Privacy Policy

This policy explains what personal data Contexto collects, why we collect it, who we share it with, and what rights you have over it. It covers the Contexto iOS app and the context-o.com website.

We have tried to write this in plain language. Where a term has a specific legal meaning under the UK GDPR and EU GDPR we have used it, but nothing here is meant to be harder to read than it needs to be.

1. Who we are

Contexto is operated by Nicolas Mosquera, trading as Contexto (“Contexto”, “we”, “us”).

We are the data controller for the personal data described in this policy. That means we decide what data is collected and why.

For anything about this policy or your data, contact us at nico@context-o.com.

We are not required to appoint a Data Protection Officer, so privacy requests go to the address above and are handled by us directly.

2. The short version

• We collect the account details you give us, and the learning data the app produces as you use it.
• We use it to run the service: to decide which words to show you, when to review them, and to track your progress.
• We do not run analytics, advertising, or tracking of any kind. There are no third-party analytics SDKs, no advertising identifiers, and no cross-app or cross-site tracking in the Contexto app.
• We do not sell or rent your personal data, ever.
• We do use third-party AI and speech providers to generate and assess language content. Section 6 explains exactly what reaches them.
• When you delete your account, your data is deleted immediately and permanently.

3. What we collect

3.1 Information you give us

3.2 Learning data

This is the bulk of what we hold, and it is what makes the app work. For each language you study we record:

• Which words and word senses you have encountered, collected, favourited, or grouped into collections.
• Spaced-repetition state for each card: review count, ease factor, review interval, learning phase, last review time, when the next review is due, and derived “mastery points”.
• Familiarity scores per word sense and per inflection, and which senses and inflections have been unlocked for you.
• Daily streak, longest streak, and the date of your last completed review session.
• Periodic progress snapshots of each unit, used to show progress over time.
• Whether you have seen a given vocabulary image, and whether you liked it.
• Your per-language display preferences (reading assistance, alternative script) and your chosen audio speaking rate.

3.3 Content you write or speak

• Written replies. In conversation-practice exercises you type a reply in the language you are studying. That reply, and the conversation it belongs to, are sent to our AI provider so it can be graded and corrected (see section 6).
• Voice. Speaking exercises use your device’s microphone, with your permission. Two separate things happen with that audio:
  • Transcription — turning your speech into text — is handled by Apple’s Speech framework. We ask iOS to recognise your speech on the device itself wherever your iPhone and the language you are studying support it, in which case the audio never leaves your phone. Where on-device recognition is unavailable — which depends on your device and the language — iOS sends the audio to Apple for processing instead.
  • Pronunciation scoring — how closely your pronunciation matches the target — is done by Microsoft Azure Speech Services, which the app contacts directly.
  In neither case does the audio pass through, or get stored on, our servers. We receive only the resulting text and scores. Microphone access is entirely optional and you can revoke it at any time in iOS Settings.
• Generated exercise content. The sentences, questions and model answers the AI generates for your cards are stored against your user account so that we can review the quality of generated content and reproduce problems you report.

3.4 Technical data

• Authentication tokens. Signing in issues a JSON Web Token, valid for 7 days, which your app stores and sends with each request. Password reset links contain a separate token valid for 30 minutes.
• Session cookie. During a study session we set a signed session cookie to hold temporary state. The website uses a session cookie for form security. These are strictly necessary cookies — see section 11.
• Server logs. Our web server and application record requests, errors and diagnostic output. These logs include IP addresses, request paths, timestamps, and — because the service is a language app — can include the words and sentences being processed for a request. Logs are used for debugging, security and abuse prevention, and are kept only as long as needed for those purposes.

We do not collect device identifiers, advertising IDs, location data, contacts, photos (beyond a profile picture you deliberately choose), or health data.

3.5 A note about profile pictures

If you upload a profile picture it is resized and stored on our server under a random, unguessable filename, and served over a public URL. It is not listed or searchable, but anyone who has the URL can view it. Please don’t upload anything you would not be comfortable being viewable by someone holding that link.

4. Where the data comes from

All of it comes from you or from your use of the app. We do not buy personal data, and we do not receive personal data about you from data brokers, social networks, or other third parties.

5. Why we use it, and our lawful basis

Under the UK GDPR and EU GDPR we must have a lawful basis for each use of your data.

5.1 To provide the service — performance of a contract

Creating and maintaining your account; authenticating you; selecting which words and sentences to show you; scheduling reviews; tracking streaks and progress; generating and speaking sentences; grading your practice replies; storing your collections and favourites; sending transactional email such as password resets.

5.2 To keep the service working and secure — legitimate interests

Diagnosing errors, monitoring performance, preventing abuse, and investigating problems you report. Our legitimate interest is in running a functioning, secure service; we balance it by keeping logs minimal and short-lived.

