Privacy Policy

Effective Date: January 1, 2026 · Last Updated: March 2026

1. Information We Collect

We collect the following types of information:

  • Account Information: Email address, username, and password hash when you create an account.
  • Learning Data: Vocabulary lists, saved passages, review progress, grammar points, and study history that you create while using the Service.
  • Usage Data: Pages viewed, features used, and general interaction patterns to help us improve the Service.
  • Payment Information: All payment processing is handled by Stripe, our payment processor. We never store your credit card numbers, bank account details, or other financial credentials. Stripe provides us with subscription status, plan details, and transaction IDs.

2. How We Use Your Information

We use the information we collect to:

  • Provide and maintain the Service, including generating personalized content.
  • Schedule spaced repetition reviews and track your learning progress.
  • Personalize content to your proficiency level and learning goals.
  • Send transactional emails (account verification, password resets, subscription confirmations) via Amazon Simple Email Service (SES).
  • Improve the Service based on usage patterns and feedback.
  • Respond to support requests and communicate important updates about the Service.

3. AI Processing

The Service sends text prompts to third-party AI providers (OpenAI, Anthropic, and Google) to generate passages, definitions, grammar explanations, and other learning content. These prompts contain language learning context such as target language, proficiency level, and topic preferences.

We do not send personally identifiable information (PII) in AI prompts. Your email, username, and account details are never included in requests to AI providers. AI providers may retain prompts and responses in accordance with their own data policies.

4. Third-Party Services

We use the following third-party services:

5. Data Storage and Security

Your data is stored on secure, industry-standard cloud infrastructure located in the United States. We implement the following security measures:

  • All data transmitted between your browser and our servers is encrypted via HTTPS/TLS.
  • Passwords are hashed using bcrypt and are never stored in plain text.
  • Data at rest is encrypted using AWS managed encryption keys.
  • Access to production systems is restricted to authorized personnel.

6. Data Retention

We retain your data for as long as your account is active. If you request account deletion, your personal data will be removed within 30 days. Anonymized, aggregated analytics data (such as overall usage statistics) may be retained indefinitely to help improve the Service.

7. Your Rights

You have the right to:

  • Access your personal data and learning history.
  • Correct inaccurate or incomplete data in your account.
  • Delete your account and associated data.
  • Export your vocabulary lists and learning data.

For EU residents (GDPR): You additionally have the right to restrict processing, object to processing, and data portability. You may also lodge a complaint with your local data protection authority.

For California residents (CCPA): You have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell your personal information.

8. Chrome Extension

The Imbue Chrome Extension (“Imbue - Language Learning Dictionary”) allows you to look up foreign language words on any webpage and add them to your Imbue review queue. The extension collects and processes the following data:

  • Selected Text: When you trigger a word lookup (via keyboard shortcut or right-click), the extension sends the selected word and surrounding sentence to our API for context-aware dictionary lookup. This data is used solely to provide accurate definitions and is not stored beyond the lookup session unless you explicitly add the word to your review queue.
  • Authentication Token: An opaque authentication token is stored locally in the browser's extension storage (chrome.storage.local) to keep you signed in. This token is only sent to imbue-lang.com and is cleared on sign-out.
  • Local Cache: Dictionary results and audio pronunciations are cached locally in IndexedDB within the extension to improve performance and enable offline access. This data never leaves your device and is cleared when you sign out or clear the cache via extension settings.
  • Extension Settings: Your preferences (such as auto-play audio) are stored locally in chrome.storage.local and are never transmitted to any server.

What the extension does NOT collect:

  • Browsing history or the URLs of pages you visit.
  • Page content beyond the specific word and sentence you select for lookup.
  • Keystrokes, mouse movements, or any form of activity tracking.
  • Data from any website other than imbue-lang.com.

The extension communicates exclusively with imbue-lang.com (for API requests) and Vercel's blob storage CDN (for audio pronunciation files). No data is shared with any other third party.

9. Cookies and Local Storage

We use minimal cookies and local storage:

  • Authentication cookie — A session cookie containing an encrypted JWT token to keep you logged in.
  • Theme preference — Stored in localStorage to remember your light/dark mode preference.

We do not use third-party tracking cookies, advertising cookies, or analytics cookies. We do not participate in advertising networks or share browsing data with third parties.

10. Children's Privacy

The Service is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal data, please contact us.

11. International Data Transfers

Your data is processed and stored in the United States. By using the Service, you consent to the transfer and processing of your data in the United States. If you are located in the EU/EEA, we rely on your consent and standard contractual clauses where applicable to lawfully transfer your data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will provide at least 30 days' notice of material changes via email or in-app notification. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

13. Contact

If you have questions about this Privacy Policy or your personal data, please contact us at privacy@imbue-lang.com or support@imbue-lang.com.