Privacy notice

How Moien handles your data, why, and what you can ask us to do about it. Last updated 18 October 2026 (the optional public link to a certificate, which shows it, with your Google account’s name, to anyone who has the link: sections 2, 3, 5c, 6, 7 and 8). Before that, 16 October 2026 (the signed certificate is now kept, so that it is signed once and can be downloaded again: sections 2, 3, 5, 5c, 6, 7, 8 and the browser storage note); also 16 October 2026 (the optional buttons that open LinkedIn from a certificate: sections 6 and 7); also 16 October 2026 (a certificate of completion issued by Valnivo Sign for Moien, for your Google account, with the name of that account printed on it: sections 2, 3, 5c, 6, 7 and 8). Before that, 16 October 2026 (the optional choice to run the speech check and the chat’s message check on a server of Valnivo Labs instead of on your device: sections 2, 3, 5b, 6, 7 and 8; and a donated recording may now be one line of a conversation, not only a word, and donors are asked again: sections 3, 5a and 6). Before that, 12 October 2026 (one small, non-personalised advertisement at the end of a few pages of the website, with Google’s consent message: sections 2, 3, 6, 7, 8, 9 and 11). Before that, 9 October 2026 (anonymous page and screen view counts on the website and in the Android app: sections 2, 3, 6, 7 and 8; the synthetic voice; how long chat data stays stored, what leaving does not remove and what members see; named counted actions; the platform recorded with a donor's consent). Before that, 7 October 2026 (opening Moien inside Valnivo Home, section 5). Before that, 2 October 2026 (the chat rooms, section 5b, with the words the chat refuses, review requests, and rooms that end after 5 quiet hours or when empty, the message check on your device, and training copies of reported and refused messages). Before that, 30 September 2026 (no advertising; Android backup, reminders and permissions; starred words and the daily goal in sync; the reviewers of donated recordings; the Android download; e-mail you send us, fonts served from our own domain, and the age the app is meant for).

1. Who is responsible

The data controller is Valnivo Labs, based in Luxembourg, which develops and runs Moien. Valnivo Labs is a trade name, not a registered company: if you need the controller named for a formal request or a complaint to a supervisory authority, ask at the address below and it will be given to you. This covers the Moien website and the Moien Android application.

• E-mail: privacy@luxembourgish.app

Valnivo Labs is not a registered company, so it has no business premises to publish; e-mail is the way to reach the controller, and every request described in this notice is answered there. If a supervisory authority needs a postal address, it will be provided to them on request.

There is no Data Protection Officer. Moien does not meet the criteria in Article 37 GDPR that would require one.

