Last updated: 2026-09-01
VietLingo is developed by Han Hoa ("we", "us"), reachable at hanniboy@gmail.com.
Đ. Ngô Thị Bì/75, Khu đô thị Him Lam, Tân Hưng, Hồ Chí Minh, Vietnam
This policy describes what data VietLingo (the "App") collects and why, as of the version stated above. We update this page whenever that changes and note material changes in our public changelog.
Decks, cards, review history, XP and streaks are stored in a local database on your device. Without a VietLingo account we do not receive, see, or store this data on our servers. It leaves your device only if you either:
Uninstalling the App or losing your device permanently deletes the local copy; we cannot recover it for you unless you had cloud sync enabled.
The App's core features work fully offline and need no account. You can optionally create a VietLingo account to sync your decks across devices.
Sign-in. You sign in with an email address, plus either a password or a one-time code we email to you. On our server we store: your email address; if you set a password, only a salted hash of it (bcrypt — never the password itself); hashed session/refresh tokens; a random identifier for each device signed in to the account; and the related timestamps. One-time login codes are sent through our email provider and expire shortly after being issued.
What sync copies to our server. While you are signed in and syncing, your decks, the cards (vocabulary) you create or import, and your review history (ratings and scheduling data) are copied to our server so your other devices on the same account can load them. This data is tied to your account, is not shared with third parties, and is not used for advertising or profiling. Our server is hosted in the European Union (Hetzner).
Deleting it. You can delete your account and all of its synced data at any time — see https://vietlingo.asia-zone.com/delete-account. Deleting the account removes the email address, credentials, tokens, and all synced decks/cards/review history from our server. Local data on your device is not affected; clear the app's data or uninstall to remove that.
A random device identifier. On first launch the App generates a random identifier (not derived from any hardware ID, name, or contact data) and sends it to our server to (a) enforce a per-device daily limit on the AI-powered import feature, and (b) count how many people use the App, which determines whether in-app ad placements would be shown. It does not identify you personally but is a persistent pseudonymous identifier, and we treat it as personal data under GDPR.
Server access logs. Like virtually every web server, ours temporarily logs the IP address of incoming requests for security and debugging. These logs are not linked to the device identifier or to an account and are not used to profile users.
Text you submit for AI-powered import. If you use "Import word list" or "Import from text", the words or text you enter are sent to our server, which forwards them to DeepSeek (Hangzhou DeepSeek AI, based in China) to translate them or extract vocabulary. That text is therefore transferred outside the EU/EEA to a country without an EU adequacy decision. We send only the text you actively submit for this purpose — never your decks, review history, or any other App data — and DeepSeek is instructed to process it only to generate the response returned to you. We do not control DeepSeek's own data handling; see their privacy policy for details. Common words are matched against a dictionary bundled in the App instead, in which case nothing is sent anywhere.
The "News of the Day" feature loads a daily, AI-summarized news bundle (text, illustration, audio) from our server. This request does not include the device identifier, your account, or any other identifying data — it is a plain, anonymous content fetch, like loading a public web page. The underlying article and its source link originate from a third-party publisher (VnExpress International); we do not control that publisher's own data practices. Words you import from a news article are stored like any other word.
All traffic between the App and our server uses HTTPS/TLS. Passwords are stored only as bcrypt hashes; login tokens are stored only as hashes.
Under GDPR (and comparable laws elsewhere) you can ask us to tell you what we hold about you, or to delete it. For a signed-in account, contact hanniboy@gmail.com from your account email, or use the delete-account page above. Without an account we can only act on requests that identify your device's records (e.g. the device identifier). Contact hanniboy@gmail.com for any such request.
The App is not directed at children under 13 and we do not knowingly collect personal data from them beyond the anonymous device identifier described above, which is required for the App's basic anti-abuse functionality regardless of who uses it.
In-app ad placements exist in the code but are currently disabled for all users. If they are turned on, this policy will be updated first to describe what additional data (if any) that involves.
We update the "Last updated" date above and, for material changes, note what changed in our public changelog.
hanniboy@gmail.com