Skip to content

Privacy policy

Version 2026-10-17, effective from 17 October 2026. This policy is available in English and Norwegian with the same content; if you spot a difference, tell us at privacy@hellomolo.com.

Molo is made by Hardmax AS. This policy says what we store about you, why, who receives it, where it is processed, and how to get it or delete it.

Controller: Hardmax AS, org. nr. 936 143 202, Brinken 19A, 0654 Oslo, Norway. privacy@hellomolo.com. We have no data protection officer.

What we store

  • Account: name, email address, the sign-in method you use and, if you sign in with Apple or Google, the identifier we receive from them (see "Signing in"). Passwords are stored as hashes we cannot read. You must give a name and an email address to have an account; without them we cannot provide Molo. When you create an account, or the first time you sign in with Apple or Google, we check your birth year and country of residence and, when needed, whether you have reached the minimum age this year. We keep a yes/no record that you meet the age requirement and your country selection (Norway, South Africa or another country) to determine whether web purchases are available; the country is also named in the message our team gets when you join (see "Who receives your data"). We also keep a yes/no record of whether you are old enough to agree to product analytics yourself (16, or 13 in Norway; see "Product analytics"). The birth year and birthday confirmation are discarded. You can optionally choose a league display name and opt out of leagues in Settings.
  • Learning: which exercises you did, your answers' correctness and time, review schedules, XP, streaks, hearts, league membership and rank, and your settings (language, daily goal, listening and speaking modes, preferred voice, reduced motion). Your league display name and rank are visible to the other learners in your weekly league (up to 20 people). The display name defaults to your first name; you can change it in Settings. You can also opt out of leagues there, which removes you from the current league immediately without losing learning progress.
  • Reminders: if you turn reminders on — when the app asks after your first lesson, or in Settings — we store your time zone and the reminder time you chose, a push-notification token for your device with its platform and app version, and a record of each reminder we send (which kind, which wording, the date and time, and whether by push or email), so we never send more than two a day and can vary the wording. Reminders go through Expo's push service to Apple or Google; if you have no phone registered, the daily reminder and the come-back messages after a break come by email instead. Turn reminders off in Settings and we stop sending them; turn off "Push reminders" on a phone, or sign out there, and we delete that phone's token. As a guest without an account, the reminders you allow are scheduled on your phone only, and nothing about them is sent to us; if you then sign in to an account without reminders, they move to it, with the time and time zone stored as above, and league updates and new-unit messages stay off until you switch them on; an account that already has reminders keeps its own time and settings.
  • Recordings you make: speaking exercises are scored on your device; the audio is discarded and never leaves your phone. Only the result is stored with your learning data. Editors and speakers who record for the course work under a written agreement with us and receive their own privacy notice.
  • Reports and feedback you send us: if you report an exercise, we store your report text with your account id, and our team gets a short notice in Slack saying which exercise, the reason you chose and the app version. If you report another learner's league name, we store the report with your account id, theirs and the name as you saw it, and our team gets that name and the number of open reports in Slack; if you hide a learner in your league, we store that choice with your account id. The learner you report is not told who reported them. Feedback you send from the app or the website is not stored in our database: it goes to our team in Slack with the screen you sent it from, the app version and platform, your language and, if you are signed in, your account id — never your name or email.
  • Purchases: if you buy Molo Plus, the seller (Apple, Google or, on the web, Hardmax AS through RevenueCat and Stripe) handles payment; we receive the subscription status, the store, a subscription identifier assigned by RevenueCat, and the dates your subscription started and was cancelled, which we store with your account — never card details. We use RevenueCat's dashboards to see aggregate subscription statistics. We also retain your express-start request, purchase details, any withdrawal notice and refund reference for the accounting and refund period described below; abandoned checkout requests are removed after 30 days.
  • Technical: error and crash reports and a sample of performance timings (Sentry, hosted in the EU) containing the device model, operating system and app version, and the app's state at the time of the error. When the app starts it asks Expo's update service (US) whether a newer version of the app's code exists; that request carries the app version, the platform and a random installation identifier, not your account. The IP address of the request is discarded on receipt and never stored. They are not linked to your name or email. We do not use advertising SDKs and we do not sell or share your data for advertising. Product analytics runs only if you agree to it (below).
  • Which app you use: with your account we keep the platform you joined on (iOS, Android or the web), and the platform and app version you last used with the date we last noted them, until you delete your account. We note them when they change, and otherwise at most once a day. We use them in the totals our team gets (see "Why we use your data"), to help you when you contact us, and to know when an app update has reached learners: our legitimate interest in following how Molo grows, supporting you and keeping the app working (GDPR Art. 6(1)(f)). You can object (see Your rights).

