Privacy Policy

1. Introduction

Rushford Collyer LLC ("we," "us," or "our") operates the Ensemble language learning application and website at https://ensemblelanguage.com (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have.

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

2. Information We Collect

Information you provide directly

• Account information: When you create an account, we collect your email address and display name. You may optionally upload a profile photo.
• Flashcard content: The decks, cards, folders, and groups you create, including any text, translations, and notes you enter.
• Profile photo: If you choose to upload one, your photo is stored on our servers. You can remove it at any time from Settings.

Information generated by your use of the Service

• Practice history: Your flashcard practice sessions, self-rated recall scores, and spaced-repetition scheduling data (SM-2 algorithm parameters) so the app can show you cards at the right time.
• Audio files: When you use the text-to-speech feature, audio pronunciations are generated and stored on our servers so they can be replayed without regenerating each time.
• Session tokens: When you sign in, we store a secure session token on your device to keep you signed in. This token is stored in your device's secure enclave (iOS Keychain via expo-secure-store).

Information collected automatically

• Usage analytics: We use Vercel Analytics to collect anonymous, aggregated data about how visitors use our website (page views, referring pages, browser type). This data does not identify you personally.
• Log data: Our hosting infrastructure may automatically log standard server request information such as IP address, request timestamp, and HTTP status codes for security and diagnostic purposes. These logs are retained for a short period and are not used for marketing.

3. How We Use Your Information

We use the information we collect to:

• Create and manage your account and authenticate your identity
• Provide and improve the Service, including spaced-repetition scheduling
• Generate translations and audio pronunciations for cards you create using Google Cloud Translate and Text-to-Speech
• Send transactional emails (sign-in magic links, group invitations)
• Respond to your support requests and questions
• Monitor for abuse, fraud, and security issues
• Analyze aggregate usage patterns to improve the Service

We do not use your flashcard content or practice history for advertising purposes, and we do not sell your personal information to third parties.

4. Third-Party Services

We rely on the following third-party services to operate the Service. Each has its own privacy policy governing their handling of data.

5. Data Storage and Security

Your data is stored on servers located in the United States (AWS and Neon, us-east-1 region; Vercel infrastructure). If you are located outside the United States, your information is transferred to and processed in the United States.

We use industry-standard measures to protect your data, including encrypted connections (HTTPS/TLS) for all data in transit, encrypted database connections, and secure token storage on mobile devices via the iOS Keychain. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Children's Privacy

The Service is available to users of all ages. We are committed to complying with the Children's Online Privacy Protection Act (COPPA) and similar laws regarding the privacy of children under 13.

Users under 13: If you are under 13 years of age, you must have verifiable consent from a parent or legal guardian before creating an account or using the Service. By creating an account on behalf of a child under 13, the parent or guardian represents that they have reviewed this Privacy Policy and consent to our collection and use of the child's information as described herein.

We do not knowingly collect personal information from children under 13 without verifiable parental consent. If we become aware that we have collected personal information from a child under 13 without parental consent, we will take steps to delete that information promptly. If you believe we may have collected information from a child under 13 without appropriate consent, please contact us at privacy@ensemblelanguage.com.

Parents and guardians may review the personal information we have collected about their child, request its deletion, or refuse further collection by contacting us at privacy@ensemblelanguage.com. We will respond to verified requests within 30 days.

7. Your Privacy Rights

All users

Regardless of where you are located, you have the right to:

• Access and update your data: View and edit your profile information at any time in the Settings screen.
• Delete your account: Permanently delete your account and all associated data directly from the Settings screen in the app, or by contacting us at privacy@ensemblelanguage.com. Deletion is irreversible and removes all your decks, cards, practice history, and account information.

EU and UK users (GDPR / UK GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, the General Data Protection Regulation (GDPR) or UK GDPR applies to our processing of your personal data. Our legal basis for processing your data is:

• Contract performance: Processing your email, name, and content is necessary to provide the Service you signed up for.
• Legitimate interests: Security monitoring and aggregate analytics to maintain and improve the Service.
• Consent: Optional features such as Google Sign-In and profile photos, which you can revoke at any time.

Under GDPR / UK GDPR, you have the right to:

• Access a copy of the personal data we hold about you
• Correct inaccurate personal data
• Request erasure of your personal data ("right to be forgotten")
• Restrict or object to certain processing (e.g., opting out of analytics)
• Data portability — receive your data in a structured, machine-readable format
• Lodge a complaint with your local supervisory authority (e.g., the ICO in the UK, or your EU Member State's data protection authority)

To exercise any of these rights, contact us at privacy@ensemblelanguage.com. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

Because your data is stored in the United States, international data transfers from the EEA/UK are covered by Standard Contractual Clauses (SCCs) or equivalent mechanisms as required by applicable law.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it for legal or compliance purposes (e.g., fraud prevention records).

Audio files generated by the text-to-speech feature are retained as long as the associated flashcard exists. Deleting a card removes its associated audio.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective date" at the top of this page. For significant changes, we will notify you by email or through a notice in the app before the change takes effect. Your continued use of the Service after the effective date constitutes your acceptance of the updated policy.

10. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: