Privacy Policy

Effective: October 26, 2026

This document describes what data the Hang On English mobile app and its browser version (PWA) at app.hang-on.app (together, the “App”) and their server api.hang-on.app process, for what purpose, and how you can manage it.

1. Controller

The data controller is Jan Komadowski (the “Controller”), who is also the service provider and operates the server api.hang-on.app. The App (its code and educational content) was created by Aleksandra Natalia Komadowska, who is not the data controller or the service provider and does not operate the server. Direct any questions about data to the Controller. Contact for privacy matters: support@hang-on.app.

2. The key points

• To learn (lessons, quizzes, reviews) you do not need an account. We do not ask for an email, password, name or phone number.
• The App contains no ads and uses no analytics or tracking tools.
• You create an account only to play live quizzes, add friends and appear in rankings. A nickname is all it takes.
• You can delete your account in the App at any time, along with all related data (how to delete your account). Deleting it, or signing in on another device, requires the recovery code. We cannot recreate it, so do not lose it (details in section 10).

3. Data stored on your device

The following information is saved locally on your phone. Except for progress (if you have an account, see below), it is not sent to our server:

• the list of mistakes to review (questions and your wrong answers), the queue of topics to review,
• progress in lessons and quizzes (results, completion marks) and your chosen level – also copied to the server if you have an account (section 4),
• settings: theme, accent color, reminders,
• a downloaded copy of the content (lessons and quizzes) for working offline,
• the account secret (see section 4) in the system’s secure storage.

Uninstalling the App or clearing its data in system settings erases this information.

Browser version: the same information is saved in the browser’s storage (localStorage, cache), and the account secret in localStorage, which is less protected than the phone’s system secure storage. Clearing site data, private browsing or switching browsers removes it from the device, along with the account secret. Without a saved recovery code you cannot sign in again (see section 10). The browser version uses no cookies and no external scripts or tracking tools.

4. Account and live features (server)

When you create an account, we store on the server:

• a nickname (up to 15 characters) that you choose yourself,
• a hash of a random account secret. The secret itself stays only with you and works as an account recovery code, so do not lose it and do not show it to anyone,
• points awarded for completing quizzes, lessons, the daily quiz, reviews and live games,
• best results in completed activities: the identifier (of a quiz, lesson, daily quiz with its date, or review), number of correct answers, number of questions and completion date, without the content of your answers. They are used to award points only once and to synchronise progress between your devices,
• your chosen learning level (A1–C2), also to synchronise between devices,
• your list of mistakes to review (up to 400 questions): the question text, the last wrong answer you typed or chose, the number of mistakes and review dates, and the queue of topics waiting for review (to synchronise between your devices). Do not type data you do not want stored on the server into quiz answers,
• a history of completed live games (room code, date and points awarded) and your best score in each live quiz you played,
• the join date and the date of last activity (dates only, no times),
• an optional “about me” note (up to 200 characters),
• a friend code and a friends list (up to 50 people),
• the list of players you have blocked (account identifiers) and the fact of who has blocked you; nobody but you sees your list, and the blocked player is not told,
• your device’s push notification token and platform name, if you enable invitations from friends,
• in the browser version, if you enable notifications: Web Push subscription data (the address of your browser’s notification service and encryption keys), the interface language and, for daily quiz reminders, your time zone and whether the daily quiz is already done,
• a record that a room invitation was sent (so nobody can be flooded with notifications). The record disappears after 24 hours.

The account contains no data that would let us recognise you other than the recovery code, and we collect none. So please do not ask us to recover an account without the code, and do not use your real name as a nickname.

Your nickname and points are visible to other users in rankings and rooms, and your nickname also in friends lists. Any user who sees you in a ranking, in room results or in a friends list can open your profile, which shows your nickname, points, ranking place, join date and “about me” note. In the account screen you can turn on “Hide my profile” at any time – other users then see only your nickname, points and ranking place. Do not put data in your nickname or note that you do not want to reveal.

Content checking. Your nickname and note are checked by an automatic word filter: when you enter them (prohibited content is not saved) and when they are shown to other users. If the content breaks the rules, others see a placeholder name or a notice that it is hidden, and you see a warning; we do not change or delete the content. The result of the check is not stored. The filter takes no decision about you other than hiding the content from others; at your request a person reviews the matter (support@hang-on.app).

Live quiz rooms store the room code, players’ nicknames, their progress and results. Room data is deleted automatically after 24 hours.

5. Purposes and legal bases (GDPR)

• Providing accounts, live quizzes, friends and rankings and blocking players at your request – Art. 6(1)(b) GDPR (performance of a contract, i.e. the Terms of Service).
• Checking and hiding content that breaks the rules – Art. 6(1)(f) GDPR (the Controller’s legitimate interest: user safety and lawful content).
• Push notifications about invitations – Art. 6(1)(a) GDPR (your consent; you can withdraw it in system or App settings).
• Server security, abuse prevention and error diagnostics – Art. 6(1)(f) GDPR (the Controller’s legitimate interest).

6. System permissions

• Camera – only for scanning friends’ and rooms’ QR codes (in the browser after you grant permission). The image is analyzed on the device; we do not save or send it. The App does not use the microphone.
• Notifications – reminders about the daily quiz (in the Android app scheduled locally, without the server; in the browser version sent from the server) and, optionally, room invitations from friends. In the browser your permission in site settings is required.
• Internet – required to use the App: downloading content, the account and live features.

7. Recipients and processors

We do not sell data or share it for advertising. We use services that process data on our behalf:

• Cloudflare, Inc. – server hosting (Workers, D1 database, Durable Objects), content delivery network and technical logs.
• Google LLC (Firebase Cloud Messaging) – delivery of push notifications; Google receives the device token and the notification content.
• Browser notification services (Web Push) – in the browser version, notifications are delivered through the service of your browser’s maker (e.g. Google, Mozilla, Apple, Microsoft), which receives the subscription address and the encrypted notification content.
• Google Play store – distribution of the Android app, under terms set by Google.

These providers may process data outside the European Economic Area, including in the USA, based on standard contractual clauses or a European Commission adequacy decision.

8. Technical logs

During connections to the server, the infrastructure provider (Cloudflare) may record technical request data such as IP address, time, resource address and response code. It is used for security and diagnostics, not for profiling. We do not link it to the content of your learning.

9. How long we keep data

• Account and related data: until you delete the account.
• Accounts inactive for 12 months are deleted automatically along with points, completed activities, game history, scores, friends, tokens and invitations. This also applies to accounts whose recovery code has been lost.
• Web Push subscriptions: until you delete the account, turn notifications off, or your browser’s notification service reports the subscription as invalid.
• Quiz rooms: 24 hours. Invitations: 24 hours.
• Blocks: until the account of the blocking or the blocked player is deleted (deleting either one removes the block).
• Technical logs: according to the infrastructure provider’s settings, no longer than necessary for security purposes.

10. Your rights

You have the right to access your data, rectify it (change your nickname and note in the App), erase it, restrict processing, data portability, object to processing based on legitimate interest, and withdraw consent at any time. You can see your account data (nickname, points, join date, note) on the account screen in the App, and delete the account there. Instructions: Delete your account.

Lost recovery code. We do not know your identity and deliberately do not collect data that would let us establish it (email, phone number, documents). Under Art. 11 GDPR we are not obliged to. If you lose the code and no longer have the App signed in to the account, we cannot confirm that the account is yours, so we cannot sign in to it or delete it. The account will be deleted automatically after 12 months of inactivity (section 9). A name alone is not enough to identify an account.

Other people’s data in a nickname. If you believe someone’s nickname or “about me” note contains your data or infringes your rights, write to support@hang-on.app and say what the report concerns. After a credible report we will change the nickname to a neutral one (e.g. “Player-4821”) and remove the note. We do not delete the whole account this way or disclose who runs it.

You also have the right to lodge a complaint with a supervisory authority: the President of the Personal Data Protection Office in Poland (uodo.gov.pl) or the authority in your country.

11. Children and minors

We do not ask for the age or the country of our users. If you are not of full age under the law of the place where you live, use the App with the consent of a parent or legal guardian. If you believe a child has created an account without such consent, write to us and we will delete it.

12. Security

Connections to the server are encrypted (HTTPS). The account secret is kept in the system’s secure storage (in the browser: in localStorage), and only its hash is kept on the server. No system is fully secure, however, so do not share your secret with anyone.

13. Changes to this policy

We will announce significant changes in the App or on this page. The date at the top shows the current version.