2. The short version

• You can use the entire course without an account and without giving us anything.
• Your progress is kept in your own browser or phone, not on our servers, unless you sign in.
• Signing in with Google is optional. It carries your progress between your devices and is what the chat rooms and a certificate of completion need.
• On the website, and only on luxembourgish.app, one small advertisement served by Google AdSense and labelled “Sponsored” sits at the end of a few pages (the home page, the list of lessons, the vocabulary, a word’s page and the verbs), never in a lesson, an exercise, the review, the placement test or the chat. It is not personalised. In the EU, the EEA, the UK and Switzerland, Google asks for your consent before setting its cookies, and you can change your choice at any time on the Settings and data page. The Android app shows no advertising.
• The website and the Android app count page and screen views with GoatCounter, a service that sets no cookie and stores no IP address or visitor identifier. There is no tracking pixel and no profiling of learners, and in the app you can switch the counting off on the Settings and data page.
• If you record yourself saying a word, the recording never leaves your device and is not kept, unless you have opted in to donating recordings and press "Send this recording" for that one, or you have chosen to run the speech check on our server (next points).
• Donating recordings to improve the speech check is off until you opt in. Donations are stored under a random donor number, never under your name, your e-mail address or your Google account, and you can withdraw and delete them in one step.
• Phrases and example sentences that no speaker recorded in the dictionary are read by a synthetic voice made by the ZLS (an AI voice). Its listen button is marked "Synthetic voice". The audio is produced in advance and shipped as ordinary files: nothing about you is used to make it or sent to anyone when you play it.
• The optional speech check is off until you turn it on. It is an AI speech recogniser that runs on your device; turning it on downloads it once, and your recordings are still never sent anywhere, unless you choose to donate one or to run the check on our server (next point).
• Instead of downloading them, you can choose, separately for the speech check and for the chat’s message check, to have them run on a server of Valnivo Labs. This is off until you choose it, needs you to be signed in, and sends each recording (speech check) or the text of each message (chat) to that server over an encrypted connection, to be checked and discarded at once: nothing is stored or logged. You can go back to your device at any time. The server is a virtual machine we rent from Oracle Cloud Infrastructure in Frankfurt, Germany.
• When you have finished a level, you can download a certificate of completion as a PDF issued by Valnivo Sign for Moien. It is made for the Google account you are signed in with, and the name printed on it is that account’s name, taken from your sign-in: you do not type it. The signed certificate is kept for you, so that it is signed once and can be downloaded again (section 5c). It needs you to be signed in, because it is made from your progress record.
• If you choose, you can make one certificate viewable by anyone who has a link, so that a LinkedIn post carrying the link shows it as a preview card. Nothing is public unless you tick the box and press Create a public link, and you can turn the link off at any time (section 5c).
• In the Android app, Android's own backup may copy what the app stores to your Google account, and reminders are shown by your phone without anything being sent. Both can be switched off (section 3).
• The chat rooms are optional and open only to people aged 16 or older who sign in and choose to join. Others there see the name you choose for the chat and what you write, never your Google name, picture or e-mail address. Messages are deleted after 30 days (section 5b).
• You can delete your account and everything stored with it from inside the app, in one step.
• If you e-mail us, your message passes through Cloudflare, which forwards it to a Gmail mailbox where it is read and answered.

3. What we process, why, and on what legal basis

We do not sell data, we do not build learner profiles, and the only analytics we run are the anonymous page-view counts in the first row of this table. The one advertisement on some pages of the website is not personalised (above), and the Android app shows none.

4. Learning without an account

This is the default. Your level, completed lessons, points, today's points, your daily goal, the words you starred and your review schedule are written to your browser's local storage on your own device, or to the app's own storage on Android. Nothing is sent to us and we cannot see it. Pressing "Reset progress" on the Settings and data page, or clearing your browser's site data, removes it permanently. On Android, the phone's own backup may keep a copy in your Google account (section 3).

5. If you sign in with Google

Sign-in is entirely optional. When you use it, Google tells us your account's name, e-mail address, profile picture and a user ID, and we store your learning progress (your level, lessons, points, today's points, your daily goal, the words you starred, your streak and your review schedule) against that ID in a Cloud Firestore database hosted by Google in the European Union, in the multi-region eur3. Security rules on the database allow only you, signed in as yourself, to read or write your own record. We do not read individual records.

Deleting your account

On the Settings and data page, signed in, "Delete account and data" removes the signed certificates kept for you (section 5c), your stored progress and your Moien account in one step, and empties the progress and any certificate copies on that device. If the certificates cannot be deleted, nothing is deleted and you can try again. Google may ask you to sign in again first to confirm it is you; if you cancel that, nothing is deleted and the progress on your device stays as it was. Your Google account itself is untouched; you are only removing Moien's copy and Moien's ability to identify you. The deletion is immediate and there is no backup from which we could restore it. You may also simply sign out, which leaves your cloud copy in place until you return.

Opening Moien inside Valnivo Home

Valnivo Home can open Moien while you are signed in there. Moien then uses that Home account's user id as your user id here, and creates the account if you do not already have one. It is a new account in Moien, not a join to a Google account you already use on luxembourgish.app. Your course data stays in Moien. Signing in on luxembourgish.app itself does not use the Home account. The course still works with no account. Valnivo Home's own notice describes the dashboard.

5a. Donating recordings

The speech check uses models that learnt from native speakers, which is why they often miss learners. If you want to help, you can opt in on the Settings and data page. Nothing changes until you do, and even then a recording is sent only when you press "Send this recording" for it; every other recording stays on your device as before.

