Effective 6 September 2026
Privacy Policy
What you read says a lot about you. This policy explains what Archer Lingo collects, why, who else touches it, and the rights you have over it.
1.Who is responsible
The data controller is Archer Futura Technologies AB, Sweden. For anything about your data, write to privacy@archerlingo.com.
2.What we collect
- Account data — your email address, the name you give, your chosen sign-in method and the session records that keep you signed in. This is collected and stored by Clerk on our behalf.
- Learning data — the texts you import or open, the words you look up and the levels you give them, your notes, review answers, reading positions, preferences (languages, daily target, dictionaries, display), and the activity log that drives your progress views.
- Technical data — request logs with your IP address, browser and device type, kept by our hosting provider for a short period for security and reliability. We do not run analytics scripts, advertising trackers or fingerprinting.
We do not ask for, and please do not enter, sensitive personal data such as health or political information. Text you import may of course contain anything; treat it as your own responsibility.
3.Why we use it, and the legal basis
- To provide the Service you signed up for — reading, lookups, reviews, progress. Basis: performance of our contract with you.
- To keep the Service secure and working — request logs, abuse prevention. Basis: our legitimate interest in running a safe service.
- To improve the product using aggregate, anonymous signals, such as how often a meaning is chosen across all learners. These are stored without any link to an account. Basis: legitimate interest.
- To contact you about the Service — sign-in codes, important changes to terms, replies to your messages. Basis: contract and legal obligation. We do not send marketing email unless you ask for it, and you can withdraw at any time.
We do not make automated decisions about you with legal or similarly significant effects. The knowledge model that estimates what you know only suggests changes to word levels; you decide, and every suggestion is explained.
4.Who processes it for us
We use a small number of service providers, each bound by a data-processing agreement and acting only on our instructions. When a provider is outside the European Economic Area, transfers rest on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Clerk, Inc. | Sign-in and account management | Email address, name, sign-in method, session records | United States (EU–US Data Privacy Framework) |
| Supabase, Inc. | Database and file storage | All learning data and imported content | European Union (Ireland) |
| Vercel, Inc. | Hosting and delivery | Request logs including IP address and browser details, kept briefly for security | European Union (Stockholm) with a global edge network |
| Anthropic, PBC | Sentence translation, grammar notes and in-context meanings, when enabled | The specific sentence or word you ask about, with no account identifier | United States |
| DeepL SE | Word and sentence translation, when enabled | The specific text you ask to translate, with no account identifier | Germany |
| Wikimedia Foundation | Wiktionary definitions | The word looked up, with no account identifier | United States |
Project Gutenberg receives only a request for a public catalogue entry or book file; nothing about you is sent. We never sell personal data and never share it with advertisers.
5.Cookies and local storage
The Service sets one essential cookie: the Clerk session cookie that keeps you signed in. Your browser also stores small preferences locally — the light or dark theme and your reader layout — which never leave your device. There are no advertising or analytics cookies, so there is no cookie banner to click through.
6.How long we keep it
Account and learning data are kept for as long as your account exists. When you delete your account, your content, vocabulary, notes and activity are deleted from the database and file storage within 30 days, and from backups within 90 days. Request logs at our hosting provider are kept for a short period, typically less than 30 days. Anonymous aggregate signals contain nothing that identifies you and may be kept.
7.Your rights
Under the General Data Protection Regulation you can ask us to:
- access the personal data we hold about you, and receive a copy;
- correct data that is inaccurate;
- delete your data (“right to be forgotten”) — deleting your account does this;
- restrict or object to processing that rests on legitimate interest;
- port your data to another service in a machine-readable form.
Write to privacy@archerlingo.com; we answer within one month. You also have the right to complain to a supervisory authority. Ours is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se); you may also complain to the authority where you live.
8.How we protect it
Data travels encrypted (TLS) and is stored encrypted at rest by our providers. Every table that holds learning data carries row-level security policies in the database itself, so a request can only ever read or change rows that belong to the signed-in account — this holds even if the application had a bug. Access to production systems is limited to the people who run the Service, using individual accounts with multi-factor authentication.
9.Children
The Service is not directed at children under 13, and we do not knowingly collect their data. Where local law sets a higher age for consenting to data processing, a parent or guardian must consent. If you believe a child has given us data without consent, contact us and we will delete it.
10.Changes to this policy
We will update this policy when the Service or the law changes. Material changes are announced in the app or by email at least 14 days before they take effect. The date at the top is always the version in force. Our Terms of Service describe the rest of the agreement between us.