Privacy

Last updated 6 October 2026

The short version

Lua rewrites words on pages inside your browser, and what you read stays on your device. If you create a Lua account, we store your sign-up details and the setup answers you chose. If you press "Wrong?" on a swapped word, we also keep that report, without your account (see below).

The extension

What it reads: it reads the text of web pages you visit, inside your browser, to swap words into the language you are learning. That text is processed on your device and is not sent anywhere. The only exception is a word you choose to look up (see below).
What it stores: which words you have marked as known and how often you have seen them, and, to quiz you later, how you used each swapped word (when you revealed the original and for how long, audio plays, your quiz answers) with the sentence you first met it in (with email addresses and long numbers removed, and never from mail, banking or payment pages). All of it is kept in your browser's local extension storage on your computer.
Sync between your computers: only when you are signed in, the extension syncs your progress (known and saved words, daily counts) and your learning history (for each swapped word: the word and its translation, when you met it, how often and how long you revealed it, listened to it or opened its card, your quiz answers, how well you seem to remember it, and whether you marked it known or saved it) with Lua's servers, so your other computers pick up where you left off. It is encrypted on the way and stored encrypted with a key for your account. The sentences you met words in are never synced: they stay on the computer where you read them. Signed out, nothing is synced.
Setup from the website: if you finish onboarding on learnwithlua.com with the extension installed, the website passes your known words, your list of sites to skip, and your level to the extension on your own computer.
Your session: if you are signed in when you finish onboarding, the website also passes your sign-in session to the extension so word look-ups can run as you. Signing out of the website does not sign out the extension: use "Sign out" in the extension popup to remove it.
Lua for Mac (only if you connect them): if you also use Lua for Mac and press "Connect" in the extension's Account tab (Chrome asks you to allow it first), the extension and the Mac app talk to each other directly on this computer. They share which account each one is signed in to (the email address only), your language settings and the number of words due for a review, and the extension asks the open page to show its look-up card when you press ⌥⇧L in Chrome. Your sign-in passes to the Mac app only when the Mac app asks for it (when you choose "Use my Chrome account" there), so you do not sign in twice. This link never goes through Lua's servers, and nothing extra leaves your computer. "Disconnect" in the Account tab, or removing the permission in Chrome, ends it.
Permissions: "storage" to keep your progress, "activeTab" so the popup can show which site you are pausing, and network access to Lua's own servers and Google's sign-in service, used for word look-ups, sync, audio, AI page translation and "Wrong?" reports. Lua runs on http and https pages and skips code blocks, text boxes and editable areas.
Removing it: "Reset progress" in the popup clears your progress and learning history on this computer and, when you are signed in, on Lua's servers (when this computer next syncs) and on your other computers when they sync after that. Uninstalling the extension removes its stored data.

Your account and setup answers

If you choose to save your plan, we create an account with Google Firebase (email and password, or Google sign-in). We store:

your email address and the sign-in provider, held by Firebase Authentication;
your setup answers: target and native language, your reasons for learning, topics you like, daily time, where you read, the kinds of sites you want Lua to skip, your starting level, and the words you told us you already know;
when the profile was created and last changed.

We use this to keep your plan with your account. We do not sell it or use it for advertising. You can choose "Not now" during setup to keep your answers on your device only. To delete your account and stored answers, contact us (below) and we will remove them.

Emails from Lua

We send email through SendGrid (Twilio), which receives your address and the message in order to deliver it. We do not track whether you open an email or click its links. There are two kinds:

A one-time welcome when you create an account and confirm your email address.
The weekly email (off unless you turn it on): if you switch it on in the extension (Account tab), every Monday Lua’s servers open your synced learning history and your daily reading counts, which are stored encrypted with a key for your account, to work out your week. The email is about the language you are learning (as picked in the extension, or in your saved plan) and holds those numbers (new words, quick checks, words learned, days you read, words swapped, totals so far, words due for a quick check) and up to three words you keep revealing or missing, with their translations. To do this Lua stores the switch, the language codes you picked and which week was last sent; it keeps nothing from the email itself. Like the welcome email, it shows the Lua logo and loads fonts from Google Fonts when you open it, so those servers see a request from your mail app. The sentences you met words in are never in it: they never leave your computer. Every weekly email has an unsubscribe link, and the switch in the extension turns it off too.

Looking up a word

If you select a word or short phrase on a page and press "Look up", the extension sends that selected text, the language you are learning, and your sign-in to Lua's servers. We forward only that text and the language to OpenAI to produce the translation, meaning and example, then return it to you. We do not send the page, its address or title, or your browsing history; the sentence around the word is sent only if you have turned on AI page translation (below). The request also names your native language (English unless you chose another). We count look-ups, page translations and audio per account, and what they cost us per month, to apply plan limits; we do not store the words you look up with your account. Answers to plain word look-ups (the word, and the translation shown on the page when you open a word's details, never the sentence) are kept in a shared cache that is not linked to any account, so the next person asking gets them at once. OpenAI processes the text under its own API terms and may retain API inputs for a limited time, and our servers and Google's sign-in service see your IP address and account ID as part of any request. Look-ups are off until you sign in, and never happen unless you press the button.

AI page translation (off unless you turn it on)

For languages that have no built-in word list, you can switch on AI page translation in the extension's Settings. It is off by default. When it is on, the extension reads the paragraphs you are reading, in whatever language the page is written, and sends the text of those paragraphs (with email addresses and long numbers removed), the page's language (when it is not English), the language you are learning and your level, encrypted, to Lua's servers, which forward it to OpenAI to translate a few words in them (on pages not in English, OpenAI also chooses which words). We never send the address or title of the page, and nothing is sent from pages you have paused or skipped, from mail, banking and sign-in pages, or from pages with password or card fields. Lua does not store the text (except a sentence in a "Wrong?" report, below); our servers keep only counts (for example how many requests, and how long they took) to apply limits and fix problems. The extension remembers the translated words on your device so a page you revisit is quick. OpenAI states that it does not use API data to train its models unless a customer opts in, and that it may keep API inputs and outputs for up to 30 days to detect abuse. With this switched on, looking up a word also sends the sentence it is in. Turn the switch off in Settings at any time and nothing further is sent.

Reporting a wrong translation ("Wrong?")

The card on a swapped word has a "Wrong?" button. Pressing it puts the original word back in that sentence and remembers, on your device only, not to swap that word in that sentence again. If you are signed in, it also sends a report, encrypted, to Lua's servers so we can fix our word lists and prompts. A report holds the word, the translation that was shown, the language you are learning, the language of the word and the page, how the word was swapped (word list, AI or on-device AI) and your level. The sentence the word was in (with email addresses and long numbers removed) is included only if you have turned on AI page translation, and never from mail, banking or sign-in pages or pages with password or card fields. We never send the page's address or title. Reports are stored without your account or email, and their time only to the day; we separately count how many reports each account sent each day, to limit them to 30 a day. Reports are deleted automatically after 180 days. Nothing is sent unless you press the button.

This website

This site sets no cookies of its own and has no analytics. It loads fonts from Google Fonts, which means your browser contacts Google to fetch them. The sign-up page loads Firebase's sign-in code from Google. Our hosting provider (Google Firebase Hosting) keeps standard server logs. The site stores a few things in your browser (your unfinished setup answers, and decoration on the page) and never sends them anywhere unless you save your plan.