Lexora — Privacy Policy

This privacy policy explains what information Lexora and the Lexora Companion browser extension collect, how it is used, and what choices you have. By using the service or the extension, you agree to the terms below.

If you have any questions or want to exercise your rights, write to contact.yuriidorosh@gmail.com.

---

1. Who we are

Lexora is a personal language-learning platform operated by Yurii Dorosh (trading as Avantgarde Systems), based in Ukraine. The platform is reachable at https://lexora.avantgarde.systems. The Lexora Companion browser extension is distributed via the Chrome Web Store and talks to that same instance by default.

For data-protection purposes, the operator listed above is the data controller of any personal data described in this policy.

2. What this policy covers

This single policy covers:

• The Lexora web platform at https://lexora.avantgarde.systems (portal pages under /my/*, public landing pages, and the API at /lexora_api/*).
• The Lexora Companion browser extension (Chrome / Chromium-based browsers), version 1.0.0 and later.
• The four backend worker services that the platform calls on your behalf (translation, LLM enrichment, audio, Anki import).

It does not cover third-party websites you visit while the extension is installed — Lexora does not log, track, or sell your general browsing activity.

3. Information we collect

3.1 Information you provide directly

3.2 Information collected automatically

3.3 Information sent by the Lexora Companion extension

Each feature only sends data to your configured Lexora instance (default: https://lexora.avantgarde.systems). The extension talks to no other server. The Lexora server may forward parts of your request to third parties as described in §5.

The extension also reads your Lexora session cookie via chrome.cookies and forwards it as the X-Lexora-Session-Id header so the server can identify you across browsers that block third-party cookies. This cookie is read only for the configured Lexora URL — never from any other site.

3.4 Information stored locally in your browser

The extension persists the following inside Chrome's local storage. None of this leaves your computer.

You can clear all of this at any time by removing the extension or via Chrome → Settings → Privacy & Security → Site settings → View permissions and data stored across sites.

3.5 What the extension does NOT collect

• Your general browsing history. The extension does not record which pages you visit.
• Analytics or telemetry. No Google Analytics, no Mixpanel, no Sentry, no Segment.
• Cookies from other sites. Scoped to your Lexora URL only.
• Microphone access in the background. The mic is requested only when you explicitly click Start Recording.
• Form-field contents on pages other than where you click the L FAB. The Writer only reads the field after you explicitly click the floating L button.

4. How we use your information

We process the data described in §3 only for these purposes:

1. Provide the service. Translate vocabulary, generate enrichments, transcribe audio, run PvP duels, show your dashboard.
2. Authenticate you. Verify your session cookie on every API call.
3. Improve reliability. Read server logs to debug crashes and slow endpoints.
4. Respond to your requests. When you write to the contact email above.
5. Comply with the law. Respond to lawful requests from authorities.

We do not:

• Sell, rent, or trade your personal data to anyone.
• Run ad networks, retargeting, or behavioural advertising.
• Use your vocabulary entries, audio recordings, or chat messages to train ML models.
• Share your data with other Lexora users beyond what you explicitly choose to share (see §6).

5. Third parties that process your data on our behalf

The Lexora platform calls a small number of external services to provide specific features. These calls are made from the Lexora server, not from your browser.

The LLM enrichment service (Qwen2.5) runs entirely on the Lexora server's own CPU. No text leaves the Lexora server for enrichment, grammar explanation, slang lookup, writing analysis, roleplay, or speaking-coach feedback.

The platform does not use any analytics provider (Google Analytics, Plausible, Matomo, etc.), error-tracking provider (Sentry, Rollbar), CDN with logging, or marketing/email automation system at this time.

6. Privacy inside the platform

7. Cookies

Lexora sets exactly one cookie: session_id. It is:

• Strictly necessary — without it you cannot log in.
• HTTPS-only in production (the Secure flag is set).
• HttpOnly — JavaScript on the page cannot read it.
• SameSite=Lax — sent with top-level navigation only.

We do not set any analytics, advertising, or social-media cookies. We do not embed third-party scripts from analytics or ad networks.

8. Data retention

When you delete your account, we apply the policy in our SPEC §6: private vocabulary, audio, import logs, and private DMs are hard-deleted; public posts, comments, public chat messages, PvP battle records, and leaderboard standings are anonymised (author becomes "Deleted User") to preserve thread integrity.

9. Your rights

If you are in the European Economic Area, the United Kingdom, Ukraine, or any other jurisdiction with similar data-protection laws, you have:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate data.
• Erasure — delete your account and the data tied to it as described in §8.
• Restriction — ask us to stop processing your data in specific ways.
• Portability — receive your vocabulary and posts in a machine-readable format.
• Objection — object to processing based on our legitimate interests.
• Withdraw consent — at any time without affecting the lawfulness of past processing.

To exercise any of these rights, write to contact.yuriidorosh@gmail.com. We will respond within 30 days.

You also have the right to complain to your local data-protection authority if you believe we have mishandled your data.

10. Security

• All connections to https://lexora.avantgarde.systems use TLS 1.2 or 1.3.
• HSTS is set with max-age=31536000; includeSubDomains; preload.
• Passwords are stored using Odoo's standard salted hashes (pbkdf2_sha512).
• The session cookie is HttpOnly, Secure, SameSite=Lax.
• Strict response headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy).
• Postgres, Redis, and RabbitMQ are not reachable from the public Internet.
• The master password is stored encrypted on disk inside the running container only.

If you believe you have found a vulnerability, please write to contact.yuriidorosh@gmail.com before public disclosure.

11. Children

Lexora is not directed at children under 13 (or under 16 in the EU and UK). We do not knowingly collect personal data from children.

12. International transfers

Lexora is hosted on a single VPS located in the United States. If you access the service from outside the United States, your data will cross borders. We rely on the legitimate-interests basis under the GDPR and on the standard contractual clauses of the third-party providers listed in §5 to provide an adequate level of protection.

13. Changes to this policy

We may update this policy as Lexora evolves. The Last updated date at the top of this page changes whenever we make a substantive change. If the change is material, we will also notify logged-in users via a banner on their dashboard or by email. Older versions are tracked in the project's public git history at docs/PRIVACY_POLICY.md.

14. Contact

---

This policy is provided under the same proprietary licence as the Lexora source code. It is not a substitute for legal advice; if you operate a fork of Lexora at a different URL, you must publish your own policy.