Privacy Policy

Effective 14 September 2026 · Last updated 16 October 2026

Lexica turns what you want to learn into flashcards and schedules your reviews. To do that it stores your cards and your study history, and it sends the text you write to an AI service to generate translations, examples and pronunciation. This page explains exactly what is collected, why, who it goes to, and how to get rid of it.

1. Who we are

Lexica is developed and operated by Astemir Boziev EI ("we", "us"), an entrepreneur individuel registered in France as a micro-entreprise, SIRET 131 332 322 00018, of 4 rue Saint-Julien, 78000 Versailles, France. For the purposes of the EU and UK General Data Protection Regulation, we are the data controller for the personal data described here. This policy covers the iPhone app, the web app at app.uselexica.com, the AI assistant connector and the website uselexica.com.

You can reach us about anything on this page at privacy@uselexica.com.

2. What we collect

Account information

Lexica requires an account, created by signing in with Apple or Google. Apple gives us an account identifier, and — only if you choose to share them — your name and an email address; Apple lets you hide your real address behind a private relay address, and if you do, that relay address is all we ever see. Google gives us an account identifier, your name and your email address.

Alongside that we store a small profile record: when the account was created, when it was last active, whether it is on the free or paid tier, and the app version and build, plus the iOS version for the iPhone app, at the time the account was created.

Your learning content

This is the substance of the app, and it is the largest category of data we hold:

• Decks and their names, descriptions, emoji and language settings
• Cards: the term, its translation, any phonetic (IPA) transcription and example sentence
• Tags you create and apply
• Your review history: every rating you give a card, when you gave it, how long the card was on screen, and the scheduling state the algorithm derives from it
• Your settings: study and native language, level, daily goals, scheduling parameters and display preferences
• Pronunciation audio generated for your cards

Shared decks. When you share a deck, we store a copy of it under a link. Anyone with the link can see the deck's name, its cards, its audio and your first name, and can copy the deck into their own account. A shared link expires 90 days after it was last shared or opened in Lexica.

The AI assistant connector. If you connect an AI assistant such as Claude or ChatGPT to Lexica, you sign in to Lexica from the assistant and we issue it an access token tied to your account. The assistant can then read and change your decks and cards when you ask it to. What you share in a conversation with the assistant is handled by its provider under its own privacy policy.

Diagnostics and usage

On the iPhone we collect crash reports and product-analytics events so we can find bugs and understand which features are used. The events describe how Lexica is used, not what your cards say: screens you open, reviews you finish, AI actions and whether they worked (with the model used and its token count), sign-in, the upgrade screen, purchases, and limits you reach. We also attach a few properties to your analytics profile: your plan (free or paid), your study language, your native language, your level and the platform. If you installed the app from an Apple Search Ads advertisement, Apple tells us which campaign, ad group and keyword it was, and we attach those too. We do not use advertising identifiers.

Firebase Analytics also collects some information automatically, including a randomly generated app-instance identifier, device model, operating system version, and approximate location derived from an IP address at the country or region level. It does not collect your precise location.

Lexica on the web, app.uselexica.com, logs the same events, but only after you accept Google Analytics in its cookie banner, and you can change your choice at any time in Profile › Account › Analytics cookies. Our website, uselexica.com, works the same way: Google Analytics runs only after you accept it, and Cookie settings at the bottom of every page changes your choice. If you decline, no analytics script loads and no analytics cookies are set. Your choice is stored in your browser.

The web app also uses Google reCAPTCHA to protect sign-in and our services from abuse. It is strictly necessary and does not wait for your consent. Signing in keeps you signed in through your browser's storage, and your preferences in the web app (such as the theme) are stored in your browser too; neither is used for analytics.

Notifications

Study reminders are scheduled and delivered entirely on your device by iOS. The reminder is not sent from our servers, and we do not learn whether or when one appears.

Separately, if you grant notification permission the app registers your device with Apple's push service and with Firebase Cloud Messaging, which issues a device token held by Google as our processor. We do not store that token in our own database and we do not currently send push messages. You can turn reminders off at any time in iOS Settings or in the app, and you are never required to enable them.

Purchases

On the iPhone, Lexica Pro is sold through Apple. Apple processes the payment; we never see your card details, billing address or Apple ID. We receive whether your account holds an active purchase, and a copy of Apple's signed record of it, which we verify so Pro works on the web and in the AI assistant connector too.

On the web, Lexica Pro is sold by Link, Stripe's reseller service. Link and Stripe receive your name, email address, billing address and payment details, and process them as an independent controller under Link's privacy policy. We never see your card details. We store the identifiers of your Stripe customer and subscription, your plan, its status and when it renews or ends.

