VIDLISH Privacy Policy

Version 1.1 — October 6, 2026 Effective date: October 6, 2026

VIDLISH takes the protection of personal data seriously. This policy explains what data is processed, why it is processed, how long it is kept, which third parties may be involved and what rights users have.

1. Data controller

The data controller is:

• Name: Florian MONTAIGNE
• Capacity: natural person and non-professional publisher of VIDLISH
• Privacy contact: tech_elec@yahoo.fr

The data controller’s home address is not made public.

2. Data processed

Depending on how you use VIDLISH, the following categories may be processed.

2.1 Account and authentication

When you sign in with Google, VIDLISH uses Google Sign-In to authenticate you.

Within V1, VIDLISH may retain:

• the stable technical identifier associated with your Google account and used as your VIDLISH account identifier;
• your first name when provided and used to initialize or personalize your profile;
• VIDLISH session tokens required for authentication.

Email addresses and avatars are not part of the persistent VIDLISH V1 profile.

VIDLISH does not request or store your Google password or YouTube login credentials.

2.2 Preferences and settings

VIDLISH may retain:

• translation language;
• studied language;
• reference English level;
• selected learning interests;
• application language;
• theme or appearance settings;
• notification preferences.

2.3 Learning activity

To provide learning continuity, recommendations and progress tracking, VIDLISH may process information such as:

• videos started or studied;
• playback position and resume data;
• studied sentences or learning units and related learning state;
• quiz answers and results;
• flashcards and memorization state;
• review sessions;
• favorites;
• recent searches when that feature is used;
• information required for learning streaks, recent activity and progress indicators;
• information required to create and track VIDLISH notifications.

These data are used to operate VIDLISH learning features and personalize the experience for signed-in users.

2.4 Notifications and device identifiers

When notifications are enabled, VIDLISH uses Firebase Cloud Messaging (FCM).

For this purpose, VIDLISH may process:

• a notification token associated with the application installation or device;
• notification preferences;
• state required to create, deliver and read notifications in the application.

VIDLISH does not seek to use these identifiers to track users outside VIDLISH.

2.5 Guest mode

In guest mode, some configuration data may be stored locally on the device, including application settings required for the user experience and the local tutorial state.

Guest mode does not prevent integrated third-party services, including YouTube, from processing their own technical data when those services are used.

2.6 Product monitoring and the VIDLISH Observatory

VIDLISH provides an administrator-only Observatory used for product, learning and technical monitoring.

Within V1, this Observatory primarily relies on business data already persisted by VIDLISH and produces aggregated indicators. VIDLISH has not implemented an exhaustive generic event-telemetry layer intended to record every user action.

Access to the Observatory is restricted to VIDLISH administration.

2.7 Technical data

Operating and securing the backend may require processing technical connection or request data generated by the infrastructure, such as IP addresses, timestamps, request information or technical logs.

Within V1, VIDLISH does not maintain a separate warehouse intended to keep these logs indefinitely. Operational retention depends on the technical rules and active service plan of the hosting provider, Railway, and is limited to operation, security, diagnostics and applicable legal requirements.

3. Purposes and legal bases

Providing the service and account

Purposes include authentication, account management, saving preferences and settings, learning continuity and operation of the learning features.

Legal basis: performance of the requested service and these Terms of Use.

Learning personalization

Purposes include personalized content or learning actions, resuming activities and calculating progress or consistency indicators.

Legal basis: performance of the requested service.

VIDLISH recommendations do not produce legal or similarly significant effects.

Notifications

Purposes include providing notifications enabled by the user and ensuring their technical delivery.

Legal basis: performance of the requested service and, for operating-system permissions, the user’s choice.

Product monitoring, security and service integrity

Purposes include understanding how the product operates using necessary data, securing sessions and access, preventing abuse, diagnosing technical issues and protecting infrastructure.

Legal basis: the publisher’s legitimate interest in operating, improving and securing the service, subject to users’ rights and freedoms.

Legal obligations

Certain data may be retained or disclosed when required by law.

Legal basis: compliance with a legal obligation, where applicable.

4. YouTube API Services and Google

VIDLISH uses YouTube API Services and an embedded YouTube player to provide video content and certain metadata.

Use of these services may result in processing by Google or YouTube under their own policies.

Google Privacy Policy:

https://policies.google.com/privacy

YouTube Terms of Service:

https://www.youtube.com/t/terms

VIDLISH does not use users’ YouTube login credentials and is not intended to access a user’s personal YouTube account.

Video content and metadata originating from YouTube remain subject to applicable YouTube rules and third-party rights.

5. Firebase Cloud Messaging

VIDLISH uses Firebase Cloud Messaging, provided by Google, for push notifications.

Firebase may process technical installation identifiers and information required for notification delivery under its own documentation and privacy rules.

Firebase privacy information:

https://firebase.google.com/support/privacy

6. Artificial intelligence

VIDLISH uses artificial-intelligence services, including OpenAI APIs and, for some catalogue-preparation steps, Google Gemini services.

