Privacy Policy

LexFlexer.com is wholly owned and operated by Gorgeous Games Ltd (Company No. 13214522), a company registered in England and Wales. Our registered address is 124 City Road, London EC1V 2NX.

If you have any questions about this privacy policy or how we handle your data, contact us at [email protected].

When you use LexFlexer, we collect:

• Account information — email address, username, and profile preferences when you sign up
• Authentication data — if you sign in with Google, we receive your name, email, and profile picture from Google. We do not store your Google password.
• Learning data — test results, scores, word mastery progress, and learning preferences
• Usage data — pages visited, features used, buttons and links you click, session duration, page loading performance, and device type. Most of this is captured automatically by the analytics services listed in section 5.
• Error reports — when the app hits an error, an automatic diagnostic report is sent to our error-monitoring service containing the error message and technical trace, the page you were on, your browser and device details, and your IP address
• Technical data — IP address, browser type, and operating system for security and troubleshooting

We use your data to:

• Provide and personalise the LexFlexer learning experience
• Track your vocabulary progress and adapt difficulty
• Authenticate your account and keep it secure
• Improve our service based on usage patterns
• Send important service updates (we do not send marketing emails unless you opt in)

Your data is stored on secure servers hosted by Railway (railway.app). We use industry-standard security measures including:

• HTTPS encryption for all data in transit
• HttpOnly cookies for authentication tokens — never accessible to JavaScript
• Bcrypt password hashing — we never store plain-text passwords
• Regular security audits of our codebase and infrastructure

Usage and error-report data is not stored on our own servers — it is held by the analytics and monitoring providers listed in section 5, on their infrastructure.

We use the following third-party services:

• Google OAuth — for "Sign in with Google" functionality. Google's privacy policy applies to data they process.
• Railway — for hosting our application and database
• Cloudflare R2 — for audio file storage
• OpenAI — for AI-generated word definitions, examples, and difficulty scoring. We send vocabulary words to OpenAI for processing; no personal data is shared.
• PostHog — for product analytics, so we can see how the app is actually used. PostHog automatically records page views, clicks and other interactions, page performance measurements, and your browser and device details. Requests are routed through lexflexer.com and the data is stored in PostHog's EU cloud. When you are signed in, we send PostHog your account ID, email address and username, so this activity is linked to your account.
• Google Analytics 4 — for traffic measurement. Google's tag is loaded from googletagmanager.com and records the pages you visit, together with the browser, device and approximate location details Google derives from your IP address. It sets its own cookies. Google's privacy policy applies to data they process.
• Sentry — for error monitoring. Sentry receives the automatic error reports described in section 2, including your IP address, and stores them in its EU region.

We do not sell your personal data to any third party.

We use cookies and similar browser storage (localStorage) for the following purposes:

• Authentication cookies — HttpOnly cookies that keep you logged in securely
• Session cookies — to maintain your session state across pages
• Preference storage — localStorage entries that remember choices such as your chosen theme
• Analytics cookies and storage — PostHog stores a visitor ID in both a cookie and localStorage so that repeat visits are recognised as the same person, and Google Analytics sets its own cookies for the same purpose. These are analytics cookies, not essential ones.

We do not use advertising cookies, and we do not share this data with advertisers. LexFlexer does not currently show a cookie banner or offer an in-app setting to turn analytics off; you can block or clear these cookies and site data through your browser settings.

You have the right to:

• Access your personal data — your profile page shows your stored information
• Correct inaccurate data — update your profile at any time
• Delete your account and associated data — contact us at [email protected]
• Export your data — contact us to request a copy of your data
• Withdraw consent — you can revoke Google sign-in access from your Google account settings

LexFlexer is designed to be suitable for learners of all ages. We do not knowingly collect personal information from children under 13 without parental consent. If you believe a child under 13 has provided us with personal data, please contact us and we will promptly delete it.

We retain your account data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days. Anonymised usage statistics may be retained for service improvement.

This privacy policy and any disputes arising from it are governed by the laws of England and Wales. You agree to the exclusive jurisdiction of the courts of England and Wales.

We may update this privacy policy from time to time. We will notify registered users of significant changes via email or an in-app notification. The "last updated" date at the top of this page reflects the most recent revision.

For any privacy-related questions or requests, contact us at:

Email: [email protected]
Address: Gorgeous Games Ltd (Company No. 13214522), 124 City Road, London EC1V 2NX