Lernomi
Privacy policyTerms of useSupportDelete your accountImpressum

Privacy Policy

Effective: October 9, 2026 · Version 1.10.2

Language:TürkçeEnglishDeutsch

This is an informational translation. The binding text is the Turkish version.

In brief

  • ·Lernomi is a language learning app: German and English.
  • ·Your email and name are processed to run your account, and your progress data to track your learning.
  • ·What you write and say is sent to AI providers only after you allow it in the app; the consent screen names the providers.
  • ·The microphone opens only when you answer by speaking. Audio reaches the server only with your permission, and the recording is not kept.
  • ·No ads, no advertising identifier, no third-party tracking.
  • ·You can delete your account at any time, from the app or the web.
  • ·GDPR rights in Europe, KVKK rights in Türkiye.

1. Data controller

The controller of the personal data covered by this policy, within the meaning of Turkish Law no. 6698 on the Protection of Personal Data (KVKK) and the European Union General Data Protection Regulation (GDPR), is the person identified below: they decide what data is processed for what purpose, how long it is kept and which providers it goes to. The same person provides the service, publishes the app on Google Play and the App Store and receives the subscription revenue. The policy covers the Lernomi web app (www.lernomi.app) and the Android and iOS apps.

Service provider and data controller
Musa Atila
Postal address
Akpınar Mah. Akpınar Merkez Küme Evler No:6, Tufanbeyli, Adana, Türkiye
Tax office
Tufanbeyli Vergi Dairesi
Developer name on Google Play
RumpusKit
KVKK requests (Türkiye)
kvkk@lernomi.app
GDPR / UK GDPR requests and EU representative
gdpr@lernomi.app
Support
support@lernomi.app

The controller is established in Türkiye and the service is provided from Türkiye. The servers, however, run on Netcup GmbH, Germany (EU) and the data is stored there; your data is therefore transferred abroad (section 6). Traffic to the site and the app passes through Cloudflare's network before it reaches the server. The provider identification (Impressum) is on the imprint page.

EU representative (Art. 27 GDPR): As the controller is not established in the European Union and also offers the service to people in the Union, it must designate a representative in the Union; its representative is the person identified below. Users in the EU and EEA and supervisory authorities may contact the representative, in addition to or instead of the controller, on all issues related to the processing of data. The representative is not the controller.

EU representative (Art. 27 GDPR)
Samet Atila
Postal address
Emil-Figge-Str. 9, Zimmer 421, 44227 Dortmund, Germany
Contact
gdpr@lernomi.app

Collection method and legal ground (KVKK Art. 10): Data is collected electronically, by automated or partly automated means, through registration and settings forms, the sign-in provider you choose (Google or Apple), in-app interactions, your device's notification service, Google Play's integrity service on Android and the microphone; the legal ground for each item is given in the table in section 3.

2. Which law applies to whom

  • Users in Türkiye: KVKK and its secondary legislation (Communiqué on the Obligation to Inform, Communiqué on Applications to the Data Controller, rules on transfers abroad). The controller is established in Türkiye; requests are made directly to them (section 10).
  • Users in the EU/EEA: the controller is not established in the Union; because the service is offered to people in the Union, the GDPR applies by virtue of Art. 3(2) GDPR, together with the supplementary data protection law of the member state where you are; in the United Kingdom, the UK GDPR and the Data Protection Act 2018 also apply. The legal grounds in this policy are mapped to Art. 6 GDPR. The identity and contact details of the EU representative under Art. 27 GDPR are given in section 1.
  • Other countries: rights under local data protection law are reserved (section 10). Lernomi does not sell your personal data and does not share it for behavioral advertising.

