Privacy Policy
Last updated: November 2026
Introduction
Loqu, Inc. ("we", "us", or "our") operates the Elyxs application and website. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.
Information We Collect
We collect information you provide directly, including your email address, language preferences, questions you ask, and flashcard data. We also automatically collect device information, usage data, and analytics to improve our service.
Using Elyxs from ChatGPT, Claude or Gemini
If you connect Elyxs to ChatGPT, Claude or Gemini, you sign in with your Elyxs account. The assistant then sends us only what a tool needs: the text of a card (an expression, its meaning, the languages, a short note on when you'd use it, its example sentences and, if you met the expression in a sentence, that sentence as written, with its translation) and which cards to show. Apart from that sentence, we don't receive your conversation. We send back your cards, your progress and your monthly card count. The cards the assistant saves are handled like cards you save in the app: their words and meanings go to OpenAI to make and check your cards (see “Who processes your data for us”). We also record which of them you've connected Elyxs to, when you first connected it, and when you last used Elyxs there, so the app can show it. We keep this until you delete your account. OpenAI, Anthropic and Google handle your conversation under their own privacy policies.
Asking in the Elyxs web app without an account. Your questions and Elyxs's answers are kept by Guuey, our agent platform, in the United States (Amazon Web Services) so the chat can carry on. Starting a new chat, or signing up or signing in on that browser, deletes the chat before it; when you sign up, your AI OK moves to your account. As of November 2026, a guest chat you leave open, or can no longer reach after clearing your browser, has no set end date at Guuey yet; write to privacy@loqu.co and we'll have it erased. Your browser keeps two random values in its local storage, one for your guest chat and one that remembers your AI OK; clearing the site's data removes both.
How We Use Your Information
We use your information to provide and improve Elyxs, personalize your learning experience, send notifications about your flashcard reviews, and communicate with you about updates and support. We do not use your data to train our AI models. How you answer each card decides when that card comes back, for you alone.
Data Security
We implement appropriate technical and organizational measures to protect your personal information. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.
Who processes your data for us
- Amazon Web Services: hosting, sign-in, storage, and AI processing (Amazon Bedrock); what it computes from your cards and chats is deleted with them.
- OpenAI: to create, check and choose content in Elyxs, your cards' expressions and meanings, with the language you're learning, are sent to OpenAI's API. This includes each card's languages, its note on when you'd use it and the sentences it already has. For a card from ChatGPT, Claude or Gemini, those include the example sentences it came with and the sentence you met the expression in. Under OpenAI's API terms, API data isn't used for training by default. OpenAI may keep it for up to 30 days to check for misuse, and longer if the law requires it or to prevent harm.
- On Elyxs Plus and Pro, we also prepare a picture for each example sentence on your cards. To make them, the card's expression, meaning, example sentences and its note on when you'd use it are sent to OpenAI's API to make the pictures. None of this includes your name, email or account. On Plus, a picture of a sentence Elyxs wrote is shared by every learner with the same sentence and kept with no set end date; to have one removed, tell us its sentence at privacy@loqu.co. On Pro, every picture is yours alone: it's kept with your card and deleted with the card or your account. A picture of a sentence you wrote is kept with your card and deleted when you delete the card or your account. Sentences that came with a card from ChatGPT, Claude or Gemini (its example sentences and the sentence you met the expression in) get pictures too, kept the same way.
- On Elyxs Plus and Pro, Elyxs's chat can also answer with a picture. To make it, only a short description written from your question, which may use your own words, is sent to OpenAI's API. None of this includes your name, email or account. The picture is yours: we keep it in our storage in the United States (Amazon Web Services) until you delete all your chats or delete your account.
- When you review a card, your answer, your cards and their review history, and questions from Elyxs's chat are also sent to OpenAI's API, without your name, email or account.
- Parts of Elyxs's answers in its chat are also sent to OpenAI's or TypeSafe's API, with the word you asked about, your two languages and the meaning shown. For this check, your question, your photos, your name, email and account aren't sent.
