Akapulco — last updated: 19 October 2026. · Version française
This Privacy Policy is the English original, corresponding to the French original at https://api.akapulco.app/confidentialite. Your GDPR rights do not depend on the language of this page.
Akapulco is a vocabulary-learning app. The principle behind this policy is simple: we collect only what makes the service work, nothing more, and everything that concerns you can be deleted on request.
If you use friends: your username, the only name they see — never your email address. Once a request is accepted, your friends see your languages, your level, the meanings you have discovered and mastered, and your day streak. Nothing is visible before you accept; removing a friend stops it at once.
Inviting someone by email: the address you enter is used to send them one invitation, at your request and under your username. We keep only a pseudonymised fingerprint of it, for thirty days, so as not to write to them twice and to limit sending; we send them nothing else. If someone invited you, we know who, so as to give them their week; this information disappears with your account.
Challenges between friends: the participants in a challenge see, day by day, whether you did a session — never what you studied; for a race, how many meanings and letters you worked on (discovered or reviewed) during its seven days. Your friendship titles and race score are visible only to the two of you. Removing a friend, or deleting your account, stops the challenges in progress.
From your first session, you appear in the ranking that all learners see: your rank, your total level (all languages together), your points (five per completed session) and how you have moved since the day before. You appear under your username if you have chosen one, otherwise under a generic name ("Player" followed by a number) that does not identify you — never under your email address. An offensive, sexual, racist or dangerous username is refused or hidden. The ranking is recalculated once a day; deleting your account removes you from it.
Your email address is first of all used for your account: the sign-in code and, if you subscribe, the order confirmation, the statutory notice before renewal and the cancellation acknowledgement. These emails are necessary for the service and always reach you.
Around the end of your free trial, we also write to you about the subscription, three times at most: two days before the end, on the day it ends, and if you reopen the app later. Each of these emails has an "Unsubscribe" link: one click is enough to stop receiving them, with no effect on your account. A request to bonjour@akapulco.app has the same effect.
ak_session, 6 months).In the European Union: our servers and our database are in Frankfurt (hosting provider Render), and emails are sent through Brevo (a European provider). Learning content (lessons, audio) is served by a content delivery network (Cloudflare) and requires no account. Payments are processed by Stripe (Stripe Payments Europe, Ireland).
If you subscribe in the app, the purchase is made from and paid to Apple (App Store) or Google (Google Play), under their own privacy rules. It is verified for us by RevenueCat (RevenueCat, Inc., United States), which receives the technical identifier of your Akapulco account and the history of your in-app purchases — never your email address or your payment details. This transfer outside the European Union is governed by the European Commission's standard contractual clauses.
Notifications go through Firebase Cloud Messaging, a Google service, which delivers them to your phone via Apple (iPhone) or Google (Android). Firebase receives your device's technical token and the text of the notification (for example "Tom challenges you") — never your email or your progress. This data may be processed outside the European Union; such transfers are covered by the European Commission's standard contractual clauses.
Your data is kept for as long as your account exists. A device session that has been inactive for six months is signed out. Deleting your account erases immediately and permanently your email address, your progress and its complete history; only the accounting records of payments remain with Stripe, for the statutory retention period.
One exception: the free trial. So that the same free trial cannot be obtained more than once by deleting and re-creating an account, we keep, for twelve months after deletion, a pseudonymised fingerprint of your email address: a code computed with a secret key (HMAC-SHA256). It does not allow us to recover your address; it only allows us to recognise the same address if it is used again. It contains no other data, is linked to no account, is shared with no one, and is used only to avoid granting a second trial: the account can still be created, and a subscription taken out. Legal basis: our legitimate interest in preventing abuse of the trial offer (GDPR, Art. 6(1)(f)). It is deleted automatically after twelve months.
You may object to this retention at any time by writing to bonjour@akapulco.app: the fingerprint of your address is then deleted.
Under the GDPR, you have the rights of access, rectification, erasure, restriction, portability and objection. A simple request by email is enough: bonjour@akapulco.app. You may also lodge a complaint with the CNIL, the French data protection authority (cnil.fr), if you believe your rights have not been respected.
Akapulco is published by OASIS WATERFALL PROVIDENCE (OWP), SASU, 4 avenue du Teiras, 06300 Nice, France — bonjour@akapulco.app. Terms of Sale and Use: akapulco.app/en/terms.