Privacy Policy
Last updated: 2026-05-30
Lingo ("we", "our", "the extension") is a Chrome extension that helps users learn languages while watching their day-to-day online content — currently YouTube, with more platforms coming. We take your privacy seriously. This policy explains what data we handle, why, and your rights.
TL;DR
- We process YouTube subtitle text only to identify language-learning terms. Subtitles are sent to your chosen AI provider (Google Gemini or Alibaba Qwen) and are not stored by us.
- If you create an account, we store the words you choose to save plus your email address.
- We do not sell your data, do not show ads, and do not track your browsing outside YouTube.
1. What data we handle
1.1 Subtitle text (transient)
When you watch a YouTube video with captions enabled and have Lingo's side panel open, the extension reads the currently-displayed subtitle text from the YouTube page and sends it to your chosen AI provider for analysis. Subtitle text is not stored by Lingo's servers. It exists only in transit between the extension and the AI provider.
1.2 Account data (if you sign up)
If you create a Lingo account, we store:
- Your email address (used for login and account recovery)
- A secure password hash (we never see or store your raw password)
- The terms you explicitly save (by clicking the star button), along with the video ID and context where you saved them
Account data is stored on our backend, hosted on Supabase (Postgres database) and accessed via our API on Vercel.
1.3 API key (stored in your browser only)
If you bring your own AI API key (Google Gemini or Alibaba Qwen), the key is stored in Chrome's storage.sync API. It is never sent to Lingo's servers. It travels only between your browser and the AI provider you chose.
1.4 What we do NOT collect
- We do not collect your browsing history outside YouTube.
- We do not collect personally identifiable information beyond your email.
- We do not use cookies or analytics trackers.
- We do not record video, audio, or anything other than the captioned subtitle text.
2. Who we share data with
| Recipient | What is shared | Why |
|---|---|---|
| Google (Gemini API) | Subtitle text (transient) | AI analysis to identify terms — only if you selected Gemini as your AI provider |
| Alibaba Cloud (Qwen / DashScope API) | Subtitle text (transient) | AI analysis — only if you selected Qwen as your AI provider |
| Supabase | Email, password hash, saved terms | Database and authentication for your account |
| Vercel | API requests to our backend | Hosting infrastructure for our backend API |
These third parties have their own privacy policies governing how they handle the data we send them. We have no control over their data practices beyond the data we choose to send. We send the minimum data needed for the feature to work.
We do not share, sell, or rent your data to advertisers, data brokers, or anyone else.
3. Data retention
- Subtitle text: not retained by Lingo (sent in real-time to AI, response shown, then discarded). The AI provider may retain it briefly per their own policies.
- Account data: retained until you delete your account.
- API key: stored in your browser until you remove it via the extension's Options page.
4. Your rights and choices
You can, at any time:
- Use Lingo without an account — saved terms then live only in your browser (
chrome.storage.local) and are never sent to us. - Sign out — your data stays on our servers; sign in again to resume.
- Delete a saved term — click the trash icon next to it in the Saved tab.
- Delete your entire account and all data — email us (see contact below). We will delete your data within 30 days.
- Remove your API key — in the extension's Options page.
- Uninstall the extension — Chrome will remove all locally-stored data; backend data remains until you request deletion.
If you're in the EU, UK, or California, you have additional rights under GDPR / UK GDPR / CCPA, including the right to access, correct, or delete the data we hold about you. Contact us to exercise these rights.
5. Security
- All connections (extension ↔ backend, extension ↔ AI providers) use HTTPS.
- Passwords are hashed (we cannot read or recover them).
- Backend access is gated by JWT tokens.
No system is perfectly secure. We will inform affected users within 72 hours if we discover a breach affecting account data.
6. Children's privacy
Lingo is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
7. Changes to this policy
We may update this policy as the product evolves. The "Last updated" date at the top will change. For material changes, we will notify account holders by email and post a notice in the extension.
8. Contact
For privacy questions, deletion requests, or anything else:
- Email: zhuoyuan.jiang625@gmail.com
- Project: Lingo Chrome Extension
This privacy policy applies to the Lingo Chrome extension and its associated web dashboard.