Privacy policy
Learning should feel personal, not exposed.
Sanala is operated by Brightforge Software Inc. The core learning experience is local-first. Online accounts, AI tutor requests, optional billing, and the YouTube extension use the limited data described below. We do not sell personal information or use it for targeted advertising.
Data controller and contact
Brightforge Software Inc., Delaware, United States, with its product team in Helsinki, Finland, is the controller for Sanala account and product data. Contact [email protected] with the subject “Sanala privacy”.
What we process
- On-device learning data: level, interests, vocabulary, reviews, streak, lesson progress, and settings.
- Account data: email, provider identifier, session tokens, confirmation and recovery events.
- Optional online learning data: anonymous Study sync key, saved vocabulary, weak spots, explicit YouTube study interactions, and service diagnostics.
- AI data: tutor prompts, speech transcript, and limited learning context needed to answer. Sanala does not intentionally persist full tutor conversations in its product store.
- Billing data: plan, entitlement, provider customer/subscription identifiers, and webhook records. Stripe or Apple, where offered, handles payment credentials.
- Support messages you choose to send.
YouTube extension
The extension runs only on YouTube watch pages. It reads available caption text to display dual subtitles and processes words you explicitly click or save. It may send that word, video ID/title/URL, and your pseudonymous Study sync key to Sanala. It does not import or store your complete Chrome or YouTube history.
Voice and AI
Microphone and speech access is requested only when you start pronunciation or live speaking. Sanala does not record continuously in the background. Speech recognition and speech synthesis use platform services; availability and whether processing is local or cloud-assisted depend on the operating system. Generative tutor requests may be sent to contracted AI infrastructure, currently including Nebius Token Factory and an optional Google Gemini fallback. The interface identifies AI tutor experiences and warns that responses may be wrong. Do not submit secrets or sensitive personal information.
Purposes and legal bases
We process data to provide the service and account you request, protect the service and prevent abuse, improve reliability through minimal diagnostics, comply with billing/legal duties, and respond to support. For EEA users the bases are contract, legitimate interests in security and reliability, consent where required for optional permissions, and legal obligation.
Service providers and transfers
Sanala uses Supabase for account authentication, Heroku and Cloudflare for hosting, Nebius and optional Google services for AI, Stripe for web billing, and Apple/Google for sign-in or storefront services. Providers process data under their own terms and contractual safeguards. Data may be processed outside your country, including the United States and EEA, using an applicable transfer mechanism where required.
Cookies and local storage
The marketing site currently uses no advertising or cross-site analytics cookies. The web app uses essential browser storage for session, settings, and local learning progress. The Chrome extension uses extension-local storage for its settings and Study sync key. Because these are required for requested functionality, there is no advertising-cookie banner.
Retention and deletion
Local data remains until you clear it or remove the app. Online account data remains while the account is active. Use “Delete account” inside Sanala to remove the auth account and product entitlement; an active web subscription is cancelled first. Some security, transaction, and tax records may be retained where law requires. You may also request deletion by email. We aim to acknowledge privacy requests within 7 days and complete verified requests within the legally required period.
Your rights
Depending on location, you may request access, correction, portability, restriction, objection, or deletion, and may complain to your data protection authority. California residents may also request to know, correct, or delete covered information and may exercise rights without discrimination. Sanala does not sell or share personal information for cross-context behavioural advertising.
Age
Sanala is a general-audience learning product and is not directed to children under 13. Do not create an online account if you are under 13. If we learn that we collected personal information from a child under 13 without required consent, we will delete it. Local-only learning can be used without an account.
Changes
Material changes will be posted here with a new effective date. This policy describes the currently shipped product, not planned analytics or integrations.