1. Introduction
Welcome to LingoSnap ("Company", "we", "our", "us"). By accessing or using our application, you agree to be bound by these Terms of Service and our Privacy Policy (collectively, the "Terms"). If you do not agree, please do not use our services.
2. AI & Accuracy Disclaimer
IMPORTANT: This application uses Artificial Intelligence (AI) (specifically Google Gemini) to generate content. AI is experimental and may produce inaccurate, offensive, or biased results.
- No Warranty of Accuracy: We do not guarantee the accuracy, completeness, or reliability of any definitions, translations, or quizzes generated by the AI.
- Educational Use Only: This tool is a study aid. It should not be the sole source of information for critical exams, professional translation, or legal/medical advice.
- User Responsibility: You are responsible for verifying all generated content. The Company is not liable for any errors in learning materials or consequences resulting from the use thereof.
3. User Content & Copyright
You retain ownership of the images and documents you upload ("User Content"). However:
- License to Us: You grant us a worldwide, non-exclusive, royalty-free license to use, reproduce, and process your User Content solely for the purpose of providing the Service (e.g., sending it to the AI provider).
- Prohibited Content: You represent and warrant that you own the rights to any file you upload. You must not upload copyrighted textbooks (without permission), illegal content, or content containing sensitive personal data (PII) of third parties.
- Indemnification: You agree to indemnify and hold the Company harmless from any claims arising from your violation of third-party copyrights or intellectual property rights.
4. Subscriptions & Payments
- Processing: Payments are processed securely via Stripe. We do not store your credit card information.
- Cancellations: You may cancel your subscription at any time. Your access will continue until the end of the current billing period.
- Refunds: Payments are non-refundable, except where required by law. We do not provide refunds for partially used subscription periods.
- Plan Upgrades: When upgrading to a higher plan, the new plan takes effect immediately. No refund or credit is issued for the unused portion of the previous plan. The new subscription fee applies from the next billing cycle.
- Price Changes: We reserve the right to modify subscription fees with reasonable prior notice.
5. Privacy Policy
- Data Collection: We collect your email (for account management) and the content you actively upload.
- Third-Party Processors: To provide the service, your text and images are processed by Google (Gemini API) and payments by Stripe. By using the app, you agree to their respective privacy policies.
- Data Security: While we use commercially reasonable standards to protect data, no method of transmission is 100% secure.
6. Limitation of Liability
TO THE FULLEST EXTENT PERMITTED BY LAW, THE COMPANY SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS OR REVENUES. IN NO EVENT SHALL THE AGGREGATE LIABILITY OF THE COMPANY EXCEED THE AMOUNT YOU PAID US IN THE PAST TWELVE (12) MONTHS.
7. Termination
We reserve the right to suspend or terminate your account at our sole discretion if you violate these Terms, specifically regarding illegal uploads or abuse of the API.
8. Changes to Terms
We may update these Terms from time to time. Continued use of the service constitutes acceptance of the new Terms.
Privacy Policy
Effective date: 2026-04-30 · Version: 2.0
P1. Data Controller
LingoSnap
Operator: Martin Hubálek
Contact: privacy@lingo-snap.com
Country: Czech Republic
P2. What Data We Collect
The following table lists all personal data we hold:
| Field | Purpose | Required? | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Login, account communication | Yes | Contract (6.1.b) | |
| First name, last name | UI personalization, email greetings | No | Contract |
| Phone number | SMS reminders (optional) | No | Consent (6.1.a) |
| Password (bcrypt-hashed) | Authentication | If not using social login | Contract |
| Social login IDs (Google, Apple) | Sign-in via third party | No (alternative to password) | Contract |
| IP address (hashed in audit log) | Security, fraud prevention | Auto-collected | Legitimate interest (6.1.f) |
| Notebooks, vocabulary entries | Core product functionality | You create them | Contract |
| AI usage logs (operations, costs) | Credit accounting | Auto-collected | Contract |
| Subscription & transaction records | Billing, accounting | If you subscribe | Legal obligation (6.1.c) — 10 years per Czech accounting law |
What we DON'T collect: credit card numbers (handled by Stripe), social security numbers, location data, contacts, biometrics, browser history, advertising identifiers.