- ElevenLabs: to read words and sentences aloud when you tap to hear them in the app (in Elyxs's chat, on your cards and in the listening practice), the text being read, with its language, voice and speed, is sent to ElevenLabs' API, which processes it in the United States. The same text may also go to OpenAI's API. Nothing that identifies you is sent with it. A clip of a word or of a sentence Elyxs wrote is shared by every learner who hears the same text, and we keep it in our storage in the United States (Amazon Web Services) with no set end date, to reuse it; to have one removed, tell us its word or sentence at privacy@loqu.co. A clip of your own words, such as a sentence you wrote or a line from your photo, is kept for you alone and deleted when you delete the card it came from, delete all your chats, or delete your account. ElevenLabs handles the text under its own terms and, at our request, doesn't use it to train its models.
- Anthropic: questions you ask in the Elyxs app's chat are answered by Anthropic's Claude, through Guuey, our own agent platform (Loqu, Inc.). Guuey also keeps the chat's thread, your messages and its answers, in Amazon Web Services in the United States, so a conversation can carry on. When you ask while signed in, the app also sends Guuey your sign-in token, which includes your account id, email and name, so Guuey can confirm it's you and Elyxs's chat can see your plan and reach your cards; the token isn't sent to Anthropic.
- Anthropic, for suggestions: while you write in the app's chat, what's in your message box so far is sent to Anthropic's API, even before you send it, so Claude can suggest questions. Nothing that identifies you is sent with it. It isn't used to train Anthropic's models (Anthropic's commercial terms), and Anthropic deletes it within 30 days, longer only if it's flagged for misuse or the law requires it. Anthropic may process it in the United States, Europe, Asia or Australia, and stores it in the United States.
- OpenAI and TypeSafe, to tell which language you're using: the question you send in the app's chat and any photo you send go to OpenAI's API so Elyxs can tell which language a question is in. A question you ask by voice is checked the same way, from its text. With the text go your languages and, from the chat's previous turn, its question, the languages it was answered in and the words it was about. A photo goes as a short-lived link. The text and those details may go to TypeSafe's API instead, never a photo. Your name, email and account aren't sent, though anything you type or say yourself is in the text. Elyxs keeps no text or photo from this, only which language was detected: in our server logs for 30 days, and with the chat until you delete it. OpenAI doesn't train on it and deletes it within 30 days, longer only if it's flagged for misuse or the law requires it; TypeSafe keeps it as long as reasonably necessary to provide its service, longer only to prevent fraud or abuse or as the law requires, and doesn't train on it.
- In Elyxs's chat you can also ask about a photo. Before sending it, the app saves a new copy without its location or camera details. It's sent to OpenAI's API and, through Guuey, to Anthropic's Claude, to answer. Your name, email and account aren't sent to OpenAI or Anthropic with it. The photo stays with that chat in our storage in the United States (Amazon Web Services) and is deleted with it: when you delete the chat or all your chats, or delete your account.
- Your browser, if you use voice in the Elyxs web app: when you tap the mic, your browser turns your speech into text with its own speech service (in Chrome, Google's; in Edge, Microsoft's; in Safari, Apple's, or on your device; other browsers use their maker's). Your voice is handled by that service under its own privacy policy. If you're signed in, when you stop speaking, the recording (up to 60 seconds) also goes through our server to OpenAI's API, to write out what you said; its text can replace your browser's text in the message box, so you can check it before you send. The recording goes when you stop, even if you don't send the question; if you cancel, the recording isn't sent. Nothing else goes with it: not your name, email or account. OpenAI doesn't keep the recording or train on it, and Elyxs doesn't keep it either: it exists only while OpenAI writes it out. Your chat and the language check above get only the words, never the recording.
- Your phone, if you use voice in the Elyxs app on iPhone or Android: when you tap the mic, your phone turns your speech into text with its own speech service (on iPhone, Apple's, on the device when your language is installed there and otherwise on Apple's servers; on Android, your phone's speech service, usually Google's, on the device where it can). Your voice is handled by that service under its own privacy policy. When you stop speaking, the recording (up to 60 seconds) also goes through our server to OpenAI's API, to write out what you said; its text can replace your phone's text in the message box, so you can check it before you send. The recording goes when you stop, even if you don't send the question; if you cancel, the recording isn't sent. Nothing else goes with it: not your name, email or account. On Android, the recording is sent only from Android 13; on earlier versions, only your phone's text is used. OpenAI doesn't keep the recording or train on it, and Elyxs doesn't keep it either: on your phone it's gone once it's sent (or at the app's next start, if the app closed while you spoke), and on our server it exists only while OpenAI writes it out. Your chat and the language check above get only the words, never the recording.
