Duolingo keeps your personal data for as long as it is needed for the purposes it was collected, without specifying exact timeframes.
This analysis describes what Duolingo's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The policy does not specify fixed retention periods for different categories of data, which under GDPR requires that retention periods or criteria be communicated to users; the absence of specific timeframes creates ambiguity about how long learning and behavioral data is retained.
Interpretive note: The policy does not specify category-specific retention periods, and the criteria-based approach may or may not satisfy GDPR transparency requirements depending on regulatory interpretation.
The updated policy removes explicit language stating that Android users and website users are not subject to audio collection for product improvement purposes. Previously, the policy authorized audio collection only from iOS users, with an explicit carve-out for Android and web users. The revised language now states that all users may choose not to share audio within app Settings, suggesting audio collection may now occur across all platforms unless the opt-out mechanism is used. The practical operational effect of this change depends on whether Duolingo implements audio collection on Android and web platforms, which the policy change does not explicitly confirm. You can decline audio sharing for product improvement by adjusting the setting within the app.
View change record →Expanded to detail specific factors considered for retention (amount, nature, sensitivity, risk of harm) and added 'legal, accounting, or reporting requirements' but excerpt appears incomplete/truncated.
View full change record →The policy states data is retained as long as necessary for stated purposes, without specifying maximum retention periods for categories such as learning activity, device identifiers, or payment information, which means data may be retained for extended periods.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process your personal information, and whether we can achieve those purposes through other means.Excerpt from Duolingo's Privacy Policy
REGULATORY LANDSCAPE: GDPR Article 5(1)(e) requires that personal data is kept in a form that permits identification of data subjects for no longer than necessary, and Articles 13 and 14 require that retention periods or …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The policy does not specify fixed retention periods for different categories of data, which under GDPR requires that retention periods or criteria be communicated to users; the absence of specific timeframes creates ambiguity about how long learning and behavioral data is retained.
The policy states data is retained as long as necessary for stated purposes, without specifying maximum retention periods for categories such as learning activity, device identifiers, or payment information, which means data may be retained for extended periods.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Duolingo.