• No link to you. Donations are stored under an anonymous account created only for donating, and its random number is your donor number. It is never your Google account, even when you are signed in for sync, and we do not store your name, e-mail address or IP address with a recording.
• Where. In the same Cloud Firestore database as synced progress, hosted by Google in the European Union (eur3), in a separate area that security rules restrict to your donor number.
• Who listens. Valnivo Labs, and native Luxembourgish speakers who help check that a recording says the word it is labelled with, bound to confidentiality. Each reviewer signs in with a Google account that Valnivo Labs has listed as a reviewer, and their answer is stored with the recording under that account's user ID (section 3). Recordings are not sold and are never published or shared as recordings.
• What comes of it. Checked recordings may be used to train improved versions of the speech-recognition models, which are published openly (on Hugging Face) so that the app and anyone else can use them. A trained model contains no recording. The permission to do this is in section 6 of the terms of use.
• If you opted in before 30 September 2026. That permission was not written down then, so the Settings and data page asks you again. Until you agree, the database refuses any new recording from you and none of your recordings is used for training; if you do not want to agree, "Stop and delete my recordings" deletes them.
• Where training runs. On a GPU server rented for the purpose from Scaleway in Paris, France (section 6), only for the duration of a training run. The checked recordings are copied there for that run with your first language if you gave it and a speaker code made from your donor number, which cannot be turned back into it (it keeps one person's recordings together, so the model is tested on voices it did not train on). The server, with everything on it, is deleted when the run ends.
• Withdrawing. "Stop and delete my recordings" on the Settings and data page deletes every recording you sent, your donor record and the anonymous account, immediately. A model already trained cannot unlearn what it learnt, but it holds no recording of you. If you no longer have the device, write to the address in section 1 with the donor number shown on the Settings and data page, and we will delete them.
• Your first language. Optional, asked when you opt in and changeable afterwards; "Prefer not to say" stores nothing. It is kept with your donor record, not with each recording, and used only to see how well the speech check understands people of each first language, and to know which recordings come from native Luxembourgish speakers. It is deleted with the rest when you withdraw.
• How long. Until you withdraw, and never more than 3 years after a recording was sent. A donor record with no recordings left is deleted once its consent is 3 years old.
• Age. Donating is for people aged 16 or older, which you confirm when you opt in.

5b. Chat rooms

The chat rooms let learners write to each other, by level. They are off until you choose to join, which needs a Google sign-in, your confirmation that you are 16 or older, and your agreement to the chat rules in section 11 of the terms of use.