Product analytics (only if you agree)

Molo asks whether you want to help us improve it. Only if you say yes, on the website or in the app, do we collect product analytics through PostHog, so we can learn what works in the course and what to improve:

  • How you use Molo: the pages and screens you open and how long you stay, what you tap or click (which button or element, never what you type into it), how far you scroll, and the page's loading speed.
  • How your lessons go: which lesson and exercise, whether your answer was right, how long it took and whether you skipped it — never the answer itself — and hearts, streaks, daily goals, reviews, leagues, chests, audio you play, reminders you open, the Molo Plus page (including which button led you there and, if you answer it, the option you pick when we ask once what stopped you from buying) and purchases, settings you change, feedback and reports you send (that you sent them, not what you wrote), and error messages you see.
  • Screen recordings (session replays): a recording of what happens on the screen while you use Molo, including which options you tap in an exercise. Everything you type is hidden in it, and so are other learners' names and your own email address.
  • Your device and approximate location: device type and model, operating system, browser or app version, screen size, language, time zone, and the country you are in. Our analytics provider works out the country from your IP address and then discards the address; we never keep your IP address or your city.
  • Your Molo Plus subscription after you buy it: when it starts (and whether with a free trial or an introductory price), renews, turns from a trial into a paid subscription, is cancelled or resumed, ends, or has a billing problem, with the reason given for a cancellation or an ending (for example that you cancelled it, a billing error or a refund), and the product and store — never the price or your payment details. RevenueCat tells us about these changes; we pass them on to PostHog only if you said yes.
  • Which person it is: a random identifier stored on your device and, when you are signed in, your account id — never your name or email address. With these we keep a few facts about your account: your course language, the country you chose, your plan, your daily goal, the platform, the app version and the date you signed up.

We do not use this for advertising, we do not sell it, and we do not combine it with data from other companies. The question is asked of a guest too; say yes only if you are 16 or older (13 or older in Norway). If your account does not show that you are old enough (an account created before we asked counts as not, unless its country is Norway or South Africa), we never ask, collect nothing, and do not ask again on that device. You can change your mind at any time in Settings: we stop at once and delete what the analytics kept on your device.

Counting guest use (no identifier)

When you use Molo as a guest, without an account, the app or website tells us when a few things happen: it was opened, the intro was finished, a lesson was started or finished, or the sign-up form was opened. We add one to a counter for that day, that platform (iOS, Android or the web) and that event, and keep nothing else: no account, no device or advertising identifier, no IP address, and nothing about which lesson it was or what you answered. Nothing is stored on your device for this, and it does not depend on your answer to the product analytics question. The counters cannot tell one guest from another; they only say how many times something happened. Like every request to Molo, the request passes through our hosting provider (Cloudflare), which uses its IP address to deliver it and to limit abuse; the address is not stored with the counts. When you are signed in, nothing is counted this way. Our team sees the totals in the daily, weekly and monthly numbers (see "Why we use your data").

Signing in

You can sign in with an email address and password, with Sign in with Apple, or with Google. When you use Apple or Google, we receive only your name, your email address and a provider identifier that lets us recognise your account; we do not receive your Apple or Google password, and we do not post to or read anything in those accounts. If you choose Apple's "Hide My Email", Apple gives us a relay address ending in privaterelay.appleid.com that forwards to you. We use it only to send you our own account and receipt emails; Apple lets you stop forwarding at any time in your Apple Account settings, in which case our emails will not reach you until you give us another address. Accounts are matched by verified email address or by the provider identifier; if you sign in with a different method that uses a different address, a second account may be created. When you delete your account we also revoke the Sign in with Apple authorisation held for it.

Who receives your data

Our processors, who act only on our instructions under data-processing agreements: Cloudflare (hosting and edge network — US company, servers worldwide including South Africa), PlanetScale (database in London; US company), Sentry (error reports, EU region; account metadata in the US), Resend (email — US company; sent from an EU region, records stored in the US), Expo (push delivery and app updates, US), RevenueCat (subscription status, US), Slack (messages to our team: when someone joins, their first name, whether they signed up with Apple, Google or email, the country they gave — Norway, South Africa or another country — whether they joined on iOS, Android or the web, and the language they take the course in; the reports and feedback you send us; and daily, weekly and monthly totals that name no one; US) and, only if you agree to product analytics, PostHog (analytics and screen recordings, EU region; US company). Acting on their own behalf under their own privacy policies: Apple, Google and Stripe when you buy Molo Plus or sign in with Apple or Google. Other learners in your weekly league see your league display name and rank. The current list of providers, where each processes data and the safeguard we rely on is at hellomolo.com/privacy/providers.