- RevenueCat: subscriptions, under your account id. On the web, we pass your account email to RevenueCat's checkout so you don't have to type it, and Stripe takes your card and billing details; your card number never reaches us. In the phone apps, Apple or Google take the payment, and RevenueCat gets your account id and the store's receipt. If you allow ad measurement in the app, RevenueCat also sends your purchases to our attribution partner, so we can see which ads lead to a plan; otherwise it sends nothing there.
- AppsFlyer, our attribution partner, in the iPhone and Android apps: counting installs and measuring our ads. When you install and open the app, AppsFlyer gets its own ID for the app on your device (on iPhone also the app's vendor ID), your IP address, from which it works out your country, your device's model, system version and language, and the app's version. Whether or not you allow ad measurement, it may use your IP address and your device's details to count your install toward one of our ads it estimates you saw or tapped before installing. It gets no advertising identifier, and it passes none of this to an ad network. If you came from an Apple ad, the attribution token Apple created when you tapped it is redeemed with Apple so Apple can tell us which ad — without any advertising identifier. On Android, the app also passes on the Play Store's install referrer, which says which link or ad, if any, took you to the app's store page — again without any advertising identifier. If you allow ad measurement when the app asks, AppsFlyer also gets your device's advertising identifier, four app events (signing up, finishing onboarding, your first review and your first paid plan) and, from RevenueCat, your purchases, and shares them with the ad network that brought you to Elyxs, so we can see which ads work. If you say no, those events are deleted on your phone and never sent.
- PostHog: product analytics: your account id and plan, your languages and study settings, whether you use the widget, when you joined, which app you used, which screens you open and which buttons you tap (never the words on them), and counts. PostHog also gets your device or browser type, its language setting and time zone, and your IP address, from which it works out your approximate location. PostHog also receives error reports, and in the iPhone and Android apps it records how you move through the app (session replay), to help us fix problems; all text and images are masked there, so a replay doesn't show what your chats or cards say. The web app and our site don't record sessions. To object to analytics, write to privacy@loqu.co. Once we've recorded your objection, our servers stop sending PostHog anything linked to your account within 30 seconds, and we delete what PostHog holds under your account. An app may still send analytics after that; write to us and we'll delete that too. To withdraw your objection, write to us again.
- Google Firebase Analytics, in the iPhone and Android apps: automatic events such as first open, sessions and screens.
- Expo's push service, with Apple and Google, to deliver review reminders: your device's push token and the reminder text.
- Google and Apple, if you sign in with them: they confirm it's you and send us your email and your name (from Apple, only if you share it), which we keep with your account.
- Tally (in Belgium): our support form, in the app and on our website's contact page: what you write in it and the contact details you give.
The Elyxs app asks for your OK before it sends anything to the AI companies above (Anthropic, OpenAI, ElevenLabs and TypeSafe), and you can't use its features without it. You can withdraw it in Settings → AI data: the app's features then stop until you agree again, and the data we keep stays until you delete it.
We do not sell your personal information. Your data is stored mainly in the United States, at Amazon Web Services; the services named above store or process what they receive where "Transfers abroad" says.
Our attribution partner processes for us the app's installs and opens — without any advertising identifier — so we can count them and, whatever you answer at the prompt, may use your network address and device details to count an install toward one of our ads it estimates was seen or tapped before installing. If you came from an Apple ad, it also redeems the attribution token Apple created when you tapped it, so Apple can tell us which ad — without any advertising identifier. On Android, it also receives the Play Store's install referrer, which says which link or ad, if any, led to the install — without any advertising identifier. If you allow ad measurement in the app, we also share your device's advertising identifier, a few app events (sign-up, finishing onboarding, your first review and your first paid plan), your purchases, the ad that brought you to Elyxs, and basic device details — your country (from your network address), your device and system model, and your device's language — with that partner and the ad networks we advertise on, to measure our ads. Nothing else — never your cards, your languages or your email. You can say no at the prompt and change your mind later in Settings (on iPhone, Apple's Tracking setting, which the app's Settings opens).
Transfers abroad
Elyxs is run by Loqu, Inc. (United States), and the companies below handle your information, most of them in the United States. For Korea, we rely on Article 28-8(1)(3)(a) of the Personal Information Protection Act: the transfer is needed to set up and provide the service you signed up for, and we disclose it here. For Japan, we provide your personal data to the companies below, which are outside Japan, with your consent under Article 28 of the Act on the Protection of Personal Information; before you consent, this section tells you each company's country, an outline of that country's personal-information system, and the measures the company takes. Each company receives your information over an encrypted connection when you use the feature it serves, or when we run it for you (such as sending reminders or preparing your cards). If you have a question, complaint or dispute about any of these transfers, write to privacy@loqu.co: we handle it ourselves, whichever company is involved.
