Privacy Policy

This website

This website has no cookies, scripts, forms or analytics. It is served through Cloudflare, which handles each request, including your IP address (see Service providers).

The app and web app

Your account. When you sign in with Apple or Google, we receive your email address (with Apple, this can be a private relay address). The first time you sign in with Apple, we also receive your name if you choose to share it. We use these to identify your account and to recognize you when you sign in again. We store the account ID that Apple or Google gives us only as a keyed hash. For Apple sign-in, we also keep an encrypted token from Apple, so that we can revoke Sign in with Apple when you delete your account.

Your learning records. For each review: the card, when you reviewed it, the grade you chose, whether your answer was right, and the answer you typed. We also keep your study preferences, such as daily limits and paused cards. We use these to schedule your reviews, build your daily recap and keep your progress in sync across your devices.

Battles. Your nickname, your stars and your match results. During a match, your opponent sees your nickname, your stars and your progress (how many cards you’ve answered and how many you got right), and at the end, your score and time. In battles, the words you type stay on your device: only whether each answer was right and how long it took reaches our server. There is no public leaderboard.

Subscriptions. If you subscribe through the App Store, we receive your subscription status and Apple-signed transaction records, and use them to give you what your subscription includes. When you buy, Apple receives your AhaFluent account number so the purchase is tied to your account. Apple handles the payment; we never see your payment details.

Devices and sessions. Each app installation, and each browser you sign in from, gets an installation number from our server. We keep it with the platform (iPhone, iPad, Mac or web) and when it was first and last used. Sign-in credentials are stored only as hashes. We don’t collect your device model, advertising identifiers or location, and your IP address is not stored with your account.

Diagnostic log (apps only). The app keeps a diagnostic log on your device for up to 7 days. It isn’t sent to us automatically; we only see it if you choose to share it with us.

In your browser (web app only). The web app uses only the storage it needs to work: one sign-in cookie (HttpOnly, kept for up to 30 days), a note of which sign-in method you used, and the progress of a battle in the current tab, which is cleared when the match ends or you sign out. Because there are no advertising or analytics cookies, there’s no cookie banner. Signing in with Apple or Google opens their sign-in page, which follows their own privacy policies.

Server logs. Our server doesn’t log normal requests. When a request fails, the error log can record your IP address and request details such as your browser and system version (User-Agent). These logs are kept for up to 30 days.

Email. If you email us, we receive your email address and your message, and use them to reply to you.

What we don’t do. We don’t track you across other companies’ apps or websites. There are no analytics, crash-reporting or advertising SDKs. We don’t sell or rent your data or use it for advertising. We don’t currently send your content to any AI service.

Service providers

We use a few providers to run AhaFluent. Each one handles only what it needs to do its job:

• Apple: Sign in with Apple, the App Store and subscriptions. Apple’s privacy policy
• Google: Sign in with Google on the web app. Our server only checks Google’s signature on the sign-in; we don’t store any Google tokens. Google’s privacy policy
• Cloudflare: hosts this website, the web app and lesson media, and delivers them through its network; stores our encrypted backups; forwards email sent to support@ahafluent.com. Cloudflare sees request details such as your IP address, and keeps sampled request records for a period it sets (currently at least 31 days). Cloudflare’s privacy policy
• Vultr: runs our server and database in Singapore. Vultr’s privacy policy

Where your data is stored. Our server and database are in Singapore, and our encrypted backups are stored with Cloudflare in the Asia-Pacific region. Cloudflare delivers websites and media from locations around the world. If you use AhaFluent from outside Singapore, your data is transferred to Singapore.

How long data is kept

• While you have an account: your account details, learning records (including the answers you typed) and battle data.
• When you delete your account: these are deleted right away, and we revoke your Sign in with Apple authorization. We keep an account number with no name or email attached; installation and session records (credentials stored only as hashes); sign-in, audit and usage events; and Apple-signed subscription transaction records, which we need for accounting, refunds and disputes. None of these is linked to your name or email any more.
• Backups: we make an encrypted backup of our database every hour and keep backups for 2, 35 or 365 days, depending on the backup tier. Data from a deleted account is gone from every backup within 365 days.
• Sign-in: on the web, you stay signed in for up to 30 days. In the app, you’ll need to sign in again after 30 days without use, or after 180 days at most.
• Server error logs: up to 30 days.
• App diagnostic log: up to 7 days, on your device only.

Your choices

• Delete your account at any time. In the app: Settings › Account › Account Management › Delete AhaFluent Account. On the web: Settings › Account › Delete Account. This can’t be undone.
• See, correct, export or delete your data by emailing support@ahafluent.com. We’ll reply within 30 days. For now, we prepare exports by hand.
• Depending on where you live, you may have other rights, such as objecting to how we use your data or complaining to your local data protection authority. Email us and we’ll help.

Children

AhaFluent is not meant for children under 13, and we don’t knowingly collect data from them. If we learn that we have, we’ll delete it. If you believe a child under 13 has given us data, please email support@ahafluent.com.

Changes

When we change this policy, we update the “Last updated” date at the top of this page. For a significant change, such as a new kind of data or a new service provider, we’ll note it at the top of this page at least 7 days before it takes effect.

Contact

Questions about privacy: support@ahafluent.com