5.3 To improve the quality of the content — legitimate interests

We review generated sentences, exercises and images — including which vocabulary images users liked — to improve the material the app produces. Our legitimate interest is in the app teaching correct, useful language. When you report a problem with a card, the report we receive includes your username and the content involved, so we can find and fix it.

We are also notified by email when a new account is created and when certain content pipelines fail, which is how a small service keeps track of its own health. These notifications can include your username and email address.

5.4 To send optional email — consent

If you opt in, we may send occasional product updates about Contexto. We are not currently sending these, but the setting exists and we will honour it if we do. You can withdraw consent at any time, in the app or by replying to any such email, and withdrawing it does not affect anything else about your account. Transactional email (password resets, essential account notices) is not optional and is covered by 5.1.

5.5 What we do not do

We do not profile you for advertising, we do not make automated decisions that produce legal or similarly significant effects about you, and we do not use your data for any purpose unrelated to teaching you a language.

6. AI processing, and who receives your content

Contexto generates its teaching material with third-party AI services. This is central to how the app works, so it deserves to be spelled out.

6.1 What is sent

6.2 What is not sent

We do not send your name, username, email address, or account identifier to any AI provider. The content they receive is not labelled with who you are.

6.3 Training

We do not use your data to train AI models, and we do not permit our providers to use it to train theirs. We use these services through their commercial APIs, whose terms — as they stand at the date of this policy — do not use content submitted via the API to train or improve their models. Providers may retain content briefly for abuse monitoring under their own policies.

6.4 Other recipients

We may also disclose data where we are legally required to, or where necessary to establish, exercise or defend legal claims. If Contexto is ever sold or transferred, your data may transfer with it, and we will tell you before that happens.

All of the above act as our processors — they handle data on our instructions and are bound by contract to do so. We do not sell your personal data, and we do not share it for advertising or cross-context behavioural advertising.

7. International transfers

Our servers are located in London, United Kingdom, so your account and learning data is stored in the UK.

Some of the providers listed in section 6 process data outside the UK and EEA, principally in the United States. Where that happens, transfers are made under safeguards recognised by UK and EU law — typically the European Commission’s Standard Contractual Clauses (with the UK International Data Transfer Addendum where applicable), and, for providers that are certified, the EU–US and UK–US Data Privacy Framework.

You can ask us for more detail about the safeguards applying to a specific provider.

8. How long we keep it

Because deletion is immediate and irreversible, please export or note anything you want to keep before deleting your account.

9. How we protect it

• Passwords are hashed with bcrypt. We cannot see or recover your password.
• All traffic between the app and our servers is encrypted with TLS.
• API access requires a signed, expiring token.
• Password reset emails never reveal whether an address has an account, to prevent account enumeration.
• Access to the production server and database is limited to the operator of the service.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where the risk is high, notify you directly.

10. Your rights

If you are in the UK or the EEA, you have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — have inaccurate data corrected. Your username and email are editable in the app.
• Erasure — have your data deleted. You can do this yourself at any time from your account settings, and it takes effect immediately.
• Restriction — ask us to limit how we use your data while a concern is resolved.
• Portability — receive your data in a structured, machine-readable format, or have it sent to another controller.
• Object — object to processing we carry out on the basis of legitimate interests (sections 5.2 and 5.3), on grounds relating to your particular situation.
• Withdraw consent — for anything we do on the basis of consent, such as optional email or microphone access, at any time.

To exercise any of these, email nico@context-o.com. We will respond within one month. There is no charge, and we will not ask you for more information than we need to identify your account.

If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner’s Office (ico.org.uk, helpline 0303 123 1113) or to the supervisory authority in your EU member state. We would appreciate the chance to put it right first.

10.1 If you are a US resident

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. Depending on your state, you may have rights to know, delete, correct, and to appeal a refusal of any of these. Use the same contact address above, and we will not discriminate against you for exercising them.

11. Cookies and similar technologies

The app does not use advertising or tracking cookies, and contains no third-party tracking SDKs.

We use only strictly necessary cookies:

• A signed session cookie during a study session, holding temporary state such as which cards you reviewed and which voices were selected.
• A session cookie on the website supporting form security (CSRF protection).

Strictly necessary cookies do not require consent under the UK Privacy and Electronic Communications Regulations, and we do not set any others.

12. Children

Contexto is not intended for children under 13, and we do not knowingly collect personal data from them. In some EU member states the minimum age for consenting to online services is higher than 13 — up to 16 — and in those countries a parent or guardian must consent on the child’s behalf.

If you believe a child has given us personal data, email nico@context-o.com and we will delete the account.

13. Changes to this policy

If we change this policy we will update the date at the top and publish the new version at context-o.com/privacy. If a change materially affects how we use your data, we will tell you in the app or by email before it takes effect.

14. Contact

Nico Mosquera, trading as Contexto
nico@context-o.com