Dictoterix Privacy Policy

Last updated: August 21, 2026

1. Who is responsible for your data

The data controller (responsable) for Dictoterix (dictoterix.com) is:

Leonid Plekhanov, based in Mexico

Contact for privacy matters: support@dictoterix.com

We built Dictoterix to collect as little personal data as a language-learning service can get away with. In particular: no advertising, no third-party analytics trackers, no sale or sharing of personal data for marketing — ever.

2. What we collect

Account data — your email address, a password (stored only as a secure hash by our authentication provider), your display name, chosen profile icon, interface language, and account status (e.g. pending approval, active).

Learning activity — the language pairs you study, your vocabulary and grammar progress (per-word mastery, levels, streaks, session history and duration, placement results), practice answers you type or select, and your settings (daily goal, preferences).

Messages and shared media — messages you exchange with other users, images you share in chat, your companion-chat history, and moderation records (reports you file or that are filed about your content, blocks).

Feedback and reports — feedback you submit about the Service and reports about specific content (e.g. a bad sentence).

Technical and security data — server logs and error reports (which may include your user ID and technical context of a failure), API-usage records, and rate-limiting records (which may include IP-derived identifiers). During registration, Cloudflare Turnstile processes technical browser signals to distinguish humans from bots.

Approximate location — the country our hosting provider derives from your connection's IP address, stored on your account so we can see where the Service is used. We never store your IP address itself or a more precise location.

Payment records (if paid features launch) — the Service is currently free and processes no payments. If we introduce optional paid features in the future (such as a premium membership tier) and you purchase one, our payment processor (planned: Stripe) will process your payment details. We would receive only confirmation data (amount, date, a transaction reference, and the email you used) — never your full card number.

Profile visibility to other users

Your learner profile is listed in the in-app people search by default, but only once the date of birth on your account shows you are 18 or older. Accounts under 18, and accounts with no date of birth on record, are never listed — the same age rule the Service applies elsewhere.

Other signed-in users who find you there see: your display name and handle, your profile icon, the languages you speak and are learning, and how many friends you have. Your age and your gender are shown only if you have separately switched each of those on; they are hidden otherwise. Your email address is never shown. Suspended accounts and users you have blocked are excluded, and a partner from an anonymous live-practice session cannot use this search to identify you unless you both chose to reveal.

You can turn this listing off at any time in Settings → Profile → Public profile. Turning it off removes you from the people search; it does not affect people you are already friends with.

What we deliberately do not collect

• Microphone audio. Pronunciation practice records and analyzes your voice entirely on your device, in your browser. The audio is never uploaded to our servers or to any third party.
• Tracking. No advertising identifiers, no cross-site tracking, no third-party analytics.
• Precise location, contacts, or device files. Never requested.

3. Why we process it (purposes and legal bases)

We do not use your data for behavioral advertising or sell it to anyone. Under the LFPDPPP, the purposes above are all finalidades primarias (necessary for the service); we pursue no secondary purposes. Under the LGPD, the corresponding bases are execution of contract, legitimate interest, and compliance with legal obligations (LGPD Art. 7).

We do not make automated decisions about you that produce legal or similarly significant effects. (The app's difficulty and review scheduling adapt to your learning progress — that is the product working as described, and it affects nothing beyond your lessons.)

4. AI processing

To generate your practice conversations, exercises, corrections, and companion messages, we send the relevant text (for example, the sentence you typed and recent conversation context) to Anthropic, our AI-model provider, via its API. Under Anthropic's commercial API terms, this data is not used to train Anthropic's models. AI conversation partners in Dictoterix are clearly not human; you are never covertly talking to a machine believing it is a person.

5. Who processes data on our behalf

We use a small set of service providers ("processors" / "encargados"), each bound by a data processing agreement:

No other third parties receive your personal data, except public authorities where the law compels disclosure, or a successor operator if the Service changes hands (you would be notified).

6. International transfers

Our infrastructure is hosted in the United States. If you use Dictoterix from the EU/EEA, the UK, Brazil, Mexico, or elsewhere, your data is transferred to and stored in the US.

For EU/EEA users: these transfers rely on the European Commission's Standard Contractual Clauses as implemented in each provider's data processing agreement, and, where the provider is certified, the EU–US Data Privacy Framework. For Brazilian and Mexican users, transfers rely on the corresponding contractual safeguards under LGPD and LFPDPPP.

7. How long we keep data

• Account and learning data: for as long as your account exists. When you delete your account, your personal data is deleted immediately; residual copies in routine backups expire within 7 days.
• Messages you sent to other users: deleted for both parties when you delete your account, along with images you uploaded to chats and your profile pictures.
• Server logs, error reports, and rate-limiting records: kept up to 90 days, then deleted or anonymized.
• Moderation records: kept as long as needed to handle the incident and prevent repeated abuse, then deleted.
• Payment records: kept for the period required by tax and accounting law.
• Backups: routine encrypted backups expire on a rolling cycle of 7 days; deleted data disappears from backups as the cycle turns over.

8. Your rights

Wherever you live, you can exercise these rights by writing to support@dictoterix.com or, for most of them, directly in-app (Settings → Account). We respond within the deadline your law sets (one month under GDPR; 15–20 business days under LFPDPPP and LGPD).

• Access / portability — request a copy of your data by writing to support@dictoterix.com; we provide it in a commonly used, machine-readable format.
• Rectification — correct inaccurate data (profile data is editable in-app).
• Deletion (cancelación / eliminação) — delete your account and data in-app at any time.
• Objection / restriction (oposición) — object to processing based on legitimate interest.
• Withdraw consent — where processing rests on consent, withdraw it at any time without affecting prior processing.

We will never discriminate against you for exercising a privacy right.

Complaints. You can also complain to a supervisory authority: your local Data Protection Authority in the EU/EEA, the ANPD in Brazil, the competent data-protection authority in Mexico, or your state Attorney General in the US. We would appreciate the chance to resolve the issue first.

For US state residents (California and similar laws): we do not sell personal information or share it for cross-context behavioral advertising, and we collect no sensitive personal information beyond account credentials. The rights above cover the access, deletion, and correction rights those laws grant.

9. Cookies

We use only cookies that are strictly necessary to run the Service: your authentication session and your interface-language preference. Cloudflare Turnstile may set a cookie during registration for bot protection. We use no advertising or analytics cookies — which is why you see no cookie-consent banner: there is nothing to consent to.

10. Children

Dictoterix requires users to be 16 or older. We do not knowingly collect data from anyone under 16; if we learn we have, we delete the account and its data. If you believe a child is using the Service, contact us at support@dictoterix.com.

11. Security

Data is encrypted in transit (TLS). Database access is governed by row-level security policies so that each user can reach only their own data. Passwords are stored only as hashes by our authentication provider. Administrative access is restricted to the Operator. No internet service can promise perfect security; if a breach affects your data, we will notify you and the competent authorities as the law requires.

12. Changes to this policy

We may update this policy as the Service evolves. For material changes we will notify you (by email or in-app notice) before the change takes effect, with the effective date shown at the top.

13. Contact

Leonid Plekhanov

support@dictoterix.com

Language. This policy is published in English and Spanish. The English version controls, except where the mandatory law of your jurisdiction requires otherwise — for users in Mexico, the Spanish version (aviso de privacidad) governs.