Privacy Policy

Mitho Bol ("we," "us," or "our") operates the Mitho Bol language learning mobile application (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

We are committed to protecting your privacy and being transparent about our data practices. Please read this policy carefully. If you do not agree with our policies, please do not use our Service.

1. Information We Collect

1.1 Information You Provide

When you create an account or use our Service, you may provide:

• Account Information: Email address, display name, and profile picture (optional)
• Authentication Data: A password hash for email-and-password accounts, or account information and sign-in tokens from Google or Apple when you use those sign-in methods
• Learning Preferences: Your learning goal (travel, connect with family, curiosity), language proficiency level
• Feedback: Messages you submit through our feedback feature, together with automatically attached app variant, platform, operating-system version, current lesson day, streak, word count and XP

1.2 Information Collected Automatically

When you use our Service, we automatically collect:

• Learning Progress: Current lesson day, completed lessons, exercise scores, time spent learning, streak data
• Vocabulary Data: Words learned, mastery levels, spaced repetition review schedules, correct/incorrect answers
• Achievement Data: Unlocked achievements and progress toward achievements
• Usage Analytics: App opens, feature usage, lesson starts/completions and button taps, linked to a device analytics identifier or your account ID after sign-in
• Device Information: Device type, operating system version, app version
• Error Data: Crash reports, error logs, diagnostic device information and account ID when signed in

1.3 Information NOT Collected

We do not collect:

• Precise location data
• Contacts or address book
• Photos, camera, or microphone data
• Payment-card details or bank-account details (payments are processed by Apple App Store or Google Play; we receive purchase and entitlement records to provide paid access)
• Health or biometric data
• Browsing history outside our app

2. How We Use Your Information

We use the information we collect to:

3. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide the Service you requested (account management, learning features, progress sync)
• Legitimate Interests: Processing for our legitimate business interests, such as improving our app, preventing fraud, and ensuring security, balanced against your privacy rights
• Consent: Processing based on your explicit consent, such as sending marketing communications (you may withdraw consent at any time)
• Legal Obligation: Processing necessary to comply with applicable laws

4. Information Sharing and Disclosure

We do not sell your personal information. Third-party services we use only receive the minimum information necessary to provide their service and are contractually prohibited from using your data for any other purpose.

We may share your information only in these limited circumstances:

• Service Providers: With third-party services that help us operate (see Section 5)
• Legal Requirements: When required by law, subpoena, or legal process
• Protection of Rights: To protect our rights, privacy, safety, or property
• Business Transfers: In connection with a merger, acquisition, or sale of assets (you will be notified)

5. Backend and Third-Party Services

We use our self-hosted backend and the following third-party services to operate our app:

6. Data Retention

We retain your personal data for as long as necessary to provide our Service and fulfill the purposes described in this policy:

• Account Data: Retained until you delete your account
• Learning Progress: Retained until you delete your account
• Usage Analytics: Retained for up to 7 years
• Error Logs: Retained for 90 days
• Feedback: Retained until resolved and for reasonable period thereafter

When you delete your account, we delete or anonymize your personal data within 30 days, except where we are required to retain it for legal purposes.

7. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Portability: Request your data in a structured, machine-readable format
• Restriction: Request limitation of processing in certain circumstances
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent for processing based on consent at any time

To exercise these rights:

• Delete your account directly in the app (Settings → Delete Account)
• Email us at privacy@mithobol.com

We will respond to your request within 30 days (or sooner as required by law). We may ask you to verify your identity before processing your request.

8. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

Right to Know

You have the right to request information about:

• Categories of personal information we collect
• Sources from which we collect personal information
• Business purposes for collecting personal information
• Categories of third parties with whom we share personal information
• Specific pieces of personal information we have collected about you

Right to Delete

You have the right to request deletion of your personal information, subject to certain exceptions.

Right to Opt-Out of Sale

We do not sell your personal information. Therefore, there is no need to opt-out.

Right to Non-Discrimination

We will not discriminate against you for exercising your CCPA rights.

To exercise your CCPA rights, contact us at privacy@mithobol.com.

9. International Data Transfers

Our Service is operated from the United States. If you are located outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate.

For transfers from the EEA, UK, or Switzerland to the United States, we rely on:

• Standard Contractual Clauses approved by the European Commission
• Data Processing Agreements with our service providers

By using our Service, you consent to the transfer of your information to these countries, which may have different data protection laws than your country of residence.

10. Children's Privacy

Our Service is not directed to children under 13 years of age (or 16 in the EEA). We do not knowingly collect personal information from children under these ages.

If we learn that we have collected personal information from a child under the applicable age, we will take steps to delete that information as quickly as possible.

If you believe we have collected information from a child, please contact us immediately at privacy@mithobol.com.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (HTTPS/TLS)
• Secure authentication with password hashing and OAuth
• Secure token storage using device keychain/keystore
• Access controls limiting who can access your data
• Regular security reviews and updates

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify you through the app or by email (for significant changes)
• Give you the opportunity to review the changes before they take effect

Your continued use of our Service after the effective date of any changes constitutes your acceptance of the updated policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For EEA residents: If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.