• What others see. The name you choose for the chat and what you write, with its time. Your Google name, picture and e-mail address are never shown in the chat. Other members can read every message in a room for as long as it is kept, and can copy it; write nothing you would not want a stranger to read.
• Rooms and their creators. Any member may open up to three rooms. Whoever opens a room looks after it: they can delete any message in it and ban someone from it, and they receive the reports about it. They see only what every member sees, plus those reports.
• Reports. A report goes to the room's creator and can be read by Valnivo Labs, which may delete content or close a room or a membership that breaks the rules or the law. Something illegal can also be reported to support@luxembourgish.app.
• Words the chat refuses. A list of slurs, threats and plainly abusive words, in English, French, Spanish, Portuguese, Italian, Arabic, German and Luxembourgish, is refused in messages, room names and chat names, also when spelled out letter by letter or disguised with symbols. The app checks before sending, and the database refuses it anyway; a refused message is not stored. If you think a message was refused wrongly, by the list or by the message check below, you can ask for a review: that message, the word (or "message check") and the room go to Valnivo Labs, are read only to correct the list or the check, and are deleted after 90 days at most, or sooner when you leave the chat.
• The message check (AI, on your device or, if you choose, on our server). To use the chat you install a small AI model, a multilingual classifier of abusive language, which runs on your phone or computer, or you choose to have it run on our server instead (sections 2, 3 and 6), in which case nothing is installed. Before you send a message that passed the list above, it reads it: if the message may break the rules, it asks you to look again and you can still send it; if it is sure the message is insulting or abusive, the message is not sent, you are told why, and you can ask for a review. It decides only whether a message is sent, and nothing about you; on your device it sends nothing anywhere; on our server it receives only the text of the message, scores it and discards it at once. Either way it stores nothing, and its verdict is not kept. It can be wrong both ways, especially in Luxembourgish. It is downloaded once from Hugging Face, and on the website its small runtime comes from jsDelivr (section 6); "Remove the message check" deletes it, after which the chat cannot be used on that device.
• Training the message check. Every report and every review request also leaves a training copy of the message concerned, whoever wrote it: the text with names, e-mail addresses, links, phone numbers and @mentions removed automatically, the interface language and the reason, and nothing that links it to its author, the room or the reporter. The room's creator's handling of a report proposes a label (deleting the message: abusive; dismissing the report: fine), and the reviewers named in section 13 read the copies and give theirs; a copy trains only on a label they confirm. The legal basis is our legitimate interest in keeping the rooms free of abuse (Article 6(1)(f) GDPR). Copies are kept 3 years at most, never published, used to train and test the check (on Scaleway, section 6, when training runs), and only the trained model is ever released. Because nothing links a copy to you, leaving the chat cannot find and delete it; you can object at privacy@luxembourgish.app, quoting the text, and we will delete it.
• Blocking. Blocking someone hides what they write from you, in every room. They are not told. The list is kept with your chat membership, which only you can read.
• Where. In the same Cloud Firestore database as synced progress, hosted by Google in the European Union (eur3). Security rules let only signed-in members read the rooms, keep a banned member out of the room they were banned from, and let nobody but you read your membership.
• How long. A room ends, and is deleted with every message in it, once 5 hours have passed without a message in it, or as soon as it is empty: when its last message is deleted, when its creator leaves it before anyone has written, or 10 minutes after it was opened with nothing written. Nobody can read it from that moment, and a job that runs every six hours deletes what is left. Every message expires after 30 days, every report after 180 days and every review request after 90 days; the weekly clean-up then deletes them, so each can stay stored for up to a week longer.
• Leaving. "Leave the chat and delete what I wrote", on the chat page and on the Settings and data page, deletes your rooms with everything in them, your messages in every room, the reports you made and those about your rooms, your review requests, and your chat membership, at once. Deleting your account does the same. It does not remove reports that other people filed about your messages: those keep the message and your chat name, and are deleted with the other reports after 180 days at most; nor the training copies described above.
• What other members see. Your chat name, and a pseudonymous account number that is part of a room's address and of each message's author. Never your Google name, photo or e-mail address.
• Age. The chat is open only to people aged 16 or older, which you confirm when you join.

5c. Certificates of completion

When you have passed every lesson of a level and are signed in with Google, the page /certificate offers to make the certificate of that level as a PDF, issued by Valnivo Sign for Moien. Moien is the course the certificate is for. Valnivo Sign, another product of Valnivo Labs, signs it, and its public page can check it too. This is what happens:

• What is sent, only when you press the button: your Google sign-in token, the level, and the PDF your browser made. Your browser first asks the issuer what the certificate will say, so the sheet you see shows what the issuer confirmed and not what your device says.
• Where. To the Moien issuer service of Valnivo Labs, on Google Cloud in the European Union (Cloud Run, region europe-west1). It checks your account and your progress, sees your name, the level and the PDF, and keeps the signed certificate (what is kept is described below) and nothing else. It then passes the PDF and a title to the issuer service of Valnivo Sign, another product of Valnivo Labs, which signs with a key held in Google Cloud KMS in the European Union, stores nothing and logs nothing it is sent. The key cannot be exported; the service may only ask KMS to sign.
• What it reads. It checks your sign-in, reads your own synced progress record (users/<your user ID>), which has to show every lesson of the level as passed, takes the date from the record, and builds the number from the level, the year and a short code derived from your user ID, so that two learners never share a number. The name printed is your Google account’s name, taken from your sign-in. If the account has no name, no certificate is made. What the certificate says is only that the synced progress record of your Google account showed every lesson of the level as passed when it was issued; Moien does not check how that record was made.
• What is kept, where and why. The signed certificate, as one PDF for each level you have been issued: your Google account’s name, the level, the certificate number and the date, with Valnivo Sign’s proof. It is kept in a private Google Cloud Storage bucket in the European Union (Belgium, europe-west1), under a name made of the Moien project, your user ID and the level, so that your certificate is signed once and you can download it again at any time, on any device, instead of a new one being signed each time. Nothing else about the certificate is kept, and the service logs no name, token, user ID, address or file. Moien keeps no other list of the certificates it has issued.
• Who can reach it. You, through Moien’s issuer, when you are signed in with your Google account: the service gives a stored certificate to the account it was issued to and to nobody else, and the bucket is not public. Access to the bucket is limited to the issuer service’s own service account; Valnivo Labs staff can reach it only through Google Cloud permissions, and nobody else is granted any.
• Deleting it. “Delete account and data” on the Settings and data page deletes every certificate kept for your account first, and the deletion stops, with nothing else deleted, if that cannot be done, so that you can try again. Deleting the account deletes the stored certificates; copies you downloaded, or that your own device kept (below), are yours and are erased from your device when you sign out or delete the account, but not from files you saved or shared. Google Cloud Storage may keep a deleted object for a short period under its own settings before it is gone for good.
• On your device. After you download a certificate, your browser keeps a copy in its IndexedDB, so that you can download it again without a connection. It is checked against the fingerprint the issuer gives before it is used, and it is erased when you sign out or delete the account. If your browser does not allow that storage, the file is simply fetched from the issuer again.
• The optional public link. Only if you tick “I understand that anyone with the link can see my certificate, including my name” and press Create a public link, the issuer makes a page and a picture that anyone who has the link can open, with no sign-in. The link holds 32 random characters that cannot be guessed, and there is at most one for each certificate. The page shows the level and its name, the certificate number, the date, Issued by Valnivo Sign for Moien, and links to the check page of Valnivo Sign and to Moien; its text carries no name. The picture is the certificate and does show your Google account’s name. Your browser draws the picture from the sheet on your screen and sends it with the request; the signed PDF itself is never made public. Both are kept in the same private bucket under a name made of the random characters (the page and the picture are served by the issuer; the bucket stays private), with a small index of your link inside your own certificate storage so that it can be found and deleted. The page asks search engines not to index it and sends no referrer, but anyone you give the link to, or who sees it in a post, can open it, and can share it. Turning it off (Turn off the link) deletes the page and the picture at once, and a new link would be a new address. Deleting your account deletes every link too. Caches may show the page for a few minutes after it is turned off, and LinkedIn, or anyone who saved the picture, may keep what they fetched while it was on; Moien cannot remove that.
• Checking one. The proof is written into the file. Anybody can check it later with nothing but the file, on Moien’s /check page or on the check page of Valnivo Sign. The check is made in the browser of whoever does it: the file is not uploaded, and neither Moien nor Valnivo Sign is told. What Valnivo Sign’s own page does is described in its own notice.
• What it proves, and what it does not. It shows that the file is the one Valnivo Sign issued for Moien for that account, unchanged. It is not a qualified electronic signature, it is not an official qualification, and it does not show that the person named did anything beyond what Moien recorded.

6. Who else is involved

Google acts as our processor for hosting and for the database. Scaleway acts as our processor for training the speech-recognition models. Cloudflare acts as our processor for e-mail sent to Moien, and Google (Gmail) holds the mailbox it arrives in. For the website’s advertisement, Google acts as an independent controller.

