Effective 18 October 2026
VidLingo (vidlingo.io) lets you learn languages from videos with word-by-word transcripts and translations. This page says, in plain words, what we collect about you, why, who processes it on our behalf, how long we keep it, and what you can do about it. It covers the website, the app and the services behind them.
When you sign in with an email address and a password we store the address and a one-way hash of the password, and we email you a confirmation link and, on request, a password-reset link. When you sign in with Google we receive your email address, your name, your profile picture and a Google account identifier. We store those, your plan, your native and learning languages, and a nickname if you choose one for crediting your transcripts. We also keep the IP address used at sign-up and at your last sign-in, for abuse control.
Video or audio files you upload, links to public videos you paste, the transcripts and translations produced for them, versions you edit or write by hand, suggested edits to other people's transcripts, your ratings of transcripts and translations, words you save to your vocabulary with the sentence they came from, and the track setup you choose for each video. Uploaded videos are private unless you make them public.
Whether or not you are signed in, we record events as you use the site: the pages you view, the controls you click (the button or link, never what you type into a field), the features you use (for example changing a track or looking up a word), how long videos play, and each request your browser makes to our API with its outcome and duration. Each event carries the country, region and city derived from your IP address by our hosting provider, your device type, browser and operating system, the random visitor id from the vl_aid cookie, the page that referred you on your first visit, your IP address, a keyed hash of that address, and a short signature of your browser type. The IP address itself is blanked after 90 days; the hash stays so we can recognise repeat activity from the same network without holding the address. We use this to see what people actually do, to decide what to build and what the service costs, and to stop abuse such as duplicate free accounts or automated traffic.
Stripe collects your card details directly; we never see or store the card number. We keep your Stripe customer id, your plan and subscription status, and a record of minute packs you buy.
Suggestions, problem reports and support questions sent through the feedback form, with the page you sent them from, your country and device, and your email address if you were not signed in and asked for a reply.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| Supabase auth cookies | Strictly necessary | Keep you signed in after you sign in. | Session, refreshed while you use the site |
| vl_aid | Analytics | A random id for a browser that has not signed in, so we can tell returning visits apart and count features honestly. | 1 year |
| vl_native, vl_learn | Preference | Your native language and the language you are learning, so the home page and subtitles default correctly. | 1 year |
| Browser storage (not cookies) | Preference | Theme, line length, the tracks you chose for each video, and whether the welcome screen was dismissed. Stays on your device only. | Until you clear site data |
| PostHog (when enabled) | Analytics | Click and page analytics and session replays with form contents masked, to see where people get stuck. | Up to 1 year |
| YouTube | Third party | Set by YouTube when a YouTube video plays in its embedded player on our pages. | Set by YouTube |
| Cloudflare Turnstile (when enabled) | Strictly necessary | Tells bots from people on the upload and link forms. | Set by Cloudflare |
You can delete cookies and site data in your browser at any time. Without the sign-in cookies you will be signed out; without the preference cookies the site forgets your languages. Items marked "when enabled" are only present once we turn that service on.
We do not sell personal data and do not share it with advertisers. These companies process data for us, under contracts that limit what they may do with it:
| Service | What for | Where |
|---|---|---|
| Supabase | Database, sign-in, and file storage for uploads, audio files, transcript data and thumbnails. | United States (Ohio) |
| Vercel | Hosts the website and its API; adds the country, region and city of each request from its edge network. | United States, with edge servers worldwide |
| Railway | Runs the background worker that fetches public videos, transcribes, translates and manages media. | United States (California) |
| Bunny.net | Encodes and delivers the videos we host (uploads and copies of public posts) as streaming video from servers near the viewer. | Storage in the United States (New York), delivery servers worldwide; company based in the EU |
| Transcription engines: Microsoft Azure AI Speech, ElevenLabs, Groq, Fireworks, Google Gemini, Deepgram, xAI, OpenAI, OpenRouter | Receive the audio of a video (and its title, as hints) and return the transcript. You, or the engine recommendation, choose which one runs. | Mostly United States; each engine's own policy governs what it keeps |
| Language models: Anthropic, OpenAI, OpenRouter | Translate transcript lines, clean up captions, and explain words and phrases you click on. | United States |
| Stripe | Subscriptions and minute packs. Stripe handles your card; we never see the number. | United States and worldwide |
| YouTube's embedded player and data API for public video details; Gemini transcription for some languages. | Worldwide | |
| Resend | Sends our sign-in emails: the link that confirms your address and the link that resets a password. | United States |
| Proxy providers (for example Webshare) | Fetch public videos from platforms that block data-centre addresses. They see the public video address, never your data. | Worldwide |
| Sentry (when enabled) | Error reports from the site and the worker, so we can fix crashes. | United States |
| PostHog (when enabled) | Product analytics and session replay in the browser. | United States or EU, depending on the project region |
| GitHub | Holds an encrypted copy of the database made each night, kept for two days. | United States |
For a transcription we send the engine the audio of the video and its title; for a translation or a word explanation we send the text of the transcript lines involved. We do not send your name, email or account details to these engines. We may also disclose data when the law requires it, to protect our rights or users' safety, or as part of a sale or merger of the business, in which case this policy continues to apply to the data.
