Privacy Policy

Enmersion is operated by an independent developer based in New Jersey, United States. For anything in this policy, write to hello@enmersion.com. We are the data controller for the personal data described here.

Account. Your email address and a password. Passwords are stored only as a salted hash (scrypt); we never see or store the password itself. We keep the time your account was created and last signed in.

Learning profile. Your native language, the languages you are learning, a self-reported level for each, and your study preferences (daily goal, answer mode, and similar settings).

Your library. The media you add: titles, creators and media type; any text you paste (song lyrics, article text, book passages); text we extract from photos you take or pick; and the flashcards, definitions, example sentences and summaries generated from them.

Study history. Which cards you reviewed and when, how you rated them, answers you typed in study mode, and the spaced-repetition schedule derived from that history.

Usage of AI features. Each time an AI feature runs we record the feature, the model used, token counts and the credits charged, so we can show you your remaining allowance and keep our own costs in check.

Feedback. If you send feedback from the app we store your message, the email address you optionally enter, and your browser or device user agent so we can reproduce problems.

Crash and error reports. If the app crashes or hits an unexpected error, a report is sent to our error-monitoring provider containing the error, a stack trace, and your device model, operating system and app version. Reports are configured not to include your account, your email, your library content or anything you typed. The provider sees the IP address the report is delivered from; we do not use it.

Technical data. Our servers see the IP address and user agent of each request. We use IP addresses in memory, for minutes at a time, to rate-limit sign-in attempts and abusive traffic. We do not write them to our database.

What we do not collect. No advertising identifiers, no precise location, no contacts, no payment card details (we do not currently sell anything in the app), and no analytics or tracking pixels.

• To run the service: sign you in, keep your library and study history in sync across devices, schedule reviews, and send password-reset emails you request.
• To generate study material: build decks, define words, translate example sentences, read text out of photos, and recommend media in the language you are learning.
• To meter free and paid credits and prevent abuse of the AI features.
• To find and fix bugs, using crash reports and feedback you send us.
• To respond when you contact us.

Where the law requires a legal basis, we rely on the performance of our contract with you (providing the app), our legitimate interests in keeping the service secure and working, and your consent where we ask for it (for example, notification permission on your phone).

We do not sell personal data and we do not share it with advertisers. The following providers process data on our behalf, only to deliver the service:

• Google Gemini (Google LLC) generates definitions, decks, translations, summaries and reads text out of your photos. To do that we send Google the relevant content: the title and creator of the media, text you pasted, the photo you submitted, the language pair and your level, and, for recommendations, a sample of the words in your cards. Google processes this under its Gemini API terms. Photos are processed to extract text and are not stored by Enmersion.
• Google Search is used through Gemini's search grounding to look up song lyrics and media details. Queries contain media titles and creator names, not your account details.
• Resend delivers transactional email, such as password resets. It receives your email address and the message content.
• Railway hosts our servers and database.
• Sentry receives the crash and error reports described above.
• Wikipedia, Wikidata and Apple's iTunes Search are queried with media titles to fill in details and cover art. Cover images are loaded by your browser or device directly from Wikimedia or Apple, so those services see your IP address when an image loads.
• Websites you paste a link to. When you add an article by URL, our server fetches that page to extract its text. The site sees our server's address, not yours.

We may also disclose data if required by law, or to protect the rights, safety or property of Enmersion, our users or others.

The website uses a single cookie, immerse_session, to keep you signed in. It is HTTP-only, lasts up to 30 days, and is removed when you sign out. We use the browser's session storage for transient interface state, such as text you are in the middle of pasting. We do not use advertising or analytics cookies.

The mobile apps store your sign-in token in the device's secure keychain and keep a small offline copy of due cards so you can study without a connection. Both are removed when you sign out.

Your data is stored on servers provided by Railway in the United States. If you use Enmersion from outside the United States, your data is transferred there and handled under United States law. By using the service you agree to this transfer.

We keep your account data for as long as your account exists. When you delete your account, your profile, library, cards, study history, credits ledger and sessions are deleted immediately. Feedback you sent us is kept but unlinked from your account. Encrypted backups of our database are retained for up to 30 days and then overwritten. Crash reports are retained by Sentry for 90 days.

• Access and correction. Your profile, library and settings are all visible and editable in the app.
• Deletion. Settings → Delete account removes your account and data immediately, after confirming your password.
• Export. Email us and we will send you a copy of your data in a machine-readable format.
• Notifications. Study reminders on your phone are local notifications you can turn off in your device settings at any time.
• Objection and complaints. You can object to our processing or complain to your local data-protection authority. We would appreciate the chance to address your concern first.

Depending on where you live you may have additional rights under laws such as the GDPR, the UK GDPR, the CCPA or Australia's Privacy Act. We honour these for all users regardless of location. To exercise any right, email hello@enmersion.com from the address on your account.

Enmersion is not directed at children under 13, and you must be at least 13 years old (or the age of digital consent where you live, if higher) to create an account. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

All traffic to Enmersion is encrypted in transit with TLS. Passwords are hashed with scrypt, session tokens are stored only as hashes, and access to production systems is limited to the operator. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as the law requires.

When we change this policy we will update the date at the top and, for material changes, tell you in the app or by email before they take effect. Continuing to use Enmersion after a change means you accept the updated policy.

Questions, requests or concerns: hello@enmersion.com.