Privacy

Last updated 14 September 2026. This describes what the app actually does; check it still matches what you are running before publishing it.

The short version

Everything Lunosia knows about you — your progress, your words, your mistakes — is stored in your own browser and is never sent anywhere. There is no account and no server-side copy of any of it.

The one thing that does leave your device is the conversation itself. On this site the conversation partner runs on Cloudflare's Workers AI, so what you say to it is sent there to be answered. That is the default here, because it is the only partner that works on a phone. You can switch it off in Settings — the built-in partner runs entirely in the page. Both are described under The conversation partner below.

What is stored, and where

Lunosia keeps all of this in your browser's localStorage, on the device you are using. There is no account, no server-side profile, and no copy held anywhere else:

• the name and level you entered
• your progress: XP, streak, which of the 60 days you have done
• your vocabulary deck and its review schedule, including words you added yourself
• your mistake journal — corrections you have been given
• which reading passages you have read and which listening clips you have heard
• your writing tasks and the drafts you wrote for them
• your pronunciation scores and which grammar lessons you have finished
• notes your conversation partner wrote about you, so it remembers you between sessions
• your settings, including any API key you enter

Clearing your browser's site data for this domain erases all of it permanently. There is no backup. Settings → Export writes it to a file you control if you want one.

Speech

Speaking: Chrome and Edge perform speech recognition on Google's servers, not on your device. When you use the microphone, the audio is sent to Google by the browser itself. This is how the Web Speech API works in those browsers and Lunosia cannot change it. If that is not acceptable to you, type instead — everything works by typing.

Listening: speech is generated locally where the neural voice is installed, and by your operating system's own voices otherwise. Nothing is uploaded to produce it.

The dictionary

The 31,000-word dictionary is a file served from this site and stored in your browser's cache. Looking a word up, working out what form it is in, and every number on the word bank screen happen entirely on your device. Nothing you look up is sent anywhere, and nobody — including whoever runs this site — can see which words you searched for.

It is built from en.wiktionary.org and from the OpenSubtitles frequency lists published as hermitdave/FrequencyWords, both under Creative Commons Attribution-ShareAlike. The built file carries the same licence.

The conversation partner

• Built-in (scripted): runs entirely in the page. Nothing leaves the device.
• Ollama: runs on a machine you control. Nothing leaves that machine.
• This site: this one sends data off your device. It is the default on the public site, because it is the only partner that works on a phone. What you type and what the microphone transcribed is sent to Cloudflare's Workers AI — over this site's own address, not to a third-party API you signed up for — along with the scenario and the recent turns of the conversation, and a reply comes back. Cloudflare's own privacy terms apply to that processing. Nothing is stored on the server: there is no account, no conversation history kept off your device, and no key to leak. Switch to Built-in or Ollama if you would rather nothing left the device at all.
• Gemini: this one sends data off your device. If you switch it on, what you type and what the microphone transcribed is sent to Google to generate a reply, along with the scenario and recent turns. Google's own privacy policy applies to that. Your API key is stored in your browser and sent only to Google.

Advertising

Every page of this site loads Google AdSense. That script is Google's, it runs in your browser, and it can set cookies and read device identifiers to select and measure advertising — including on pages where no advert is shown, because the same script does the measuring.

What it cannot do is see anything Lunosia knows about you. Your progress, your words, your mistakes and your conversations are held in your browser's own storage, which a script from another origin has no access to. Nothing on this site passes any of it to Google, and no advert is targeted using it.

Google's use of advertising cookies is described in their advertising policies, and you can turn off personalised advertising at My Ad Center. A content blocker will stop the script loading at all, and nothing on this site breaks if you use one — the app does not check, and would still work offline with the network gone entirely.

If you are in the EU or the UK, a consent notice appears before any advertising cookie is set, and your answer is respected.

Analytics

None. There is no analytics script, no telemetry and no error reporting, and Lunosia itself makes no request on its own beyond fetching its own files and, if you are using the hosted partner, sending your turn of the conversation. The advertising script described above is the one thing on these pages that talks to anyone else, and it is Google's rather than this site's.

Children

This is a study tool with no accounts and no social features, and it collects nothing that identifies anyone. The advertising described above is subject to Google's own policies on ad serving, including those on advertising to children.

Contact

Questions about this policy, or about anything the site does with your data, go to [email protected].