Privacy Policy
Effective from 24 September 2026 · UK GDPR & Data Protection Act 2018
1. Who's responsible for your data
Digital Blue Solutions Limited, trading as Tungo, is the "data controller" for the personal data described in this policy. Our registered office is 14 Wharfedale Street, Wednesbury, WS10 9AG, England, company number 15686184. You can reach us about privacy matters at privacy@tungo.xyz.
2. What we collect
Account data
- Your email address and password (we only ever store a securely hashed version of your password, never the password itself).
- If you sign in with Google or Microsoft, the name and email address they give us, and the ID your account has with them. That's all they send. We use it to create your account and to know it's you next time. If you only ever sign in that way, we hold no password for you at all.
- Your base language and the language you're learning, and your learning settings.
- Your time zone, your reminder and notification settings.
- A profile picture, if you choose one. If you upload a photo we don’t keep your file: we make a fresh 320-pixel square copy and discard the original, so anything hidden inside it – including any location your camera recorded – is never stored or shown. Your picture appears on your profile, to friends and anyone you’re linked to in the app, and to our staff in our admin system. You can change or remove it whenever you like: the old one is deleted straight away, and so is your picture when your account is erased.
Usage data
- Your activity within lessons and games – for example, answers given, progress, and which tasks you've completed – so the app can track and adapt to your progress.
Technical data
- A first-party login cookie that keeps you signed in, and a short-lived, single-use signed token used only at the moment of logging in to securely carry your session from tungo.xyz to my.tungo.xyz.
- Standard technical data such as IP address and browser type, used for security and troubleshooting.
- A count of how many separate people visit, worked out from your IP address and browser type as a one-way fingerprint. Only the fingerprint is kept – your IP address is never stored next to it, and the fingerprint cannot be turned back into it. It is rebuilt from scratch on the 1st of every month, so it cannot be used to recognise anyone from one month to the next. If you are signed in while we see that fingerprint, we record that the two belong together, so we can tell which pages someone looked at before they created their account. That link is dropped when the fingerprint is rebuilt each month.
- Your country, worked out from your IP address on our own server using DB-IP's free country data (db-ip.com), so we can show prices in the right currency and the site in your language. We don't keep the country; when you sign up, we keep only the currency it gave your account.
- If you turn on reminders on a device, the address your browser gives us for that device, and the keys that let us encrypt a message only it can read. It identifies the browser on that device, not you, and we keep one for each device you turn on. Turning reminders off for that device, or clearing your browser data, deletes it.
Payment data
- Records of your plan and payments (amount and date). Your card details are entered directly with Stripe, which sells your plan through Link, and never pass through or get stored on our own servers.
Communications
- Emails we send you, such as password reset links, and any messages you send us for support, including any pictures you attach to them. A screenshot shows whatever was on your screen, so please check it before you send it.
3. What we use it for
- To create and run your account and deliver the lessons and games themselves;
- to process your payments and keep accurate records of them;
- to send essential account emails, like password resets;
- to keep the Service secure and stop misuse; and
- to understand how Tungo is used so we can improve it.
Reminders and notifications
To help you practise a little each day, Tungo sends you a practice reminder at 7pm – by email, or as a notification on any device you turn that on for – and a short weekly progress summary by email. These are on when you create your account. You can change their times, choose which days you get them, or turn them off at any time in Settings > Reminders, or by using the link in any reminder email. We only send offers and promotions if you choose to receive them.
4. Our legal basis
We rely on:
- Contract – most of the above is necessary to provide the Service you've signed up for;
- Legitimate interests – for keeping Tungo secure and improving it, in a way that doesn't override your own rights; and
- Legal obligation – for keeping financial records we're required to keep.
5. Cookies
All of Tungo's cookies are our own. We don't use advertising cookies, and nothing here follows you onto other websites.
We also count how many separate people visit, and we do it without a cookie – nothing is placed on your device for it. See "Technical data" above for how that works.
