---
title: "Privacy Policy | Yupo"
description: "How the Yupo app and the yupolearn.com website process personal data, which service providers they use, and how to exercise your rights."
url: https://yupolearn.com/privacy/
---

# Privacy Policy

**Last updated:** October 27, 2026

This document explains how this mobile application (“App”) processes your personal data. The App offers language learning, quizzes, progress tracking, and related features. How the yupolearn.com website measures visits is described in section 10.

## 1. Data controller and contact

For personal data requests relating to the App, contact us at **info@yupolearn.com**.

## 2. What data may be processed?

The App and related services may process the following types of data to provide features:

| Category | Examples |
| --- | --- |
| **Account and identity** | Email address (if you register with email), anonymous user identifier (anonymous session), session tokens |
| **Learning and usage** | Quiz results, word progress, daily tasks, profile/statistics summary, in-app preferences (e.g. interface language) |
| **Product analytics** | In-app usage events (e.g. onboarding steps, lessons started and completed, paywall and ad interactions, dictionary use) and subscription events (e.g. trial started, renewal, cancellation), linked to a pseudonymous user ID |
| **Device and technical** | App version, operating system, device language and region; limited technical logs for debugging (depending on configuration) |
| **Translation and audio (optional)** | Text sent for translation; text transmitted for synthesis when cloud text-to-speech is used |
| **Advertising and marketing (where permitted)** | Advertising identifier (IDFA/GAID, etc.), metrics related to ad impressions |
| **Subscriptions and payments** | Purchase status, product identifiers; payment card data is not processed directly by the App (via Apple/Google payment flows) |
| **Notifications (where permitted)** | Push notification token for sending alerts |

## 3. Third-party service providers

The App uses the infrastructure of the providers below. They process data under their own privacy policies.

### 3.1 Supabase (Supabase Inc.)

- **Purpose:** Database, authentication (sign-in, anonymous sessions), server-side functions (Edge Functions), and storage of user-related data.
- **Data processed:** Account information, learning data, and server-side records required for the App to operate.
- **Location:** Data is hosted according to the region selected for your Supabase project.
- **Policy:** [Supabase — Privacy](https://supabase.com/privacy)

### 3.2 Microsoft Azure Translator (Azure Cognitive Services)

- **Purpose:** Translation of words or text into the target language.
- **Data processed:** Text content sent to the server during translation requests. Microsoft applies its own security and compliance standards when providing this service.
- **Policy:** [Microsoft — Privacy Statement](https://privacy.microsoft.com/privacystatement)

### 3.3 Unity LevelPlay (ironSource) and mediated ad networks

- **Purpose:** In-app advertising (rewarded and interstitial ads). Unity LevelPlay selects which ad network serves each ad; current networks are ironSource Ads, Unity Ads and Google AdMob.
- **Data processed:** Advertising identifier, device and app information, approximate location derived from IP address, ad interactions; personalized ads depend on your consent choices and device settings (e.g. App Tracking Transparency on iOS).
- **Consent:** Where required (e.g. EEA, UK, certain US states), your choices are collected with Google's User Messaging Platform and shared with the ad networks via industry-standard consent signals (IAB TCF / GPP).
- **Policies:** [Unity — Privacy Policy](https://unity.com/legal/game-player-and-app-user-privacy-policy), [Google — Privacy & Terms](https://policies.google.com/privacy)

### 3.4 Adapty (Adapty Tech Inc.)

- **Purpose:** Subscriptions, paywalls, and in-app purchase experience; linking the user with the purchase profile.
- **Data processed:** Purchase status, product identifiers, customer user ID (e.g. linked to your Supabase user ID).
- **Analytics:** Adapty forwards subscription events for your user ID to PostHog (see 3.5).
- **Payments:** Payments are processed through the Apple App Store or Google Play; card details are not stored by Adapty or the App developer.
- **Policy:** [Adapty — Privacy Policy](https://adapty.io/privacy/)

### 3.5 PostHog (PostHog Inc. — product analytics)

- **Purpose:** Product analytics, to understand which features are used, where people get stuck, and how subscriptions perform, so we can improve the App.
- **Data processed:** Pseudonymous user ID (the same anonymous identifier used for your account); from app version 1.4.0, in-app usage events and their settings (e.g. step, game type, screen, paywall or ad placement), app version, operating system, device language and region; and subscription events that Adapty forwards to PostHog (e.g. trial started, subscription started, renewed or cancelled, product, price and proceeds, store country, test or live purchase). IP addresses are not stored and IP-based location lookup is switched off. No session recordings, screen content, or text you type are collected.
- **Location:** PostHog EU Cloud (Frankfurt, Germany).
- **Your choice:** From app version 1.4.0 you can turn in-app usage statistics off at any time in **Settings → Privacy → Usage statistics**. Where the EEA/UK consent form applies and analytics consent is not given, they are switched off automatically. To object to subscription analytics or to have your analytics data deleted, write to **info@yupolearn.com**.
- **Policy:** [PostHog — Privacy Policy](https://posthog.com/privacy)

