Privacy Policy

Account information

When you create an account we collect your name, username (handle), email address, date of birth, and password (hashed — we never store it in plain text). If you sign in via Google or Apple OAuth, we receive your name, email, and profile picture from that provider.

We collect your date of birth to enforce our minimum age requirement (13+). Your date of birth is never shown to other users.

Profile information

You may optionally provide a profile photo, biography, phone number, timezone, and the languages you are studying or teaching.

Booking and lesson data

We store records of your lesson bookings, session dates and times, lesson notes you or your teacher add to a session, and your booking wallet credit balance.

Payment information

Payments are processed by Stripe in Australian Dollars (AUD). We do not store your card number, CVV, or full payment card details — these are held securely by Stripe under PCI-DSS compliance. We store records of purchases, amounts, and Stripe session IDs to manage your booking history and credits.

Lesson recordings and AI summaries

If you have given explicit consent (via your Privacy settings), we may retrieve the transcript of your Zoom lesson recording to generate a personalised post-lesson summary and homework email. The transcript is processed by Anthropic Claude and is not retained by us beyond what is needed to generate the email. The summary email is delivered via Resend. You can withdraw your consent at any time from Settings → Privacy.

Text-to-speech audio

When you use audio playback features (such as hearing a word or phrase spoken aloud), the text is sent to Google Cloud Text-to-Speech to generate audio. The text is not retained by Google after the audio is returned. Generated audio may be cached in our own storage to improve performance on repeat requests.

Voice mode

When you use real-time voice conversation features, your audio is streamed via LiveKit (a real-time communications platform), transcribed by Deepgram, and AI speech is generated by ElevenLabs. Audio is processed to power the AI tutor conversation and is not retained by these providers beyond the duration of the session.

Messages

AI tutor messages are stored so the tutor can maintain conversation history and are processed by Anthropic Claude. Human-to-human messages use end-to-end encryption for new messages on supported web and mobile clients. For encrypted messages, the message text and encrypted media are encrypted on your device before delivery; Lit Land and its database provider receive ciphertext plus routing metadata such as conversation participants, device public keys, message type, timestamps, delivery state, and encrypted media size/path. Lit Land cannot decrypt those messages from the server.

Encrypted message history is stored locally on the devices that receive or send it — in browser storage on the web and local app storage on mobile. Browser or device storage is not a cloud backup. Losing or clearing that storage can remove the local encrypted history, and a new device does not automatically receive arbitrary older history. Existing messages may predate the encryption boundary and remain legacy, server-readable messages.

When you use in-chat learning features such as translation, grammar breakdown, or pronunciation on an encrypted message, the app asks for confirmation, decrypts only the selected message on your device, and sends that plaintext to Anthropic Claude for the requested operation. That private-message analysis is temporary, is not added to cloud chat history, and is not written to the message-analysis cache. AI tutor conversations and legacy messages may still be processed and cached as described above.

New encrypted chat photos and voice messages are encrypted on your device before upload. Legacy chat photos and audio use access-controlled storage and short-lived signed links, but are not end-to-end encrypted. Push notifications for encrypted messages contain routing data only; the client decrypts the message locally before showing any preview. Legacy notification previews may contain a short message preview.

End-to-end encryption currently uses static per-device keys. It does not provide forward secrecy, verified device identity, encrypted cloud backup, or complete multi-device history recovery. Encrypted group delivery is supported by separately encrypting a copy for each recipient device, but the server still sees group membership and delivery metadata. Because Lit Land cannot decrypt encrypted messages, reports involving them may not provide message content for moderation review. You can block any user at any time; blocked users cannot see your messages or contact you.

Speech transcription

When you record audio for speaking practice or assessments, the recording is transcribed by OpenAI Whisper under API terms that prohibit training on your data; audio is not retained by OpenAI after the transcription is returned.

Photo capture and OCR

When you use the camera or photo import feature to scan text, the image is sent to Anthropic Claude (vision) to detect and translate visible text. Images are not stored by us beyond what is needed to return the result, and are not retained by Anthropic after the response is returned.

Mobile app

Our companion mobile app (Lit Land) collects the same account information listed above and shares the same encrypted human-chat service as the web app. Additionally:

• Text you enter for translation or AI-assisted learning is sent to Anthropic Claude and is not retained after the response is returned. For encrypted chat, this happens only after you explicitly request analysis of a selected message.
• Your personal dictionary (word wall) entries and spaced-repetition study progress are stored in our database so your learning history persists across sessions.
• If you enable push notifications, your device token is sent to Expo (our push notification delivery service) to deliver lesson reminders and message alerts. You can disable notifications at any time in your device settings.
• In-app purchases and subscription management are handled by RevenueCat, which receives your anonymised app user ID and purchase records. RevenueCat does not receive your name or email address.
• Crash reports and performance errors may be sent to Sentry to help us diagnose and fix bugs. These reports may include device type, OS version, and anonymised stack traces. We configure Sentry to minimise personal data in error reports.

Usage data

We collect standard server logs including IP address, browser type, pages visited, and timestamps to operate and improve the service. We also use Google Analytics to collect aggregated, anonymous information about how visitors use our platform to help us improve user experience and monitor performance.

Partner discovery (mobile, 18+)

Partner discovery — finding and being found by other users looking for a language-exchange partner — is available only to users aged 18 and over. If you are 18 or older, the mobile app lets you opt in to being discoverable in Settings → Discoverability. If you turn this on, other users searching for partners can see your first name, handle, profile photo, native and target languages, and the short bio you write for this purpose. Your date of birth, email, and phone number are never shown. You control who can contact you (everyone, only language matches, or nobody), and you can turn discoverability off at any time — you disappear from search immediately. Users under 18 do not see this setting and cannot appear in or use partner discovery; this is enforced by our systems, not just by the app's interface.

If another user knows your exact handle, they can look up a minimal version of your profile (name, handle, photo, languages) even if you are not discoverable, unless you have blocked them — this lookup is also limited to users 18 and over. Requests to connect are rate-limited and permanently rejectable; profiles with multiple open safety reports are automatically hidden from discovery pending moderation review.