3. What data is processed and why

DataSourcePurposeLegal ground (KVKK / GDPR)Retention
E-mail address, name, password hashRegistration form, or the Google or Apple account you sign in withAccount creation, sign-in, password reset, verification email; subscription notices (e.g. a reminder before a free trial ends)Conclusion and performance of a contract (Art. 5/2-c / Art. 6(1)(b))For the life of the account
Guest identity: a random user ID and session token (no email, name or password is collected)The app, when you tap "Continue without an account"Keeping your progress on the server while you use the app without an account; moving it into your account if you create one or sign inConclusion and performance of a contract (Art. 5/2-c / Art. 6(1)(b))Deleted within 7 days after 30 days without use; deleted immediately when combined with an existing account or when you choose not to add it; becomes your account itself when you create one with email
Display name, avatar choice, level, course, daily goal, voice preferenceYouPersonalization; the display name is visible to other users on the weekly leaderboardPerformance of a contractFor the life of the account
Learning data: word state, review results, streak, XP, achievements, Speaking step and exam resultsWhile you use the appSpaced repetition schedule, progress, leaderboardPerformance of a contractFor the life of the account
Texts you write and say (writing tasks, chats in Speaking steps, exam answers)YouAI assessment, feedback and replies in the chatExplicit consent for sending to language model providers (Art. 5/1 / Art. 6(1)(a)): in-app consent screen, revocable. Performance of a contract for keeping the results in your accountAssessments for the life of the account; chat logs for 30 days
Microphone audio sent to the serverThe microphone: walk mode in the mobile app with the screen off or the phone in your pocketTranscribing what you saidExplicit consent (Art. 5/1 / Art. 6(1)(a)); in-app consent screen, revocableNot kept; deleted as soon as recognition finishes, only the recognized text is retained (30 days)
Usage events: which screen opened, round started/finished, screen width and platformThe appImproving the product (first-party analytics)Legitimate interest (Art. 5/2-f / Art. 6(1)(f)); can be switched off in settings, and the choice is saved to your account (section 8)For the life of the account
Anonymous error report: error message, stack trace (where in the code the error happened), screen name, app version and platformThe app and the website, when an error occursFinding and fixing errorsLegitimate interest (Art. 5/2-f / Art. 6(1)(f))No user ID is attached; before it is stored the report is scrubbed of email addresses, tokens and long numbers. Kept until the error group is fixed
IP address and browser/device description (in the session record)Your connectionSession security, abuse prevention and rate limitingLegitimate interest (security)For the life of the session; a session unused for 30 days expires and its record is deleted within 7 days at the latest
Server logs: IP address, requested address, time, browser description; the app's error and operational messages (may contain a user ID)Your connection and the server itselfSecurity, detecting attacks and abuse, debuggingLegitimate interest (security)Web server access logs 14 days; system and application logs 30 days
Bot protection (Cloudflare Turnstile): IP address, browser/device signalsSign-up, sign-in and password reset screenPreventing fake accounts and automated attacksLegitimate interest (security)Lernomi uses only the verification result and does not store the signals
Device integrity check (Google Play Integrity, Android app only): the integrity result for the app and the device (Google's assessment: whether the app is recognized, device integrity, license status) and the reason for the resultIn the Android app, Google Play services prepares the check when the sign-in screen opens (nothing is sent to Lernomi); the result is requested and sent to Lernomi only when you tap "Continue without an account"Preventing fake and automatically created guest accountsLegitimate interest (security)Lernomi does not store Google's signed token; only the result and its reason are kept, linked to the guest identity, for 90 days; when the account or guest identity is deleted they are detached from it
Social profile: username, visibility and request preferencesYouLetting your friends and, if visibility is "public", other users find youPerformance of a contract; consent for the preferencesFor the life of the account
Friend requests, friend list, blocks, user reportsYou and your friendsFriend features, safety and moderationPerformance of a contract; legitimate interest (safety)For the life of the account; reports 1 year after the review closes
Activity feed, reactions, nudges, shared quests, inbox notificationsWhile you use the appSharing progress with your friends and motivation (visible only to your friends)Performance of a contract; can be switched off with the "show my activity" preferenceFor the life of the account
Web push subscription (browser endpoint and encryption keys)Your browser, if you allow itReminder notifications on the webConsent (browser permission)Until the permission is withdrawn or the endpoint expires
Reminder preferences: daily reminder, streak protection and weekly exam toggles, reminder time, time zoneYou (the time zone is taken from your browser when you turn on notifications on the web)Sending reminders at your local time and keeping your choice the same on all your devicesPerformance of a contractFor the life of the account
Mobile notification token and platform (Android/iOS)Your device, if you allow notificationsDelivering reminders and friend notifications (requests, nudges, shared quests) to your phone; delivery is handled by Firebase Cloud MessagingConsent (the operating system's notification permission)Until you sign out or the token expires; deleted immediately when the account is deleted
Your AI and voice consent decisions (purpose, decision, date, text version, platform)You (consent screen, Settings › Privacy)Being able to show that consent was given or withdrawnLegal obligation (Art. 5/2-ç / Art. 6(1)(c) and Art. 7(1) GDPR)For the life of the account
The version of the terms of use you accepted and the date of acceptanceSign-up and sign-inBeing able to show which contract text you accepted and when, and to send it to youConclusion and performance of a contract; legal obligation (storing the contract)For the life of the account
Purchase and subscription stateApp store / RevenueCatUnlocking Premium featuresPerformance of a contract; legal obligation (accounting)For the life of the account; financial records for the statutory period
Your content reports: the reason you choose, your optional description, the reported content as it appeared on screen and technical context (platform, app version, course, language pair, content version)You ("Report" on content across the app and on AI answers)Reviewing and fixing errors in learning content (wrong answer, spelling, translation, audio, technical problems) and inappropriate AI answersLegitimate interest (a safe and accurate service)1 year after the review closes
Support messages and rights requests you sendYouAnswering the request, statutory recordLegal obligation (KVKK Art. 13, GDPR Art. 12)2 years after the request closes

