Duolingo updated its privacy policy on April 21, 2026 to introduce a new Math Tutor video feature, disclosing that audio from that feature is shared with Apple for speech recognition before being deleted, while the text transcript may be retained and shared with AI vendors. The policy also now allows Duolingo to retain your IP address for longer than 30 days if you're a paying subscriber, for payment processing and fraud prevention. Additionally, the session replay tools used to monitor your app activity have been expanded to include a new service called 'Session Replay,' and the policy no longer explicitly lists what data FullStory does not record.
Duolingo's updated policy introduces a Math Tutor feature that sends your audio to Apple for speech recognition before deletion, but the resulting text transcript can be retained by Duolingo and shared with AI vendors — a new data-sharing pathway not previously disclosed. If you pay for a Duolingo subscription, your IP address may now be held indefinitely (beyond 30 days) for payment and fraud purposes. You can disable FullStory and Session Replay activity recording by using the Tracking toggle within the app Settings.
When you use the Math Tutor feature, your voice is sent to Apple to be converted to text, and Duolingo can keep that text and share it with AI companies.
If you pay for Duolingo, your IP address can now be stored for longer than the previously stated 30-day limit.
+ 4 more obligation changes. Full breakdown available with Watcher.
Unlock — $9.99/mo →Duolingo has introduced new audio and transcript sharing with Apple and unnamed AI vendors through the Math Tutor feature, while simultaneously removing a protective commitment about what FullStory cannot record — expanding the scope of data collection and third-party sharing without equivalent new protections. Paying subscribers are also subject to longer IP address storage, and a new session replay tool adds another layer of behavioral monitoring.
New clause discloses that Math Tutor feature audio is sent to Apple for speech recognition and the resulting text transcript may be retained and shared with AI vendors.
Paying subscribers' IP addresses may now be retained beyond the previously stated 30-day cap for payment processing and fraud prevention purposes.
The explicit list of data types FullStory is prohibited from recording (names, emails, passwords, etc.) has been removed from the policy without replacement.
ConductAtlas Policy Archive Entity: Duolingo | Document: Duolingo Privacy Policy | Record: CA-C-000581 Captured: 2026-04-21 06:05:19 UTC URL: https://conductatlas.com/change/2026-04-21-duolingo-duolingo-privacy-policy-581/ Accessed: May 2, 2026
Unlock the full analysis
14-day free trial available.
Duolingo's April 21, 2026 update introduces three material changes compliance officers should note: (1) a new third-party data share — user audio sent to Apple for speech recognition under the Math Tutor feature, with text transcripts retained and shared with unspecified AI vendors; (2) extended IP address retention for paying subscribers beyond the previously stated 30-day cap; and (3) addition of a new session replay vendor ('Session Replay') alongside FullStory for behavioral monitoring. These changes touch GDPR Art. 13/14 disclosure obligations, lawful basis requirements for new processing purposes (Art. 6), and data minimization principles (Art. 5). Organizations with Duolingo in their vendor stack — particularly schools or employers using Duolingo for Business — should assess whether their own privacy notices and DPAs reflect these new sub-processing relationships. Action is required for DPO review.
1. GDPR — Art. 5(1)(b) purpose limitation and Art. 5(1)(c) data minimization: sharing audio with Apple and retaining text transcripts for AI vendor use may exceed the original purpose of language/math learning. Art. 6(1) lawful basis must be identified for each new processing activity. Art. 13(1)(e) and 13(2)(f): new recipients (Apple, AI vendors) must be disclosed. Art. 28: updated DPAs required with Apple and AI vendors as processors. Art. 44-49: if Apple or AI vendors process data outside EEA, cross-border transfer safeguards (SCCs) are required.
Compliance intelligence locked
Obligation analysis, escalation trigger, board language, and recommended action.
Watcher: regulatory citations + obligations. Professional: full compliance memo.
ConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-C-000581.
See the full side-by-side comparison of every sentence added, removed, and modified.
🔒 Unlock full diff — Watcher $9.99/moWe monitor 200+ platforms and archive every change — verified and timestamped.