How Milo handles your data

The short version

• There is no Milo account. You don't sign up, sign in, or hand us an email to use the app.
• Your learning data lives locally in the app. On Android, the operating system can include the learning database and app preferences in your Google-account device backup so they can be restored. This is not a Milo account or Milo-operated sync service.
• We use product analytics to know what works. The Android app also uses crash diagnostics to keep the app reliable. We don't sell data, share it with advertisers, or build an advertising profile on you.

Who runs Milo

Milo is built and maintained by Milo Hebrew, a small independent team. If you have a question about anything on this page, use our contact form.

What the apps handle

The learning model is local on both platforms. Android also has a system backup path. Android crash reports go to Firebase Crashlytics when Firebase is configured for the installed build.

• Stays on your device. Your CEFR level, daily pace, recognition-probe answers, the words you've seen and how you rated them (Got it / Again), your favorites, study sessions, streak, and notification schedule. Notifications are scheduled locally. Except for the Android system backup described next, Milo does not receive or sync this learning database.
• Android system backup. Milo allows Android's backup service to copy user.sqlite (the local learning database) and all Android shared preferences (app settings and locally stored app identifiers). The bundled dictionary is excluded. Google/Android stores and restores this copy through the Google account selected for device backup; Milo does not receive it or operate the storage. In Android Settings you can turn Backup by Google One on or off and review backup details. Google also provides account-dashboard controls to delete backup data; that deletion acts on the Google-account backup, while clearing Milo's storage or uninstalling removes the local copy from the device. Android backup help.
• Sent to us as anonymous analytics. When analytics is enabled, the app sends events for app opens, onboarding steps, words shown (with how long you spent on each), Got it / Again / Bookmark taps, and notification opens. Each event carries your CEFR level and daily pace so we can tell whether the algorithm is working — none of it is tied to a name, an email, or an identifier we can trace back to you.
• Android crash diagnostics. The Android app uses Firebase Crashlytics to send crash stack traces, relevant non-sensitive app state, device and operating-system metadata, app version, timestamps, and installation/session identifiers to Google so we can find and fix crashes. We do not attach your name, email, a Milo account, learning answers, or free-form learner content to these reports. Firebase privacy and security.
• Reads from us. The app downloads dictionary updates from Firebase Storage. Those reads carry only an App Check token (proves the request comes from a real Milo install) and no user identifier.
• Never collected. Your contacts, photos, location, microphone, keyboard input outside Milo, the contents of other apps, your iCloud data, your Apple ID, or your phone number. Milo does not ask iOS or Android for permission to any of these.

What we collect on this website

milohebrew.com is the marketing site for the Milo apps.

• Android closed-test email. If you request Android beta access, we store the Google-account email and the language of the page you used. We use them only to add you manually to the private Google Play tester list and send the pending and access-ready emails. The address is not sent to analytics.
• Web analytics. We use Mixpanel and Google Analytics 4 to count page views, scroll depth, FAQ opens, locale switches, store/setup clicks, and whether a closed-test request succeeded or failed. We never include the submitted email in analytics.

Why we collect any of this

Four reasons, all narrow.

• To make the app better. If everyone skips a word, we should know.
• To decide what to build next. Which features get used, which don't.
• To find and fix crashes in the Android app.
• To manage closed-test access and send the two emails you requested.

Who else sees the data

A short, named list. We add no one to it without updating this page first.

• Mixpanel. Processes the analytics events. Mixpanel privacy policy.
• Google (Android backup / Analytics 4 / Firebase). Runs Android's user-controlled device backup, processes Analytics 4 events and Crashlytics reports (including Firebase Installations and Sessions identifiers), hosts the site, stores the dictionary file and closed-test request, and holds the private Play tester email list. Android backup belongs to the user's selected Google account; Milo cannot inspect or delete that backup. Google privacy policy.
• Apple. Distributes the app and runs the App Store. We can't see who downloads or what their Apple ID is. Apple privacy policy.
• Resend. Delivers the two Android closed-test emails and the operator notification. Resend privacy policy.

Where the data lives

Milo Hebrew is based in Israel. The processors above run servers in the United States and the European Union. If you're reading from the EU or the UK, analytics events and Android crash diagnostics may leave Europe. Mixpanel and Google use Standard Contractual Clauses for those transfers. Android backup storage and location are controlled by Google under the Google account used for device backup.

How long we keep it

• On-device data. Until you clear Milo's storage, delete the app, or use Milo's reset control where available. On Android, the system-managed backup described above is a separate Google-held copy.
• Android system backup. Google controls backup retention and deletion. You can turn device backup off in Android Settings and use your Google Account dashboard to delete backup data. Milo cannot access or delete that Google-held copy for you.
• Android closed-test email. While access is pending or the closed test is active, then up to 12 months for support and operational records. You can ask us to remove it sooner.
• Analytics events. Up to 14 months in Google Analytics. Up to 5 years in Mixpanel — the default; we'll review before public launch.
• Android crash reports. Firebase Crashlytics keeps crash traces and associated installation identifiers for 90 days before starting removal from live and backup systems.

Your rights

You can ask us what we have on you, to delete it, or to send it back in a machine-readable form. Send your request through our contact form — we respond within 30 days.

A note on analytics and Android crash diagnostics: they use app or installation identifiers rather than a Milo account, so we cannot use your name or email to single out specific events or crash reports. Deleting Milo stops new app events and crash reports; a content blocker can stop new website events. Closed-test access is the one website flow where we store your email — reply to either tester email to be removed from our records and ask us to remove you from the Play tester list.

Android backup is controlled separately by Google. Use Android Settings to turn Backup by Google One on or off and review what is backed up; use your Google Account dashboard for Google's backup-deletion control. Clearing Milo's storage or uninstalling removes local data from that device, but Milo cannot manage the Google-held backup for you.

If you live in the EU or UK, you can also complain to your local data protection authority.

Cookies and similar technologies

We don't set tracking cookies. The web analytics SDKs use first-party storage (cookies or localStorage in your browser) to count returning visitors. That storage is never shared with anyone, and you can clear it from your browser settings at any time.

Children

Milo is built for people who can already read Hebrew at A2 level — typically teens and adults. We don't knowingly collect data from children under 13, or under 16 in the EU. If you believe a child has used Milo, write to us and we'll delete what we have.

Changes to this policy

We'll update the date at the top of this page when anything changes. For meaningful changes, we'll show a notice in the app or on the home page before they take effect.

Contact

Milo Hebrew · Contact form. We read every message — expect a reply within a few business days.