The launch list

If you join the launch list on uselexica.com, we keep your email address and whether you signed up on the English or the Spanish page, to send you one email when Lexica launches. Brevo (Sendinblue SAS, France) stores the list and sends the emails for us. You first get an email asking you to confirm the address; until you confirm, you are not on the list. Every email has an unsubscribe link, and you can ask us to remove you at any time. We delete the list within 30 days of sending the launch email.

3. Why we collect it

Where we rely on legitimate interests, we have considered whether that interest is overridden by your rights, and you can object at any time — see Your rights and choices.

4. AI processing of your content

This section matters, so it is separate rather than buried above.

When you generate cards from a topic, paste an article or word list, ask for a translation, request a phonetic transcription or an example sentence, or generate pronunciation audio, the text you provided is sent to Google's Gemini models, through Firebase AI Logic or through our own server, and the generated result is returned to you and saved to your account.

What this means in practice:

• Anything you type or paste into a generation field leaves your device or browser. Please do not paste confidential or sensitive personal information into it.
• Google processes that text as our service provider, under the Google Cloud and Firebase terms, to return a result to us.
• The output is generated by a model and can be wrong. Translations, example sentences and phonetic transcriptions should not be treated as authoritative, and we do not warrant their accuracy.
• We do not use your content to train our own models. We do not operate any models of our own.

5. Who else processes your data

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We use a small number of service providers who process data on our instructions:

Two others act on their own account rather than on our instructions: Link and Stripe, which sell Lexica Pro on the web, and the provider of any AI assistant you connect. Each handles your data under its own privacy policy.

We may also disclose personal data if we are legally required to, or where necessary to establish, exercise or defend legal claims.

6. Where your data is stored

Your account data is stored in Google Cloud in the United States (region us-central1). If you are in the United Kingdom, the European Economic Area or Switzerland, this means your data is transferred outside your home region. That transfer is covered by the Standard Contractual Clauses incorporated into our agreement with Google as our processor.

The launch list is stored by Brevo in the European Union.

7. How long we keep it

• Account and learning content — for as long as your account exists. Deleting your account removes it (see below).
• Crash reports — retained by Firebase Crashlytics for up to 90 days.
• Analytics — retained for up to 14 months.
• Shared decks — until 90 days after the deck was last shared or opened in Lexica.
• Launch list — until 30 days after the launch email, or until you unsubscribe.
• Web purchase records — our copy for as long as your account exists; Link and Stripe keep theirs as the law requires them to.

8. Your rights and choices

If you are in the UK, EU or Switzerland

You have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to how we process it, and to receive it in a portable form. You also have the right to complain to a supervisory authority: in France the CNIL (cnil.fr), which oversees us, in the UK the Information Commissioner's Office, or the authority where you live.

If you are in California

You have the right to know what personal information we collect and why, to request its deletion, to request correction of inaccurate information, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA and CPRA, and we do not process it for cross-context behavioural advertising, so there is nothing to opt out of.

Exercising your rights

Most of these you can exercise yourself, immediately, without asking us: your cards and settings are editable in the app and on the web, and account deletion is built in. For anything else, email privacy@uselexica.com. We will respond within 30 days (or 45 days for CCPA requests), and we may need to verify that the request comes from you.

Turning things off

• Notifications — iOS Settings → Notifications → Lexica.
• Analytics on the web — Profile › Account › Analytics cookies in the web app, and Cookie settings at the bottom of uselexica.com.
• Analytics and crash reporting in the iPhone app — email us and we will disable collection for your account.

9. Deleting your account

On the iPhone: Profile → Delete Account. On the web: Profile → Account → Delete account. This permanently removes your decks, cards, tags, review history, settings, pronunciation audio, your profile record and your authentication account. It cannot be undone and we cannot recover it afterwards. Decks you shared stay readable at their links until they expire.

Deleting your account cancels a Lexica Pro subscription bought on the web at once, and ends a lifetime purchase. It does not cancel a subscription bought on the iPhone, because Apple manages that one: cancel it in Settings → your name → Subscriptions on your device.

10. Children

Lexica is not directed to children under 13, and we do not knowingly collect personal data from them. If you are in the EEA or the UK, the minimum age is 16, or the lower age set by your country's law where it permits one. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Security

Your data is stored in Google Cloud and protected by access rules that permit only your own signed-in account to read or write it; it is encrypted in transit and at rest by our infrastructure providers. We use Apple's App Attest in the iPhone app, and Google reCAPTCHA on the web, so our backend can distinguish the real app from software impersonating it. No system is perfectly secure, and we cannot guarantee absolute security.

12. Changes to this policy

If we change this policy we will update the date at the top of this page. If a change materially affects how we handle your data, we will tell you in the app or by email before it takes effect.

13. Contact