Privacy Policy

1. Information we collect

Account information: your email address and a securely hashed version of your password (we never store your password in plain text). You may optionally tell us your preferred interface language.

Learning data: your course enrolments, lesson progress, quiz results, XP, streaks, achievements, and daily-challenge completions — the data needed to track and gamify your learning.

Technical data: standard server logs (such as IP address and request metadata) generated when you use the site, used for security, rate limiting, and debugging.

2. How we use your information

To create and secure your account, verify your email, and let you sign in and reset your password.

To deliver the learning experience — track progress, award XP and achievements, and personalise daily challenges.

To keep the service safe and reliable (rate limiting, abuse prevention, and diagnosing errors). We do not sell your personal data.

3. Cookies

We use a small number of strictly necessary cookies: a secure, httpOnly session cookie to keep you signed in, and preference cookies that remember your interface language and theme. We do not use advertising cookies.

4. Service providers

We rely on trusted third parties to operate the service: a managed PostgreSQL database (Neon) to store your data, an email provider (Resend) to send verification and password-reset emails, a rate-limiting service (Upstash), and hosting/infrastructure (Vercel). These providers process data on our behalf under their own security and privacy commitments.

5. Data retention & your rights

We keep your account data while your account is active. You can permanently delete your account at any time from Settings; deletion removes your account and associated learning data from our database. Verification and password-reset tokens expire automatically.

Depending on where you live, you may have rights to access, correct, export, or delete your personal data. To exercise these rights, contact us using the details below.

6. Children

BolEnglish is not directed to children under the age required by your local law to consent to online services without parental permission. If you believe a child has provided us personal data without appropriate consent, contact us and we will take appropriate steps.

7. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you.