Privacy Policy

LinCaden ("we", "us", "our") operates a web-based language learning platform that helps learners build listening, dictation, and shadowing fluency through short audio lessons, instant feedback, and progress tracking.

If you have questions about this policy or your personal data, you can contact us using the information provided in the footer of this website.

Account information: When you sign in with Google OAuth, we receive your email address, display name, and profile avatar URL. These are stored in our database to identify your account and display your profile.

Practice and progress data: We store your lesson attempts, accuracy scores, completion records, study time, replay counts, and per-lesson mode progress states. This data powers your progress dashboard, streak tracking, and leaderboard ranking.

User-generated content: Comments you post on exercises, notes you create on lesson segments, and error reports you submit are stored in our database and linked to your account.

Preferences: Your selected theme (light/dark), preferred language (English/Vietnamese), and learning preferences are stored both in your browser's local storage and, when you are logged in, in your profile.

Local storage data: Your browser stores a cached copy of your practice progress in IndexedDB so you can continue working offline. This data syncs to the server when you are online and logged in.

Automatic data: We collect standard server logs (IP address, request timestamps, user agent) for security monitoring, rate limiting, and error debugging. Vercel Analytics collects aggregated, privacy-preserving usage metrics.

To provide the service: authenticate your account, display your profile, save and sync your progress, and show your ranking on the leaderboard.

To improve the platform: analyze aggregated usage patterns, identify popular lessons, and prioritize feature development.

To communicate with you: send service notifications, respond to your reports and inquiries, and notify you of important changes to the platform.

To maintain security: monitor for abuse, enforce rate limits, detect and debug errors, and protect against unauthorized access.

We do not sell your personal information to third parties. We do not use your data for targeted advertising.

Supabase: Our primary backend provider. Supabase hosts our PostgreSQL database, authentication system, and serverless functions. Your account and practice data are stored on Supabase's infrastructure.

Google OAuth: We use Google Sign-In for authentication. Google provides us with your email, name, and avatar. We do not access your Google contacts, documents, or other Google data.

Vercel: Our hosting and deployment provider. Vercel serves the website and collects aggregated analytics through Vercel Analytics.

Sentry: We use Sentry for error monitoring. Sentry receives error reports that may include browser type, request URL, and error stack traces, but not your personal data.

Resend: We use Resend to send transactional emails such as error notifications and service updates.

Upstash Redis: Used for rate limiting and server-side caching. No personal data is stored in Redis.

Azure Cognitive Services: Used for text-to-speech pronunciation and translation features. Audio text is sent to Azure for processing; no personal data is included.

AI providers: We use multiple AI providers (such as Grok, Cohere, Together AI, and others) to clean transcripts and generate shadowing content. Only lesson text is sent to these providers, never your personal data.

YouTube and Supadata: Used to fetch and process video transcripts for lesson creation. These services receive video URLs, not user data.

LinCaden does not use tracking cookies or advertising cookies.

We use browser local storage to remember your language preference, theme preference, and authentication session token. This data stays on your device.

IndexedDB is used to cache your practice progress locally so you can work offline. This data is cleared when you delete your browser data or request account deletion.

You can clear local storage and IndexedDB at any time through your browser settings. This will not affect your server-side progress if you are logged in.

We retain your account and practice data for as long as your account is active. If you request account deletion, we will permanently delete your profile, practice records, comments, notes, and all associated data from our database.

Account deletion triggers a cascade delete in our database, removing all records linked to your user ID.

Server logs and error reports are retained for a limited period for security and debugging purposes, then automatically purged.

If you have not logged in for 24 months, we may deactivate your account and delete associated personal data. You will be notified before any such action.

Access: You can view your personal data through your profile page and progress dashboard.

Correction: You can update your display name and preferences through your profile settings.

Deletion: You can request permanent deletion of your account and all associated data by contacting us.

Export: You can request a copy of your practice data in a machine-readable format.

Withdrawal: You can revoke Google OAuth access at any time through your Google Account settings.

To exercise any of these rights, contact us using the information in the footer.

Row Level Security (RLS): All database tables use deny-by-default RLS policies. Users can only read and modify their own data.

Encryption: API keys stored in the database are encrypted at rest using AES-GCM encryption.

CSRF protection: All mutating requests are validated against the Origin header to prevent cross-site request forgery.

Content Security Policy: We enforce a strict CSP with per-request nonces to prevent injection attacks.

Rate limiting: API endpoints are rate-limited using Upstash Redis with in-memory fallback to prevent abuse.

Server-side validation: All progress data submitted by clients is validated server-side. Leaderboard rankings and XP are computed from trusted server-side logic, not client-submitted values.

Despite these measures, no system is perfectly secure. We encourage you to use strong, unique passwords and enable two-factor authentication on your Google account.

LinCaden is designed for language learners aged 13 and older. We do not knowingly collect personal information from children under 13.

If you believe a child under 13 has created an account, please contact us and we will delete the account immediately.

LinCaden is available globally. Your data is stored on Supabase infrastructure and may be processed in countries with different data protection laws than your country of residence.

If you are located in the European Economic Area, United Kingdom, or other jurisdiction with data protection regulations (such as GDPR), you have the rights described in Section 7. We process your data on the legal basis of providing the service you requested and our legitimate interests in maintaining platform security and improving the service.

LinCaden uses minimal cookies and browser storage to operate the platform. Here is what we use and why:

Essential storage: We use browser local storage and IndexedDB to remember your theme preference, selected language, and cached practice progress. These are required for the platform to function and cannot be disabled.

Analytics cookies: Vercel Analytics uses privacy-preserving, aggregated usage metrics. No individual user tracking or cross-site advertising cookies are used.

No third-party advertising: We do not use advertising cookies, tracking pixels, or third-party ad networks.

You can clear cookies and local storage at any time through your browser settings. Doing so will sign you out and remove locally cached progress, but your server-side progress remains intact.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page.

If we make material changes that affect how we handle your personal data, we will notify you through the platform or by email before the changes take effect.

Your continued use of LinCaden after the effective date constitutes acceptance of the updated policy.

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us using the email or social links provided in the footer of this website.

We aim to respond to all privacy-related inquiries within 30 days.