Duolingo

You must arbitrate disputes individually — no class action lawsuits.

What this means: Duolingo requires you to resolve money disputes through private arbitration rather than in court, and you cannot join a class action lawsuit. This means if Duolingo wrongs many users in the same way, each person must fight their case alone — making it economically impractical to pursue small claims. There is a 30-day opt-out window from the day you first use the service, which most users will miss.

What you can do: If you are a new user, email [email protected] within 30 days of signing up to opt out of arbitration. If you've already passed that window, you are bound by this clause.

Duolingo can change its terms and your next login counts as agreement.

What this means: Duolingo can change its terms at any time, and the new terms kick in as soon as you open the app — even if that's just one day after the change. You don't need to actively agree; simply using the service counts as acceptance. Your only real option to reject changes is to stop using Duolingo entirely.

What you can do: Watch for notices on the Duolingo website about term changes. If you disagree with a change, stop using the service before the 7-day window closes or before your next login.

Your data is shared with Meta, Google, and others for targeted ads.

What this means: Duolingo shares your personal data with a wide network of ad companies — including Meta, Google, Unity, and others — who track you across multiple websites and apps to build an advertising profile. This is opt-in by default for most users outside the EU/UK, meaning it happens unless you actively turn it off. These third parties can use your data for their own market research purposes.

What you can do: Go to app Settings and turn off personalized advertising. Also check your phone's privacy settings (iOS: Advertising ID; Android: Advertising ID) to limit cross-app tracking.

Any content you submit is licensed to Duolingo forever, irrevocably.

What this means: Content"), you hereby grant to Duolingo a full-paid, royalty free, perpetual, irrevocable, worldwide, nonexclusive, transferable, and sublicensable license to use, reproduce, copy, adapt, modify, merge, distribute, publicly display, and create derivative works from the Content; incorporate the Content into other works; and sublicense through multiple tiers the Content. You acknowledge that this license cannot be terminated by you once your Content is submitted to the Service.

What you can do: Be mindful of what you submit. Avoid uploading original creative work you want to retain exclusive control over, as the license is permanent and irrevocable.

Duolingo can keep your data indefinitely under broad exceptions.

What this means: Duolingo keeps your personal data for as long as your account exists, and can hold onto it even longer for broadly defined reasons like 'legitimate interests' or 'disputes.' The exceptions are wide enough to allow indefinite retention in practice. Anonymous data derived from your information is kept forever.

What you can do: Delete your Duolingo account via the app if you want to trigger data deletion. After deletion, submit a formal erasure request through the Duolingo Data Vault to ensure your data is removed.

Duolingo's liability is capped at what you paid them — often zero.

What this means: If Duolingo causes you harm, the most you can ever recover is what you paid them in the past year — which is zero for free users. Even for paying subscribers, this cap is very low relative to potential harms like data breaches or service failures. All claims combined share this single cap.

What you can do: Understand that your legal recourse against Duolingo is financially capped. If you experience significant harm, consult a lawyer about whether consumer protection laws in your jurisdiction override this cap.

Google, Meta, and Amazon cookies track you across the whole web.

What this means: Targeting cookies placed by Google, Meta, and Amazon can follow you across the entire web — not just on Duolingo — to build an advertising profile. This cross-site tracking happens by default for most users and is separate from Duolingo's own data use.

What you can do: Visit Duolingo's Privacy Preference Center (linked from the Cookie List page) to manage or disable targeting cookies. You can also use browser-level cookie controls.

Your voice recordings are stored and used to train Duolingo's AI.

What this means: When you use AI features like Video Call, Duolingo records what you say and stores those recordings to train its own AI models. This means your voice and conversation content become training data. The policy asks you not to share sensitive information in these features, but does not give you a way to delete specific recordings.

What you can do: Avoid sharing any personal or sensitive information during AI-powered conversations. You can also opt out of sharing audio for product improvement in app Settings.

Data can be kept after account deletion for vague, broad reasons.

What this means: Duolingo keeps your data as long as your account exists, but even after deletion, it can hold onto data for a broad list of reasons including 'legitimate interests' — a vague standard that gives Duolingo wide discretion. Anonymous data (which may be derived from your personal data) is kept forever.

What you can do: Delete your account via the Duolingo Data Vault and submit a formal erasure request to [email protected] to maximize the chance your data is removed.

Using the app counts as agreeing to all data collection and sharing.