Using the app without an account (guest): If you use the app without creating an account, the learning data, personalization preferences, usage events and session record described above are processed under a guest identity instead of an account. Guests have no social features, nothing is sent to server-side speech recognition, and there is no notification token and no purchase; reminders are set up only on your device and are not written to the server. Sending text to AI is limited to a single writing or speaking assessment per guest identity and, as with an account, happens only with your explicit consent (section 5); your consent decision is recorded under the guest identity and can be withdrawn under Settings › Privacy. The guest identity's token is stored only in your device's secure storage (iOS Keychain, Android Keystore) and used only to keep or restore your session and to move your progress into an account. If you create an account with email, the guest identity becomes your account itself (it stays a guest until you verify your email address). If you create an account with a social sign-in, your guest progress moves into it. If you sign in to an existing account that already has progress, you are asked whether to add this progress: if you add it, it is combined with that account's progress (for the same word, Speaking step or exercise the most advanced state and the total effort are kept, and your account's settings stay in force); if you don't, the guest data is deleted; in both cases the guest identity is deleted.

What is not collected: precise location (GPS), contacts, calendar, photos, advertising identifier, hardware identifiers (such as IMEI or serial number), special categories of personal data. Lernomi does not ask for your location; in the iOS app, if you choose sign-in with Google, Google's sign-in library may derive a coarse location from your connection's IP address to prevent abuse, which is why the App Store privacy label shows "Coarse Location". The only device identifiers collected are the mobile notification token and the web push subscription above; both are used solely to deliver notifications. The Android app's Google Play Integrity check (above) provides Google's integrity result rather than a hardware identifier; Google Play's data safety section lists it under "device or other IDs". Lernomi shows no ads, contains no third-party analytics, crash reporting or tracking SDK, and sells no data. The anonymous error report sent when an error occurs in the app or on the website (in the table above) goes only to Lernomi's own server and is not passed to third parties; the app stores may separately collect their own crash statistics (Play Console, App Store Connect) under their own terms.

4. Microphone and audio recordings

The microphone opens only where you answer by speaking, and only when you start it: walk mode, spoken answers in the Path's Speaking steps (explanation and chat) and in speaking exercises, and the speaking parts of exams. In walk mode you hear a prompt in your own language and say the word in the language you are learning.

In the mobile app, while the screen is on, recognition is performed by the device's own speech recognition service; on the web, the browser's speech recognition service is used. Whether that service processes the audio on the device or sends it to the servers of the operating system or browser provider (such as Google or Apple) depends on the device, the browser, the language and the settings, and is governed by that provider's own terms; this path does not go through the Lernomi server. To assess your answer, only the recognized text reaches the Lernomi server, not the audio.