• Firebase Hosting serves the website. Firebase Authentication handles sign-in and the anonymous donor accounts, and Cloud Firestore stores progress, the chat rooms if you join them, and, if you donate, your donated recordings. See Firebase privacy and security.
• In the Android app, Android's backup is Google's own service, which you control from your Google account and Android's settings; see the Google privacy policy.
• GoatCounter (goatcounter.com, run by an individual in Ireland and hosted on servers of Hetzner Online GmbH in Finland and Germany) counts the website's page views, only on luxembourgish.app, and the Android app's screen views, as described in section 3. Opening a page asks gc.zgo.at for its small counting script and sends the count to moien.goatcounter.com; the app sends only the count, as a plain request to moien.goatcounter.com; neither sets a cookie. It does not store your IP address, and it matches visits to each other only through a random number it keeps in memory for up to 8 hours. See the GoatCounter privacy policy. You can stop it by sending Do Not Track, by blocking those two addresses, or, in the app, by switching it off on Settings and data; the course works the same.
• On the website only, Google AdSense (Google Ireland Limited) serves the one advertisement at the end of a few pages, as described in section 3, only on luxembourgish.app and only after the page has loaded. Its consent message is Google’s own. See how Google uses information from sites that use its services and the Google privacy policy.
• Pronunciation recordings come from the Lëtzebuerger Online Dictionnaire as open data and are served from our own domain. Playing one sends no request to any third party. The fonts are served from our own domain too, so reading a page asks no one else for them.
• Only if you download the Android app from this website rather than from Google Play: the file is served from Moien's releases page on GitHub (github.com/valnivo-labs/moien-feedback), run by GitHub, Inc. (United States), which receives the download request with your IP address and browser details and handles its own logs as an independent controller. See the GitHub privacy statement.
• Only if you press Add to LinkedIn profile or Share on LinkedIn on a certificate: your browser opens LinkedIn (linkedin.com, LinkedIn Ireland Unlimited Company and LinkedIn Corporation) in a new tab. The address carries the course, the level, the certificate number and the month, or a short text you can change before you post, and never your name or the PDF; nothing is sent before you press. If you made a public link (section 5c) and put it in a post, LinkedIn’s own servers also fetch the page and its picture from our issuer to draw the preview card, and may keep a copy of them. LinkedIn handles what happens there as an independent controller. See the LinkedIn privacy policy.
• Only if you e-mail us: Cloudflare, Inc. (United States) receives mail sent to privacy@, contact@ and support@luxembourgish.app through its Email Routing service and forwards it, without keeping it, to a Gmail mailbox run by Google, where it is read and answered. See the Cloudflare privacy policy and the Google privacy policy. Mail to any other address on the domain is not delivered.
• Only if you join the chat: Hugging Face serves the message check's model from Valnivo Labs' own account there (Valnivo-labs/moien-chat-check, an unchanged copy of an openly licensed model, the exact version Moien was tested with). Nothing you write is sent to it: the check happens on your device.
• Only if you turn on the optional speech check: Hugging Face serves the speech-recognition models (the University of Luxembourg's LuxASR, which we publish there unchanged apart from their format) and jsDelivr serves the open-source program that runs them. See the Hugging Face privacy policy and the jsDelivr privacy policy. Neither receives a recording: recognition happens on your device.
• Only if you choose to run the speech check or the chat’s message check on our server: Oracle Cloud Infrastructure (Oracle) rents Valnivo Labs the virtual machine the server runs on, in its Frankfurt region (Germany), and acts as our processor for it; Cloudflare serves only the DNS entry of the server’s name (ai.luxembourgish.app) and sees none of the traffic; Let’s Encrypt issues the server’s certificate and receives no data about you. To check your sign-in the server downloads Google’s public keys, which sends Google nothing about you.
• Only if you ask for the certificate of a level: Google Cloud (Google Cloud EMEA Limited) runs the Moien issuer service and the Valnivo Sign issuer service (both Cloud Run), the key Valnivo Sign signs with (Cloud KMS), the private bucket that keeps your signed certificate (Cloud Storage) and the database it reads your progress record from (Cloud Firestore, section 5), as our processor. Google receives your sign-in token and the PDF in doing so, and keeps for us only what section 5c describes, including, if you choose to make one, the public page and picture of a certificate, which the issuer serves to anyone who opens the link. Checking a certificate sends nothing to Moien or to Valnivo Sign: your own browser reads the file.
• Only if you donate recordings: Scaleway SAS (8 rue de la Ville l'Évêque, 75008 Paris, France) rents us the GPU servers the models are trained on, in its Paris data centres, under its data processing agreement. A server holds the checked recordings only for one training run and is deleted afterwards (section 5a).

Besides its own files, including its fonts, the website and the app ask GoatCounter to count each page or screen view (section 3), and the app contacts our database only while you are signed in (which is also how the chat rooms work) or when you opt in to, send or withdraw a donation, Hugging Face and jsDelivr only when you download the speech check or the chat's message check, and GitHub only when you download the Android app from this website. On a website page that carries an advertisement, it also loads Google AdSense’s script (section 3); the Android app loads none.

