Cookie Policy

This Cookie Policy explains how LingoGap uses cookies, browser storage and similar technologies when you visit or use the LingoGap website and web application.

It should be read together with the LingoGap Privacy Policy.

1. Who provides LingoGap?

Service and trading name: LingoGap

Legal seller and commercial operator: UgleCare ApS

CVR: 34353255

Registered address: Borups Allé 116, st. tv., 2000 Frederiksberg, Denmark

Website: lingogap.dk

Email: support@lingogap.dk

LingoGap is operated and sold commercially by UgleCare ApS under licence from the relevant owner of the LingoGap platform and intellectual property.

UgleCare ApS does not acquire ownership of the LingoGap brand, software, educational content, domains or other intellectual property through this commercial role.

References in this Cookie Policy to “LingoGap”, “we”, “us” or “our” refer to the LingoGap service and UgleCare ApS when acting in its relevant customer-facing and data-controller capacity.

Technical development, maintenance, hosting administration, security and technical support may be performed by an independent technical operator on behalf of UgleCare ApS.

2. What are cookies and similar technologies?

A cookie is a small piece of data that a website or service may store in or access from a user’s browser or device.

Websites and applications may also use other technologies that perform similar functions, including:

• local storage;
• session storage;
• IndexedDB;
• authentication persistence;
• browser cache mechanisms;
• temporary redirect state;
• browser communication channels;
• software-development-kit storage;
• device permissions; and
• provider-managed identifiers.

This Policy uses the term “cookies and similar technologies” to cover both traditional cookies and these related browser technologies.

Under Danish rules, cookies and similar technologies generally require prior consent unless they are exclusively technically necessary to provide a service requested by the user. Separately, where those technologies involve personal data, GDPR requirements such as legal basis, transparency and data minimisation may also apply.

3. Current use of cookies and similar technologies

Based on the current reviewed implementation, LingoGap does not itself set traditional first-party cookies through application code.

The current application does not contain:

• document.cookie writes;
• application-generated Set-Cookie headers;
• an application cookie library;
• analytics cookies;
• advertising cookies;
• remarketing cookies;
• session-replay tracking;
• behavioural advertising technologies; or
• a custom cookie-consent platform.

LingoGap does, however, use browser storage and provider-managed technologies for:

• authentication;
• remaining signed in;
• Google Sign-In;
• functional preferences;
• flashcard behaviour;
• limited account-activity coordination;
• Stripe-hosted payment and subscription services; and
• browser speech functions.

4. Categories of technologies used

The technologies currently used by or in connection with LingoGap fall into the following categories.

4.1 Strictly necessary technologies

These support functions such as:

• user authentication;
• maintaining a signed-in session;
• completing authentication redirects;
• protecting authenticated access;
• coordinating necessary account state; and
• providing payment and subscription functionality requested by the user.

Disabling these technologies may prevent login, payment, subscription management or other core account functions from working correctly.

4.2 Functional and preference technologies

These remember choices actively made by the user, including:

• appearance;
• audio speed;
• lesson-support language;
• flashcard review mode; and
• flashcard review state.

Disabling or deleting these technologies generally does not prevent basic access to the website, but preferences may be lost or reset.

4.3 Operational account-activity technology

LingoGap stores a limited local timestamp to reduce unnecessary repeated updates of the authenticated user’s lastActivityAt account field.

Following the latest implementation change, this is limited to:

• an authenticated and visible opening of the application; and
• a return from hidden or background state to visible state.

It is not triggered by:

• every click;
• every form change;
• every submission;
• every route change; or
• detailed page-by-page interaction.

It is not intended for:

• advertising;
• behavioural profiling;
• marketing;
• cross-site tracking;
• detailed usage analytics; or
• ranking users by engagement.

4.4 Provider-managed technologies

Firebase, Google and Stripe may use cookies or similar technologies within their own authentication, payment, fraud-prevention or hosted service environments.

These technologies are not directly created or controlled through LingoGap’s application storage code.

5. Application browser-storage inventory

5.1 Theme preference

Storage type:localStorage

Key:danish-coach-theme

Possible values may include:

• system;
• light; or
• dark.

Purpose:

• remembers the selected visual theme;
• applies the theme when the application loads; and
• helps avoid displaying the wrong theme before the application is fully rendered.

Category: Functional preference

Created when:

• the theme is initialised; or
• the user changes the appearance setting.

Retention:

• remains until overwritten;
• remains until browser storage is cleared; or
• remains until removed by the application or browser.

Effect of deletion:

The application may return to its default or system appearance.