Audio reaches the Lernomi server in one case only, and only if you have given permission: walk mode in the mobile app with the screen off or the phone in your pocket. While the screen is on, no audio is sent to the server on any surface. The recording is sent as a short audio clip and passed to one of the speech recognition providers listed below. The audio file is not stored on the Lernomi server; only the recognized text, the expected word and the clip length are written to the usage record; the recognized text and the expected word are removed from the record after 30 days. On the provider side: Microsoft Azure short-audio recognition does not store the audio; at Deepgram, participation in model training is switched off; Cloudflare Workers AI, used when Deepgram is unavailable, does not store the input and does not use it to train models; at Groq, zero data retention is on and inputs and outputs are not logged.

  • In walk mode the microphone stays open until you stop the mode in the app; on Android a persistent notification is shown during that time. On other screens the microphone is open only while you say your answer.
  • While the screen is off, recording runs through the background mechanism the operating system provides for this: a microphone-type foreground service on Android, a background audio session on iOS. The system microphone indicator stays on.
  • Before audio is sent to the server, a consent screen explains this processing and names the speech recognition providers the audio may go to; in walk mode this screen is the microphone consent, and the mode does not start without it. Without your permission no audio is sent to the server. If you decline, the only feature that relies on the server, walk mode with the screen off, does not work; walk mode with the screen on and the rest of the app do.
  • Profanity is masked in the recognition result.

Explicit consent text (voice)

When you press "I agree, start" in walk mode, or "Allow and continue" on the voice consent screen, you give the following declaration: "I give my explicit consent to my microphone recordings being transferred to the Lernomi server and to the speech recognition providers named on the consent screen and listed in section 6 of this policy, some of which are located abroad, for the purpose of transcribing what I said; and to the recording being deleted as soon as the operation finishes. I know that I can withdraw this consent at any time under Settings › Privacy."

4a. Social features and visibility

  • Your display name is visible to all users on the weekly leaderboard; if you do not want to appear there, you can leave your display name empty (you then appear as "Learner").
  • Your social profile (username, level, streak) is public by default; under Settings › Privacy you can set it to "friends only" or "private", and turn off friend requests and appearing in suggestions.
  • The activity feed (round completion, streak milestone) is visible only to your friends; it is turned off with "show my activity".
  • When you block a user, neither side sees the other; when you report someone, the record is reviewed by a human. Block and report records are not shown to the other party.
  • Lernomi has no private messaging; interaction happens only through reactions, nudges and shared quests.

4b. Automated decision-making and profiling

The spaced repetition schedule, the content of the daily round, the level suggestion and the weekly leaderboard are computed automatically from your learning data. These are part of how the product works; they do not profile you comprehensively and produce no legal or similarly significant effect for you (there is no decision within the scope of Art. 22 GDPR). You can change the suggested level yourself at any time.

5. Texts processed by AI

If you have given permission, your chats in Speaking steps, writing tasks and exam answers are sent to language model providers in order to generate feedback. What is sent is only the text you wrote or said and the scenario of the chat; your name and email are not sent. The text is sent to the providers through their API only to generate a reply; the terms each provider works under are listed in the table in section 6. The app states clearly that AI characters are not real people (transparency under Art. 50 of the EU AI Act). Answers can contain mistakes; you can flag them with the "Report" button under each answer, and reports are reviewed by a human. Lernomi makes no decision about you that is based solely on automated processing and produces a legal effect.

Permission: Before any text goes to a provider for the first time, a consent screen shows what will be sent and names the providers it may go to. Until you press "Allow and continue", your text goes to no provider; this rule is enforced on the server, not in the app, so an older app version or another device cannot bypass it. If you decline, practice continues without AI: the chat part of conversations is skipped and the conversation counts with your explanation score, and writing and exam answers get a rule-based estimate or stay unscored. Your decision is saved to your account with its date and text version and applies on all your devices; you can change it at any time under Settings › Privacy. If the list of recipients changes, you are asked again.

