Privacy policy

Who we are

Lalea is operated by Artem Eremenko. Questions about your data: hello@lalea.app.

What we collect and why

• Your sign-in. With email: your address and a one-time code (we keep only a protected fingerprint of the code, for 10 minutes). With Google: your email address and Google account number - we do not keep Google tokens. With Plex: your Plex username and the access token Plex gives us. With Jellyfin or Emby: your server address, your username there and the access key your server returns; your password goes once to your own server and is never stored. Used to sign you in and to reach your server.
• Your library. To show your films, "Continue watching" and what you have seen, we copy from your server the list of titles in your library (names, descriptions, tracks, file paths on your server) and your watch state and recent watch history there. It is refreshed when you sign in and every few hours.
• Your learning. The words you save with their scene (the line, its translation, the film title and the moment), word statuses, notes and your own translations, your review schedule, streak, goals and badges, and your language settings.
• Lines prepared for you. AI translations of subtitles, text recognised from speech and your corrections are saved for your account only and reused only for you.
• Limits and plan. Which films you translated this month, daily and monthly counters for AI explanations, pictures, speech recognition and voice, and the dates of your trial or paid plan.
• Activity. The days you used Lalea, the time of your last visit and simple counts of actions (signed in, opened a film, saved a word, practised). Used to keep the service working and to see whether it helps. Kept for up to 400 days.
• Ideas and problem reports. What you write on the idea board and your votes. A problem report can include the page address, interface language, language you learn, browser and screen size, so we can find the problem.
• Video. Video plays from your own server to your browser. When your browser cannot reach your server directly, the stream passes through our server without being stored. For speech recognition (Pro), our server reads the soundtrack from your server and recognises it on our own servers. Video files you open from your computer are played by your browser and never sent to us.
• Listening mode. Your phone's microphone is used by your browser's built-in speech recognition (Google in Chrome, Apple in Safari, under their own policies). Lalea receives only the recognised words needed to find the place in the subtitles and does not store them.

Server logs. Our relay server keeps standard access logs - IP address, time, the address requested and browser - for 14 days, for security and troubleshooting, then deletes them. The service itself does not log the pages you request; it holds IP addresses in memory only, for a short time, to limit abuse of sign-in codes.

Who else processes data

• AI providers. Text is sent through OpenRouter to AI models: subtitle lines and the film title to translate them, a word with its sentence to explain it, words to write their dictionary entries and pictures, the title and file name of a film from your server to recognise which film it is, titles and descriptions of films to translate the film page, and the text of ideas to translate them for other users. We request providers that do not retain or train on this data. We do not attach your name, email or account to these requests; text you write yourself, such as an idea, is sent as written.
• Resend delivers our emails - sign-in codes and the welcome message - from send.lalea.app; it receives your email address and the message.
• Google. Sign-in with Google happens on Google's pages. For Pro, words and short phrases (up to 240 characters) are read aloud by Google Cloud Text-to-Speech - only the text is sent.
• Plex Inc. Plex sign-in happens on plex.tv under Plex's own privacy policy; film details come from Plex's metadata service.
• Wikidata - to find links to other film sites by a film's public ID. Nothing about you is sent.
• Cloudflare - our domain is registered there, and the video player loads one open-source library from cdnjs.cloudflare.com, which sees your IP address and browser like any website.
• Hosting. The service and the data above live on servers we operate; connections reach them through our relay server in the Netherlands.

We do not sell data, show ads or use third-party analytics or tracking.

Outside the European Economic Area. Our servers and some of the providers above are located outside the European Economic Area. Your data is transferred there because it is necessary to provide the service you sign up for.

Why we use your data

• To provide the service you signed up for - sign-in, your library, words, review, translations, limits and plan. Without this data Lalea cannot work for you; you can always delete it.
• Our legitimate interest in keeping Lalea secure and working and in seeing whether it helps - server logs, activity counts, problem reports, and stopping abuse of free limits.
• Your choice - ideas and votes you post, and anything you send us.

The browser extension

This section applies when you install the Lalea extension. It colours words on the pages you visit by your level, right in your browser. It sends to Lalea only what is needed for what you ask: the word you tap and its sentence, the text you select and ask about, the words of a page you mark up, the full page text when you ask how hard a page is, and the subtitles of a video where you turn Lalea on. On ChatGPT, Claude and Gemini it colours words of the conversation in your browser; the conversation itself is not sent to us, only the words you tap. It keeps your settings and your word list in the browser's extension storage. It has no analytics.

Cookies and local storage

One cookie keeps you signed in (until 6 months after your last visit, at most a year after you sign in, or until you sign out). A second, short cookie exists only for the 10 minutes of a sign-in with Google. Your browser also remembers small preferences on your device: site language, languages you learn, theme, filters and the last tab you used. Nothing else.

How long we keep data and how to delete it

Your data is kept until you delete it. On the Account page, "Delete my data" removes your account, sign-ins and server connections, your library copy and watch history, your words, statuses, review and progress, the lines prepared for you and your activity record. What remains:

• a one-way fingerprint of your email address and the dates of your trial or paid plan, so a new account with the same email does not get a second free trial;
• ideas, votes and problem reports you sent, and your marks that subtitles do not match a film - write to us and we will remove them;
• a short internal note that a new account signed up, used to tell us about new users;
• records of emails we sent you, kept by our email provider for its own limited period;
• daily and monthly counters, which expire on their own within a month;
• shared material that contains nothing about you: dictionary entries, pictures and voice recordings of words;
• server logs, until they are deleted after 14 days.

Signing out removes the session from this device. You can also revoke Lalea's access in your Plex account settings under "Authorized Devices", or in Jellyfin and Emby under Dashboard, Devices.

Your rights

You can see what we keep about you on the Account page, export your words as a CSV file, and delete your data there. Write to hello@lalea.app to get a full copy of your data or a copy in a machine-readable form, correct something, limit or object to a use of your data, or ask a question. If you live in the European Union or the United Kingdom, you can also complain to your data protection authority. Lalea is not meant for children under 16.

Changes

If this policy changes in a way that matters, we will say so on this page and update the date above.