5.2 Text-to-speech playback speed

Storage type:localStorage

Key:danish-coach-tts-rate

Data stored:

A selected speech-playback rate, such as a slower or faster audio speed.

Purpose:

• remembers the user’s selected playback speed; and
• applies it to supported speech and audio functions.

Category: Functional preference

Created when:

• the text-to-speech preference is initialised; or
• the user selects a playback speed.

Retention:

Persistent until overwritten or cleared.

Effect of deletion:

The playback speed may return to its default value.

5.3 Foundation support-language preference

Storage type:localStorage

Key:foundationSupportLanguage

Possible values may include:

• en;
• fa;
• both; or
• none.

Purpose:

• remembers the selected support language for Foundation lessons; and
• controls which supported explanatory language is displayed.

Category: Functional preference

Created when:

• Foundation language support is initialised; or
• the user changes the selection.

Retention:

Persistent until overwritten or cleared.

Effect of deletion:

The support-language preference may return to its default state.

5.4 Flashcard review mode

Storage type:localStorage

Key:flashcardReviewMode

Possible values may include:

• normal;
• reverse; or
• mixed.

Purpose:

• remembers how the user wishes to review flashcards; and
• applies the selected review direction or mode.

Category: Functional preference

Created when:

• the flashcard-review interface loads; or
• the user changes the review mode.

Retention:

Persistent until overwritten or cleared.

Effect of deletion:

The review mode may return to its default setting.

5.5 Fast Review fallback offset

Storage type:localStorage

Key:danish-coach-fast-fallback-offset

Data stored:

An integer representing the current fallback position or offset used by the Fast Review function.

Purpose:

• varies fallback flashcard selection;
• avoids repeatedly presenting the same fallback sequence; and
• maintains continuity in the user-requested Fast Review behaviour.

Category: Functional state

Created when:

The Fast Review fallback function is used.

Retention:

Persistent until updated or cleared.

Effect of deletion:

The fallback review position may reset.

5.6 Limited last-activity coordination

Storage type:localStorage

Key pattern:danish-coach:lastActivityAt:{uid}

The {uid} portion contains the user’s Firebase account identifier.

Data stored:

A timestamp representing the latest local activity-write coordination time.

Purpose:

• prevents unnecessary repeated Firestore writes;
• throttles updates to the account’s lastActivityAt field;
• coordinates limited last-activity recording; and
• supports administrative visibility of the latest recorded application presence.

Current triggers:

The current implementation records activity only for:

• an authenticated visible application opening; and
• a hidden-to-visible foreground return.

The mechanism no longer records ordinary:

• clicks;
• field changes;
• submissions; or
• route changes.

Category: Operational account activity

Local retention:

• the local coordination timestamp expires after 30 days;
• expired values are cleaned up by the application; or
• the value may be removed earlier if browser storage is cleared.

Server-side record:

The related account field is stored separately in Firestore as:

users/{uid}.lastActivityAt

Clearing the browser’s local-storage value does not itself delete the previously recorded server-side lastActivityAt value.

Effect of deletion:

The local write-throttling state may reset. This does not delete:

• Foundation progress;
• completed lessons;
• current lesson;
• last-opened lesson;
• PD3 progress;
• flashcards;
• spaced-repetition data;
• AI usage; or
• subscription information.

6. BroadcastChannel activity coordination

Technology: Browser BroadcastChannel

Channel name:danish-coach:last-activity

Data communicated between open tabs may include:

• an activity-written event type;
• Firebase UID; and
• write timestamp.

Purpose:

• coordinates recent activity updates between LingoGap tabs open in the same browser;
• reduces duplicate writes; and
• helps prevent several tabs from immediately recording the same activity.

Persistence:

This channel is temporary and is available only while participating browser tabs or contexts remain open.

It is not persistent storage and does not normally survive closing the participating tabs.

Category: Operational account coordination

It is not used for cross-site advertising, marketing or behavioural profiling.

7. Firebase Authentication storage

LingoGap uses Firebase Authentication to provide account access.

Firebase Authentication may use SDK-managed browser storage to:

• keep users signed in;
• restore authenticated sessions;
• store authentication state;
• complete Google redirect authentication;
• coordinate popup or redirect events; and
• maintain security-related authentication information.

LingoGap currently initialises Firebase Authentication without explicitly selecting a different persistence mode.

Firebase documentation explains that browser authentication state may be persisted locally, for the current session, or only in memory depending on configuration and environment. Firebase also documents local persistence as the browser default when supported.

7.1 Firebase IndexedDB

Storage type: IndexedDB

Database:firebaseLocalStorageDb

Object store:firebaseLocalStorage

Possible data:

• authenticated Firebase user state;
• session information;
• token-related state;
• provider information; and
• SDK persistence data.