Explicit consent text (AI)

When you press "Allow and continue" on the consent screen you give the following declaration: "I give my explicit consent to the texts I write, and the texts transcribed from what I say, being transferred together with the task itself to the language model providers named on the consent screen and listed in section 6 of this policy, some of which are located abroad, for the purpose of producing assessments, feedback and the conversation character's replies. I know that I can withdraw this consent at any time under Settings › Privacy."

6. Service providers that receive data, and transfers abroad

Data is sent to the providers below only for the stated purpose and only to the extent that task requires.

The controller is in Türkiye and the servers are in the European Union (currently Austria). For users in Türkiye, data reaching the servers in the EU and the providers below is transferred abroad within the meaning of Art. 9 KVKK. The data of users in the EU and EEA is stored on servers in the EU; the controller accesses it from Türkiye, and there is no adequacy decision of the European Commission for Türkiye. All traffic to the site and the app also passes through Cloudflare's global network (reverse proxy and bot protection) before it reaches the server, and the connection encryption is also terminated there.

The table gives each provider's region and the safeguard relied on under the GDPR for the transfer to that provider; the app stores and the sign-in providers (Google, Apple) are independent controllers for their own services and subject to their own privacy terms.

ProviderFor whatWhich dataRegionSafeguardWhen
Cloudflare (network, reverse proxy and Turnstile bot protection)Delivering traffic to the site and the app, attack and bot protectionIP address, browser/device signals, the requests and responses passed through (the connection encryption is also terminated at Cloudflare)Global networkEU Standard Contractual Clauses (in the provider's data processing terms)Always
Cloudflare R2 (encrypted backup copy)Off-site backup for disaster recoveryEncrypted copy of the database (the key is only on the Lernomi server; Cloudflare cannot read the content)EUEU Standard Contractual Clauses (in the provider's data processing terms)Every night
Microsoft (Edge Read Aloud service)Speech synthesisText to be spoken (Speaking step content, the character's reply in the chat); the request comes from the Lernomi server, no account data and not your IP addressUSA / global (no region guarantee)No data processing agreement; only the text to be spoken is sentWhen a text is read aloud
Microsoft Azure SpeechSpeech recognition and speech synthesisAudio recording (temporary), text to be spokenEUWithin the EU (adequacy)Walk mode (screen off / in pocket); fallback for speech synthesis
GroqSpeech recognition (Whisper) and language modelAudio recording (temporary), conversation and assessment textsUSAEU Standard Contractual Clauses (in the provider's data processing terms)Always
DeepgramSpeech recognitionAudio recording (temporary)USAEU Standard Contractual Clauses (in the provider's data processing terms)Always
Cloudflare Workers AISpeech recognition (Whisper) and language modelAudio recording (temporary), conversation and assessment textsGlobal networkEU Standard Contractual Clauses (in the provider's data processing terms)Always
Google (Sign-In)Sign-in with GoogleGoogle account id, name, e-mailUSAThe provider is an independent controller for its own service; the transfer is necessary for the service you choseIf sign-in with Google is chosen
Apple (Sign-In)Sign-in with AppleApple account id, name, e-mail (Apple's private relay address if the user chooses it)USAThe provider is an independent controller for its own service; the transfer is necessary for the service you choseIf sign-in with Apple is chosen
Google PlayApp distribution and subscription paymentsPurchase informationUSAThe provider is an independent controller for its own service; the transfer is necessary for the service you choseAndroid app and subscription
Google (Play Integrity)Device and app integrity verification (preventing fake guest accounts)Play Integrity token (device and app integrity signals, a random per-request hash); no account data is sentUSAThe provider is an independent controller for its own service; the transfer is necessary for the service you choseIf you continue without an account on Android
Google (Firebase Cloud Messaging)Push notification deliveryDevice notification token, the notification's title and textUSAEU Standard Contractual Clauses (in the provider's data processing terms)If notifications are allowed
Apple (App Store)App distribution and subscription paymentsPurchase informationUSAThe provider is an independent controller for its own service; the transfer is necessary for the service you choseiOS app and subscription
RevenueCatSubscription state managementUser id, purchase informationUSAEU Standard Contractual Clauses (in the provider's data processing terms)When the mobile app opens (purchase infrastructure; guests included, under an anonymous id)
Resend (e-mail, over SMTP)Verification and password reset e-mailsE-mail addressUSAEU Standard Contractual Clauses (in the provider's data processing terms)Always

Data is transferred to public authorities only where there is a legal obligation or a request from a competent authority, and only within the scope of that request.

