Privacy Policy

Effective: October 18, 2026

This document describes what data the Hang On English mobile app (the “App”) and its server api.hang-on.app process, for what purpose, and how you can manage it.

1. Controller

The data controller is Jan Komadowski (the “Controller”). Contact for privacy matters: support@hang-on.app.

2. The key points

• To learn (lessons, quizzes, reviews) you do not need an account. We do not ask for an email, password, name or phone number.
• The App contains no ads and uses no analytics or tracking tools.
• You create an account only to play live quizzes, add friends and appear in rankings. A nickname is all it takes.
• You can delete your account in the App at any time, along with all related data.

3. Data stored only on your device

The following information is saved locally on your phone and is not sent to our server:

• progress in lessons and quizzes and the list of mistakes to review,
• settings: theme, accent color, reminders,
• a downloaded copy of the content (lessons and quizzes) for working offline,
• the account secret (see section 4) in the system’s secure storage.

Uninstalling the App or clearing its data in system settings erases this information.

4. Account and live features (server)

When you create an account, we store on the server:

• a nickname (up to 15 characters) that you choose yourself,
• a hash of a random account secret. The secret itself stays only with you and works as an account recovery code, so do not lose it and do not show it to anyone,
• your total points and best score in each live quiz you played,
• the join date and the date of last activity (dates only, no times),
• an optional “about me” note (up to 200 characters),
• a friend code and a friends list (up to 50 people),
• your device’s push notification token and platform name, if you enable invitations from friends,
• a record that a room invitation was sent (so nobody can be flooded with notifications). The record disappears after 24 hours.

Your nickname and points are visible to other users in rankings and rooms, and your nickname also in friends lists. Do not put data in your nickname or note that you do not want to reveal. The “about me” note is not shown in rankings or rooms.

Live quiz rooms store the room code, players’ nicknames, their progress and results. Room data is deleted automatically after 24 hours.

5. Purposes and legal bases (GDPR)

• Providing accounts, live quizzes, friends and rankings – Art. 6(1)(b) GDPR (performance of a contract, i.e. the Terms of Service).
• Push notifications about invitations – Art. 6(1)(a) GDPR (your consent; you can withdraw it in system or App settings).
• Server security, abuse prevention and error diagnostics – Art. 6(1)(f) GDPR (the Controller’s legitimate interest).

6. System permissions

• Camera – only for scanning friends’ and rooms’ QR codes. The image is analyzed on the device; we do not save or send it. The App does not use the microphone.
• Notifications – reminders about the daily quiz (scheduled locally, without the server) and, optionally, room invitations from friends.
• Internet – downloading content and running live features.

7. Recipients and processors

We do not sell data or share it for advertising. We use services that process data on our behalf:

• Cloudflare, Inc. – server hosting (Workers, D1 database, Durable Objects), content delivery network and technical logs.
• Google LLC (Firebase Cloud Messaging) – delivery of push notifications; Google receives the device token and the notification content.
• Google Play store – distribution of the App, under terms set by Google.

These providers may process data outside the European Economic Area, including in the USA, based on standard contractual clauses or a European Commission adequacy decision.

8. Technical logs

During connections to the server, the infrastructure provider (Cloudflare) may record technical request data such as IP address, time, resource address and response code. It is used for security and diagnostics, not for profiling. We do not link it to the content of your learning.

9. How long we keep data

• Account and related data: until you delete the account.
• Accounts inactive for 12 months are deleted automatically along with scores, friends, tokens and invitations.
• Quiz rooms: 24 hours. Invitations: 24 hours.
• Technical logs: according to the infrastructure provider’s settings, no longer than necessary for security purposes.

10. Your rights

You have the right to access your data, rectify it (change your nickname and note in the App), erase it, restrict processing, data portability, object to processing based on legitimate interest, and withdraw consent at any time. You can delete your account in the App on the account screen. If you do not have access to your phone, write to support@hang-on.app; because we do not know your identity, we may ask for the recovery code to confirm the account.

You also have the right to lodge a complaint with a supervisory authority: the President of the Personal Data Protection Office in Poland (uodo.gov.pl) or the authority in your country.

11. Children

The App is intended for people who are at least 13 years old. If you believe a child under that age has created an account, write to us and we will delete it.

12. Security

Connections to the server are encrypted (HTTPS). The account secret is kept in the system’s secure storage, and only its hash is kept on the server. No system is fully secure, however, so do not share your secret with anyone.

13. Changes to this policy

We will announce significant changes in the App or on this page. The date at the top shows the current version.