This provision states that IP addresses are retained for a maximum of 30 days under standard circumstances, with an exception permitting extended retention for subscribers who provide a payment method, limited to payment processing and fraud prevention purposes.
This analysis describes what Duolingo's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a specific IP address retention timeline with a carve-out for payment subscribers that does not define a maximum extended retention period, which may require evaluation under GDPR data minimization and storage limitation principles for EU users.
Interpretive note: The absence of a defined maximum retention period for subscriber IP addresses introduces ambiguity regarding compliance with GDPR storage limitation principles; applicable regulatory guidance may impose additional constraints.
The updated policy removes explicit language stating that Android users and website users are not subject to audio collection for product improvement purposes. Previously, the policy authorized audio collection only from iOS users, with an explicit carve-out for Android and web users. The revised language now states that all users may choose not to share audio within app Settings, suggesting audio collection may now occur across all platforms unless the opt-out mechanism is used. The practical operational effect of this change depends on whether Duolingo implements audio collection on Android and web platforms, which the policy change does not explicitly confirm. You can decline audio sharing for product improvement by adjusting the setting within the app.
View change record →Under this provision, non-subscriber users' IP addresses are retained for up to 30 days. Users who purchase a Duolingo subscription and provide a payment method may have their IP address retained for an unspecified longer period for payment processing and fraud prevention purposes.
Cross-platform context
See how other platforms handle IP Address Retention and Payment Fraud Exception and similar clauses.
Compare across platforms →"We will retain your IP address for no more than thirty (30) days, unless exceptional circumstances require longer retention. If you purchase a Duolingo subscription and submit a payment method to Duolingo, Duolingo may retain your IP address for longer solely for purposes of payment processing and fraud prevention.Excerpt from Duolingo's Privacy Policy
1) REGULATORY LANDSCAPE: GDPR Article 5(1)(e) requires that personal data be kept in a form that permits identification no longer than necessary for the stated purpose (storage limitation).
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes a specific IP address retention timeline with a carve-out for payment subscribers that does not define a maximum extended retention period, which may require evaluation under GDPR data minimization and storage limitation principles for EU users.
Under this provision, non-subscriber users' IP addresses are retained for up to 30 days. Users who purchase a Duolingo subscription and provide a payment method may have their IP address retained for an unspecified longer period for payment processing and fraud prevention purposes.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Duolingo.