7. Cookies and local storage

On the web only the strictly necessary session cookie is used (to remember that you are signed in, for 30 days); for that reason there is no cookie consent banner. No marketing or tracking cookies are used. Browser and app local storage holds device-specific things like theme and sound preferences and an unfinished Speaking step; these never leave your device. Nothing is written to or read from your device for usage measurement (section 8). Reminder preferences, AI permissions and your "Send usage data" choice, by contrast, are saved to your account so that they apply on all your devices (section 3). The bot protection on the sign-up, sign-in and password reset screen (Cloudflare Turnstile) is strictly necessary for security and serves no marketing or tracking purpose.

8. Product analytics and switching them off

To understand which features are used, Lernomi writes short usage events to its own server (e.g. "round completed"). What such an event may contain is tightly bounded:

  • Event names come from a closed, predefined list.
  • Each event may carry a technical label of at most 32 characters (such as "single:artikel" or "level:B1").
  • The label accepts only letters, digits, underscore, colon and hyphen, and cannot consist of digits alone. It therefore cannot hold an email address, a link or a phone number.
  • Nothing else is sent as free text, and the events go to no third party.

You can switch this off with the "Send usage data" toggle under Settings › Privacy. This is the right to object under KVKK and Art. 21 GDPR. Your choice is saved to your account (to the guest identity when you use the app without an account), applies on all your devices and is respected by the server too: while it is off, no product analytics event is written; only the records strictly necessary for the service to work (e.g. that a notification was delivered or a purchase was verified) are kept.

8a. Commercial electronic messages

You receive only service-related messages: email verification, password reset, account and security notices, subscription notices (e.g. a reminder about 2 days before a free trial ends, by email and, if you allowed notifications, as a notification), and the reminders you allowed. No commercial electronic messages within the meaning of Turkish Law no. 6563 are sent; if marketing messages are ever sent, your separate consent will first be obtained through the Turkish Message Management System (İYS) and every message will carry an opt-out.

9. Retention periods

  • Account and learning data: as long as the account exists; when the account is deleted, all of it is deleted.
  • Guest data (use without an account): if you do not use the guest identity for 30 days, its session expires and the data is deleted within 7 days at the latest; when combined with an existing account or when you choose not to add it, the guest identity is deleted immediately; when you create an account with email, it becomes your account itself.
  • Chat logs (the sentence you said and the model's reply): 30 days, then deleted automatically within one more day at the latest.
  • Audio recordings: not kept on the Lernomi server (for the provider side see section 4).
  • Recognized text and expected word in walk mode: 30 days, then removed from the record automatically within one more day at the latest.
  • Anonymous error reports: not linked to a person; until the error group is fixed.
  • Server logs: web server access logs (including IP addresses) 14 days, system and application logs 30 days.
  • Content and user reports: 1 year after the review closes.
  • Mobile notification token: until you sign out or the token expires.
  • Session records (IP, device description): for the life of the session; a session unused for 30 days expires and its record is deleted within 7 days at the latest.
  • Device integrity result (starting without an account on Android): 90 days, then deleted automatically within one more day at the latest.
  • Financial records (subscription invoices): the period required by the Turkish Commercial Code and the Tax Procedure Law (10 years), and only to the extent the app store (Google Play or the App Store) passes them on.
  • Correspondence about rights requests: 2 years after the request closes.
  • Server backups (including the encrypted off-site copy in Cloudflare R2): deleted data drops out of the backups within 30 days at the latest; backups are used only for disaster recovery, and a deleted account is never restored from a backup.

