Locals privacy policy

Effective 23 October 2026

Locals helps you learn French and English by reading. This page says what the app keeps about you, where it goes and how long it stays. We keep as little as we can.

On your phone only

Your saved words, your notes, your streak and your reminder time stay on your phone. They never reach our server.

On our server

• A random id the app makes when you first open it, the date it was made, and a key the app uses to prove it is you. We keep only a scrambled form of the key.
• The language you learn and your level.
• If you sign in with Apple or Google: the account id Apple or Google gives us. Not your name, not your email address. With Apple, also the token Apple gives for your sign-in, so we can revoke it when you delete your data.
• If you allow notifications: your phone's push token, so we can tell you when a result is ready.
• Which mails and lives you were given, on which day and in which language, so you never get the same one twice and each opens again in the language you read it in.
• Your answers to the questions in a mail: what you picked and wrote, your phone's language (the explanations are written in it), when you sent them, and the grading result.

On an iPhone, when you first open the app, it uses Apple's App Attest to show our server that it is the real Locals app. This works with a key made on your device. When we make this check, we keep that key's id and its public part with your other data; they say nothing about who you are.

Who else handles it

• Cloudflare runs our server and stores this data (Cloudflare D1, in North America). Like any server, it sees your IP address when the app connects. We use it only to slow down anyone who signs up or signs in again and again, and we don't keep it in our database; it can appear in server logs we keep for a few days to fix problems.
• OpenRouter and the company that runs the AI model get what you write in answer to a question, with the mail, its questions and your phone's language (for the explanations), so the model can grade it. They get no name, email address or account id. OpenRouter keeps these files for up to 30 days. So don't put anything personal in your answers, like your name or address: whatever you write goes to them.
• Expo passes our notifications on to Apple or Google. A notification carries your push token and which result is ready, nothing you wrote.
• Apple and Google, when you sign in with them, under their own privacy policies.

How long it stays

Until you delete it. In the app, Me › Delete my data deletes everything about you on our server at once, along with what is on your phone, and revokes the Sign in with Apple token if you used it.

If you signed in with Apple or Google, one thing stays for 30 days after that: a scrambled (SHA-256) form of that account's id, with which mails and lives you were given (their day and language) and which mails you answered. If you sign in with that account again within the 30 days, you carry on from there: the same mails and lives don't come again, and the same answers aren't graded twice. It is deleted when you sign in again, or when the 30 days are over.

Other ways to delete your data

The waiting list

If you leave your email on our website to hear when Locals comes out, we keep your address, the language you picked, the language of the page and the day, on the same server. We write once to confirm your address and once when Locals comes out. Every mail has a link that takes you off the list at once and deletes all of it. Cloudflare sends these mails. The form uses Cloudflare Turnstile to keep robots out, and the page's fonts come from Google Fonts: each sees your IP address and browser the way any website does. No cookie is set.

What we don't do

No ads, no tracking, and nothing about you is ever sold.

Contact

A question about your data: team@sixlayerstudios.com. If this policy changes, we update this page and the date at the top.