7. Transfers outside the EU

Your progress, your account, the chat rooms and any donated recordings are stored in the European Union, and training on donated recordings happens there too: Scaleway is a French company and its servers used for training are in Paris. Google is a company established in the United States, so some support and administrative access from outside the EU cannot be excluded, and in the Android app your device backup is held by Google under your own Google account. Where Google transfers data outside the EU, it relies on the European Commission's Standard Contractual Clauses and on the EU-US Data Privacy Framework. See Google's data processing terms.

If you e-mail us, your message passes through Cloudflare, Inc. and is stored by Google, both companies established in the United States. Both are certified under the EU-US Data Privacy Framework, which the European Commission has found to give an adequate level of protection (Article 45 GDPR). What crosses that border is the message you chose to send. If you ask to test the Android app, your Google address goes to Google Play in the same way.

Google may process the data its advertisement uses on servers outside the EU, relying on the EU-US Data Privacy Framework and the Standard Contractual Clauses.

GoatCounter's servers are in Finland and Germany, so counting page views does not leave the European Union.

If you ask for a certificate, your sign-in token and the PDF are processed on Google Cloud in the European Union (Cloud Run and Cloud KMS in Belgium, europe-west1), and the signed certificate is kept in Cloud Storage in the same region. Google is a company established in the United States, so access from outside the EU cannot be excluded; where Google transfers data outside the EU it relies on the Standard Contractual Clauses and the EU-US Data Privacy Framework (above).

If you choose to run a check on our server, the recording or the message is processed on a machine in Frankfurt, Germany, so it stays in the European Union. Oracle is a company established in the United States, so access by it from outside the EU cannot be excluded; where Oracle transfers data outside the EU it relies on the European Commission’s Standard Contractual Clauses and on the EU-US Data Privacy Framework.

Hugging Face is also a company established in the United States, and jsDelivr serves its files through content-delivery networks that include companies established in the United States. If you download the speech check, the requests for its files may reach servers outside the EU. They carry no recording and nothing from your progress.

LinkedIn, if you choose to open it from a certificate, may process what it receives outside the EU under its own terms; Moien has no control over that and keeps nothing of it. A public link (section 5c) can be opened from anywhere in the world by whoever has it, including the servers of LinkedIn, so what it shows (the certificate, with your Google account’s name) can leave the European Union once someone opens it; the stored copy stays in the EU.

GitHub, Inc. is established in the United States. If you download the Android app from this website, the request for the file reaches GitHub's servers, which may be outside the EU. It carries nothing from your progress.

8. Cookies and local storage

Moien itself sets no cookies, and the page and screen view counter (GoatCounter, section 6) sets none and stores nothing in your browser or on your phone either. It uses your browser's storage (local storage and IndexedDB) for your progress, your starred words, your daily goal, your chosen interface language and whether you have seen the welcome tour, and, if you sign in, for the token that keeps you signed in. If you download the speech check, its files are kept in your browser's cache storage so that it works offline. Your choice to run the speech check or the message check on our server instead is kept in the same storage, per feature, and is never synced. If you opt in to donating, your donor number, the count of recordings sent and the anonymous donor account's token are kept in the browser's storage too. None of it leaves your device except the progress you asked us to sync and the recordings you choose to send. In the Android app the same things are kept in the app's own storage, which Android's backup may copy to your Google account (section 3).

The name on a certificate is your Google account’s name, read from your sign-in, and no name you typed is kept. Your browser stores nothing about a public link: whether you have one is asked of the issuer each time. After you download a certificate, your browser keeps a copy of the signed file in IndexedDB (database moien-certificates) so that it can be downloaded again offline; it is never synced and is erased when you sign out or delete your account.

On the website, the pages that carry an advertisement let Google AdSense set cookies or use similar storage, only after you agree in Google’s consent message where the law requires it (the EU, the EEA, the UK and Switzerland). You can change or withdraw that choice at any time, as easily as you gave it, with “Ad privacy choices” on the Settings and data page. The Android app has no advertising and uses no advertising identifier.

9. Your rights

Under the GDPR you have the right to:

• Access the data we hold about you, and receive a copy.
• Rectify anything inaccurate. Your name and e-mail come from Google, so correcting them in your Google account corrects them here.
• Erase your data. "Delete account and data" on the Settings and data page does this yourself, immediately; "Leave the chat and delete what I wrote" does it for the chat alone.
• Restrict or object to processing based on our legitimate interests.
• Portability: receive your progress in a structured, machine-readable format.
• Withdraw consent to donating recordings, or to advertising cookies on the website (“Ad privacy choices” on the Settings and data page), at any time, without affecting anything that happened before. Withdrawing a donation deletes the recordings.

