Lemix Privacy Policy

Who runs Lemix

Lemix is run by Soroush Ghezeli, a private individual based in Türkiye. In this policy “we” and “us” mean the person who runs Lemix. We decide how your data is used, so we are the data controller.

Contact for anything about your data: privacy@lemix.app. For help with the app: support@lemix.app.

The short version

• You sign in with your email address and a one time code. There is no password.
• We store your cards and your review history so the app can schedule your reviews.
• When you look up a word or paste a sentence, the text is sent through an AI routing service to AI companies to produce the answer. Your email and your account are not sent with it.
• A word you look up that Lemix does not have yet can become a dictionary entry that everyone using Lemix can see. Do not type personal information into the search.
• We use analytics and crash reports to improve the app.
• We do not sell your data and we show no ads.
• You can ask us for a copy of your data, or to delete it, by writing to privacy@lemix.app.

What we collect and why

What	Why	Legal basis
Your email address and a random account number	To send you a one time sign in code and to connect your data to your account	Needed to provide the service you asked for
Your learning data: the languages you learn, the words you add, words you mark as known, your collections, your votes for upcoming languages, your cards, each review (your rating, when you answered, how long you took), and your device time zone	To show your cards and schedule your reviews at the start of your day	Needed to provide the service
What you type into the search, and sentences you paste to translate	To look up the word or translate the sentence (see What you type into the search)	Needed to provide the service
Sign in records: the most recent IP address and the device and browser type of each signed in session	To keep your account secure	Our legitimate interest in security
Usage analytics: which screens and actions you use, your account number, your IP address, your device model, operating system, app version, language and time zone, and the optional note you write when you rate a card	To understand how the app is used and to improve it	Our legitimate interest in improving the app
Crash reports and update checks: the error, your device model, operating system and app version, and an installation number. Update checks also send your IP address and, after a crash, part of the crash log. Crash reports do not include your account number or your IP address, and the words you type are removed from them	To find and fix crashes and to deliver app updates	Our legitimate interest in a working app
Server records: your account number, the request, its result and how long it took, and the cost of each AI request	To keep the service running, find errors, and track costs	Our legitimate interest in running the service
Website visits: your IP address and browser details when you open lemix.app, and the visit counts described in The lemix.app website	To deliver the website and to count its visitors	Our legitimate interest in running the website
Emails you send us	To answer you	Our legitimate interest in answering you

You need to give your email address to use Lemix: without it we cannot create your account or sign you in. Everything else in this table is collected as you use the app.

What you type into the search

Lemix builds its dictionary itself. When you look up a word Lemix does not have yet, Lemix may create an entry for it, and that entry is then available to everyone who uses Lemix, including an example sentence and a spoken recording at a public web address.

So do not type personal information, such as names, email addresses or phone numbers, into the search. Once something has become a dictionary entry, other users can see it. If a dictionary entry contains information about a person, tell us at support@lemix.app and we will fix or remove it.

Words that Lemix checks but does not add are kept in a log that has no link to your account. Lemix also remembers recent answers, keyed by the word itself, so the next person who looks up the same word gets the answer faster.

Sentences you paste to translate are sent through the AI routing service to an AI company for the translation and are not stored on our servers. The app keeps your recent lookups, pastes included, on your phone for 7 days.

AI in Lemix

The meanings, example sentences, translations and word breakdowns in Lemix are written by AI, and the spoken recordings use a synthetic voice. They can contain mistakes. Your review schedule is not decided by AI: it is calculated by a fixed algorithm from your own ratings.

To produce this content, the words you look up and the sentences you paste are sent through an AI routing service to AI companies. Your email address, your account number and your other data are not sent with them. The routing service does not store the text. The AI companies keep it for up to 30 days to check for misuse, and for longer if it is flagged as misuse, and may process it in the United States.

Who receives your data

We use service providers to run Lemix. They process data on our behalf, except where we say otherwise.

Type of provider	What it receives	Where
Hosting, database and backups	Everything in your account, your requests to the app (including the words you look up), and an encrypted copy of the database	EU
AI and speech services	The words you look up and the sentences you paste, through an AI routing service, never with your account details. The speech services receive only dictionary text, to create the recordings	United States, EU and global
Email	Your email address and your sign in code, to send the code. Emails you send us, which arrive in a Google mailbox that Google handles under its own terms	EU and United States
Analytics and crash reporting	The usage analytics and crash reports listed above	EU
App delivery	The update checks listed above, and your IP address and device type when the app plays a recording	United States and global
Website hosting and visit counts	Your IP address and browser details when you open lemix.app, and the visit counts	United States and global
Development and operations	Our nightly backups while they are made (encrypted before they are stored), automated quality checks on dictionary words by AI models (including one hosted by Alibaba Cloud), and results of database queries we make while fixing problems	United States and other countries

Ask us and we will tell you the name of each provider.

Providers in the United States, and providers that process data there, receive your data outside the EU, the UK and Türkiye. Some of them are certified under the EU-US Data Privacy Framework or include the EU standard contractual clauses in their terms, and others do not. Ask us and we will tell you which safeguard, if any, applies to each provider.

We do not sell your data, and we do not share it with advertisers. We disclose data to authorities only when the law requires it.

