, and each feature needs the data it works with. Where we rely on your consent (news by email, measurement and advertising cookies), you can refuse it or withdraw it at any time without losing anything else. Reminders are optional too.
We don't ask for sensitive data such as health or religious beliefs. Associations are public, so please don't write personal details in them.
3. Why we use it, and our legal basis
- To provide the service: your account, lessons and review schedule, progress, coins, stories, purchases, the community, and the emails your account needs (confirming your address, resetting your password, deleting the account). Legal basis: our agreement with you (GDPR art. 6(1)(b)).
- To keep it safe and fair: limiting requests, the "not a robot" check, stopping repeat invitation rewards, verifying payments, investigating abuse. Legal basis: our legitimate interest in protecting the service and the people who use it (art. 6(1)(f)).
- To review associations before they earn coins, which we do ourselves or with the help of an AI model (section 4). Only the association's text and the word it is for are checked, never your name or email. If you think a verdict is wrong, write to us and a person will look at it. Legal basis: our legitimate interest in keeping the content useful and appropriate.
- To improve the course and train our AI: every association written in the Service stays in it for good. We use the associations, and how well they work (votes, and how well learners remember the words they go with, counted together), to train and improve our AI models and to create and improve associations, and an association may become one of the course's own, shown without its author's name. What we use for training contains no names, email addresses or account ids. Legal basis: our agreement with you (terms, section 7) and our legitimate interest in improving the course. If the law where you live gives you a right to object to this use, write to us: from then on your associations are left out of new training, but training already done cannot be undone.
- To send news and offers by email, only if you said yes. You can stop at any time with the link in every such email or in Settings, and an advertising email says so in its subject line. Legal basis: your consent (art. 6(1)(a)); in Israel, section 30A of the Communications Law.
- To measure visits and advertising, only if you agree in the cookie notice (section 6). Legal basis: your consent.
- To meet legal duties, such as keeping payment records for tax and accounting, and to handle disputes. Legal basis: legal obligation (art. 6(1)(c)) and our legitimate interest in defending our rights.
We don't sell your data for money, we don't use what you study for advertising, and we don't make decisions about you by automated means that have legal or similarly significant effects.
4. Who receives it
Providers that process data for us, only on our instructions and bound to protect it at least as well as this policy does:
- Our hosting provider: servers, database and backups, in the European Union.
- A network and security provider: carries traffic to the site, protects it from attacks, and runs the "not a robot" check.
- An email delivery service: sends our emails.
- Our email mailbox provider: where we receive and answer your emails.
- AI providers that help us review associations and train our models: they receive associations, the words they are for and how well they work, never who wrote them. Under our settings and agreements with them, they do not use this to train their own models.
A current list of our main service providers is available to anyone who asks.
Companies that receive data for their own part, under their own privacy policies:
- Google or Apple, when you sign in with them.
- PayPal when you pay on the website, and Apple (App Store) or Google (Google Play) when you pay in the app. They handle your payment details, and may set their own cookies for security when their payment window opens.
- Google and Meta, only if you accept measurement or advertising cookies (section 6).
Other people:
- Other learners see your display name next to associations you write and on the leaderboards (with how many words you know, associations you wrote and likes you received). When you like someone's association, its author sees your display name in their alerts.
- The person who invited you sees your display name, when you joined, and whether their reward has come through.
- Authorities or courts, only when the law requires it.
- If associlang is ever transferred to someone else, your data would go with it, still protected by this policy, and we would tell you in advance.
5. Transfers outside your country
We operate from Israel, and your data is stored in the European Union. The European Commission recognises Israel as protecting personal data adequately (Decision 2011/61/EU, confirmed in its January 2024 review), and so does the United Kingdom. Some providers in section 4 may process data outside Israel and the EU, for example in the United States. From the EU and the UK we transfer data to them only with a safeguard the law there recognises: for data from the EU, the provider's certification under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses; for data from the UK, the UK Extension to the Data Privacy Framework or the UK Addendum to those clauses. From Israel, we transfer data only as the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 2001, allow. You can ask us for details or a copy of these safeguards.
6. Cookies and storage on your device
Necessary, and so not asked about: a secure cookie that keeps you signed in for up to 60 days (refresh_token); two short-lived cookies during Google or Apple sign-in; a cookie that remembers your language (NEXT_LOCALE); security cookies set by our network and security provider. Your browser or the app also stores a short-lived sign-in token, your current course, whether sound is on, your cookie choice, an invitation code you arrived with, your reminder time and which intro screens you have seen. PayPal's own cookies load only when you open its payment window.