Write to the e-mail address in section 1 and we will answer within one month. There is no charge.

10. Complaints

If you think we have handled your data wrongly, please tell us first so we can put it right. You also have the right to complain to a supervisory authority, in Luxembourg the Commission nationale pour la protection des données:

CNPD, 15 boulevard du Jazz, L-4370 Belvaux, Luxembourg. cnpd.public.lu.

You may equally complain to the authority in the EU country where you live or work.

11. Children

Moien is a language course meant for people aged 13 and over, which is the audience declared on Google Play; it is not directed at children under 13. Because sign-in relies on consent to a contract, we ask that anyone under 16 uses the app without signing in, which requires no personal data at all, or has a parent or guardian sign in on their behalf. Donating recordings and the chat rooms are open only to people aged 16 or older. We do not knowingly hold account data, chat messages or recordings of a child under 16. If you believe we do, write to us and we will delete it. The website’s advertisement is never personalised, whoever reads the page.

12. Automated decisions

There is no automated decision-making with legal or similarly significant effects, and no profiling. The placement test is a self-assessment: it suggests a starting level and you can override it on any level page.

13. Security

The site is served over HTTPS only. Sign-in is handled by Google and we never see your password. Database rules restrict every learner's record to that learner. Donated recordings are readable only by the anonymous donor who sent them, by Valnivo Labs and by the reviewers described in section 5a; a reviewer's Google account user ID is kept in the reviewer list and with each review they give, and nowhere else. Chat rooms are readable only by signed-in members of the chat, and a chat membership only by its member. We hold no payment data and do not ask for special categories of personal data; if you write such things in a chat room, other members can read them.

14. Changes to this notice

If this notice changes, the date at the top changes with it, and what changed is listed beside the date. Material changes are announced in the app before they take effect.

15. Course content

Questions or corrections about the Luxembourgish in the course are not a privacy matter and are best raised as an issue on the project's public repository, linked from the About page.

Last updated 18 October 2026 (a certificate is now kept on Moien’s server so that it is signed once, and you may choose to make it viewable through a public link, which shows it with your name and which you can turn off; deleting the account deletes both: see the sections on certificates). Before that, 16 October 2026 (a certificate of completion issued by Valnivo Sign for Moien, for your Google account, with the name of that account printed on it: sections 2, 3, 5c, 6, 7 and 8). Before that, 16 October 2026 (the optional choice to run the speech check and the chat’s message check on a server of Valnivo Labs instead of on your device: sections 2, 3, 5b, 6, 7 and 8; and a donated recording may now be one line of a conversation, not only a word, and donors are asked again: sections 3, 5a and 6). Before that, 12 October 2026 (one small, non-personalised advertisement at the end of a few pages of the website, with Google’s consent message: sections 2, 3, 6, 7, 8, 9 and 11). Before that, 9 October 2026 (anonymous page and screen view counts on the website and in the Android app with GoatCounter: sections 2, 3, 6, 7 and 8; the synthetic voice, how long chat data stays stored, what leaving does not remove, what members see, the counted actions and the donor platform: sections 2, 3, 5a, 5b and 6). Before that, 7 October 2026 (opening Moien inside Valnivo Home: section 5). Before that, 2 October 2026 (the chat rooms, with the words the chat refuses, review requests, and rooms that end after 5 quiet hours or when empty, the message check on your device, and training copies of reported and refused messages: section 2, the table in section 3, section 5b, and sections 6, 7, 9, 11 and 13). Before that, 30 September 2026 (no advertising: the advertising script, identifiers and consent message are gone; Android's backup, reminders and the microphone and notification permissions; starred words, the daily goal and today's points in sync; the reviewers of donated recordings; the donor records deleted after 3 years; the Android download served from GitHub; e-mail you send us, and fonts served from our own domain). Before that, 28 September 2026 (donating recordings, first language, Scaleway, who is responsible).