About the United States, where most of the companies below are: the US has no comprehensive federal privacy law. Personal information is protected by laws for particular sectors (such as finance and health care), by the Federal Trade Commission, which acts against unfair or deceptive practices, and by state laws, some of them comprehensive, such as California's Consumer Privacy Act. The US takes part in the APEC Cross-Border Privacy Rules system; Japan's Personal Information Protection Commission says that in a participating economy, protection in the private sector broadly equivalent to Japan's can be expected. US law also lets authorities require companies to disclose data in some cases, such as under FISA, with court and agency oversight; the Commission's country summary does not mark this as a system that may seriously affect individuals' rights. (Source: the Commission's summary for the United States, updated January 2022.)
About Israel, where our attribution partner is based: Israel has a comprehensive privacy law, the Protection of Privacy Law, 5741-1981, which covers both the public and the private sector. The European Commission has recognised Israel as giving adequate protection since 2011, so Japan's Personal Information Protection Commission (the PPC) says a comparison with Japan's rules isn't necessarily needed. The PPC lists no duty in Israel to keep data in the country, and no duty on companies to help the government gather information that may seriously affect individuals' rights. (Source: the PPC's summary for Israel, as of 15 February 2022.)
About Singapore, where TikTok Pte. Ltd. is: Singapore's Personal Data Protection Act 2012 covers the private sector, and the Public Sector (Governance) Act 2018 the public sector. Singapore has no adequacy decision from the European Commission. It has taken part in the APEC Cross-Border Privacy Rules system since February 2018, so for the private sector Japan's Personal Information Protection Commission (the PPC) says a comparison with Japan's rules isn't necessarily needed. There is no duty to keep data in the country. Under Singapore's Criminal Procedure Code, police officers of a certain rank can order a company to produce information for an investigation, without approval from an independent body; the PPC lists this as a system that may seriously affect individuals' rights. (Source: the PPC's summary for Singapore, as of 15 February 2022.)
For people in the EU, the EEA, Switzerland or the UK: Amazon Web Services, ElevenLabs, PostHog, Stripe, Google and AppsFlyer are certified under the EU-U.S. Data Privacy Framework and its UK and Swiss counterparts; for Anthropic, TypeSafe, RevenueCat and Expo, the European Commission's standard contractual clauses apply, with UK and Swiss terms where they provide them; OpenAI processes data from the EEA and Switzerland through OpenAI Ireland Ltd. and data from the UK under those clauses. For ad measurement, Meta is certified under the EU-U.S. Data Privacy Framework, as Google is; for TikTok, and for Apple's attribution token, the standard contractual clauses in their terms apply. Tally is in the EU. Ask privacy@loqu.co for a copy of the clauses.
- Amazon Web Services, Inc. (servers run by Amazon Data Services, Inc.) · United States · aws-korea-privacy@amazon.com · everything Elyxs keeps: your account, cards, review history, chats (including those Guuey keeps for us) and settings, and our server logs · hosting, sign-in and storage, and AI processing on Amazon Bedrock, and sending our emails · for as long as "What we keep and for how long" says · protective measures: under its data processing addendum, AWS handles the data only on our instructions, doesn't access it except to provide the service or as the law requires, keeps it secure (ISO/IEC 27001, SOC 2), and doesn't use what Amazon Bedrock processes to train any model; for storage alone, AWS doesn't handle the data, which stays in our own account.
- Anthropic, PBC · United States, and for processing also Europe, Asia or Australia · privacy@anthropic.com (domestic representative in Korea: Anthropic Korea Ltd., anthropic_privacy@kimchang.com) · what "Who processes your data for us" lists for Anthropic · answering in Elyxs's chat and suggesting questions · what you type for suggestions is deleted within 30 days, longer only if flagged for misuse (up to 2 years) or the law requires it; your chats under Anthropic's commercial terms: by default deleted within 30 days, or up to 2 years if flagged for misuse · protective measures: under its data processing addendum, which also covers our chat's calls made through Guuey, Anthropic handles the data only on our instructions, keeps it confidential and secure (SOC 2 Type II, ISO 27001), holds its sub-processors to equally protective terms, and doesn't train its models on it.