Optional, only after a yes in the cookie notice: Google Analytics, to see which pages help learners; Google Ads and the Meta Pixel (Facebook and Instagram), to know whether one of our ads brought someone to sign up or buy. They receive the page address, browser and device details, your IP address, and events such as signing up, opening a payment or a purchase (its amount, currency and our purchase number). We never pass them your email, your name, your account id or what you study. This lets Google and Meta collect information about your activity over time and across different websites; they also use it under their own privacy policies, and may link it to other information they hold about you, for example if you are signed in to Facebook. How Google uses this data. You can change your choice at any time under "Cookie settings" at the bottom of every page; saying no removes their cookies.
The iPhone and Android apps load none of these tags. Browsers' "Do Not Track" signal has no agreed meaning and we don't respond to it, but no optional tag ever loads without your yes.
For California residents: under California's privacy laws (CCPA/CPRA), the advertising cookies (Google Ads and the Meta Pixel) may count as "selling" or "sharing" personal information for cross-context behavioral advertising. They load only after your yes, and saying no in the cookie notice, or withdrawing your yes under "Cookie settings", is your request that we not sell or share it (Do Not Sell or Share).
7. How long we keep it, and deleting your account
- Account, learning and community data: for as long as your account exists.
- Feedback you send in the app: for as long as your account exists. Deleting the account deletes it.
- Associations: for good, as part of the course (section 3); without your name once you delete your account.
- Links sent by email: stored only as a hash, used once, and valid for 24 hours (confirming your address) or one hour (password reset, account deletion).
- Sign-in sessions: 60 days, or until you sign out or reset your password.
- Request counters used to limit abuse: in memory, for an hour at most.
- Server logs: up to 30 days, then deleted automatically.
- Backups: a copy of the database every night; only the three most recent are kept, so deleted data leaves the backups within a few days.
- Emails with us: as long as needed to handle your request and keep a record of it.
- Purchase and payment records: as long as tax and accounting law requires (in Israel, generally seven years after the end of the tax year).
You can delete your account at any time in Settings, or without the app on the account deletion page. We email a link to the address on the account, and nothing is deleted until you confirm on the page it opens. Deleting removes your email address, names, password, Google and Apple ids and profile picture link, disconnects Sign in with Apple, ends every session and stops all emails.
Some things remain: your learning and coin history, under an internal account number with no name, email or password beside it (so totals and statistics stay correct); purchase records, for as long as the law requires; and the associations you wrote, which stay in the Service without your name and are still used as section 3 describes, while your votes still count in their totals. If an association you wrote contains your personal information, write to us and we will remove it.
The invitation fingerprint also remains: a one-way code made from your email address and your Google or Apple id with a secret key. It cannot be turned back into your details; it only lets us recognise the same address or account if it signs up again, so that nobody earns the invitation reward twice. We keep it for as long as invitations are rewarded.
8. Your rights
Wherever you live, you can ask to:
- see the data we hold about you, and receive a copy;
- have it corrected;
- have it deleted (section 7 says what the law requires us to keep);
- withdraw a consent (news by email, cookies) at any time, without affecting what came before;
- stop marketing emails.
In the European Union, the United Kingdom and Switzerland you can also restrict how we use your data, receive it in a machine-readable format (portability), and object to processing based on our legitimate interests. In Israel, these rights come from the Protection of Privacy Law, 1981: access (section 13), correcting or deleting data that is wrong, incomplete, unclear or out of date (section 14), and removal from a direct-mail list (section 17F).
Several of these you can do yourself in Settings: your name, language, email preferences and deleting the account. For anything else, write to [email protected] from the address on your account, so we know it's you. It's free, and we answer within 30 days (the GDPR allows two more months for a complex request; we would tell you why).
If you are unhappy with how we handle your data, tell us: we will acknowledge your complaint within 30 days and look into it. You can also complain to Israel's Privacy Protection Authority, or to the data protection authority where you live or work (for example the CNIL in France, the AEPD in Spain, the Garante in Italy or the ICO in the United Kingdom).
We don't sell personal information for money. The only thing that may count as "selling" or "sharing" under US state privacy laws is the advertising cookies of section 6, which run only after your yes and which you can turn off at any time.
9. Security
Connections are encrypted, passwords and email links are stored only as hashes, our servers sit behind a firewall and a network security service, only the operator has access to the data, and resetting your password signs out every other device. No system is perfectly secure. If a security incident puts your data at risk, we will tell you and the authorities, as the law requires.
10. Children
You must be at least 13 to use associlang, and it is not directed at children under 13. When an account is opened, we ask you to confirm that you are 13 or older. If we learn that a child under 13 has an account, we will delete it. In the European Union and the United Kingdom, if you are younger than the age at which you can consent on your own (between 13 and 16, depending on the country), a parent must agree for you before you accept news by email or optional cookies. Under 18, you need a parent's permission to buy coins. A parent can write to us to have a child's account deleted.
11. Changes
We may update this policy. The date at the top will change, and if a change matters we will tell account holders by email or in the app before it takes effect.
12. Contact
Questions and requests: [email protected], or through the contact page.