### 3.6 Inworld (Inworld AI — optional feature)

- **Purpose:** Cloud-based text-to-speech for German TTS playback (if enabled in Settings).
- **Data processed:** Text to be spoken and generated audio output; requests are sent via server-side functions.
- **Policy:** [Inworld — Privacy](https://inworld.ai/privacy) (verify the current link on the provider’s website)

### 3.7 Expo (Expo / 650 Industries, Inc.)

- **Purpose:** App development infrastructure; if push notifications are used, notification delivery infrastructure (Expo Push Notification service).
- **Data processed:** Push token and related delivery metadata for sending notifications.
- **Policy:** [Expo — Privacy Policy](https://expo.dev/privacy)

### 3.8 Apple and Google

- **Purpose:** Validation of in-app purchases, store listings, device security, and operating system services (e.g. speech recognition — may be processed on device).
- **Policy:** [Apple](https://www.apple.com/legal/privacy/) / [Google](https://policies.google.com/privacy)

## 4. Purposes of processing

- Account creation and session management
- Delivering learning content, recording progress, and showing statistics
- Translation and (if enabled) cloud speech synthesis
- Providing paid features and subscriptions
- Displaying and measuring ads (subject to permission and settings)
- Sending notifications (where permitted)
- Product analytics: understanding feature usage and subscription performance, and improving the App
- Security, debugging, and improving the service

## 5. Legal basis and retention

Processing may rely on contract performance, legitimate interests (for example, product analytics, which you can object to as described in section 3.5), consent, or legal obligations, as applicable. Data is kept for as long as necessary for those purposes or as required by law; it is deleted, anonymized, or removed when retention is no longer justified or upon request where applicable.

## 6. Your rights

Depending on applicable law (e.g. GDPR, UK GDPR, or local privacy laws), you may have rights including access, rectification, erasure, objection to processing, and in some cases data portability. You can submit requests, including deletion of your analytics data, via **info@yupolearn.com**. You may also lodge a complaint with your local data protection authority.

## 7. Children’s privacy

The App does not knowingly collect personal data from children under 13 (or under the minimum age in your country). Parents or guardians may contact us with concerns about their children’s data.

## 8. International transfers

Some providers may process data outside your country or outside the European Economic Area, for example in the United States or in the selected cloud region. PostHog Inc. is a US company; analytics data is hosted in the EU. Where required, appropriate safeguards such as contractual clauses or standard contractual clauses may be used.

## 9. Changes to this policy

This text may be updated as features or legal requirements change. Material changes may be announced in the App or by email. We recommend checking the “Last updated” date.

## 10. Website (yupolearn.com)

The website does not use cookies, advertising, or tracking scripts, and it does not require an account. To understand which channels bring visitors and which content is useful, it collects anonymous usage statistics as described below.

- **Hosting:** The website is served by Cloudflare. To deliver pages and protect against abuse, Cloudflare processes technical connection data such as IP addresses under its own policy.
- **Cloudflare Web Analytics:** Aggregated statistics such as page views and referring websites, without cookies.
- **Our own event measurement:** When you arrive on the site, tap an App Store or Google Play button, start or finish a quiz, look up a word in the article finder, or switch the site language, the site records the event together with the channel you came from (for example a search engine, a social network, or a link tag), the page and its language, and the country derived from the connection. For finder searches without a result, the search term is recorded so missing words can be added. No IP address, browser identifier, or user identifier is stored.
- **Visit flow (PostHog):** To see how visits flow from arriving on the site to tapping a store button, our server forwards the same events to PostHog (EU Cloud, Frankfurt), our product analytics provider. Nothing is loaded from PostHog in your browser and nothing is stored on your device. Events from the same day are grouped under a random-looking code that our server computes from your IP address and browser information together with a secret value that changes every day. The IP address itself is not sent to PostHog or stored, the code cannot be turned back into it, and a new code is used the next day, so visits on different days cannot be linked. [PostHog — Privacy Policy](https://posthog.com/privacy)
- **Session storage:** To remember the channel you came from while you browse, the site keeps a single value (for example “google”) in your browser’s session storage. It contains no identifier and is deleted when you close the tab.
- **Store links:** App Store and Google Play links from the website include a campaign tag naming the channel, the site language, and the button. Apple and Google use it to report anonymous download statistics to us under their own policies.
- **Legal basis and retention:** Legitimate interest in understanding and improving the website. Cloudflare event records are kept for up to 3 months; PostHog event records are kept according to our PostHog plan (currently up to 1 year). You can object at any time by writing to **info@yupolearn.com**.
- **Policy:** [Cloudflare — Privacy Policy](https://www.cloudflare.com/privacypolicy/)

## 11. Quick reference

| Service | Primary use |
| --- | --- |
| **Supabase** | Backend, database, authentication, Edge Functions |
| **Azure Translator** | Text translation |
| **Unity LevelPlay (ironSource, Unity Ads, Google AdMob)** | Advertising |
| **Adapty** | Subscription / paywall management |
| **Inworld** | Optional cloud TTS |
| **Expo** | Development infrastructure; push notifications |
| **Cloudflare** | Website hosting and anonymous website statistics |
| **PostHog (EU)** | App product and subscription analytics; website visit-flow statistics |
| **Apple / Google** | Store payments and platform services |