Privacy policy

1. Who we are

Russio is made by IOCODO LLC, a limited liability company registered in Wyoming, United States. We decide why and how the data described on this page is used, so under European data protection law we are its controller.

Postal address: 30 N Gould St Ste N, Sheridan, WY 82801-6317, United States
Email: support@iocodo.com

Use this email for anything about your data, including the requests described in Your rights.

2. What this policy covers

This policy covers the Russio app on iOS and Android, and the Russio pages on iocodo.com, this one included. Russio is an app for learning Russian from the alphabet up, with lessons, spaced review and graded reading.

Here, "personal data" means any information about you as a person who can be identified, directly or indirectly. That includes identifiers such as a user ID, an installation ID or a device token, even when they do not contain your name.

3. Data that stays on your device

Russio keeps the following on your device, in the app's own storage:

• your learning progress and review schedule, which the app also backs up (see Accounts and sign-in)
• your daily practice record, your reading progress and the results of your level tests
• your settings, such as the language the app explains in, sound, appearance, daily goal and reminder time
• your daily reminders, which your phone's operating system holds
• whether you have Russio Pro, as the store or our database last confirmed it, so the paid levels open offline

We do not receive any of this, unless another section of this policy says otherwise. If you back up your device with iCloud or Google, the backup can include a copy of this data, under Apple's or Google's terms. Uninstalling the app deletes this data from your device.

4. Accounts and sign-in

Russio uses Firebase Authentication, a Google service, to recognize your account.

The first time the app opens with an internet connection, Firebase Authentication gives your installation a guest account with a random user ID. It does not contain your name or email address, but it is a pseudonymous identifier: it links the data the app keeps on our servers to your installation.

The app uses this account to back up your progress automatically. For each letter, word and grammar card you have studied, the backup holds:

• when you last reviewed it and when it is next due
• how often you have reviewed and forgotten it
• how well the review scheduler estimates you know it

It also holds the levels you tested out of.

Signing in is optional, from Sign in to sync in the menu or from Settings. Your progress carries over to the signed-in account, so you can use it on another device or after reinstalling the app.

If you sign in with Google, we receive from Google your email address, the name and profile picture of your Google account and a Google user ID, and Firebase Authentication stores them to keep you signed in.

If you sign in with Apple, we receive an Apple user ID and, the first time only, the name and email address you choose to share. If you choose to hide your email address, Apple gives us a private address that forwards to yours.

Russio shows your name or email address only to you, in Settings. Settings, then Sign out returns this device to a new guest account: your progress stays on the device, and your signed-in account is not deleted.

5. What we use data for, and on what legal basis

European data protection law (the GDPR and the UK GDPR) requires a legal basis for each use of personal data. For each use, here is the data involved and the basis we rely on.

• Running the app: your account, the backup of your progress, keeping the app configured and confirming that requests come from the genuine app

  Data: your user ID, the progress backup and the levels you tested out of, installation identifiers and App Check tokens and, if you sign in, what Apple or Google share with us.

  Legal basis: Performance of our contract with you, that is, providing the app you asked for (GDPR art. 6(1)(b)).

• Selling and unlocking Russio Pro

  Data: the plan you buy and the store's confirmation of the purchase, which the app checks on your device; if we give you Russio Pro as a gift, a record of the gift kept with your user ID.

  Legal basis: Performance of our contract with you, that is, providing the app you asked for (GDPR art. 6(1)(b)).

• Handling the reports, language requests and emails you choose to send

  Data: what you send (see Reports and emails you send us), with your user ID for reports and your email address for emails.

  Legal basis: Performance of our contract with you, that is, providing the app you asked for (GDPR art. 6(1)(b)).

• Knowing which versions of the app are in use and who has Russio Pro, so we can fix or retire a faulty version and help paying learners

  Data: a device record kept with your user ID:

  • the last day and time you opened the app
  • the app version, and whether the device runs iOS or Android, with which system version
  • whether you have Russio Pro, of which kind (monthly, annual, lifetime or gift), and since or until when
  • on Android, whether the device is registered for notifications

  Legal basis: Our legitimate interests (GDPR art. 6(1)(f)): keeping the app working for everyone who uses it and supporting the people who pay for it. You can object at any time by writing to us.

