Privacy Policy

Effective date: 11 July 2026  ·  Last updated: 9 September 2026

Boring Projects Ltd, a company registered in New Zealand (“we”, “our”, or “us”), builds the Boringua language-learning app (the “App”). This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using Boringua you agree to this policy.

1. Information we collect

Information you provide

• Account information. If you sign in, we receive a user identifier and an email address. That address may come from Apple (Sign in with Apple, which may be a private-relay address), from Google (Google Sign-In), or from you when you continue with email — we then send a one-time sign-in code to that address. We also receive a display name if you provide one.
• Your learning data. Words you save, word lists you build, your review history, and your study streaks. When you are signed in, this data is synced to your account so it is available across your devices.
• Photographs you scan. If you use the camera to look up what is in front of you, the single photograph you take — or the single photograph you choose from your photo library — is sent to us and on to our AI provider to be read. We do not keep it. Section 2 explains this in full.
• Support messages. If you email us, we receive your email address and the contents of your message.
• Bug reports you send from the App. If you use “Report a bug” in the App, we receive what you wrote and, only if you choose to leave it, your email address. We store it ourselves, along with your app version, device model, operating system version, and a device identifier so we can find the problem. You can send a report without signing in. We do not attach a screenshot, and none of your saved words or other app data is sent with it.

Information collected automatically

• Device and app information. Device model, operating system version, and app version — used for compatibility and debugging.
• Diagnostics. If the App encounters an error or crash, we collect diagnostic data (such as error logs and device state) through Firebase Crashlytics to help us fix problems.

Apart from a photograph you deliberately scan (Section 2), we do not collect your precise location, your contacts, your photo library, health data, or advertising identifiers, and we do not track you across other companies’ apps or websites. Boringua cannot browse your photo library: when you pick a photo to scan, your phone hands us that one image and nothing else.

2. Photos you scan with the camera

Boringua’s camera turns a photograph into words you can learn. To do that, the photograph has to leave your phone. This section explains exactly where it goes and what is — and is not — kept.

What we send, and to whom

We send one photograph and the language you are learning. Before the photograph leaves your phone, the app strips out the extra information cameras hide inside an image file — including where and when it was taken. We do not send your name, your email address, or your account identifier with it.

The photograph is read by OpenAI, under our paid business account. OpenAI does not use data sent through its business interface to train its models, and we have not turned on any optional logging, data-sharing, or history feature. OpenAI may retain the request for up to 30 days for abuse and safety monitoring before deleting it, and may retain it beyond that period where it is required by law to do so, or where it is reasonably necessary to protect its services or other people. We do not claim otherwise: unless and until zero-retention has been approved for our account, treat that 30-day window as real, and as a floor rather than a ceiling. See OpenAI’s data controls for their side of this.

We keep no photograph

Boringua does not retain the photograph at any stage — not as a file, a copy, a thumbnail, a crop, or an entry in a log. It exists in our servers’ memory for the length of one request and is then dropped. OpenAI is the only company we ever send it to: it is never attached to a crash report, never included in a result you report to us, and never passed to any other service. The words the scan produces are not stored by us either, unless you choose to report that result to us (see below). Any word you save from a scan is saved as a word in your own word lists, not as a picture.

If you ask the app to save a scanned photo, with its words drawn on it, to your photo library, that copy is written on your own phone. We never receive it.

If you report a result

A scan result carries a button for telling us it is offensive, wrong, or nonsense. Nothing is sent unless you press it. When you do, we receive the words you were shown, which reason you picked, the scan’s reference number, and the app version, platform, operating-system version and device model already attached to a bug report. We store that ourselves, with our other learner-written reports, not with crash diagnostics.

The photograph is never included — not in a report, not as a thumbnail, not as a screenshot. Neither is your account identifier, your email address, or anything you were doing elsewhere in the app. We keep a report only so that a person can read the words you objected to and fix what produced them.

The 30-day scan record

What we do keep, for 30 days, is a short record that each scan happened. It contains no photograph and none of the words the scan produced. It holds:

• a reference number for the scan, and the date and time;
• a scrambled (hashed) form of your account identifier and of the photograph — neither your identity nor the picture can be reconstructed from these, although we can match a record to an account we already know, which is how we act on your deletion request;
• the photograph’s size in bytes and the language you were learning; and
• what happened — a result was returned, the AI service declined to answer, nothing was found, the request failed, the image was invalid, or you had used up your daily allowance — and, where the AI service declined, the reason it gave.

We keep it for three reasons: to look into a result you report to us, to detect misuse of a paid service that every learner shares, and to answer a safety complaint from our AI provider. It is not used to profile you, to advertise, or to track you between apps or websites.

Each record deletes itself after 30 days. We take no backup of it that would outlive that window, and only a named person, using access limited to this record alone, can read it. Deleting your account removes your records from it.

If you are in someone else’s photo

A photograph a learner scans may have you in it even though you have never used Boringua. We do not keep that photograph, we do not try to work out who is in it, and we never use it to recognise faces or to build a profile of anyone. Our Terms of Use require the learner to have the right to photograph and submit what they scan, and tell them not to photograph people who have not agreed to it. If you believe a photograph of you was scanned and you want to know more, contact us at support@boringprojects.com — bearing in mind that we hold no photographs to look up.

