Privacy Policy

DigMyGem is a language learning reader. This policy covers the hosted service at app.digmygem.com and api.digmygem.com. If you install DigMyGem from the source code and run it yourself, you operate that copy, and this policy does not describe it.

The data controller for that hosted service — the one who decides what is collected and why, and the one you can hold to this policy — is an individual, not a company: Jiawen Lin, trading as DigMyGem, Lorcan Drive, Dublin, Ireland. Write to privacy@digmygem.com about anything in this policy.

We have not appointed a data protection officer: a one-person operation meets none of the cases where Article 37 requires one. No Article 27 representative is appointed either, because the controller is established inside the European Union.

Account. Your email address. If you sign in with Google or GitHub, that provider also sends us your name and profile image. If you use a password, we store a one-way hash of it and never the password itself. We also keep session records, the verification state of your email, and your two-factor settings. When you create an account we record that you confirmed you are at least 16 and agreed to the Terms, with the time and the version of the Terms.

Learning data. Everything you make in the app: lessons, collections and their covers, saved vocabulary, known words, cloze sentences, practice answers and scores, daily statistics, reading progress, journal entries, transcripts, and your settings.

Content you import. When you import a web page, we fetch that page and keep its text and a cropped cover image in your library.

Error reports. When you report a picture or a dictionary text, we store the word, the language, your native language, the picture or section, the reason you chose, your optional note, and the app version. The stored report does not name your account. We email it to the operator together with your account id.

Provider keys. If you connect your own AI provider, we store that key encrypted at rest with AES-256-GCM, so the server can call the provider for you. We never send the key back to a browser.

Technical data. Every sign-in writes a session record in our own database, and that record holds the IP address and the browser user agent you signed in from. Our network and hosting providers keep request logs as well, which also include IP addresses, to serve traffic and to stop abuse. If the operator turns on error reporting, we send error reports that describe the failure and not your library.

We use your account and your learning data to give you the service you asked for. We keep security logs and error reports because we have a legitimate interest in running a service that works and resists abuse. We send account email — verification, password reset, and service notices — because the account cannot work without it. Any other email carries an unsubscribe link.

Each of those reasons has a lawful basis behind it, in the words the GDPR uses. Your account, your library, your imported content and your stored provider key are performance of our contract with you: they are the service you signed up for, and it cannot run without them. Account email is the same basis.

Security logs, the bot check, error reports and the shared word lexicon rest on our legitimate interests in a service that stays up, resists abuse, and does not pay twice for the same lookup. You can object to any of these — see Your rights.

Optional email rests on your consent. You can withdraw it at any time with the unsubscribe link, and withdrawing it does not undo what was lawful before.

Keeping invoices and tax records for a paid plan is a legal obligation. Paddle is the seller on those records and keeps them too.

We set two essential cookies: the session cookie that keeps you signed in, and, if you use two-factor sign-in, a short-lived challenge cookie that holds the step between your password and your code. Your theme, fonts, speech rate, and other preferences stay in your browser's local storage and never reach the server. Bot protection may set a Cloudflare cookie while it checks a sign-up or a sign-in. We run no advertising cookies and no cross-site tracking.

Every cookie we set is needed to make the site work, so there is no cookie banner to click. The optional analytics described below sets no cookie either. Paddle may set its own cookies on its checkout, and Paddle's privacy notice covers those.

• Cloudflare carries network traffic, terminates TLS, and provides the bot check (Cloudflare Turnstile) on sign-up and sign-in. It sees request metadata, and Turnstile sees the signals your browser sends for the check.
• Oracle Cloud hosts the application and the database, in Amsterdam in the European Union. All of the data above lives there.
• Resend sends our account email. It sees your email address and the message.
• Paddle is our merchant of record: it sells the subscription, so it is the seller on your invoice and its own privacy notice covers the purchase. When you start checkout we send Paddle the plan you picked, an internal id for your account, the Paddle customer id we already hold for you if there is one, and the discount code you typed if you typed one. You give Paddle your payment and billing details directly — they never reach us. Paddle sends back your Paddle customer id, your Paddle subscription id, the billing email address you gave Paddle, the subscription status, which plan it is, and when the current period ends. We store those, the id of the account they belong to, and the times Paddle reported the change and we recorded it. That is all we store about a payment. We never see your card.
• Google or GitHub confirm your identity when you choose that sign-in method. We receive your name, your email address, and your profile image.
• Your AI provider, the one you configure or the one the operator configures, receives the text you send for translation or explanation.
• Managed AI models. On the hosted service, the words and sentences you ask to have explained or translated by a model go to OpenRouter, which passes them to a Google Gemini or Gemma model, and to the Google Gemini API when it is used directly. No account identity is sent with the text.
• Machine translation services. For free translation of a word, a phrase or a sentence, our server asks the public translation endpoints of Microsoft (Edge Translator and Bing Translator), Google Translate and Yandex, in turn, until one answers. Each receives the text and the language pair. The request comes from our server, so it carries our server's address and not yours, and no account identity. The titles of articles in Discover are translated the same way.
• The site you import from, such as YouTube or TikTok for a video, or the web page you name. Our server fetches it for you and sends the address you gave. For YouTube the request may go through a relay that we operate.
• Google Cloud Text-to-Speech turns writing into speech. When your language is served by it, it receives the word or the sentence you asked to hear, and the voice and speed you chose. Nothing that identifies you is sent with it. When neither Google nor your device has a voice for the language — Irish, Vietnamese and Malay can come to this — the text is spoken by eSpeak NG, which runs on the server itself. For that, nothing you asked to hear leaves the server.
• Plausible, only if the operator enables it, counts page views. It is loaded from the address the operator sets, it sets no cookie, and it does not follow you to other sites. No deployment gets it by default.
• Cloudflare Web Analytics, on the public launch pages only and never inside the signed-in app, counts page views without cookies. It is not loaded when your browser sends Do Not Track or Global Privacy Control, and a self-hosted copy has it off unless its operator turns it on.
• Sentry, only if the operator enables it, receives error reports.