How long we keep it

Data	How long
Your account and learning data, except your votes for upcoming languages	Until you delete your account
Sign in records (IP address, device type)	Until you sign out or delete your account
Usage analytics	Until you delete your account or ask us to delete it
Logs and records at our providers	Database platform logs: up to 7 days. Crash reports: 30 days. Words sent to AI companies: up to 30 days, longer if flagged as misuse. Server logs: shown to us for up to 30 days, and kept by our hosting provider under its own policy. Automated quality check logs: up to 90 days. Email and update-check logs: under each provider’s policy. Website visit counts: in detail for 7 days, then as a summary for up to 6 months. Website requests: kept by our hosting provider under its own policy.
Server records of usage, performance and cost, and your votes for upcoming languages	Kept, under a random number. Once your account and the backups that hold it are gone, this number no longer connects to you
Dictionary entries, words Lemix checked but did not add, and remembered answers	Kept, without any link to you
Backups	A new backup is made each night; the 14 most recent successful backups are kept
Emails you send us	As long as needed to answer you. A record that we handled a privacy request is kept for 3 years

Deleting your account

To delete your account, email privacy@lemix.app from the email address you sign in with. We delete your account within 30 days and confirm by email. See lemix.app/delete-account for what is deleted and what is kept.

Your rights

You can ask us to:

• tell you what data we hold about you and send you a copy (a JSON file with your email address, the words you added and your review history);
• correct data that is wrong;
• delete your data;
• stop using your data for analytics, or restrict how we use it;
• tell you the names of the providers who receive your data.

Write to privacy@lemix.app from the email address of your account, so we know the request comes from you. We answer within 30 days, free of charge.

Lemix makes no decision about you by automated means that has a legal or similarly significant effect on you.

If you are unhappy with how we handle your data, please write to privacy@lemix.app first so we can put it right. You also have the right to complain to a data protection authority: in the EU, the authority in your country (listed at edpb.europa.eu); in the UK, the Information Commissioner’s Office; in Türkiye, the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu). UK users can also complain to us first, and we acknowledge the complaint within 30 days.

Data stored on your phone

The app stores on your phone: your sign in session, your recent lookups and pastes (for 7 days), your settings, the ratings and notes you gave on cards, your recent activity, and the deck you last used. The analytics, crash reporting and update services each store an installation number on your phone.

Crash reports and update checks are needed to keep the app working and to deliver fixes, so they run for everyone. In the UK, they rely on the exemption for storage used to fix technical faults and keep the device secure.

Signing out removes your session. Uninstalling the app removes what it stored on your phone, unless your phone’s own backup saved a copy.

The lemix.app website

The lemix.app website, including this policy, is served by Cloudflare. When you open a page, Cloudflare receives your IP address and your browser’s details, as any website host does, to deliver the page to you.

We count visits to the website with Cloudflare Web Analytics. It sets no cookies and stores nothing on your device, and Cloudflare does not use your IP address or browser details to identify you or follow you across websites. It tells us how many times each page is opened, which website linked to it, and each visitor’s country, browser, operating system and type of device. Cloudflare keeps the detailed records for 7 days and a summary for up to 6 months.

The website has no accounts and no forms, so it collects nothing you type. If you email us from the website, your email is handled like any other email to us.

How we protect your data

• All connections between the app and our services are encrypted.
• Each account can only read its own data; other users can see only the shared dictionary.
• Sign in uses one time codes, so there is no password to steal.
• Backups are encrypted.
• Crash reports have the words you type removed before they are sent.

Age limit

Lemix is for people aged 18 and over. It is not directed at children. If we learn that an account belongs to someone under 18, we delete it.

Changes to this policy

When this policy changes, we update the date at the top. If a change affects how we use your data in a significant way, we tell you in the app or by email before it applies.

Information notice for users in Türkiye (KVKK)

This notice is given under Article 10 of the Personal Data Protection Law No. 6698 (KVKK).

Data controller: Soroush Ghezeli, Türkiye. Contact: privacy@lemix.app.

How data is collected: automatically, through the Lemix app and our services when you use them, and by email when you write to us.

What we process, why, and on what ground:

Data	Purpose	Ground (KVKK Article 5(2))
Email address, account number	Creating your account and signing you in	(c) necessary for the performance of a contract
Learning data, time zone, search text and pastes	Providing the app	(c) necessary for the performance of a contract
Sign in records	Keeping your account secure	(f) our legitimate interest
Usage analytics	Improving the app	(f) our legitimate interest
Crash reports, update checks, server records	Keeping the app working, fixing errors, tracking costs	(f) our legitimate interest
Website visits	Delivering the website and counting its visitors	(f) our legitimate interest
Emails you send us	Answering you	(f) our legitimate interest

Who receives it and why: each type of provider in Who receives your data receives only the data listed there, for the reason given there: to store your account, to run the app, to produce dictionary content, to send your sign in code, to receive your emails, to measure use, to report crashes, to deliver updates, to back up the database, to check dictionary quality, and to serve the website and count its visits. All of these providers are outside Türkiye, in the EU, the United States and other countries, so your data is transferred abroad.

Your rights under Article 11 of the KVKK: to learn whether your data is processed and request information about it, to learn the purpose and whether it is used for that purpose, to know who receives it in Türkiye or abroad, to have it corrected or deleted and to have those recipients told, to object to a result arising solely from automated processing, and to claim compensation for unlawful processing. Send requests to privacy@lemix.app from the email address of your account. You can write your request in Turkish. We answer within 30 days, free of charge. If you are not satisfied with our answer, you can complain to the Personal Data Protection Board within 30 days of it.