Privacy Policy

1. Information We Collect

NepaliGo collects the minimum information necessary to provide you with a personalized learning experience:

• Email address — used for authentication via magic link sign-in, and for a few getting-started emails in your first week (see below). We do not use passwords.
• Learning progress — quiz scores, lesson completions, XP earned, streaks, and word mastery data.
• Device information — a push notification token for your device, stored only if you turn on the daily reminder in the app's Settings. Turning the reminder off deletes it. Older versions of the app sent this token when you signed in; we do not use those tokens to send you anything.
• Usage analytics — aggregate page views and feature events collected side by side with Umami and ChiliTrack on A14A-operated infrastructure. Section 2 lists field by field what each of those requests carries.
• Profile details — an optional display name and profile image, only if you choose to provide them.
• Error and crash diagnostics — the error message, the technical stack trace and, on the website, the page address when something breaks; in the app, the operating system version, device model and app version instead. Collected via our self-hosted GlitchTip (Sentry SDK) instance and used solely to detect and fix bugs. Section 2 describes the full trail. This is never used for advertising.
• Problem reports — only if you use “Report a problem” in a lesson. Section 2 describes exactly what a report contains.
• Getting-started emails — if you create an account, we may send up to four short emails in your first nine days: a welcome, a reminder if you haven't tried a lesson yet, a link back to where you left off, and a recap of your first week. We send them because they help new learners get going (our legitimate interest), and each one has an unsubscribe link that stops them straight away. We keep a record of which of these emails we sent you, or chose not to send, so we can tell whether they help. Unsubscribing never affects sign-in emails.
• Newsletter email — if you sign up for product updates, we store your email address to send those updates. You can unsubscribe at any time. Addresses collected for the mobile app waitlist, before the app was released, are held on the same basis and are erased the same way.

2. Analytics and Monitoring

We use ChiliTrack and Umami side by side as cookieless, privacy-first analytics. Neither sets cookies, neither tracks you across other websites, and neither builds a profile of you.

To understand which pages help people start learning, we keep a broad source label (such as Google or direct), a landing-page category and a start time in this tab’s session storage for up to 30 minutes. These labels accompany feature events. They contain no full URLs, search terms, email addresses or account identifiers, and are not joined to your account.

• What we record — the page address you visited (with any ?query and #fragment removed), the referring site, your approximate location, and your browser and device type. The same request also carries the title of the page you viewed, your screen size and the language your browser asks for. The location is derived from your IP address: our geolocation database resolves it to a country and, where it can, to a region and a city — never to a street or a person.
• Feature events — named events for things you do in the product, such as starting or finishing a quiz, choosing a category, clicking a call to action, opening an FAQ, or opening one of the app store listings, together with a short fixed list of non-identifying properties such as the category, the score, the accuracy and the time taken. Anything outside that list — free text, email addresses, or anything resembling a token — is dropped before the event is sent.
• Performance monitoring — we measure how quickly pages load and respond: Core Web Vitals such as loading time, responsiveness and layout stability, together with the address of the page being measured and how long it stayed open. This is about the behaviour of our own site, not about you.
• Error monitoring — when something breaks in your browser we record the error message, the technical stack trace, the page address, and a short trail of the actions that led up to it (page changes and network requests our own site made). We use this to fix faults. Faults on our own servers are recorded the same way. This runs on GlitchTip, an error tracker we operate ourselves at errors.a14a.org; it is not an advertising or profiling service, and the trail contains no clicks, no typing and no logged message content. No IP address, no cookies and no request headers are sent with it.
• Crash reports in the app — when the app crashes or hits an error we record the error message, the technical stack trace, the app version, the operating system version and the device model. Your account, your device's name and any trail of what you did before the crash are removed before the report is sent. The app also reports whether a session ended in a crash, and technical details when saving your progress fails or has to be retried (an error code, the step that failed and the app version), with no account attached. This also runs on our GlitchTip instance at errors.a14a.org.
• App performance — the app measures how long it takes to start and to show a usable screen, using Expo's EAS Observe. These timings are sent with the app version, operating system and device model under a random identifier for this installation; they are not linked to your account and contain nothing you typed.
• Report a problem — if you tap “Report a problem” in a lesson, we store the reason you pick, your optional note, the question, your answer and the expected answer, the word and lesson it came from, and the app version and platform. If you are signed in, the report is linked to your account so we can follow up; otherwise it is stored without one. Our team gets a short notice in its chat tool with the reason and the word, never your note or your answers. We keep reports for 12 months, and deleting your account deletes the reports linked to it.
• What we do not do — we do not record your screen, we do not replay your session, and we do not build interaction heatmaps. We do not send form input to any analytics or monitoring system.

Sign-in links, invite codes and lesson state travel in query strings on this site. Every system above has the query string and the fragment removed from the address before it is recorded, so none of them ever receives one. Beyond what is listed here, no personal data is collected by these systems.

3. How We Use Your Information

• Authenticate you and maintain your learning session
• Send a few getting-started emails in your first week, which you can stop with one click
• Track your progress and display personalized statistics
• Show a daily practice reminder on your device, only if you turn it on in the app's Settings
• With that reminder on, we may also send at most one streak reminder a day from our servers, in the evening in your time zone, when you practised yesterday but not yet today. To decide this we use your streak, the day you last practised and your time zone, which the app reports. Turning the reminder off stops it
• Improve the app based on aggregate usage patterns

4. Data Storage and Security

Your data is stored securely in a PostgreSQL database. Session tokens and account identifiers are stored locally on your device so the app can keep you signed in. All communication between the app and our servers uses HTTPS encryption.

5. Third-Party Services

We use the following third-party services:

• Resend — for sending magic link sign-in emails, the getting-started emails and newsletters. It receives your email address and the message we send
• Expo Push Notifications — issues the device token described above when you turn on the daily reminder, and delivers the streak reminders we send. It receives the device token and the text of the message, not your email address
• Umami Analytics and ChiliTrack — for aggregate, non-advertising usage analytics and web performance measurement
• GlitchTip (Sentry SDK) — a self-hosted error and crash diagnostics service we operate, used only to detect and fix bugs
• Expo (EAS Observe) — measures app startup and screen-ready times, as described in Section 2
• Slack — receives a short notice when a problem report arrives (reason and word only, no note or answers)

We do not sell your personal data or use advertising SDKs. We use the service providers above only to operate, secure, and improve NepaliGo.

6. Data Retention

Your account data is retained as long as your account is active. Problem reports are kept for 12 months and then deleted. You can delete your account and all associated data at any time:

• In the app via Profile → Delete Account
• By emailing hello@nepaligo.com (steps at nepaligo.com/delete-account)

Deleting in the app permanently removes your account and all associated data right away. If you ask by email, we remove it within 30 days of your request.

7. Children's Privacy

NepaliGo is intended for users aged 13 and older and is not directed to children under 13. We do not knowingly collect personal information from children under 13; if we learn that we have, we will delete it.

8. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and data
• Turn the daily reminder off at any time in the app's Settings or your device settings

9. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any significant changes by posting a notice within the app.

10. Contact Us

If you have questions about this privacy policy or your data, contact us at hello@nepaligo.com.