Privacy Policy

1. Information We Collect

• Account information: Your email address, display name and avatar, provided when You register or sign in with Google or Microsoft.
• Authentication data: A salted hash of Your password (if You use one), an encrypted TOTP secret if You enable two-factor authentication, and hashed session/refresh tokens.
• API Key metadata: The name, a display prefix, creation and last-used timestamps of each key. We store only a SHA-256 hash of the key itself.
• Usage records: For each successful translation request: the key used, engine, source and target language codes, character count, latency and timestamp. We do not store the text You submit or the translation returned, other than in a short-lived cache (see section 4).
• Subscription data: Your Plan, billing period and overage preference.

2. How We Use Your Information

• To authenticate You and secure Your account.
• To authorise, meter and bill API requests against Your Plan.
• To enforce rate limits and detect abuse.
• To show You usage on Your dashboard and, where applicable, to invoice overage.
• To send transactional email (verification, password reset).

3. Third-Party Processors

• LibreTranslate (all Plans): text is sent to Our self-hosted instance for translation. No third party receives it.
• DeepL (paid Plans, when requested): text is sent to DeepL for translation under DeepL's Privacy Policy.
• Google / Microsoft: identity providers, used only when You choose to sign in with them.
• Resend: transactional email delivery.
• Vercel, Railway: hosting for the website, API, database cache and translation engine.

4. Data Retention

• Translation cache: a hash-keyed copy of recent translations is kept for up to 24 hours so repeated requests are served faster. The cache key is a hash; the cached value is the translated text.
• Usage records are retained for 13 months to support billing disputes, then deleted automatically.
• Expired authentication tokens are purged daily.
• Account, keys and subscription data are retained until You delete Your account.

5. Data Security

Secrets at rest (OAuth tokens, TOTP secrets, signing keys) are encrypted with AES-256-GCM. Passwords are hashed with Argon2. API keys and session tokens are stored only as hashes. All connections use TLS. No method of storage or transmission is completely secure, and We cannot guarantee absolute security.

6. Your Rights

• Access: export everything We store about You from the Account page.
• Deletion: permanently delete Your account and all associated data from the same page. Keys are revoked immediately.
• Rectification: update Your profile through Your identity provider or by contacting Us.

These rights apply to all Users, including those protected under the GDPR, the CCPA and similar legislation.

7. Children's Privacy

The Service is not intended for Users under 16. We do not knowingly collect personal data from children. If You believe We have done so, contact Us and We will delete it promptly.

8. Contact

Privacy questions can be sent to privacy@lingua-api.com.