Privacy Policy

1. Data we collect

• Account: email, display name (pseudonym), Native language, chosen Course, age range (optional).
• Learning: progress in Units, Cards and Review scheduling, XP, Streak, Level, results of Test-out, Level test and Missions.
• Usage: product events (about 20 named events, such as "lesson completed"), device and access times, stored on our own server.
• Guest: during the demo Lesson, progress stays only on your device until you create the account.
• Reports: the reported passage, the language and the suggestion you wrote.

We do not collect payment data (there are no charges) or data about religious affiliation. We do not ask for a phone number.

2. How we use it

• Serve lessons in your Native language and in your Course.
• Calculate the spaced Review and keep Streak, XP and the Map.
• Send push notifications and operational emails that you can turn off by type.
• Measure the product (our own events) and the public funnel (Google Analytics 4, only with consent).
• Fix content based on Reports.

3. Legal basis (LGPD and GDPR)

• Performance of the contract: account, progress, Review, Groups, Referrals.
• Consent: analytics (GA4), marketing, visibility in the Group, push.
• Legitimate interest: security, abuse prevention, aggregated internal metrics.
• Legal obligation: records required by law.

4. Consent by purpose

You control each purpose separately in Settings and in the cookie banner:

• Functional: always on; needed for the service.
• Analytics: Google Analytics 4 on the public pages.
• Marketing: news and offers, at most 2 emails a month.
• Visibility in the Group: display name and XP for the week for the members of your Group.

Transactional emails (access link, export ready, deletion confirmation, change of terms) cannot be turned off. Operational ones (Streak at risk, Reviews due, re-engagement, "A2 available", Interest list confirmation) can be turned off by type.

5. Who we share it with

• Google Analytics 4: measurement of the public funnel, only after consent.
• Email provider: sending the messages above.
• Sentry: technical error reports, with no content from your learning.

At launch, none of your data is sent to artificial intelligence providers in real time; AI is used to produce the content, before it reaches you. We do not sell data and do not share it for advertising.

6. Groups

When you join a Group through the invite link, members see your display name and your XP for the week. They never see your answers, words, mistakes or Cards. Leaving the Group ends that visibility immediately.

7. Retention

• Account: while it is active.
• Guest progress: on the device, until sign-up or until you clear the browser.
• Product events: 24 months, then aggregated.
• Deleted account: complete deletion within 7 days, except what the law requires us to keep.

8. Your rights

Under the LGPD (art. 18) and the GDPR (arts. 15-22): access, correction, deletion, portability and withdrawal of consent, at any time, in Settings or by email.

• Export my data: one JSON and CSV package per category, sent by email within 24 hours, available for 7 days.
• Delete account: request in Settings, with a confirmation email; irreversible.

9. Languages and international transfer

The service is offered in 40 languages from servers in the European Union. If you use Biblup outside it, your data is processed on those servers with the safeguards provided by applicable law.

10. Minors

Biblup was designed for adults and does not state a minimum age at sign-up. If you are responsible for a minor who uses the service and you want to delete the account, write to the address below.

11. Cookies

See the Cookie Policy.

12. Contact

Privacy: [email protected] · Data Protection Officer (DPO): [email protected].