- OpenAI OpCo, LLC · United States and other countries where its cloud providers operate · privacy@openai.com (domestic representative in Korea: OpenAI Korea Ltd., privacykorea@openai.com) · what "Who processes your data for us" lists for OpenAI · the uses listed there · up to 30 days to check for misuse, longer if the law requires it or to prevent harm; it keeps no voice recordings · protective measures: under its data processing addendum, OpenAI handles the data only on our instructions, keeps it confidential and secure (SOC 2 Type 2, ISO/IEC 27001), uses sub-processors only on equally protective terms, and doesn't train its models on it.
- Eleven Labs Inc. · United States · dpo@elevenlabs.io · the text you choose to hear, with its language, voice and speed (nothing that identifies you) · reading aloud · kept in its request history under its own terms (it doesn't train on it, at our request) · protective measures: under its data processing addendum, ElevenLabs handles the data only on our instructions, keeps it secure (SOC 2 Type II, ISO/IEC 27001), and holds its sub-processors to equally protective terms.
- TypeSafe AI, Inc. · United States · privacy@typesafe.ai · the parts of an answer it checks, with the word you asked about, its meaning and your two languages; and, to tell a question's language, the text of a question in the app's chat, typed or spoken (when you send it) with your languages and, from the chat's previous turn, its question (up to 200 characters), the languages it was answered in and the words it was about (never your photos, recordings, name, email or account) · checking content in Elyxs · as long as reasonably necessary to provide its service, longer only to prevent fraud or abuse or as the law requires; not used to train its models · protective measures: under its data processing addendum, TypeSafe handles the data only on our instructions, keeps it secure, tells us of any breach within 72 hours, and holds its sub-processors to equally protective terms.
- PostHog, Inc. · United States (Virginia) · privacy@posthog.com · what "Who processes your data for us" lists for PostHog · product analytics and session replay · events up to 7 years and session replays 30 days · protective measures: it gets your account id, never your email or name; under its data processing agreement, PostHog handles the data only on our instructions, keeps it confidential and secure (SOC 2 Type 2), holds its sub-processors to equivalent obligations and doesn't let third parties train AI on it; it is certified under the EU-U.S. Data Privacy Framework.
- RevenueCat, Inc. · United States · compliance@revenuecat.com · your account id (a random id before you sign in), your purchases and store receipts, and on the web your email · managing subscriptions · while you have an account; a random id that was never linked to an account is kept under RevenueCat's own terms · protective measures: it gets a random id and your purchase records, never your name, and your email only on the web; under its terms, RevenueCat keeps the data confidential, uses it only to provide its service, and holds a SOC 2 Type II report; its published data processing addendum (security, sub-processor and audit terms) is written for data from the EEA, the UK, Brazil and California, and doesn't cover data from Japan or Korea.
- AppsFlyer Ltd., with its affiliate AppsFlyer Inc. (United States) · Israel, with the data stored in the European Union and the United States · privacy@appsflyer.com · what "Who processes your data for us" lists for AppsFlyer: for everyone, the app's installs and opens with its own ID for the app on your device (on iPhone also the app's vendor ID), your IP address and your device's details and, if you came from an Apple ad, Apple's attribution token and, on Android, the Play Store's install referrer, but no advertising identifier; if you allow ad measurement, also your advertising identifier, four app events and your purchases · counting installs and measuring our ads, including, for everyone, counting an install toward one of our ads estimated to have been seen or tapped before installing, from the IP address and device details · no more than 24 months · protective measures: under its data processing agreement, AppsFlyer handles the data only on our instructions, passes nothing to an ad network unless you allow ad measurement, and keeps the data secure (ISO/IEC 27001, SOC 2); AppsFlyer Inc. is certified under the EU-U.S. Data Privacy Framework and its UK and Swiss counterparts, and the European Commission recognises Israel as giving adequate protection. AppsFlyer's affiliates in other countries may access the data to give support, under the same agreement; AppsFlyer lists them at appsflyer.com/legal/subprocessors.
- Stripe, LLC · United States · privacy@stripe.com · on the web, your email and the card and billing details you enter at checkout · taking web payments · as payment and tax law requires · protective measures: Stripe processes payments for us and, on its own account, uses payment data to prevent fraud and meet its legal duties, which can include training its fraud models; its data processing agreement sets out its security programme (PCI DSS Level 1, SOC 2), and it is certified under the EU-U.S. Data Privacy Framework.
