Privacy Policy for Luget

Effective Date: September 30, 2026

1. Who we are

Luget is an application for learning the Uyghur language, for iPhone, Android and the web, developed by Alisher Abdrakhmanov ("we", "us", "our"). This Privacy Policy explains what information we collect when you use the Luget mobile apps or the Luget web app at https://luget.app (together, the "App") and how we use it.

Contact: [email protected]

2. Information we collect

2.1. Automatically collected information

• Advertising identifier (IDFA on iPhone, Advertising ID on Android) — on iPhone only with your consent via the App Tracking Transparency prompt
• Device type, model, operating system version, locale, time zone
• App version and usage events (launches, lesson completions, screen visits)
• Crash and performance data

In the mobile apps this information is collected through Google Firebase (Crashlytics, Analytics) and Google AdMob. The web app uses Google Firebase Analytics, which sets cookies. When it shows ads, Google AdSense may use cookies and similar technologies.

2.2. Purchase information

• App Store and Google Play. When you buy Luget Plus in the mobile apps, Apple or Google shares a transaction identifier and subscription status with us. We do not receive your card number — Apple and Google handle payment details.
• luget.app. Orders on the website are processed by Paddle.com, the Merchant of Record for those orders. Paddle collects your email address, country, postal code where required, and payment details. We receive your email address, country and the order and subscription details, which we use to give you Luget Plus and to answer billing questions. We do not receive your card number.

2.3. Locally stored information

Learning progress, daily XP goal, streak, alphabet preferences, favorite words, notes, and other preferences are stored only on your device (in the web app, in your browser's local storage) and are not transmitted to our servers, except as described in 2.5.

2.4. Notifications

If you allow notifications, the apps remind you to practise in two ways.

Some reminders are scheduled on the device itself — nothing is sent to our servers to deliver them.

The rest arrive from our servers as push notifications: when a streak is about to lapse, for instance, or when words are due for review. To send them we store the device token issued by Apple Push Notification service on iPhone or Firebase Cloud Messaging on Android, a random install identifier, the interface language, the time zone and the app version. If you are signed in, the record is linked to your account. The token belongs to the app install, not to your identity.

We use this only to deliver reminders: we do not share it with anyone and do not use it for advertising or tracking. Turn Reminders off in the app's settings, or deny notifications in the system settings, and the record is deleted from our servers. It is also deleted when Apple or Google tell us the token is no longer valid.

2.5. Exercise error reports and content updates

If you report a mistake in an exercise, we receive the exercise (its question, the expected and the chosen answer), the text you type, the App version, operating system version, device model (in the web app, the browser name), interface language and script. The report is not linked to your name or any account. Your IP address is used only in memory to limit the number of reports and is not stored.

The App downloads corrections to lesson content from our server. These requests carry no personal information beyond what any web request contains.

3. How we use information

• Analytics — to understand which features work, fix bugs, and improve UX
• Advertising — to display Google AdMob ads between lessons in the mobile apps and Google AdSense ads in the web app (removed with Luget Plus). With your consent, ads may be personalized
• Purchases — to process subscriptions, verify Luget Plus status and answer billing and refund requests
• Error reports — to find and fix mistakes in lessons
• Notifications — practice reminders

4. Third-party services

We use the following third-party services, each with its own privacy policy:

• Google Firebase (Analytics, Crashlytics) — https://firebase.google.com/policies/analytics
• Google AdMob and Google AdSense — https://policies.google.com/technologies/ads
• Google User Messaging Platform — https://policies.google.com/privacy
• Apple StoreKit — https://www.apple.com/legal/internet-services/itunes/
• Google Play Billing — https://policies.google.com/privacy
• Paddle (orders on luget.app) — https://www.paddle.com/legal/privacy
• Cloudflare (hosting of luget.app) — https://www.cloudflare.com/privacypolicy/
• Railway (hosting of our server for error reports and content updates) — https://railway.com/legal/privacy

5. Children

The App is not directed at children under 13. We do not knowingly collect data from children. If you are a parent and believe your child has provided us with information, please email [email protected] and we will delete it.

6. Data retention

Firebase analytics data is retained for no more than 14 months. Local data is removed when you uninstall the App or clear the website's data in your browser. Exercise error reports are kept while we need them to fix lesson content, and are deleted on request. Transaction data is retained by Apple, Google and Paddle under their own policies and as required by tax law.

7. Your rights

Subject to applicable law (GDPR, the Russian Personal Data Law, the Kazakh Personal Data Law), you may:

• Request a copy of the data we hold about you
• Request deletion of your data
• Withdraw consent to processing
• Lodge a complaint with a supervisory authority

To exercise these rights, email [email protected]. We will respond within 30 days.

8. Security

We apply reasonable technical and organizational measures to protect information. However, no transmission over the internet is fully secure — by using the App, you accept the residual risk.

9. International data transfers

The third-party services we use (Google, Apple, Paddle, Cloudflare, Railway) may transfer data to countries outside your jurisdiction, including the United States and the United Kingdom. These companies maintain their own compliance mechanisms (Standard Contractual Clauses, EU-US Data Privacy Framework).

10. Changes to this Policy

We may update this Policy. Material changes will be reflected in the effective date above. Continued use of the App after an update means you accept the new version.

11. Contact

All questions about this Policy should be directed to:

Email: [email protected]