Loading…
Sorlio
Effective 8 October 2026
Sorlio is operated by Zachary Haggar, trading as Sorlio (United Kingdom), referred to here as “Sorlio”, “we” or “us”. The data controller for Sorlio is Zachary Haggar, trading as Sorlio. This policy covers the Sorlio website, the installed web app and the Android app.
Questions, requests and complaints: Sorlio@proton.me. Postal address: 58 Ockford Road, Godalming, Surrey, GU7 1RF, United Kingdom.
Without an account, everything Sorlio stores is kept in your browser or the app’s storage on your device: saved and known words, phrases, reading history and progress, streaks and goals, grammar and practice progress, review settings, reading and listening preferences, texts you import, and a count of how many new words you have saved today (without Premium you can save 5 new words a day).
None of this is sent to us. It stays until you remove it in Sorlio, clear the app’s or browser’s storage, or uninstall the app. If several people share a device, each Sorlio account’s data is kept separately from the others and from data saved while signed out.
Accounts are optional and use Google sign-in. Sorlio never sees your Google password. Our account provider, Supabase, keeps:
Google also sends your name and profile picture when you sign in. Sorlio does not use them and removes them from our records automatically.
When you are signed in, your learning data (the on-device data listed above) is copied to our database so it is the same on each device where you sign in. This is what an account is for, so it is on whenever you are signed in.
Texts you import are not synced unless you turn this on in Settings → Account. Turning it off again removes your imported texts from our database; the copy on your device stays.
Signing out stops syncing and leaves that account’s data on the device until you clear it. Our database is hosted by Supabase in the EU (Frankfurt, Germany).
Premium costs £3.99 a month, is bought through Google Play and needs a Sorlio account so it can be restored on your other devices. Google handles the payment; we never receive your card or bank details.
To provide Premium we keep the subscription’s product, Google Play purchase and order references, its state (for example active, cancelled or on hold), renewal and expiry times, and when we last checked it with Google. Google tells us directly when a subscription changes, so Premium stays accurate if you cancel, pause or are refunded. These records are kept while your account exists. A log of Google’s notifications, holding only a one-way fingerprint of the purchase reference, is kept for 90 days.
AI features are part of Premium and only run when you ask: explaining a word, phrase or sentence, translating a text naturally, or creating a practice exercise. For each request we send OpenAI the text needed to answer, such as the word and the sentence around it, or the text you asked to translate (including an imported text, if you choose to translate it), plus the level you are reading at. We never send your name, email or account identifier.
We ask OpenAI not to store responses for later use, and under OpenAI’s API terms this content is not used to train its models. OpenAI may keep requests for up to 30 days to detect abuse. To keep AI costs fair we count how many AI requests each account makes per day; those counts are deleted after 30 days.
AI answers can be wrong. Each one has a “Report” button, which sends us the word and the AI’s answer so we can fix the problem (see Feedback below).
When you send feedback or report an answer, we receive what you choose to send: the type of problem, the screen and feature it concerns, the article or word involved, and any comment you write. Please don’t include personal details in comments. Feedback is not linked to your email; if you are signed in it is linked to your account identifier so that it is deleted with your account. Feedback is deleted after 12 months.
News articles are collected by our server from publishers’ public feeds, so your device does not contact those publishers unless you open an original article link. The built-in dictionary works on your device. Listening uses your device’s own text-to-speech voices; depending on your device settings, its maker may provide those voices online.
Like any website, our hosting provider (Vercel) receives your IP address, device type and the page requested with each request, and keeps short-lived server logs to run and secure the service.
To stop abuse, some requests (feedback, account checks, sign-in to the admin area) are limited per IP address; the address is held for at most 15 minutes for this. We also keep daily totals with no information about who made them, such as “AI requests that failed” or “accounts deleted”, for up to 400 days.
We use these providers to run Sorlio. They act on our instructions and may only use the data to provide their service to us:
Some of these providers process data outside the UK and European Economic Area, including in the United States. Where they do, transfers are covered by the safeguards in their data processing terms, such as standard contractual clauses and the UK International Data Transfer Addendum. We may also disclose information if the law requires it.
Sorlio is for learners aged 13 and over. We designed it with the UK Age Appropriate Design Code in mind: the most private settings are the default, nothing is shared publicly, and there are no adverts, profiling or nudges to give up privacy. If you believe a child under 13 has created an account, contact Sorlio@proton.me and we will delete it.
You can delete your account and everything synced to it in Settings, or at sorlio.site/account/delete if you don’t have the app. Data on a device stays there until you clear the app’s storage or uninstall it. Deleting your account does not cancel a Premium subscription: cancel it in Google Play first.
You can also ask us for a copy of your data, to correct it, to restrict or object to how we use it, or to delete it, by emailing Sorlio@proton.me. We will reply within one month. If you are unhappy with our answer you can complain to the UK Information Commissioner’s Office (ico.org.uk) or your local data protection authority.
Test versions of Sorlio released before this policy could, if you agreed, collect anonymous usage analytics and crash reports. This version collects neither. The analytics records collected earlier are being deleted; contact Sorlio@proton.me if you have questions about them.
If we change how Sorlio uses personal data, we will update this page and, for significant changes, tell you in the app before the change takes effect.
See also the terms of use and credits and licences.