10. Your rights

Under KVKK Art. 11 and Art. 15-22 GDPR you may ask to:

  • learn whether your data is processed, request information about it and receive a copy in a machine-readable format (access and portability),
  • correct incomplete or inaccurate data (you can change your name and preferences yourself in Settings),
  • have your data erased or destroyed (the account deletion route in section 11),
  • restrict processing and object to processing based on legitimate interest (the analytics toggle),
  • withdraw your explicit consent (the AI and voice permissions and the microphone consent, under Settings › Privacy; withdrawal does not affect the lawfulness of earlier processing),
  • request that corrections and erasure be notified to third parties to whom the data was transferred,
  • claim compensation if you suffer damage.

Making a request: write to gdpr@lernomi.app for requests under the GDPR or UK GDPR (this address also reaches the EU representative), or to kvkk@lernomi.app or the postal address in section 1 for requests under Turkish data protection law (KVKK); writing from the email address on your account is enough to verify your identity. In Türkiye, under the Communiqué on the Procedures for Applications to the Data Controller, you may also apply in writing with a wet signature, with a qualified electronic signature, or from the email address registered on your account. Requests are resolved free of charge within 30 days at the latest; under the GDPR this period may be extended by two months where necessary, and you will be told.

Complaints: in Türkiye to the Personal Data Protection Board (kvkk.gov.tr). Under Art. 14 KVKK you must first apply to the controller; if your application is refused, you find the answer insufficient or no answer is given in time, you may complain within 30 days of learning of the answer and in any case within 60 days of your application. In the EU and EEA you may, under Art. 77 GDPR, complain in particular to the supervisory authority of the member state of your habitual residence, place of work or place of the alleged infringement. As the controller is not established in the Union there is no single lead supervisory authority; the authority of North Rhine-Westphalia, where the EU representative is located (State Commissioner for Data Protection and Freedom of Information, LDI NRW), is only one of the competent authorities. In the United Kingdom, the ICO. Most requests can be resolved directly; writing to us first may be enough.

11. Deleting your account and your data

You can delete your account in two ways: in the app under Profile › Settings › Account › Delete account, or on the web at www.lernomi.app/account/delete. At the moment of deletion your account, your progress, your texts, your speaking logs, your usage events and your social traces (friendships, reactions) are permanently deleted; this cannot be undone. Financial records subject to a statutory retention obligation are kept in anonymized form. Deletion of your customer record in the purchase infrastructure (RevenueCat) is also requested; the purchase record at the store (Google Play or the App Store) stays with the store under its own obligations. If you have a store subscription, you need to cancel it separately in the store you bought it from.

If you use the app without an account (as a guest), you can delete your data in the app under Profile › Delete guest data: the guest identity and all of your progress are permanently deleted from the server and from your device.

12. Children

Lernomi is not designed for people under 18 and does not knowingly collect data from them; the terms of use limit account creation to people aged 18 and over (see terms, clause 3). The content is aimed at adult learners and at official language exam preparation; because the app contains open-ended AI conversation and user interaction, it is not suitable for a child audience. If someone under 18 is found to have created an account, the account and the data are deleted; parents can write to gdpr@lernomi.app under the GDPR or UK GDPR, or to kvkk@lernomi.app under Turkish data protection law (KVKK).

13. Security

All connections are encrypted with HTTPS. Passwords are stored as irreversible hashes. Access to the server is limited to keys; sign-in attempts are rate limited. Destructive operations such as account deletion require a password or a fresh session. In the event of a breach affecting personal data the authorities are notified (in Türkiye the Board within 72 hours) under KVKK and Art. 33-34 GDPR, and you are informed.

14. Changes

When this policy changes, the effective date and version on this page are updated; for a change that broadens the purposes of processing you are informed in the app and, where necessary, asked for consent again. Questions: gdpr@lernomi.app under the GDPR or UK GDPR, kvkk@lernomi.app under Turkish data protection law (KVKK).

Version history

What binds is the text itself; this list only shows what changed.

Version 1.10.2 · October 9, 2026

  • There is no longer a daily limit on content reports: you can report as many content errors as you find. The number was removed from the fair use section. The data collected and the recipients did not change.

Version 1.10.1 · October 6, 2026

  • If you don't allow AI, the chat part of a conversation no longer runs from a written script; it is skipped and the conversation counts with your explanation score. The data collected and the recipients did not change.