- 650 Industries, Inc. (Expo) · United States · expo.dev/contact · your device's push token, your account id and the notification · delivering notifications · until delivered, under Expo's terms · protective measures: Expo encrypts data in transit and at rest and holds a SOC 2 Type 2 report; it publishes processor terms only for data covered by EU law, not for data from Japan or Korea.
- Google LLC · United States and other countries where Google runs data centers · googlekrsupport@google.com (domestic representative in Korea: Google Korea LLC, data-access-requests@google.com) · if you sign in with Google, your email and name; on Android, your device's push token and the notification; in the iPhone and Android apps, Firebase Analytics' events with the app's ID on your device (on iPhone also its vendor ID) and, on Android, the advertising ID · sign-in, delivering notifications and analytics · analytics events up to 14 months; the rest under Google's terms · protective measures: under its data processing and security terms for Firebase, Google handles the data only on our instructions, keeps it confidential and secure (ISO/IEC 27001, SOC 2) and holds its sub-processors to equivalent terms, and it is certified under the EU-U.S. Data Privacy Framework; signing in with Google is Google's own service, under its privacy policy.
- Apple Inc. · United States · apple.com/legal/privacy/contact · if you sign in with Apple, your email and the name you share; on iPhone, your device's push token and the notification · sign-in and delivering notifications · notifications are deleted after delivery; sign-in data under Apple's terms · protective measures: Apple is certified under the Global Cross-Border Privacy Rules (CBPR) system, and its push notification service is within its ISO/IEC 27001 and 27018 certifications; signing in with Apple is Apple's own service, under its privacy policy.
- The ad networks we advertise on: Meta Platforms, Inc., Google LLC and Apple Inc. (United States), and TikTok Pte. Ltd. (Singapore; for people in the United States, TikTok USDS Joint Venture LLC) · United States and Singapore · Meta: facebook.com/privacy/policy; Google: googlekrsupport@google.com; TikTok: tiktok.com/legal/report/privacy; Apple: apple.com/legal/privacy/contact · Meta, Google and TikTok, only if you allow ad measurement in the app: your device's advertising identifier, four app events (signing up, finishing onboarding, your first review and your first paid plan), your purchases, the ad that brought you to Elyxs, your country, your device and system model, and your device's language; Apple, if you came from an Apple ad: only the attribution token Apple itself created when you tapped our ad in the App Store, so Apple can tell us which ad it was · measuring our ads; the data goes through our attribution partner as each event happens · as each network's privacy policy says; your advertising identifier goes to them only until you withdraw · protective measures: Meta, Google and TikTok get the data only with your consent when the app asks, and each network handles it under its own privacy policy and its advertising terms with us; Meta and Google are certified under the EU-U.S. Data Privacy Framework, and Apple under the Global Cross-Border Privacy Rules (CBPR) system.
- Tally BV · Belgium (European Union) · hello@tally.so · what you write in our support form (in the app or on our website's contact page) and the contact details you give · answering support requests · until we've answered and you ask us to delete it · protective measures: Belgium is in the EU, which Japan designates as having protection equivalent to its own.
If you connect Elyxs to ChatGPT, Claude or Gemini, we send your cards, your progress and your monthly card count to OpenAI, Anthropic or Google (United States) when you ask that assistant for them, at your request; each handles it under its own privacy policy. Disconnecting Elyxs there stops it.
You can refuse these transfers. Withdrawing your AI consent in Settings → AI data stops the transfers to Anthropic, OpenAI, ElevenLabs and TypeSafe, and Elyxs's features can't be used without them. Turning off notifications on your phone stops the ones to Expo, Apple and Google for notifications. You can refuse the others by not using the feature that needs them, such as web checkout (Stripe) or signing in with Google or Apple; that feature then won't work for you. The app gives RevenueCat a random id when you open it, so refusing that transfer means not using Elyxs. This version of the app can't turn off its own analytics, so the only way to stop the transfers to PostHog and Google Firebase Analytics is to stop using it; then write to privacy@loqu.co and we'll delete what PostHog keeps under your account id. Writing to us by email instead of using our support form avoids the one to Tally. Deleting your account stops all of them. Elyxs can't run without Amazon Web Services, so refusing that transfer means deleting your account. To refuse ad measurement, say no when the app asks, once, after your first review. Your advertising identifier, the app events and your purchases then never go to our attribution partner or to any ad network. You can change your mind later in Settings (on iPhone, Apple's Tracking setting, which the app's Settings opens). The app still tells our attribution partner when it's installed and opened (on Android, with the Play Store's install referrer), without your advertising identifier, and the partner may still use your IP address and device details to count your install toward one of our ads it estimates you saw or tapped before installing; deleting your account doesn't stop that while the app is on your phone, so refusing it means removing the app.
