What we hold, where it lives, and who else can see it.
Lingvo stores the strings you send it and the account that sent them. There is no advertising business here and no analytics vendor — the only reason we hold anything is to run the product you are paying for.
On this page
What we collect
Your account
Your name, email address and a password hash. We never store the password itself. If you joined by invitation we also keep who invited you, so a workspace owner can see how someone got access.
Your workspace content
The keys, source strings, translations, comments, glossary terms and file paths you push or type. This is the product — it is stored so it can be edited, exported and pulled back into your repository.
Operational records
We also keep operational log summaries of failed signup, setup and import requests. These summaries contain only the type of operation, a broad failure category and a count. They do not contain account identifiers, request bodies or customer strings.
If you use a tagged signup link, we keep its broad source label, such as GitHub, alongside the signup method and the link between your account and its original workspace. Attribution records do not contain referring URLs or free-form tags. The records stay with the workspace; deleting your account removes the link to you.
To understand whether setup works, we keep the first time your workspace prepares an export or completes a QA check. These records contain only a workspace identifier, the type of action and its time. They contain no strings, file paths or individual user identifiers, and are removed when the workspace is deleted.
Request logs, error traces and an activity trail of who changed what and when — including the times we changed something ourselves, which appear on your audit page under a support badge. Logs include IP addresses, which is unavoidable when running a network service and is what makes abuse and account compromise investigable.
What we do not collect
- No third-party analytics, no advertising network, and no script from any third party.
- Two third-party requests, both named. The typefaces come from Google Fonts, so Google sees the IP address of anyone loading a page — we intend to self-host them and remove this. And the checkout page loads Paddle's payment form from Paddle, which is how your card details reach them and never reach us. Nothing else on any page is fetched from anyone but us.
- No advertising or marketing cookies, and no cross-site tracking.
- No tracking pixels, web beacons, read receipts or click tracking in email. Our messages are HTML with a plain-text twin, and they load nothing remote — so opening one tells us nothing at all.
- No payment card numbers — if and when card payments are added, the processor holds those details and we never see them.
The app keeps seven things in your browser's local storage. None of them is a cookie and none is sent anywhere but to Lingvo: your session token; your light or dark theme choice; your interface language; which workspace you last opened; which machine-translation engine you last used in a project; an invitation token, from the moment you open an invitation link until you accept it; and — the one worth naming on its own — translation drafts.
That last one is your own content. While you are editing a translation, the text you have typed but not yet saved is kept in local storage against the project, locale and key, so closing the tab or losing your connection does not lose the work. It stays on your machine, it reaches us only when the edit is saved like any other edit, and it is removed as soon as that save lands. Clearing site data for Lingvo in your browser removes all of this.
Where it lives
The database and API both run in Sydney, Australia. Your strings are stored there and nowhere else. They leave that region in exactly two circumstances, both listed below: a sub-processor that states otherwise in the table, and a machine translation you asked for.
| Provider | What it handles | Where |
|---|---|---|
| Neon | The Postgres database — every string and account record. | AWS ap-southeast-2, Sydney |
| Fly.io | Runs the API. Holds no data at rest beyond logs. | syd, Sydney |
| Cloudflare | Serves the website and terminates TLS. | Global edge |
| Brevo | Sends transactional email: resets, invitations, verification. | EU |
| OpenAI | Machine translation for projects with no provider key of their own. Sees only the source strings of a translation you asked for. | United States |
| Paddle | Merchant of record for paid plans. Takes payment, issues invoices and handles tax. Sees your billing details; we never see a card number. | Global |
Machine translation and your strings
Nothing leaves Lingvo for a machine-translation provider until you ask for it. When you run a pre-translate or lingvo translate, the source strings for the keys you selected are sent to the provider you chose, and its reply comes back as a draft.
Which provider that is, is your choice: Claude, OpenAI, DeepL, Google, LibreTranslate or MyMemory. Each has its own terms about retention and training, and those terms — not ours — govern what it does with the text once it arrives. If a provider's policy matters to you, choose accordingly, or do not use machine translation at all. Everything else in Lingvo works without it.
With one exception, and it is the default on the Free plan. A project that has not been given a provider key of its own runs on Lingvo's own OpenAI account, so that the credits included with your plan are usable without you signing up to anything. In that case the provider is OpenAI and the choice is ours, not yours — which is why OpenAI is listed as a sub-processor above and the others are not. Add your own key for any provider and the request goes to your account instead, under your terms.
A workspace that uses only its own keys sends nothing to an account of ours. A workspace that never runs a machine translation sends nothing to any of them.
Your provider keys are encrypted and never readable back
A key you save is encrypted with AES-GCM before it is written to the database and is never returned by the API — not to you, not to an admin, not to the CLI. The interface shows only that a key is present.
Who can see your content
Members of your workspace, according to the role you gave them. Owners and admins can change structure; translators can write translations; viewers can only read.
On our side, access to the production database is limited to the people operating the service, is used for support and incident response, and is not used to read workspace content otherwise. We do not sell data, and we do not train models on your strings.
What we can change, and how you see it
A short, fixed list of things a person at Lingvo can do inside your workspace, and only after you have asked us about something. We can add machine-translation credits — for example to put back credits a failed run consumed, or after a billing mistake. We can end a run that is stuck, which returns the credits it reserved. We can end every sign-in, API token and agent connection belonging to one person, which is what we do when an account is compromised — and we email that person when we do. And we can re-run one of our own scheduled reconciliation jobs early.
Adding credits appears on your workspace's audit page, badged support, with the reason we were given. Ending somebody's sign-ins deliberately does not: it concerns one person, and putting it on a page every admin reads would tell their colleagues something about them that has nothing to do with the work. That person is emailed instead.
There is no way for us to sign in as you
No route, no button and no column that would allow it. We also cannot read a provider key, an API token or a password — the first is encrypted and returned by nothing, and the other two are stored only as hashes.
We keep our own record of every one of these actions, separately from yours, including an internal note saying why. That record is described under Keeping and deleting below.
Keeping and deleting
- Workspace content is kept until you delete it or close the account.
- Deleting a project removes its keys and translations; the deletion is not reversible from the interface.
- Operational logs are kept for a limited period and then discarded.
- Our own record of anything a person at Lingvo did inside your workspace is kept separately from your audit log and for longer than it. It has to outlive your copy, because the question it answers is what we did to you.
- That record carries an internal note about why we acted, which is not shown to you. It routinely refers to other customers — an outage, a shared root cause — which is exactly why it is a separate field from the reason you are shown on your audit page.
- Password-reset, invitation and verification tokens are stored hashed and expire on a fixed schedule.
- API tokens are stored hashed. A token shown once at creation cannot be recovered, only revoked and replaced.
Our database host keeps point-in-time recovery snapshots, and a deleted record can briefly survive in those. They roll over on the host's own schedule rather than being edited to remove single rows. We do not run a separate backup of our own.
Your rights
You can export everything: lingvo export --bundle writes every locale in the format you configured, and needs no plan, no credits and no permission from us. That is deliberate — a localization tool you cannot leave is a hostage situation, not a product.
You can also ask us to correct or delete your personal data, or to tell you what we hold. Depending on where you live you may have further rights under the GDPR, the Australian Privacy Act or comparable law; we apply the same process to everyone regardless of which one applies.
Contact
Write to privacy@lingvo.dev for anything on this page, including access, correction and deletion requests. We answer from a person, not a ticket queue.
Last updated 10 August 2026. Material changes are announced by email to workspace owners before they take effect.