Why we use your data, and our legal basis (behandlingsgrunnlag)

  • To run the course you signed up for — your account (including name and email, or Apple's relay address, from Apple or Google sign-in), your password hash, your exercise attempts, review schedule, XP, streaks, hearts, settings and, if you subscribe, your Molo Plus status: this is necessary to perform our contract with you (GDPR Art. 6(1)(b)).
  • To run weekly leagues. If you take part, your league display name and rank are visible to other learners in your league. This is part of the service you have chosen (Art. 6(1)(b)); you can opt out at any time in Settings.
  • To send reminders — a nudge at the time you chose, a streak saver in the evening, a few words when you have been away, and, each with its own switch in Settings, league updates and news of a new unit — only if you say yes, when the app asks after your first lesson or in Settings: your consent (Art. 6(1)(a)). Turn them off in Settings to withdraw it. Allowing notifications in your phone's settings alone does not start reminders. Reminders, league updates and new-unit messages are service messages about your own learning; we do not use them to sell you anything.
  • To understand how the course is used and make it better (product analytics, including screen recordings), only if you say yes: your consent (Art. 6(1)(a)), which is also what the Norwegian Electronic Communications Act (ekomloven § 3-15) requires for storing the analytics identifier on your device. Withdraw it in Settings at any time; saying no costs you no feature.
  • To find and fix errors and keep Molo secure and fair — error reports and abuse checks such as rate limiting and detecting cheating or harassment in leagues: our legitimate interest in a working, secure service and in protecting other learners (Art. 6(1)(f)). You can object (see Your rights).
  • To handle reports and feedback you send us and improve the course and the app: our legitimate interest in accurate content and a working app (Art. 6(1)(f)). Please do not put personal information in the report or feedback text.
  • To tell our team when someone joins — the message in Slack described under "Who receives your data": our legitimate interest in following how Molo grows (Art. 6(1)(f)). You can object (see Your rights).
  • To count how Molo is doing — every day, week and month our team gets totals in Slack, such as how many joined and on which platform, how many learned, how far they got in the course and how many subscribe to Molo Plus. They are worked out from the data above and name no one: no name, email address or account id. Our legitimate interest in following how Molo grows (Art. 6(1)(f)). You can object (see Your rights).
  • To count how Molo is used without an account — the guest counters described under "Counting guest use": a number per day, platform and event, with no identifier. Our legitimate interest in knowing whether the course works for the people who try it (Art. 6(1)(f)).
  • To keep purchase records after you delete your account, for five years after the end of the financial year of the last payment or refund, because Norwegian bookkeeping law requires it (bokføringsloven § 13; Art. 6(1)(c)). These are the transaction records our payment providers and our accounts hold, not your learning data.
  • Editors and speakers: we process editors' and speakers' names under our agreement with them (Art. 6(1)(b)); they receive their own privacy notice.

You may object to processing based on our legitimate interests, and to any direct marketing, at any time.

Where your data is processed

We are based in Norway. Your account and learning data are stored in a database hosted in the United Kingdom (PlanetScale on AWS, London). The United Kingdom is covered by a European Commission adequacy decision (Decision (EU) 2025/2574, valid to 27 December 2031), so no additional safeguard is needed for storage there.

Some of our providers are established in the United States or run global networks. When we transfer personal data to them we rely on (a) the EU–US Data Privacy Framework, where the provider is certified (you can check the list at dataprivacyframework.gov), and/or (b) the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), together with our assessment of the laws of the destination country. Our app runs on Cloudflare's global network, so requests are processed in the Cloudflare data centre nearest to you — for users in southern Africa that includes South Africa — under the Standard Contractual Clauses in our agreement with Cloudflare. Error reports (Sentry) are stored in the EU, except account metadata held in the US; product analytics and screen recordings (PostHog), if you agree to them, are stored in the EU (Frankfurt), with support access from the US under the Standard Contractual Clauses; transactional emails (Resend), subscription records (RevenueCat) and messages to our team (Slack) are stored in the US; push notifications are delivered through Expo (US) to Apple and Google.

The current list of our providers, the country each processes data in, and the safeguard we rely on for each is at hellomolo.com/privacy/providers. You can ask for a copy of the Standard Contractual Clauses we have signed by emailing privacy@hellomolo.com.

How long

Account and learning data: until you delete your account. An account created with Apple or Google whose birth year and country were never given is deleted, with everything it holds, seven days after it was created. When you delete your account we remove your data from our live database immediately and from backups within 30 days; the offline copy on your device is wiped when you delete the account in the app. Error reports: 90 days. Push tokens: until you turn off push reminders on that phone, sign out there, or delete the account. The record of reminders we sent: 90 days. Your time zone and reminder time: until you delete the account. Reports and feedback you send us, including the messages to our team in Slack: until handled, and at the latest 12 months after. Learners you hide in leagues: until you show them again or delete your account. Product analytics: screen recordings 30 days, other analytics events 24 months; if you delete your account, we delete the analytics tied to your account id within 30 days. Your answer to the analytics question, and when you gave it, is kept with your account settings. Purchase records: five years after the end of the financial year of the last payment or refund, because Norwegian bookkeeping law requires it (bokføringsloven § 13). Guest counters: a number per day, platform and event with no identifier, kept as long as we use them for these totals.