P3. Sub-processors (Third Parties)
We share data with the following providers, all bound by GDPR-compliant Data Processing Agreements:
| Provider | Purpose | Region |
|---|---|---|
| MongoDB Atlas | Database hosting | EU |
| Roští.cz | Application hosting | Czech Republic |
| Google Cloud (GCS, Gemini, TTS) | Encrypted backups, AI processing, audio synthesis | EU + US (SCC) |
| Stripe | Payment processing | Ireland + US (SCC) |
| Firebase (Google) | Push notifications | US (SCC) |
| Twilio | SMS notifications (optional) | US (SCC) |
| WebSupport | Email delivery (SMTP) | Slovakia |
| Sentry | Error tracking | EU (Germany) |
P4. International Data Transfers
Some sub-processors are based in the United States. We rely on Standard Contractual Clauses (SCC) approved by the European Commission as the legal basis for these transfers.
P5. Data Retention
| Category | Retention |
|---|---|
| Active account data | For the duration of your account + 30 days after deletion |
| Inactive accounts | Up to 24 months after last login (planned automatic cleanup) |
| Session refresh tokens | 30 days |
| Email verification codes | 15 minutes |
| Password reset tokens | 1 hour |
| Database backups (encrypted) | 90 days |
| Audit log (security events) | 13 months |
| Sentry error events | 30 days |
| Transaction records (anonymized after deletion) | 10 years (Czech accounting law 563/1991 Sb.) |
P6. Your Rights (GDPR Art. 15-22)
You have the right to:
- Access your data (Art. 15) — use Settings → Download my data for a complete JSON export
- Rectify incorrect data (Art. 16) — use Settings → Profile
- Erase your data (Art. 17 — "right to be forgotten") — use Settings → Delete account
- Restrict processing (Art. 18) — contact privacy@lingo-snap.com
- Data portability (Art. 20) — same JSON export as Access
- Object to processing (Art. 21) — for legitimate interest processing only
- Withdraw consent (Art. 7) — for SMS / push notifications
Response time: We respond to all requests within 30 days as required by GDPR Art. 12.
P7. Security Measures
- HTTPS everywhere (TLS 1.2+)
- Bcrypt password hashing
- JWT with rotating refresh tokens
- Account lockout after 5 failed login attempts (exponential backoff)
- Optional two-factor authentication (TOTP) — RFC 6238, with bcrypt-hashed single-use recovery codes
- Encrypted database backups (age cipher, X25519 + ChaCha20-Poly1305)
- MongoDB TLS for connections
- Audit log of all security-relevant events (13-month retention)
- Per-endpoint rate limiting (login, register, password reset)
- Secret scanning in CI (gitleaks)
- Dependency vulnerability scanning (npm audit + Dependabot)
- No PII in error tracking or logs (IP addresses are SHA-256 hashed with daily-rotating salt)
P8. Cookies (website)
The LingoSnap website (lingosnap.online) uses a different set of cookies than the mobile app described elsewhere in this policy. The site sets a strictly necessary consent cookie (cc_cookie) and — only after you grant analytics consent — Google Analytics 4 cookies (_ga, _ga_*) and Sentry error-monitoring identifiers.
For the full list, expiration, providers and international-transfer details, see our Cookie Policy. You can change your consent at any time using the cookie settings button in the footer.
P9. Data Breach Notification
In case of a personal data breach that risks your rights, we will notify you within 72 hours. We will also notify the Czech Data Protection Authority (ÚOOÚ).
P10. Right to Lodge a Complaint
If you believe your data is being processed unlawfully, you have the right to file a complaint with:
Úřad pro ochranu osobních údajů (ÚOOÚ)
Pplk. Sochora 27, 170 00 Praha 7, Czech Republic
Web: uoou.gov.cz
P11. Changes to This Privacy Policy
We may update this Privacy Policy. The current version (2.0) is shown at the top. Material changes will be communicated via in-app notification and require your re-acceptance.
P12. Contact
Questions about this Privacy Policy or your data:
privacy@lingo-snap.com