Purpose:

• maintaining authenticated account access; and
• restoring the signed-in user state.

Category: Strictly necessary authentication

Retention:

May persist until:

• sign-out;
• account removal;
• SDK cleanup;
• browser-data clearing; or
• another applicable authentication event.

7.2 Firebase local persistence keys

The Firebase SDK may use key patterns including:

• firebase:authUser:<API_KEY>:[DEFAULT];
• firebase:persistence:<API_KEY>:[DEFAULT];
• firebase:redirectUser:<API_KEY>:[DEFAULT]; and
• firebase:authEvent:<API_KEY>:[DEFAULT].

The actual Firebase API key is not displayed in this Policy.

These keys may contain:

• serialised authentication state;
• persistence bookkeeping;
• redirect-user state; or
• popup and redirect event state.

The exact storage mechanism and key behaviour may vary by:

• Firebase SDK version;
• browser;
• browser capabilities;
• authentication method; and
• fallback behaviour.

7.3 Firebase storage fallback

Where IndexedDB or another preferred persistence mechanism is unavailable, Firebase may use another supported browser-storage method or in-memory persistence.

The exact method depends on the browser and Firebase SDK behaviour.

7.4 Effect of disabling Firebase storage

Restricting or deleting Firebase authentication storage may:

• sign the user out;
• prevent the session from being restored;
• interrupt Google redirect login;
• require the user to authenticate again; or
• prevent authenticated functions from working correctly.

8. Google Sign-In

LingoGap supports Google authentication through Firebase Authentication.

The authentication flow may use:

• Google OAuth services;
• Firebase authentication storage;
• temporary popup or redirect state;
• authentication-helper domains;
• provider cookies; and
• Google-controlled account-session technologies.

Purpose:

• allowing the user to sign in using a Google account;
• completing popup or redirect authentication;
• confirming the authentication result; and
• connecting the authenticated identity to the LingoGap account.

Category: Strictly necessary when the user selects Google Sign-In

LingoGap does not use Google Sign-In as evidence of Google Analytics, advertising tracking or personalised advertising.

Google or Firebase may independently process cookies or browser information as described in their own privacy and service documentation.

Users who do not wish to use Google authentication may use another supported authentication method where available.

9. Stripe Checkout and Customer Portal

LingoGap uses Stripe-hosted services for:

• subscription Checkout;
• payment processing;
• recurring billing;
• Customer Portal;
• payment-method management;
• invoices and receipts where configured;
• subscription cancellation; and
• refund and payment administration.

The LingoGap application does not store Stripe customer, subscription or payment identifiers in browser localStorage.

Instead, the application creates a Stripe Checkout or Customer Portal session and redirects the browser to a Stripe-hosted URL.

Stripe may use its own cookies or similar technologies on Stripe-controlled pages for purposes such as:

• providing Checkout and Customer Portal;
• payment security;
• fraud detection;
• remembering relevant service state;
• identifying interaction with a Checkout session;
• regulatory compliance; and
• service reliability.

Stripe states that it uses both temporary and longer-lived cookies, including for fraud-detection services.

The exact Stripe cookie names, values and retention periods may depend on:

• the Stripe service used;
• the Checkout configuration;
• the Customer Portal configuration;
• browser behaviour;
• payment method;
• Stripe’s current systems; and
• fraud-prevention requirements.

Stripe’s own Cookie Policy and Privacy Policy apply to Stripe-controlled processing.

Disabling Stripe technologies may prevent:

• payment;
• subscription creation;
• Customer Portal access;
• payment-method changes; or
• fraud-prevention checks

from operating correctly.

10. Speech recognition and microphone functions

Supported LingoGap speaking features may use browser-provided speech-recognition technology, including:

• SpeechRecognition; or
• webkitSpeechRecognition.

When the user activates a supported speaking function:

• the browser or device may request microphone permission;
• audio may be processed by the browser or its speech-service provider;
• speech may be converted into transcript text; and
• the transcript may be sent to LingoGap for the requested correction or feedback.

The current LingoGap application does not use:

• MediaRecorder;
• application-controlled raw microphone recording storage; or
• browser storage for raw audio recordings.

Speech-recognition processing may vary by:

• browser;
• browser provider;
• operating system;
• device;
• language support; and
• provider configuration.

Microphone permission is controlled through the browser or device.

A user may revoke microphone access through browser or device settings, but speaking functions may then become unavailable.

Microphone permission is not used for advertising or unrelated tracking.

11. Browser speech synthesis and stored audio

LingoGap may use browser speech-synthesis functionality, including:

• speechSynthesis; and
• SpeechSynthesisUtterance.