What we keep and for how long
Your email, your cards, your review history and your chats in the app, for as long as you have an account (Guuey's copies of your chats follow its own deletion: see Deleting your account). Deleting a chat removes it from your account at once; to have Guuey's copy erased too, write to privacy@loqu.co. We also keep our own copy of your chats in the app, in our database in the United States (Amazon Web Services): what you asked and whether you typed or spoke it (we keep the words, never a recording, and a photo only as a reference to it), what Elyxs answered and showed you, the cards saved from it, and when, in which languages, with which tools and how long it took. From each answer we also note what kind of question it was (a meaning, how to say something, a pronunciation, a difference, examples), which words it was about, and whether you asked how to pronounce them, compared them with another word or asked for more examples. We keep it so you can find your chats and pick them up again, and to help you learn: to show you what you've asked about, and, once Elyxs offers them, to show you what you found hard and suggest study plans or tutoring that fit you. It's kept until you delete it: one chat at a time, all of them at once in Settings (your cards stay), or with your account. To run Elyxs's chat, we also keep usage numbers for each answer that never contain what you or Elyxs wrote: when it happened, the languages, the tools used and whether they worked, the model, how long it took and how long the question and answer were. They carry a random tag instead of your account, and once you delete your account they can no longer be linked to you. Our server logs record which app made each request (for example ChatGPT or Claude) and are kept for up to 30 days. Elyxs's logs never contain what you typed; the one exception is logs from app versions before 1.0, which could include parts of your chats and cards and your account details, and those logs are deleted by 31 December 2026. Logs at Guuey, our agent platform, can include your chat messages. Pictures prepared for example sentences Elyxs wrote (Plus) are shared and kept with no set end date; pictures for sentences you wrote are kept with their card and deleted with the card or your account. The same goes for pictures of sentences that came with a card from ChatGPT, Claude or Gemini. On Pro, every picture is kept with its card and deleted with the card or your account. Voice clips of a word or a sentence Elyxs wrote are shared and kept with no set end date; clips of your own words are deleted when you delete the card they came from, delete all your chats, or delete your account. Picture answers in Elyxs's chat (Plus and Pro) are kept until you delete all your chats or delete your account. Photos you send with a question stay with that chat and are deleted with it. A photo you attach but don't send is deleted automatically, usually within three days. We keep recovery backups for 35 days. After we erase your data, it's gone from them within 35 days.
Deleting your account
When you delete your account (Settings → Delete account, or privacy@loqu.co), we permanently erase your account and its data (your email, flashcards, review history, settings, devices, reminders and connected apps) within 35 days of your request. Anything we've already sent to an AI company above to run a feature can stay with it under its own rules after you delete your account: up to 30 days at OpenAI and Anthropic, longer only if it's flagged for misuse or the law requires it; ElevenLabs and TypeSafe keep it under their own terms. If pictures for your cards are still waiting to be drawn when you delete your account, we cancel that request within minutes and keep nothing it returns.
Your chats in the app are also kept by Guuey, our agent platform, which follows its own deletion: deleting your account doesn't erase them there yet. Ask privacy@loqu.co and we'll have them erased.
Chats you had before creating an account aren't linked to it, so deleting your account doesn't reach them. Disconnecting Elyxs in ChatGPT, Claude or Gemini stops its access; it doesn't delete your cards.
Your Rights
You have the right to access, correct or delete your personal information. You can see and remove your cards in the app and delete your account in Settings. To get a copy of your data or to correct it, write to privacy@loqu.co.
Children
Elyxs is for people 14 and over. We don't knowingly collect personal information from children under 14. If you believe a child under 14 has an account, write to privacy@loqu.co and we'll delete it.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.
Contact Us
If you have questions about this Privacy Policy, please contact us at privacy@loqu.co.