Cookies and storage on your device

Molo sets no advertising cookies and no third-party cookies. Apart from product analytics, which asks first (below), we store on your device only what is needed to run the service you asked for, which the Norwegian Electronic Communications Act (ekomloven § 3-15) allows without consent:

  • Web: a session cookie that keeps you signed in; browser storage (localStorage) holding your interface language and reduced-motion setting; and a cache of published lessons and audio so pages load quickly and work offline.
  • iOS and Android apps: an encrypted local database with your lessons and review queue for offline use, and — only if you turn reminders on — a push-notification token. Whether the app has asked you about reminders, and as a guest the reminders you allowed, are kept on the phone.
  • Your answer to "Why isiXhosa?", on the web and in the apps: if you answer this question in the intro, your answer (such as "Travel") is kept in browser storage (localStorage) or on the phone. It is used only to pick the encouraging line shown when you set your daily goal. It never leaves your device: it is not sent to us, and it is not linked to your account, so deleting your account does not remove it. To remove it in the apps, choose "Show the intro again" in Settings and then "Skip this question", or uninstall the app; on the web, clear this site's data in your browser.
  • Product analytics, only if you say yes: your answer to the question (as a guest, on your device until you sign in), and PostHog's random identifier, current session and settings, in browser storage (localStorage, no cookie) or in the app's storage. Say no, or turn analytics off in Settings, and they are deleted from your device.

Nothing here is used to track you across other sites or apps.

How we protect your data

We protect your data with encryption in transit (TLS), passwords stored only as salted hashes, an encrypted offline cache on your phone (SQLCipher), a database hosted in London (UK) with automatic backups, application code that runs on Cloudflare's network in the data centre nearest you, access limited to named accounts, and error monitoring hosted in the EU. No system is perfectly secure; if a breach is likely to put you at high risk we will tell you and notify the regulator (Datatilsynet, and the Information Regulator for South African users) as the law requires.

Your rights

You can ask us to: see the personal data we hold about you (access); correct it (rectification); delete it (erasure); limit how we use it while a question is resolved (restriction); and receive the data you gave us in a machine-readable file or have it sent to another service where technically feasible (portability). You can object at any time to processing based on our legitimate interests, and to any direct marketing, and you can withdraw a consent (to reminders or to product analytics) at any time in Settings without affecting the lawfulness of what we did before. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects; review scheduling and league placement are automated but only change what you see in the course. In Settings you can download everything we hold in JSON and delete your account yourself; you can also request deletion at hellomolo.com/delete-account without installing the app. For anything else write to privacy@hellomolo.com and we answer within one month. If you think we handle your data unlawfully you can complain to Datatilsynet (datatilsynet.no) or, if you live in another EU/EEA country, to the supervisory authority where you live.

If you are in South Africa

The Protection of Personal Information Act (POPIA) applies to how we handle your personal information. Hardmax AS is the responsible party; our Information Officer is Jakob Malmo, reachable at privacy@hellomolo.com or by post at Hardmax AS, Brinken 19A, 0654 Oslo, Norway. Our PAIA manual is available on request at the same address. Giving us your name, email and password is required to have an account; learning data is required to run the course; reminder notifications and product analytics are optional, and product analytics runs only if you agree to it. Your data is stored in the United Kingdom and processed by providers in the EU and the United States; the UK and EU have laws giving protection substantially similar to POPIA, and our US providers are bound by written agreements requiring equivalent protection. Other learners see your league display name in weekly leagues; you can change it or opt out in Settings. You may object to processing based on our legitimate interests and to any direct marketing at any time, and you may ask us to correct or delete your information. Reminder notifications, league updates and new-unit messages are service messages about your own progress, each of which you can turn off in Settings; we do not send marketing by push, SMS or email to South African users unless you separately opt in, and every marketing message will tell you how to stop it. In South Africa, anyone under 18 is a child under POPIA; Molo is for adults (18+) in South Africa because we do not yet collect the parent's or guardian's consent that POPIA requires. You may lodge a complaint with the Information Regulator (South Africa): Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; POPIAComplaints@inforegulator.org.za; 010 023 5200.

Children

Molo is for learners aged 13 and over, and 18 and over in South Africa, where anyone under 18 is a child under POPIA and we do not yet collect the parent's or guardian's consent POPIA requires. Product analytics is only for learners who may agree to it themselves: 16 and over, or 13 and over in Norway. A guest is asked to say yes only at that age; once an account does not show that a learner is old enough, we stop, collect nothing for that account, and do not ask on that device again. If you believe a child below the minimum age has an account, email privacy@hellomolo.com and we will delete it.

Changes

We will announce material changes in the app and by email before they take effect.