This may be used to play text using voices available through the browser or device.

LingoGap does not intentionally store speech-synthesis content in application browser storage.

Voice processing and voice availability may depend on the browser, device and operating system.

LingoGap may also deliver pre-generated educational audio files through first-party or configured content-delivery URLs, including Cloudflare R2-hosted assets.

The current audio components do not create application cookies or localStorage records for the audio content itself.

Normal browser or network caching may still occur.

12. Cache Storage and service workers

The current reviewed application does not contain an application-managed service worker or custom Cache Storage implementation.

No application use was identified for:

• navigator.serviceWorker.register;
• caches.open;
• caches.match;
• caches.put; or
• Workbox.

LingoGap includes a web-app manifest, but a manifest alone does not create a service worker or offline Cache Storage.

Normal browser caching, hosting-platform caching, CDN caching or HTTP caching may still occur independently of application-managed Cache Storage.

13. Session storage

The current reviewed LingoGap application does not directly write application data to sessionStorage.

Firebase Authentication may nevertheless use temporary SDK-managed state as part of popup or redirect authentication.

The exact storage method and cleanup timing may depend on the Firebase SDK and browser environment.

14. Analytics, advertising and tracking

LingoGap does not currently use the following technologies in its reviewed application implementation:

• Google Analytics;
• Google Tag Manager;
• Meta Pixel;
• TikTok Pixel;
• Microsoft Clarity;
• Hotjar;
• FullStory;
• Mixpanel;
• PostHog;
• Segment;
• Sentry’s browser SDK;
• Amplitude;
• Plausible;
• Matomo;
• session replay;
• remarketing pixels;
• behavioural advertising; or
• personalised advertising.

No third-party advertising or analytics script was identified in the reviewed application source.

The limited lastActivityAt mechanism described in this Policy is not intended to operate as website analytics or behavioural monitoring.

If LingoGap later introduces:

• analytics;
• marketing cookies;
• advertising pixels;
• session replay;
• cross-site tracking; or
• other non-essential tracking technologies,

this Policy will be updated and an appropriate consent mechanism will be implemented before those technologies are activated where required.

Danish authorities state that technologies used for purposes such as visitor statistics or personalised advertising will generally require consent unless a specific exemption applies.

15. Is a cookie-consent banner currently used?

LingoGap does not currently display a general cookie-consent banner.

Based on the reviewed implementation, LingoGap does not currently deploy application-authored analytics, advertising or marketing technologies requiring a general analytics or advertising consent choice.

The current browser technologies are limited to:

• authentication;
• user-requested preferences;
• flashcard functionality;
• operational activity coordination;
• provider-hosted payment functions; and
• user-activated speech features.

This does not mean that every technology is outside data-protection law.

Personal-data processing connected to these technologies remains subject to:

• applicable legal bases;
• transparency requirements;
• data minimisation;
• security;
• retention limits; and
• user rights.

LingoGap will reassess the need for a consent banner whenever its technologies, providers or purposes change.

16. Legal basis and consent

16.1 Technically necessary technologies

LingoGap relies on technically necessary technologies where storage or access is required to provide a function explicitly requested by the user, such as:

• signing in;
• remaining signed in;
• completing authentication;
• accessing an authenticated account;
• using Checkout;
• accessing Customer Portal; or
• coordinating essential service state.

Technically necessary technologies generally do not require cookie consent under the Danish cookie rules, although associated processing of personal data must still comply with GDPR.

16.2 Functional preference technologies

Functional browser storage is used to remember choices actively requested or selected by the user.

These choices include:

• theme;
• audio speed;
• support language; and
• flashcard mode.

These technologies are limited to providing or remembering the requested function and are not used for advertising or cross-site profiling.

16.3 Operational activity coordination

The limited activity timestamp is processed for:

• account-operation visibility;
• security and support;
• avoiding excessive repeated writes; and
• maintaining a limited administrative record of the latest recorded application presence.

LingoGap relies on contractual necessity or legitimate interests as applicable to the relevant processing of the associated personal data.

The local technology is limited to authenticated app opening and foreground return and is not intended to generate detailed behavioural statistics.

16.4 Future consent-based technologies

Where consent is legally required for a future technology, it will not be activated until the user has been given appropriate information and a valid choice.

A user’s refusal of optional technologies will not be treated as consent.

17. How to manage or delete browser storage

Users can generally control cookies and browser storage through browser or device settings.

Depending on the browser, users may be able to:

• view stored website data;
• delete cookies;
• delete localStorage;
• delete IndexedDB data;
• clear site permissions;
• block third-party cookies;
• block all cookies;
• reset microphone permission;
• clear cached files; or
• clear all site data.

