Privacy Policy

Last updated: March 17, 2026

This Privacy Policy explains how Envyo ("we", "us", "our") collects, uses, and protects your information when you use the Envyo desktop application and website at envyo.app ("Service"). We are committed to keeping your data minimal, transparent, and under your control.

1. What We Collect

Account Data (stored on our servers)

Data	Purpose	Retention
Email address	Account identification, login	Until account deletion
Hashed password	Authentication (PBKDF2, never stored in plaintext)	Until account deletion
Subscription status	Access control, billing	Until account deletion

Local Data (stored on your device only)

Data	Purpose	Storage
Learning progress	Spaced repetition scheduling (SM-2)	SQLite database in AppData
Custom libraries	User-created word collections	SQLite database in AppData
App settings	Overlay preferences, theme, font	SQLite database in AppData
Auth token	Session persistence (JWT, 24h expiry)	SQLite database in AppData

2. What We Do NOT Collect

No analytics or tracking: We do not use Google Analytics, Mixpanel, or any third-party tracking scripts
No usage telemetry: We do not track which words you learn, how often you use the app, or your study patterns
No device fingerprinting: We do not collect hardware IDs, IP addresses, or browser fingerprints
No cookies: The website uses localStorage only for authentication tokens, not tracking cookies
No selling of data: We never sell, rent, or share your personal information with third parties for marketing

3. Third-Party Services

The Service may use third-party providers for payment processing, hosting, and optional features such as translation. These providers receive only the minimum data necessary to perform their function (e.g., email for payment, individual words for translation). No personal data is shared beyond what is required for the specific service.

Each third-party provider operates under its own privacy policy. We recommend reviewing them if you have specific concerns.

4. Data Storage and Security

Server data is stored on Cloudflare D1 (edge SQLite database) with encrypted connections
Passwords are hashed with PBKDF2 before storage; we cannot read your password
Authentication tokens use HMAC-SHA256 signed JWTs with 24-hour expiration
Local data resides entirely on your machine in AppData/Roaming/com.envio.learn-english/

5. Your Rights

You have the right to:

Access: View your account data through the dashboard at envyo.app
Delete: Request complete account deletion by emailing support@envyo.app
Export: Your local learning data is in a standard SQLite database you can access directly
Correct: Update your email through your account settings
Withdraw consent: Cancel your subscription and delete your account at any time

We will process deletion requests within 30 days. Local data on your device is not affected by account deletion and can be removed by uninstalling the application.

6. Children's Privacy

Envyo is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

7. Data Breach Notification

In the unlikely event of a data breach that affects your personal information, we will notify affected users via email within 72 hours of discovering the breach, describing what happened, what data was affected, and what steps we are taking.

8. Changes to This Policy

We may update this Privacy Policy occasionally. Changes will be posted on this page with an updated date. If changes are significant, we will notify you by email. Continued use of the Service after changes constitutes acceptance.

9. Contact

For privacy-related questions or requests:

Email: support@envyo.app
Website: envyo.app