LexiNovaPrivacy Policy
Last updated: June 2026
📋 Introduction
LexiNova ("we", "us") operates the web application available at lexinova.fun. This page explains what personal data we collect, why we collect it, and what rights you have.
By using LexiNova you agree to these terms. If you do not agree, please do not use the application.
👤 Data controller
The controller of personal data under the GDPR (Art. 13) is:
- Miloš Lipničan — individual (natural person)
- Country: Slovakia
- Contact: lipnicanmilos@gmail.com
📦 What data we collect
| Data | Source | Purpose |
|---|---|---|
| Email address | Registration / Google OAuth | Account identification, login |
| Name | Registration / Google OAuth | Interface personalisation |
| Profile picture | Google OAuth (URL) | Displayed in profile |
| Words & categories | Created by user | Core application functionality |
| Test results | In-app testing | Progress tracking, knowledge levels |
| Dark mode preference | Settings | Saving display preference |
🔧 How we use your data
- Providing and operating the LexiNova service
- Login and account management
- Tracking your vocabulary learning progress
- Sending a welcome email upon registration
- Improving application performance and stability
We do not sell your data to third parties and do not use it for advertising purposes.
☁️ Where data is stored
- Database: Supabase (PostgreSQL) — EU/US servers
- Application: Google Cloud Run — region us-central1 (Iowa, USA)
- Local storage: Browser (localStorage) — offline cache, preferences
Transfers of data outside the EU comply with GDPR (standard contractual clauses).
🔗 Third parties
- Google OAuth — optional login via Google account. When used, Google processes your data per the Google Privacy Policy.
- AI providers — when you use the AI category creation features, only the content you supply yourself and the selected languages are sent to the provider you choose. Depending on the feature this is:
- AI from a topic — the text you enter (topic/prompt);
- AI from a photo — the image you upload (photo or screenshot);
- AI from a video — only the link (URL) to a public YouTube video. We neither download nor store the video; Google fetches it directly. This feature uses Google Gemini exclusively.
- Groq, Inc. — Privacy Policy
- Google Gemini (Google LLC) — Privacy Policy
- Anthropic (Claude) (Anthropic PBC) — Privacy Policy
- Fonts (Inter) — the typeface is hosted directly on our servers; no data is sent to third parties.
🍪 Cookies & localStorage
- Session cookie — essential for login. Valid for 30 days. The application cannot function without this cookie.
- localStorage — stores preferences (dark mode, language) and offline word cache. Remains in browser until manually cleared.
📊 Website analytics
We measure site traffic with Plausible Analytics — a tool that stores no cookies or data in your browser and builds no user profiles. That is precisely why no cookie banner bothers you on account of analytics.
- What is collected: the page visited, referring website, device type, browser and country (derived from the IP address).
- What is not collected: your IP address is not stored, there is no persistent identifier, and the data cannot be linked to an individual or to your account.
- Feature measurement: we also record anonymous events such as "word set created" or "test completed", so we know which features are worth developing. Never tied to an account.
- Data is never sold or shared with advertisers.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — operating and improving the service. Because the processing is anonymous, it poses no risk to you and the data cannot be attributed to you.
🗄️ Data retention
- Account data (email, name, words, categories, test results) — kept for the entire lifetime of your account.
- After account deletion — all your data including categories and words is immediately and irreversibly removed from our database.
- Contact messages (via the form) — kept for at most 12 months after the request is resolved, then deleted. When you delete your account, messages sent from your email are deleted too.
- Backups — database backups at our provider (Supabase) rotate per its policy; deleted data is purged from backups within the normal cycle.
🏫 Student (pseudonymous) accounts and classes
Teachers can create classes in LexiNova that students join using a class code. To minimise the processing of children's personal data (Art. 8 GDPR), students can join without an email — with just a nickname and password (a pseudonymous account).
- What we collect — for a pseudonymous account only the chosen nickname, a secure password hash and learning results. No email, name or other identifying data. We recommend using a nickname that does not identify the student (not their full name).
- What the teacher sees — only progress on the sets assigned to the class: nickname, last activity, number of tests, success rate and mastery of class sets. The teacher cannot see the student's private sets or other activity.
- Password — the teacher can reset a student's password (set a new one) but can never read it.
- Deletion — a student can delete the account at any time in their profile; a teacher can remove a student from the class. When a class is deleted, pseudonymous accounts with no other class membership are deleted along with their results.
⚖️ Your rights (GDPR)
- Access — you may request a copy of your data
- Correction — incorrect data can be corrected in your profile
- Deletion — your account and all data can be deleted in Profile Settings
- Portability — you may request an export of your data
- Objection — you may object to the processing of your data
To exercise your rights, contact us at: lipnicanmilos@gmail.com
🔒 Security
Passwords are stored as a secure hash (bcrypt). All communication is over HTTPS only. The session cookie is protected with HttpOnly and Secure flags.