The exact steps depend on the browser and device.

Deleting LingoGap browser storage may:

• sign the user out;
• reset the visual theme;
• reset audio speed;
• reset support-language preference;
• reset flashcard-review mode;
• reset Fast Review fallback position;
• reset local activity-write throttling; or
• interrupt Google redirect login.

Deleting browser storage does not automatically delete personal data stored in:

• Firebase Authentication;
• Firestore;
• Stripe;
• support email;
• server logs; or
• other provider systems.

Requests concerning server-side personal data should be made in accordance with the LingoGap Privacy Policy.

18. Clearing local storage versus deleting an account

Clearing cookies or browser storage is not the same as deleting a LingoGap account.

Clearing local browser data may remove:

• authentication persistence;
• preferences;
• temporary authentication state; and
• local operational state.

It does not automatically delete:

• the Firebase user account;
• profile data;
• Foundation progress;
• lesson responses;
• completed lessons;
• flashcards;
• spaced-repetition records;
• speaking transcripts;
• writing corrections;
• PD3 attempts;
• AI feedback;
• AI usage records;
• subscription records;
• invoices;
• refunds;
• support correspondence; or
• administrative records.

To request account deletion, contact:

support@lingogap.dk

Account deletion and subscription cancellation are separate processes.

19. Third-party provider controls

Certain technologies are controlled partly or entirely by third-party providers.

These may include:

• Firebase;
• Google;
• Stripe;
• the user’s browser provider;
• the user’s operating-system provider;
• speech-recognition providers;
• Vercel;
• Cloudflare; and
• other infrastructure providers.

LingoGap may not be able to directly delete, alter or describe every internal cookie or technical identifier used by an independent provider.

Users should review the applicable provider’s privacy and cookie information where that provider acts independently or controls the relevant technology.

20. International processing

Some providers may process technical or personal data outside Denmark or outside the European Economic Area.

Where personal data is transferred internationally, the transfer must be governed by an appropriate lawful mechanism as described in the LingoGap Privacy Policy.

This may include:

• an adequacy decision;
• Standard Contractual Clauses;
• the EU–US Data Privacy Framework where applicable;
• supplementary safeguards; or
• another lawful transfer mechanism.

21. Security

Authentication and browser-storage technologies may contain security-sensitive state.

Users should:

• avoid using shared or public devices for persistent login;
• sign out after using a shared device;
• protect their email account;
• use a strong and unique password;
• keep their browser and device updated; and
• report suspected unauthorised account access.

LingoGap does not intentionally display Firebase API keys, authentication tokens or other sensitive SDK values in this Policy.

22. Production and provider verification

This Cookie Policy is based on:

• a source-code review of the current LingoGap application;
• the current browser-storage implementation;
• the configured authentication and payment flows;
• the reviewed absence of analytics and advertising scripts; and
• the current limited lastActivityAt implementation.

Some provider-managed technologies cannot be fully identified from repository code alone.

In particular, exact cookies or storage used by the following may depend on runtime behaviour:

• Stripe Checkout;
• Stripe Customer Portal;
• Google Sign-In;
• Firebase authentication-helper domains;
• hosting infrastructure;
• CDN infrastructure; and
• browser speech recognition.

LingoGap may verify these technologies through:

• production browser developer tools;
• network inspection;
• provider dashboards;
• provider documentation; and
• periodic technical audits.

Material findings will be reflected in an updated version of this Policy where necessary.

23. Changes to this Cookie Policy

LingoGap may update this Cookie Policy because of:

• changes in law;
• regulatory guidance;
• new or changed functionality;
• new browser-storage technologies;
• new service providers;
• changes to authentication;
• changes to payment services;
• introduction of analytics;
• introduction of marketing technologies;
• changes to retention;
• security improvements; or
• clarification of existing information.

The current version and effective date will be displayed at the top of the Policy.

Where required, LingoGap will provide notice or request consent before activating a new optional technology.

A later version of this Policy does not retroactively make earlier unlawful storage or processing lawful.

24. Language

The official Version 1.0 of this Cookie Policy is in English.

Translations may be made available for convenience.

A translation may not reduce information, choices or rights required under applicable law.

25. Contact

For questions about cookies, browser storage, privacy or LingoGap’s current technologies:

Service and trading name: LingoGap

Legal seller and commercial operator: UgleCare ApS

CVR: 34353255

Registered address: Borups Allé 116, st. tv., 2000 Frederiksberg, Denmark

Website: lingogap.dk

Email: support@lingogap.dk