Public videos and their transcripts and translations are visible to everyone, including search engines, and may be played and copied by other learners. When you edit or write a transcript you choose whether it is credited to your nickname or shown anonymously. Ratings are shown only as totals. Private videos and your saved words are visible only to you and to the people who operate the service.
We are based in the United States and our systems run there, with delivery servers around the world so videos play quickly wherever you are. If you are in the European Economic Area, the United Kingdom, Brazil or another country with data transfer rules, your data is transferred to the United States. Our providers offer the safeguards those laws recognise, such as the EU standard contractual clauses and the EU-US Data Privacy Framework where they are certified under it.
| Data | How long |
|---|---|
| Account (email, name, picture, plan, preferences) | While the account exists; removed when you delete your account in Settings: at once for a free account, at the end of the paid period otherwise (the nightly backup copies age out within 2 days) |
| Uploaded video and audio files | Free plan 30 days, Pro 365 days; Power and Educator while the video is still being watched (removed after 12 months without a play). You can delete a video at any time. |
| Streaming copies on Bunny.net and the small audio file we keep for re-transcription | Same as the uploaded file |
| Transcripts, translations, your edits, saved words, ratings | While the account exists, or until you delete the video. Public transcripts and translations you wrote, and edits you made to public ones, stay after you delete your account, without your name (see the Terms of Service). |
| Usage events (pages, clicks, features, API calls, playback) | Kept; the IP address inside each event is blanked after 90 days and the keyed hash remains |
| IP address on your account (sign-up and last sign-in) | Replaced at each sign-in; deleted with the account |
| Feedback and support messages | Until handled, plus 12 months; the IP address is blanked after 90 days |
| Payment records | As long as tax and accounting law require |
| Encrypted database backups | 2 days |
To use any of these, email privacy@vidlingo.io from the address on your account, or send a support question through the feedback form while signed in. We answer within 30 days. You can delete your account yourself in Settings at any time; a free account goes immediately, a paid one at the end of the period you paid for. These rights apply to everyone; the laws of the EU and UK (GDPR), Brazil (LGPD) and California (CCPA) spell some of them out. For California residents: we do not sell personal information and do not share it for cross-context behavioural advertising, and we do not treat you differently for exercising your rights.
VidLingo is not directed at children under 13, and we do not knowingly collect personal data from them. Younger learners should use the service through a parent's or teacher's account. If you believe a child has created an account, tell us and we will remove it.
Connections are encrypted (HTTPS). Uploaded files live in private storage reached only through short-lived signed links; streaming copies are served through signed links that expire within a day. Database access is restricted to the service and its operators, backups are encrypted, and secrets are kept out of the code. No system is perfectly secure; if we learn of a breach affecting you we will tell you and the authorities as the law requires.
YouTube videos play inside YouTube's own embedded player, which is governed by Google's privacy policy and may set its own cookies. Links to the original posts on YouTube, Instagram, TikTok and other platforms take you to those services and their policies.
The VidLingo Sync browser extension runs only inside Instagram, X, Douyin and Bilibili players embedded on our pages and on our own pages. It reads the playing video's position and whether it is paused, and passes that to the page in front of you so the words can follow the video. It collects nothing else, stores nothing, and sends nothing to our servers or anyone else.
When we change this policy we update the date at the top. For changes that matter to you, such as a new purpose or a new category of data, we will tell signed-in users by email or a notice on the site before the change takes effect.
VidLingo
Privacy questions and requests: privacy@vidlingo.io
Copyright notices go to the address on the DMCA page. Postal address available on request by email.