If someone asks us for a photograph

Because we keep no photographs, there is nothing for us to produce if you, a court, or the police later ask for one. A request about the 30-day scan record is handled under Section 8 (Your rights and choices).

3. How we use your information

We use the information above to:

• provide Boringua and sync your learning data across your devices;
• operate your account and your Boringua Pro subscription;
• read a photograph you scan and return the words in it;
• diagnose crashes, fix bugs, and keep the service secure;
• act on bug reports you send us, and reply to you if you left an email address with one; and
• respond to your support requests and important service notices.

We do not sell your personal information, and we do not use it to build advertising profiles.

4. How we share information

We share information only with the service providers that help us run Boringua, and only as needed to provide the App:

We may also disclose information if required by law, to enforce our Terms of Use, to protect the rights or safety of our users or the public, or as part of a business transfer (such as a merger or acquisition), in which case we will let you know.

5. Where your data is stored

Your account and learning data are stored on Amazon Web Services infrastructure. Because Boringua is offered internationally, your information may be processed in countries other than the one where you live, including the United States. Where data is transferred internationally, we rely on appropriate safeguards such as the standard contractual clauses offered by our providers. A photograph you scan is processed in the United States by OpenAI and is not stored by us anywhere (Section 2).

6. Data retention

• Account and learning data. Kept while your account is active. When you delete your account, we delete the associated learning data from our systems within 30 days, except where we must retain limited records to meet legal obligations.
• Photographs you scan. Not retained by us at all. OpenAI may retain the request for up to 30 days for abuse and safety monitoring (Section 2).
• The scan record. Kept for 30 days, then deleted automatically. It holds no photograph and none of the words a scan produced (Section 2).
• Bug reports you send from the App. Kept so we can act on them, then deleted. If you delete your account, reports under that account go with it, including reports you sent from a device still on the account before you signed in that nobody else owns. A report you sent as a guest from a device that was never on the account, or from a device we have not seen for 90 days, stays until we delete it by hand.
• Reports you send about a scan result. Kept the same way as bug reports. The photograph is never included.
• Diagnostics. Crash and error diagnostics, retained for up to 12 months, then deleted.
• Guest data. Words you save and lists you build stay on your device until you sign in (see Section 9). A bug report you send as a guest is received by us, as described above.

7. Security

We protect your information with technical and organisational measures, including encryption in transit (TLS/HTTPS), access controls limiting who can access data, and regular review of our practices. No system is perfectly secure, but we take commercially reasonable steps to safeguard your data.

8. Your rights and choices

You can:

• Access and correct your data — your learning data is visible in the App, and your display name is editable there.
• Delete your account and synced data from within the App at any time, or by emailing us. That also deletes bug reports under the account, including ones you sent from a device still on the account before you signed in that nobody else owns.
• Export your data — contact us to request a copy.

To make a request, email support@boringprojects.com. We aim to respond within 30 days.

New Zealand (Privacy Act 2020)

Boring Projects Ltd is a New Zealand company and handles your information under the Privacy Act 2020. Because the services we rely on operate overseas, your information — including a photograph you scan — is disclosed outside New Zealand, as described in Sections 2 and 5. Before we do that, we satisfy ourselves that the provider is required to protect your information to a standard comparable to the Privacy Act, through the contractual terms they offer us.

If we ever suffer a privacy breach likely to cause you serious harm, we will notify you and the Office of the Privacy Commissioner, as the Act requires. If you are unhappy with how we have handled your information, please tell us first at support@boringprojects.com; if we do not put it right, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

European Economic Area & United Kingdom (GDPR)

If you are in the EEA or the UK, our lawful bases for processing are: performance of our contract with you (providing the App and your account), our legitimate interests (keeping the service secure and improving it), and your consent where required. You also have the right to object to or restrict processing, to data portability, and to lodge a complaint with your local data-protection authority. The data controller is Boring Projects Ltd, contactable at support@boringprojects.com.

California (CCPA/CPRA)

We do not sell or share your personal information as those terms are defined under California law. California residents have the right to know what personal information we collect, to request its deletion, and not to be discriminated against for exercising these rights. Contact us at the address above to make a request.

9. Guest mode

You can use Boringua without an account. In guest mode, the words you save and lists you build are stored only on your device and are not sent to us. If you later sign in, that local data can be uploaded to your account so it syncs across devices, as described in the App. A bug report you send as a guest is an exception: we receive it, as described in Section 1.

10. Children

Boringua is not intended for children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it.

Boringua is used by teenagers, so the camera is explained in ordinary language in Section 2 rather than only in legal terms. If you are 13–17: the camera sends your photo to an AI service to be read, we do not keep the photo, the answer is produced by a computer and can be wrong, and you can tell us about a bad result from our Support page. If anything about a result upsets you, please tell a parent, a caregiver, or a teacher as well as us.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the “Last updated” date above and, where appropriate, notify you in the App. The current version is always published at this page.

12. Contact us

For any privacy question or request, email support@boringprojects.com or visit our Support page.

Boring Projects Ltd, New Zealand.