What this means: Simply using Duolingo counts as your agreement to the entire privacy policy, including all data sharing with advertisers and AI vendors. There is no separate, affirmative consent step for each data use — your continued use is treated as blanket consent.

What you can do: Review the full privacy policy before using the service. Use the opt-out controls in Settings to limit specific data uses you disagree with.

Duolingo can change its privacy policy without your active agreement.

What this means: Duolingo can change its privacy practices at any time. While it promises email notice for material changes, it does not require you to actively agree to the new terms — continued use after notification likely constitutes acceptance. Non-material changes can happen without any notice.

What you can do: Watch for policy update emails from Duolingo and review changes carefully. If you disagree with a change, delete your account before the new policy takes effect.

Duolingo ignores your browser's Do Not Track privacy setting.

What this means: Duolingo ignores the 'Do Not Track' browser setting, which is a signal users can enable to request that websites not track them. This means even if you've turned on this privacy setting in your browser, Duolingo will continue tracking your activity.

What you can do: Rely on Duolingo's in-app Settings to manage tracking preferences rather than your browser's Do Not Track signal, as the latter has no effect here.

Duolingo records a video replay of your every click and keystroke by default.

What this means: Duolingo records a video replay of your entire session — every click, scroll, mouse movement, and answer you type — using FullStory and Session Replay. This is detailed behavioral surveillance of your in-app activity. It is on by default and must be manually disabled.

What you can do: Go to app Settings and toggle off Tracking to disable FullStory and Session Replay recording.

Subscriptions and virtual items are non-refundable once purchased.

What this means: If you pay for a Duolingo subscription and cancel partway through a billing period, you won't get any money back for the unused time. Virtual gems and other in-app purchases are also non-refundable. Your only protection is whatever consumer law applies in your country.

What you can do: Before subscribing, use the free trial if available. If you need a refund and purchased through Apple or Google, contact those platforms directly as they handle their own refund policies.

Duolingo can use anonymized versions of your data for any purpose forever.

What this means: Duolingo can strip your name and identifiers from your data and then use it for any purpose whatsoever — including training AI — without restriction. Once data is 'anonymized,' it falls outside your data rights. Re-identification risks from anonymized datasets are a known privacy concern not addressed here.

What you can do: There is no opt-out for anonymized data use. Be aware that your learning patterns and behavior contribute to Duolingo's AI and research programs even after account deletion.

Your conversations are sent to OpenAI and Google for AI processing.

What this means: Your conversations, audio, and other data are shared with external AI companies like OpenAI and Google. While Duolingo says these vendors cannot use the data for their own purposes, you have no direct visibility into or control over how these third parties handle your data.

What you can do: Avoid using AI-powered features if you are uncomfortable with data being sent to OpenAI or Google. Check Duolingo's vendor agreements for more detail if available.

Your profile is public to the whole internet by default.

What this means: Your Duolingo profile — including your name, bio, picture, languages, learning stats, and followers — is public to the entire internet by default. Web scrapers and third-party sites can freely collect and use this information. You must actively change a setting to make it private.

What you can do: Go to Settings and set your Profile to private if you do not want your learning activity and personal details visible to the public internet.

Duolingo can share your data with US government and law enforcement.

What this means: Duolingo will hand over your personal data to US government agencies, including for national security purposes. There is no mention of requiring a warrant, notifying users, or publishing transparency reports about how often this happens.

What you can do: Be aware that data stored with US-based services can be accessed by US authorities. There is no practical action to prevent this while using the service.

Duolingo offers self-service data export and account deletion tools.

What this means: Duolingo provides a self-service Data Vault where you can request access to, export, or delete your personal data. You can also delete your account directly through the app. These are meaningful user rights that go beyond what many services offer.

What you can do: Visit the Duolingo Data Vault (accessible from the privacy policy) to export or delete your data. Account deletion is also available directly in the app Settings.

Duolingo explicitly promises never to use your audio for voice cloning.

What this means: Duolingo explicitly commits that the audio it collects from speaking activities will never be used to clone your voice. This is a specific, meaningful protection given the growing risks of AI voice cloning.

Children get much stronger privacy protections with tracking and ads disabled.

What this means: Children under 13 (and users under 16 for some protections) receive significantly stronger privacy defaults: no behavioral tracking, no personalized ads, no speech data sharing, and limited social features. This is a notably user-protective stance for a service with a large young user base.