LexiPackBack to LexiPack

Privacy Policy

This explains what LexiPack collects, why, who else sees it, how long it is kept, and how to get it back or deleted. It describes what the service actually does — where a section says we do not do something, that is a statement about the code, not an aspiration.

Who is responsible for your data

LexiPack is operated by Yevhenii Lypskyi, sole proprietor (Jednoosobowa Działalność Gospodarcza), NIP: 8971963461, registered in Poland (“we,” “us,” or “our”). We are the controller of the personal data described below.

NIP
8971963461
Contact
support@lexipack.app

You can write to that address in English or Polish about anything on this page, including to exercise any of the rights below.

What we collect

  • Account details — your email address, an optional display name, and either a hashed password or the fact that you signed in with Google. We never see your Google password.
  • Your study content — the languages, packs, words and translations you create or import, including anything you paste in.
  • Study activity — each review you submit: the rating, what you typed or selected, how long you took, and the resulting schedule. This is what makes spaced repetition work; without it the app cannot decide what to show you next.
  • Streaks and XP — a running count of study days and points, plus the calendar date of your last session.
  • Subscription status — which plan you are on and when it changed. Card details are never sent to us; see Payments below.
  • Technical logs — errors and performance samples, used to find bugs.

Why we are allowed to use it

Running the service
Performance of our contract with you (GDPR Art. 6(1)(b)) — your account, your packs, your schedule.
Taking payment
Performance of contract, and legal obligation for invoices and tax records.
Security and abuse prevention
Legitimate interests (Art. 6(1)(f)) — rate limiting, spend controls and error monitoring, so the service stays up and affordable for everyone.
Legal obligations
Accounting and tax law in Poland.

Generating card content with AI

When you ask LexiPack to generate card content, we send the words you submitted, the language pair, and any hints you provided to OpenAI. We do not send your name, your email, or any other account detail with them.

If you paste a longer text so LexiPack can suggest the words worth learning, the text itself is sent to OpenAI to be analysed, in pieces, and is not stored by LexiPack after the words are chosen. Only the words you then choose to import are saved to your pack.

If you describe a situation, the text you write and the words already in that pack are sent to OpenAI to write the dialogue and choose new words. LexiPack does not keep the dialogue; only the words you then choose to import are saved to your pack.

If you import a PDF, its text is read on your device, so the file itself is not uploaded. The text is then sent to OpenAI to be analysed, in pieces, and is not stored by LexiPack after the words are chosen. Only the words you then choose to import are saved to your pack.

If you import a photo, it is resized and stripped of its location and camera details on your device, then sent to OpenAI to read the words in it. LexiPack does not store the photo or the text read from it after the words are chosen. Only the words you then choose to import are saved to your pack. Please do not photograph anything that shows other people's personal details.

If you import a deck file, it is opened on your device and is never uploaded to us. Only the words you choose to import are sent to LexiPack and saved to your pack.

Do not paste sensitive personal information into your word lists. AI output can be inaccurate or inappropriate — review it before relying on it or publishing a pack.

OpenAI processes this in the United States. Transfers rely on the safeguards in OpenAI's data processing terms. OpenAI states that data submitted through its API is not used to train its models; we rely on that commitment rather than on our own inspection of their systems.

Cookies and tracking

One cookie you can't turn off: the one that keeps you signed in. No advertising, no tracking pixels, and no session or video recording — ever, whatever you choose below.

With your consent, we use PostHog for product analytics — which pages lead to a signup and where people get stuck. It tracks individual anonymous visits, so it stays off unless you opt in: a banner offers Accept or Decline the first time you visit, and you can change your answer anytime below. It never records your screen or session, no matter which you pick.

Analytics: Not decided yet

Aggregate product analytics, opt-in. Session/video recording is never used, whatever you choose here.

Our mobile app stores your login token in the device keychain and keeps a local copy of your packs so you can study offline. That data stays on your device.

Who else sees your data

We do not sell your data and we do not share it for advertising. We use these service providers to run LexiPack:

Amazon Web Services (AWS)
Hosting, content delivery, background job queue. Region: eu-central-1 (Frankfurt, EU).
Neon
Managed PostgreSQL database. Region: eu-central-1 (Frankfurt, EU).
OpenAI
Generating translations, phonetics and example sentences from the words you submit. Region: United States - see the AI section.
Sentry
Error and performance monitoring. Region: EU/US depending on project region.
PostHog
Optional product analytics, enabled only with your consent - session recording is disabled. Region: European Union (EU Cloud).
Google
Optional 'Sign in with Google' authentication. Region: Global.
Paddle
Seller of record for web subscriptions - takes payment and handles tax. Region: Global.
RevenueCat
Managing mobile subscription status. Region: United States.
Zoho
Hosting the support@lexipack.app mailbox - it processes any correspondence you send us. Region: European Union (zoho.eu).
Apple / Google
Seller of record for in-app purchases made on iOS or Android. Region: Global.

Hosting and the database are in Frankfurt, so your account and study data stay in the EU in normal operation. The AI feature described above is the one routine transfer outside it.

Packs you choose to share

Sharing is entirely opt-in and comes in two separate steps, because they expose your pack to very different audiences:

  • A share link means anyone who has the URL can view that pack. It is not listed anywhere and is not indexed by search engines.
  • Publishing to the public library is a second, separate choice that lists the pack for anyone to find. Turning on a share link never publishes a pack by itself.

If someone saves a copy of your shared pack, that copy is theirs. Unsharing or deleting yours stops further updates reaching them, but does not delete what they already saved — the same way an emailed document stays with the recipient.

Payments

We never receive or store your card number. On the web, Paddle is the seller of record and handles the payment and applicable tax. On iOS and Android, Apple or Google is the seller. We receive only the resulting subscription status.

How long we keep it

Account and content
for as long as the account exists, then deleted within 30 days of a deletion request
Study history
with the account; deleted when the account is deleted
Shared packs
removed from the catalogue on deletion; copies already saved by other learners remain theirs
Logs
application and error logs for 90 days
Backups
database backups for 30 days, after which deleted data is gone from backups too
Invoices
invoice and transaction records for 5 years, as Polish tax law requires - this cannot be shortened by a deletion request
Support messages
support correspondence for 24 months

Your rights

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, and receive it in a portable format. We answer within one month.

Write to support@lexipack.app. If you are not satisfied with our answer you can complain to the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), or to the authority where you live.

Age

LexiPack is not for children under 16. If you believe someone younger has an account, tell us and we will remove it.

Changes

If we change this policy in a way that materially affects you, we will tell you by email or in the app before it takes effect.

Last updated 1 October 2026.