A word lookup is made for the word alone. The sentence you were reading is not sent.

Speech is cached the same way. A clip is filed under the text, voice and speed that made it — on our own disk, or in object storage the operator configures — and the same clip is served to anyone who later asks to hear those words. The cache holds the audio and that key, and no user identity.

Each of these providers keeps what it receives under its own retention rules, which we cannot change. What they send back to us is kept as this policy describes: your library for as long as the account exists, and the speech cache as described above.

We do not sell your data, and we do not use it for advertising.

The database and your imported files sit on servers in the European Union. Email delivery, error reporting, managed AI models and machine translation may be processed outside the European Union by the providers above, some of them in the United States, China or Russia. The public translation endpoint of Yandex is reached without a contract between us, so we send it nothing but the text to translate.

Leaving the European Union. Your account and your library stay in the EU. Five things can travel: email delivery, error reporting when it is on, the AI provider you or the operator configured, machine translation, and billing through Paddle. Where one of those processes data outside the EU or the UK, the transfer runs either on a European Commission adequacy decision for that country, or on the Commission's standard contractual clauses with the UK addendum where the UK applies. Ask at privacy@digmygem.com for a copy of the clauses covering a particular provider.

We keep your account and your library while your account exists. Automated backups are kept for 14 days. When you delete your account we delete your data, and the last backup that holds a copy ages out within 14 days. If you unsubscribe from an optional email, we keep that address on a suppression list so we do not mail it again.

Billing records outlive the account. Tax law requires an invoice to be kept for years after it is issued — Paddle keeps those as the seller, and we keep the subscription record that goes with them for 4 years.

One record outlives the account on purpose. When a member of staff acts on an account — a refund, a suspension — we write who did it and which email address it concerned to an audit log. That log is our record of what staff did, so account deletion does not remove it.

If you are in the European Union or the United Kingdom, you can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to limit what we do with it, object to how we use it, and receive it in a portable format. Two of these you can do yourself in the app: export your data, and delete your account. For anything else, write to privacy@digmygem.com.

These are the names the law gives them, and where each one is exercised.

• Access (Article 15) — a copy of what we hold about you, and what we do with it. Settings, then Export all learning data, downloads the whole library at once. For the rest of the account record, write to us.
• Rectification (Article 16) — correcting something wrong. Your email, password and connected sign-ins are on the Account page. Anything else, write to us.
• Erasure (Article 17) — Account, then Delete account. We email you a confirmation link and nothing is removed until you click it. Clicking it removes the account, the library and the practice history, and it cannot be undone.
• Restriction (Article 18) — asking us to hold the data but stop using it while a question about it is open. Write to us and say what you dispute.
• Portability (Article 20) — the same export as above. It is JSON, it is machine-readable, and it is yours to take anywhere.
• Objection (Article 21) — objecting to anything we do on legitimate interests. Tell us which, and why.
• Withdrawing consent (Article 7) — the unsubscribe link on any optional email.

We answer within one month and it costs you nothing. We may ask you to confirm who you are before we hand over or delete data.

Tell us first at privacy@digmygem.com — it is usually the fastest fix. You do not have to. You can complain to a data protection authority instead (Article 77), either in the country where you live, the country where you work, or the country where you think the problem happened. Our own lead authority is Ireland's Data Protection Commission, which takes complaints at dataprotection.ie. Complaining does not stop you going to court.

We make no decision about you by automated means alone that has a legal effect on you or affects you in a similarly significant way, and we do not profile you for one (Article 22). Plenty is automated — your reviews are scheduled, your usage is counted against your plan limits, and Paddle runs its own fraud checks on a payment — but none of it decides anything about you as a person. An account is only ever suspended by a person, and we say why.

Deletion takes two steps. On the Account page, Delete account asks us to send a confirmation link to your email address. Nothing is deleted until you open that link, so an account whose owner never opens the mail is still there. Once you do, your account, your library and your practice history go, and it cannot be undone. Files you imported are taken off disk by a sweep that runs every hour after that.

The button is part of the hosted service. If you run DigMyGem yourself, there is nothing for us to delete — that database is yours.

DigMyGem is not directed at children under 16, and we do not knowingly collect their data. If a child has an account, write to privacy@digmygem.com and we will remove it.

Passwords are stored as hashes. Provider keys are encrypted at rest. Traffic is encrypted in transit. The API serves only the data of the account that is signed in.

We change the date at the top when this policy changes. A material change is announced in the app before it takes effect.

privacy@digmygem.com