Privacy Policy

Last updated: October 2026

This Privacy Policy explains how iLexiBox (“Service”), operated by LexiTeam (“we”, “us”, “our”), collects, uses, and protects your personal information when you use our Service at ilexibox.com.

1. Information We Collect

We collect the following information when you use iLexiBox:

• Email address (when you register or sign in with Google or Apple)
• Usage data (number of times you use each section)
• Visit statistics — pages viewed, time spent and tools used (see below)
• History of generated texts and translations (stored to show in your sidebar)
• Subscription status and purchase information (in-app purchases are processed by the Apple App Store or Google Play; subscriptions are managed via RevenueCat)
• Voice input, when you use a speaking, pronunciation, or dictation feature — processed and discarded, never stored (see section 4)
• Pictures you scan, when you use the camera button on a text box — or paste a picture into one — to read text from a page — processed and discarded, never stored (see section 4)

Visit statistics. When you open iLexiBox — with or without an account — we record the visit: the date and time, the pages you open and how long each one is active on your screen, which tools you use (the tool’s name only — never what you type, say or translate), your approximate location (country, region and city, worked out from the network by our hosting provider; we do not store your IP address), the type of device, operating system, browser and screen size, your language settings and time zone, and the website that sent you, if any.

By default this is anonymous: each visit gets a random identifier that exists only while the browser tab is open, so visits cannot be linked to each other or to you. If you choose Allow on the “Help improve iLexiBox?” card, or switch on Usage statistics (Me) or Account → Data & privacy, we also keep a random identifier on your device so that your visits can be linked over time and, when you are signed in, linked to your account — including the visits you made on that device before you signed up. You can withdraw at any time; the identifier is then removed from your device and new visits are anonymous again.

2. How We Use Your Information

We use your information to:

• Provide and improve the iLexiBox service
• Manage your account and subscription
• Send transactional emails (account confirmation, password reset)
• Track free trial usage to enforce limits fairly
• Understand how the Service is used — which pages and tools help learners — so we can improve it (visit statistics)

3. Third-Party Services

iLexiBox uses the following third-party services:

• Supabase — database and authentication (EU region)
• Google Gemini API — AI text generation and translation, and reading text out of a picture you scan
• Microsoft Azure Speech — speech recognition and speech synthesis, for pronunciation scoring, dictation, and read-aloud
• Vercel — website hosting
• RevenueCat — subscription management (purchases are processed by the Apple App Store or Google Play, which act as merchant of record)
• Google OAuth — optional sign-in with Google
• Sign in with Apple — optional sign-in with your Apple ID

Each of these providers has their own privacy policy. Text you submit for translation or game play is sent to Google Gemini for processing and is not permanently stored by Google for model training under our API agreement.

iLexiBox uses third-party AI services — Google Gemini for lesson generation and feedback, and Microsoft Azure for text-to-speech and pronunciation scoring — to power language practice features. When you use these features, the text or audio you submit is sent to these providers for processing. We do not send your name, email, or payment information to these services.

4. Data Retention

We retain your account data for as long as your account is active. History items (generated texts, translations) are retained until you delete them or close your account. Detailed visit statistics are kept for 90 days and then reduced to anonymous daily totals.

Your voice recordings are transient. When you use pronunciation practice, dictation, or spoken conversation, the audio captured by your microphone is sent to Microsoft Azure Speech, held only for as long as it takes to recognise or score it, and discarded once the result comes back. We never store your recordings — not in our database, and not in file storage. Only the resulting text, and any pronunciation score, is saved to your account, where you can read and delete it like any other history item.

Pictures you scan are transient. When you use the camera button on a text box to read text from a page, or paste a picture into that box, the picture is sent to Google Gemini, held only for as long as it takes to read the text out of it, and discarded once the text comes back. We never store the picture — not in our database, and not in file storage. Only the text it produced goes into the box you were typing in, where it is yours to edit, use or delete like anything else you type.

Read-aloud audio is cached, and is not a recording of you. The speech you hear from the read-aloud feature is synthesised from the text being read. We cache that generated audio so the same phrase does not have to be synthesised twice. The cache is addressed by the text it was generated from and carries no account identifier, so it is not linked to you.

When you delete your account, we erase your rows from every table that holds your data — history; usage and subscription record; saved words; challenges; level progress; language goals; learning events; notes; stage progress; beginner review data; and visit statistics linked to your account — in a single database transaction, and your login record is removed immediately afterwards. There is no grace period and no soft-deleted copy. We keep service-cost telemetry (timestamps, model token counts, and audio duration) recorded against an internal identifier which, once your account is deleted, no longer resolves to any person.

5. Your Rights (GDPR)

If you are in the EEA, you have the right to access, correct, or delete your personal data, to receive a copy of it in a portable format, and to object to processing. You can exercise these rights yourself, in the app, without waiting on us:

• Get a copy of your data — on the web, Account → Data & privacy → Download my data gives you everything stored on your account as a single JSON file, immediately. In-app download is not available in the mobile app yet; until it is, email us and we will prepare your export for you.
• Delete your data — Settings → Account → Delete my account permanently erases your account and everything listed in section 4. (how deleting works)
• Object to analytics — Me → Usage statistics or Account → Data & privacy turns linked usage statistics off. It is off unless you switch it on. Anonymous visit records cannot be linked to you.

If you cannot sign in, or you would prefer that we handled it for you, contact us at support.ilexibox@gmail.com.

6. Cookies

iLexiBox uses session cookies required for authentication. If you allow usage statistics, we also keep a random identifier in your browser’s local storage to link your visits; it is never shared with anyone else and is removed when you withdraw. We keep your choice itself on the device so we don’t ask again. We do not use advertising or third-party tracking cookies.

7. Security

We implement industry-standard security measures. Authentication is handled by Supabase, which uses encryption and secure token management. Passwords are never stored in plain text.

8. Children's Privacy

iLexiBox is not directed at children under 13. We do not knowingly collect personal information from children under 13.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes via email or a notice on the website.

10. Contact

Questions about this policy? Contact us at support.ilexibox@gmail.com.