- Signing in – keeps you signed in, and remembers where you are in the steps while you're creating an account. If you sign in with Google or Microsoft, one more lasts fifteen minutes, just long enough to check that the sign-in coming back is the one that started here.
- Security – counts failed sign-in attempts, so nobody can sit and guess your password.
- Your choices – remembers the language you picked for the site.
- Where you came from – if you arrive from one of our flyers, emails or links, we note which one, so we can tell what's working. It holds no personal data and lasts six hours.
6. Who we share it with
We share the minimum necessary data with the suppliers who help us run Tungo:
- Stripe and Link, who sell your plan and take the payment. They are not simply acting on our instructions here: as the seller they decide for themselves how they use your payment and billing details, and they hold their own record of the purchase. You can see and manage that record, and ask them to delete it, at link.com; and
- Kualo Limited, a UK company, who host our website, servers, email and backups in the UK.
- If you sign in with Google or Microsoft: pressing that button takes you to their page, so they know you're signing in to Tungo. We send them nothing about you – the information travels the other way.
- If you turn on reminders on a device: whoever makes your browser – Google for Chrome, Apple for Safari, Mozilla for Firefox – because they run the service that carries the reminder to it. They receive the device's address and the time, but not what the reminder says: it is encrypted so that only your device can read it.
We don't sell your personal data, and we don't share it with anyone else for their own marketing purposes.
7. Where it's stored
Your data is stored on servers run by Kualo Limited in London, in the United Kingdom, and our backups are kept on Kualo's servers in the UK too.
Stripe may process payment data outside the UK, including in the United States. Where it does, it uses approved safeguards, such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.
8. How long we keep it
We keep your account data for as long as your account is in use.
- If you delete your account, we erase your personal data 14 days after you ask. The 14 days give you time to change your mind.
- If your account is closed or unused – no paid plan and no login for 12 months – we delete or anonymise your personal data automatically. We email you 30 days beforehand, so you have the chance to log in and keep it.
- Payment records are kept for 6 years after the end of the financial year they fall in, as HMRC requires, even after the rest of your data has been removed.
- Messages you send us, and our replies, are kept for 2 years after the last thing said on them, so we can look back at what you asked us before.
- Our record of emails we sent you is kept for 12 months. It is how we check whether something reached you.
- Our staff activity log – who inside Tungo did what – is kept for 2 years. The entries recording that an account was erased are kept for 6 years, as our own proof that we did it.
- Visit records used to see which advert or link brought someone to the site, and to count separate visitors, are kept for 12 months.
Everything above happens automatically, every day, whether or not anyone asks.
9. Keeping it secure
We use industry-standard measures to protect your data, including encrypted connections (HTTPS) across the Service, securely hashed passwords, and access controls that limit who inside Tungo can see your data.
10. Your rights
Under UK GDPR, you have the right to:
- ask for a copy of the personal data we hold about you;
- ask us to correct anything that's inaccurate or incomplete;
- ask us to delete your personal data, in certain circumstances;
- ask us to restrict how we use your data, in certain circumstances;
- ask us to move your data to you or another provider, in a portable format; and
- object to how we use your data, including for direct marketing.
To use any of these rights, contact us using the details in section 13.
11. Children
Tungo can be used by people of any age. Anyone under 18 needs a parent's or guardian's permission to use it. For children under 13 (or the age set by the law where they live), we rely on a parent's or guardian's consent to use their data, so a parent or guardian should set up and look after the account.
Only an adult can pay for a plan. If you believe a child is using Tungo without the right consent, contact us at privacy@tungo.xyz and we'll close the account.
12. Changes to this policy
We may update this policy from time to time – for example, if we start using a new supplier or the law changes. The date at the top always tells you which version you're reading, so it's worth a look now and then. Where a change affects you meaningfully, we'll take reasonable steps to let you know, such as by email or a notice in the app.
13. Contact us & complaints
Questions about this policy or your data? Contact us at privacy@tungo.xyz. If you're not happy with how we've handled your data, you also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.