Within V1, these processing operations are mainly performed server-side using video content, metadata and transcripts required to prepare learning resources. The ordinary learning flow and recommendation engine do not require sending the VIDLISH account identity, authentication tokens or personal learning history to these AI providers.

If this scope changes and processing user personal data through an AI provider becomes necessary, this Privacy Policy will be updated in accordance with applicable requirements.

OpenAI data-processing information:

https://openai.com/policies/data-processing-addendum/

Google Privacy Policy:

https://policies.google.com/privacy

7. Railway hosting and infrastructure

The VIDLISH backend, server-side processing and database are hosted through Railway Corporation.

Railway states that its primary processing operations take place in the United States, even where some workloads may be deployed in another region. Railway provides a Data Processing Addendum and transfer mechanisms for data subject to the GDPR.

Railway information:

https://railway.com/legal/privacy

https://railway.com/legal/dpa

8. Legal website and Cloudflare

The public website hosting these legal documents is intended to be deployed on Cloudflare Pages, provided by Cloudflare, Inc.

Visiting that website may result in Cloudflare processing technical connection data under its own rules.

Cloudflare Privacy Policy:

https://www.cloudflare.com/privacypolicy/

9. Recipients and third parties

Data are accessible only to the extent necessary to operate the service.

Depending on the feature used, recipients or providers may include:

• the VIDLISH publisher;
• Railway Corporation for backend and database hosting;
• Google for Google Sign-In;
• Google / YouTube for YouTube-based functionality and YouTube API Services;
• Google / Firebase for push notifications;
• OpenAI and Google Gemini for preparation of certain catalogue resources, within the scope described above;
• Cloudflare for hosting the legal website;
• other strictly necessary technical providers added in the future and identified in an updated version of this policy.

VIDLISH does not sell users’ personal data.

10. Transfers outside the European Economic Area

Some providers used by VIDLISH are established in the United States or rely on global infrastructure.

Railway states in particular that its primary processing operations take place in the United States and provides, as applicable, the Data Privacy Framework and/or Standard Contractual Clauses for transfers subject to the GDPR. Google, Cloudflare and the relevant AI providers also maintain their own mechanisms applicable to international transfers.

Where personal data are transferred outside the EEA to a country without an adequacy decision, applicable safeguards may include Standard Contractual Clauses, the Data Privacy Framework where applicable, or another transfer mechanism recognized by applicable law.

11. Retention

V1 retention criteria are:

• account, first name, authenticated preferences and settings: until account deletion, unless a legal obligation requires additional retention;
• learning history and associated learning data: until deleted through the relevant VIDLISH history-clearing function or until account deletion;
• local session data: until logout, account deletion, applicable expiry or local removal by the application;
• guest settings and local tutorial state: until replaced, application data are cleared or the application is uninstalled, depending on operating-system behavior;
• VIDLISH notification tokens and notification data: for as long as required to provide notifications and until disabled, unregistered or deleted with the account, as applicable;
• infrastructure technical logs: for the operational period applied by the hosting provider and active service plan, without separate indefinite archiving by VIDLISH.

Data independently held by Google, YouTube, Firebase, Railway, Cloudflare, OpenAI or Google Gemini are retained under their own policies and obligations.

12. Clearing history and deleting an account

For signed-in users, the privacy screen provides controls including:

Clear history

This clears the learning-history data covered by that feature while retaining the account, preferences and settings.

Delete account

This deletes the VIDLISH account and associated data managed by VIDLISH in accordance with the application’s implementation.

Deleting a VIDLISH account does not delete the user’s Google account or data independently processed by Google, YouTube or other providers for their own purposes.

13. Your rights

Subject to the GDPR and applicable law, you may have rights including:

• access;
• rectification;
• erasure;
• restriction of processing;
• data portability where applicable;
• objection where processing relies on legitimate interests;
• withdrawal of consent where a specific processing activity relies on consent.

To exercise your rights:

tech_elec@yahoo.fr

Reasonable identity verification may be requested where necessary to protect the relevant data.

You may also lodge a complaint with the French data-protection authority, the CNIL:

https://www.cnil.fr/

14. Security

VIDLISH implements technical and organizational measures intended to protect data against unauthorized access, loss, alteration or unlawful disclosure.

Authentication relies in particular on Google Sign-In and VIDLISH session tokens. Application session data are stored using secure storage mechanisms provided by the application and operating system.

The public backend uses HTTPS. Administrator access to the Observatory is authenticated.

No information system can guarantee absolute security.

15. No sale of data and VIDLISH advertising

Within V1, VIDLISH does not sell users’ personal data.

Embedded YouTube videos may nevertheless display content or advertising controlled by YouTube. Such processing and display are governed by Google and YouTube rules.

16. Changes to this policy

This policy may be updated to reflect changes to VIDLISH, new providers or features, legal requirements or changes in third-party services.

Where required, users will be appropriately informed of material changes.

17. Contact

For privacy questions:

tech_elec@yahoo.fr