Privacy Policy

Last updated: September 16, 2026

This policy explains what personal data Lotty collects, why, who it is shared with, and what rights you have. It covers the Lotty app at lotty.vslvv.com and this website at heylotty.app. Lotty is currently in a free testing phase.

Who is responsible for your data

Lotty is run by Anatolii Vasilev, a private individual, who is the data controller. For any question or request about your data, email anatolii.vslvv@gmail.com.

What data we collect

• Account data: your name, username, email address and password (stored only as a hash). If you sign in with Google, we receive your name and email address from Google.
• Learning data: what you create and do in the app — dictionaries and words, stories and their topics, retellings, exercise answers and results, messages to the AI assistant, your native and study languages and levels, and your AI credit usage.
• Product analytics (sent by our backend, without cookies): records of key actions such as signing up, creating a dictionary or story, and using AI features, linked to your user ID, along with your username, native language, and study languages and levels. These are sent to PostHog.
• Browser analytics (only with your consent): pages you visit in the app, your IP address, and the approximate location (country, city) derived from it.
• Technical data: error reports from our servers, which can include the request that failed.

We do not record your voice, and we do not use your data for advertising.

This website

This website does not use analytics or cookies and does not ask you for any personal data. It remembers your light or dark theme choice in your browser's local storage. Fonts are loaded from Google Fonts, so Google receives your IP address when you open the page.

Why we use it and on what legal basis

• To provide the service — your account, learning content and AI features. Legal basis: performance of our contract with you.
• To understand and improve the product — server-side product analytics. Legal basis: our legitimate interest in improving Lotty. You can object at any time by emailing us.
• Browser analytics — Legal basis: your consent, which you can withdraw at any time.
• To keep the service secure and working — error reports, rate limiting, and account emails (verification, password reset). Legal basis: legitimate interest and performance of our contract.

The operator may access account data, including viewing the app as a specific user, when needed to provide support or fix a problem.

AI features

AI features send the content needed for the request to an AI provider:

• Google Gemini: story generation (topic, notes, languages and level), word cards, the AI assistant (your messages together with the related dictionary or story), exercise generation and grading (your answers), and retelling feedback (your retelling).
• OpenAI: narration of audio stories, and timing of that generated audio so the text can be highlighted during playback. Only the story text is sent.
• Google Cloud Text-to-Speech: pronunciation of words.

Lotty doesn't record your voice. AI output can be inaccurate. Don't include sensitive personal information in AI requests.

Who we share data with

We use these service providers to run Lotty. They process data on our behalf:

Some providers are located outside the EU, mainly in the United States. For those transfers we rely on the EU-U.S. Data Privacy Framework where the provider is certified under it, or on the European Commission's Standard Contractual Clauses.

If you share a dictionary by link, anyone with that link can view its contents. We do not sell your data, and we disclose it to authorities only when legally required.

How long we keep data

• Account and learning data: for as long as your account exists.
• When you ask us to delete your account, we delete your account and learning data, and ask our providers to delete related analytics.
• Analytics and error reports: for as long as they are useful for improving and maintaining the service, within the retention limits of the providers.

Your rights

Under data protection law, including the GDPR, you have the right to:

• access your data and get a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to processing, including server-side product analytics;
• receive your data in a portable format;
• withdraw your consent at any time — this doesn't affect data processed before you withdrew it.

To use any of these rights, email anatolii.vslvv@gmail.com. You also have the right to lodge a complaint with a data protection authority, for example in the country where you live.

Cookies and local storage

Strictly necessary. In the app, we use cookies and local storage to keep you signed in, secure sign-in with Google, and remember your interface language, your analytics choice, and your progress in exercises. They are always on, because the app doesn't work without them.

Analytics (only with your consent). If you accept analytics in the app, PostHog stores a cookie and a local storage entry to recognise your browser across visits and measure how the app is used. It is kept for 1 year, and the data is processed by PostHog in the EU. You can withdraw your consent at any time in the app's cookie settings.

Children

Lotty is not intended for anyone under 16. If you are under 16, please don't create an account.

Changes to this policy

We may update this policy as Lotty changes. The date at the top shows the latest version. If a change is significant, we will let you know by email or in the app.