Kilo Lingo

Privacy Policy

This policy explains what personal data Kilo Lingo collects, why, and how it is handled. We are committed to transparency and to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Last updated: August 2026

Who We Are

The Kilo Lingo is a UK-operated language-learning publication. For any data or privacy matter, contact us at hello@kilolingo.com.

Data Controller

The Kilo Lingo is operated by Michael McGettrick, who is the data controller for personal data processed via this site within the meaning of UK GDPR. All data protection enquiries, subject access requests, and erasure requests should be sent to hello@kilolingo.com.

What Data We Collect and Why

Your account

You can use most of Kilo Lingo without an account. If you create one, we store your email address and, where you sign in with Google, the name and profile picture Google gives us. Sign-in itself is handled by Amazon Cognito; we never see or store your password.

  • Data held: Email address, and optionally a display name, a public username and a profile picture
  • Legal basis: Contract (Article 6(1)(b) UK GDPR) - we need it to give you an account and keep your progress
  • Retention: Until you ask us to delete your account. There is no delete button in the app yet, so email the address above and we will remove it within 30 days.

Emails we send you

We email you in two situations, and both need an account. There is no mailing list you can join without one.

Emails about your account. When you sign up we send a welcome, and over your free week a short onboarding sequence of seven emails explaining what the trial opens, plus a note before the trial ends and one after it does. These come with the account rather than being something you opt into, because they are how we tell you what is happening to it.

Learning emails you switch on. In your email settings you can ask for words to learn by email and a daily grammar tip, per language and at a frequency you choose. These are off until you turn them on, and the same page turns them off again. Your choices are stored on your account record.

We do not sell or share your address, and we do not send you anyone else's advertising. Sending is done for us by Amazon SES, listed under Third-Party Services below.

  • Data held: Your email address, your per-language email preferences, and which emails in a sequence you have already been sent, so we do not repeat one
  • Legal basis: Contract (Article 6(1)(b) UK GDPR) for the emails about your account and trial; consent (Article 6(1)(a)) for the learning emails you switch on
  • Retention: Preferences last until you change them or delete your account. Turning an email off stops the next send; there is no separate waiting period

Your learning progress

If you are signed in, we store what you have learned so it follows you between devices: which words you have met and how well you know them, which lessons and stories you have finished, your scores, your points and your daily streak. This is the service working as intended rather than anything we analyse about you.

  • Data held: Word, lesson, story and quiz progress, review scheduling, points, streaks and how far you have reached in each course; your account settings, including your browser's language preference and timezone (so emails and features can fit where you are - we do not store your IP address)
  • Legal basis: Contract (Article 6(1)(b) UK GDPR)
  • Retention: Until your account is deleted. The separate copies used for the weekly leaderboard, the journey map and the activity graph expire on their own, between 14 days and about 13 months.

What other learners can see

Some of the site is deliberately social, and you should know exactly what that publishes before you sign in.

  • Weekly leaderboard. Your points for the week appear in a public table for each language. You are named only if you have set a username; if you have not, you appear as an anonymous learner.
  • Public profile. If you set a username, a page at /profile/<username> shows your points, streak and an activity graph. Setting a username is what makes this page exist.
  • Journey map. The course map shows other learners as small avatars beside the lesson they have reached, so the course does not feel empty. If you have set a username you are named; if you have not, you still appear as an unnamed avatar. There is currently no setting that hides you from the map. Your avatar is generated from your account id and is not a photograph. We publish your position in the course and your username only; your email address and account id are never exposed, and the id is hashed before it leaves our systems.
  • Data published: Username (if set), weekly points, activity dates, and how far through a course you have reached
  • Legal basis: Legitimate interests (Article 6(1)(f) UK GDPR) - showing learners that others are working through the same material is a core part of how the course motivates people. You can object to this at any time using the contact address below, and we will remove you.
  • Retention: Leaderboard rows are deleted about 60 days after the week they cover; your journey-map position is deleted 14 days after your last finished lesson; profile activity is kept for about 13 months.

Analytics

We use Google Analytics 4 to understand how visitors use the site in aggregate (which articles are most read, which tools are used). We treat this aggregate, anonymised analytics as essential to running the site, so it operates regardless of your cookie choice.

  • Data held: Anonymised usage data (pages visited, session duration). No personally identifiable information is collected via analytics.
  • Legal basis: Consent (Article 6(1)(a) UK GDPR)
  • Retention: We retain anonymised analytics data for 14 months in line with Google Analytics defaults. You can request earlier deletion by contacting us.

Cookies

We use three categories of cookies:

  • Essential cookies - required for the site to function. Set automatically; no consent required.
  • Analytics cookies - Google Analytics cookies that help us understand aggregated site usage. We treat these as essential to running the site, so they are set regardless of your consent choice.
  • Advertising cookies - the Meta (Facebook) Pixel, which measures whether our advertising on Meta platforms works. In the UK, EEA and Switzerland these are set only if you choose "Accept all" on the cookie banner; choosing "Reject non-essential" keeps them off. You can withdraw consent at any time via the Cookie Settings link in the footer.

Third-Party Services

  • Amazon Web Services (AWS) - provides our hosting (S3, CloudFront), our application servers and databases (Lambda, DynamoDB), sign-in (Cognito) and our email sending (SES). Data is processed in the us-east-1 (Northern Virginia) region, so your data is transferred outside the UK. AWS is contracted under the UK Addendum to the EU Standard Contractual Clauses, which is the safeguard we rely on for that transfer under Article 46 UK GDPR.
  • Amazon Cognito - handles account creation and sign-in, including Google sign-in. Passwords are held by Cognito and are never visible to us.
  • Google Analytics - website analytics, treated as essential and active regardless of consent. Google's privacy policy: policies.google.com/privacy.
  • Meta Pixel - advertising measurement for our campaigns on Facebook and Instagram, consent-gated as described under Cookies above. Legal basis: consent (Article 6(1)(a) UK GDPR). Meta's privacy policy: facebook.com/privacy/policy.

Your Rights Under UK GDPR

  • Right of access - ask what data we hold about you
  • Right to rectification - ask us to correct inaccurate data
  • Right to erasure - ask us to delete your data
  • Right to restriction - ask us to limit how we process your data
  • Right to portability - request a copy in a machine-readable format
  • Right to object - object to processing based on legitimate interests
  • Right to withdraw consent - withdraw at any time without affecting the lawfulness of prior processing

To exercise any of these rights, email hello@kilolingo.com. We respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Children

This site is not directed at children under the age of 13. We do not knowingly collect personal data from children.

Changes to This Policy

We may update this policy from time to time. The date at the top of this page shows when it was last revised.