Lexis Privacy Policy

Lexis turns photos into language-learning material. This policy explains what the app processes and why.

Information we process

When you create an account, our authentication provider Supabase processes your email address, user identifier, encrypted authentication credentials, and security metadata. Passwords are not visible to Lexis.

Supabase and Resend process your email address and delivery metadata when Lexis sends confirmation, invitation, or account-recovery email. Cloudflare Turnstile processes network, device, and interaction signals needed to detect automated abuse.

Photos you choose, requested languages, and existing vocabulary needed to avoid duplicates are sent through an authenticated Lexis server to configured AI providers to generate words and descriptions. Lexis does not store photo or prompt contents on its servers. AI routes are configured to require zero-data-retention endpoints and disable fallback to retaining endpoints.

Your photos, vocabulary, review history, preferences, and downloaded pronunciation audio are stored in the app's private storage on your device. Lexis servers keep account entitlements and limited AI-usage records such as operation, provider, status, request identifier, and time—not prompts, photos, or generated responses.

If you voluntarily report AI content, Lexis stores the selected generated-text excerpt, report category, your user identifier, model, prompt version, time, and service-only review status or notes so the report can be handled. Your photo is not included.

How information is used

We use information to authenticate you, provide vocabulary generation and pronunciation, enforce service limits, prevent abuse, troubleshoot failures, and review reports you submit. We do not sell personal information or use your photos for advertising.

Sharing

Data is shared only with service providers needed to operate Lexis: Supabase for authentication and backend functions; Resend for transactional authentication email; Cloudflare for the policy and account-deletion site, bot protection, and support-email routing; Google for the monitored support inbox; and the selected AI inference providers routed through OpenRouter. Their processing is limited by their service terms and our configuration.

Retention and deletion

On-device content remains until you delete it, clear app data, uninstall Lexis, or delete your account. Account, entitlement, usage, and submitted-report records remain while your account exists and are removed when the account is deleted, except records we must retain for security or legal obligations.

You can permanently delete your account and the current device's local learning data in Lexis under Settings → Account → Delete account. If you no longer have the app, the authenticated web form deletes the account and associated server records. Any device-only data left on an installed device can be removed by clearing Lexis storage or uninstalling the app.

Security and children

Lexis uses encrypted HTTPS connections, short-lived user sessions, row-level database controls, private Android storage, and server-side secrets. No service is perfectly secure. Lexis is not directed to children under 13.

Contact

For privacy questions, use the private contact method listed on the support page. Never post account details or private content in a public issue.