• Counting how the app is used and fixing crashes

  Data: usage events, labels that describe your installation, crash and error reports, device model, system version, app-instance and installation identifiers, and a coarse location that Google derives from your connection (details in Who receives data).

  Legal basis: Our legitimate interests (GDPR art. 6(1)(f)): understanding how the course is used and fixing what breaks. You can object at any time by writing to us.

• Measuring our own ads

  Data:

  • on iOS, a token that Apple creates on your device, and Apple's answer about which Apple Search Ads campaign, if any, led to your download
  • the usage events we count as conversions (the first opening of the app, completed lessons and purchases), which Google Analytics shares with our Google Ads account

  Legal basis: Our legitimate interests (GDPR art. 6(1)(f)): knowing which of our ads bring new learners to Russio. You can object at any time by writing to us.

• Being able to send notifications to Android devices

  Data: a push token, stored with your user ID together with the platform and whether your account is a guest, and the notification topics the app subscribes your phone to (see Notifications).

  Legal basis: Our legitimate interests (GDPR art. 6(1)(f)): being able to tell the people who use Russio about the app. You can object at any time by writing to us.

• Showing the Russio pages on iocodo.com and counting visits to them

  Data: your IP address, your browser and device type, the page you open and the page that sent you there.

  Legal basis: Our legitimate interests (GDPR art. 6(1)(f)): running our website and knowing which pages people read. You can object at any time by writing to us.

6. Who receives data

We use these service providers to run Russio. Each one receives only the data listed, for the purpose listed:

• Firebase Authentication (Google LLC)

  What for: creates and recognizes your guest or signed-in account.

  Data: your user ID and, if you sign in, the email address, name, profile picture and user ID that Apple or Google share. Firebase also logs the IP addresses of sign-in requests. Firebase Authentication runs only in the United States.

  Google LLC processes this data on our behalf, under its data processing terms. Firebase Authentication privacy information

• Cloud Firestore (Google LLC)

  What for: our database.

  Data: with your user ID, the progress backup, the device record, the Android push token, your reports and language requests, and any Russio Pro gift. Cloud Firestore keeps this data in the European Union.

  Google LLC processes this data on our behalf, under its data processing terms. Cloud Firestore privacy information

• Google Analytics for Firebase (Google LLC)

  What for: counts how the app is used.

  Data:

  • usage events, such as the screens you open, the lessons you start and finish, how you answer exercises (right or wrong, how fast and, for a wrong typed answer, up to 12 of the letters you typed), the Russio Pro screen, and your purchases with their price, currency and store transaction number
  • labels that describe your installation, such as your level, the language the app explains in, whether you have Russio Pro, whether reminders and notifications are on, whether you signed in with Apple or Google, and whether an Apple ad brought you
  • an app-instance identifier, device model, system version and a coarse location that Google derives from your connection

  Google LLC processes this data under the Google Analytics terms. Google signals is turned off for Russio. Google Analytics for Firebase privacy information

• Google BigQuery (Google LLC)

  What for: keeps a daily copy of the usage events, so we can study them.

  Data: the same usage events as Google Analytics. BigQuery keeps them in the European Union and deletes them after 60 days.

  Google LLC processes this data on our behalf, under its data processing terms. Google Cloud privacy notice

• Firebase Crashlytics (Google LLC)

  What for: reports crashes and errors so we can fix them.

  Data: crash and error reports (what the app was doing, device model, system and app version, memory and disk state) with installation identifiers.

  Google LLC processes this data on our behalf, under its data processing terms. Firebase Crashlytics privacy information

• Firebase Remote Config and Firebase Installations (Google LLC)

  What for: keep the app configured, for example switching a feature off remotely or asking you to update.

  Data: an installation identifier.

  Google LLC processes this data on our behalf, under its data processing terms. Firebase Remote Config and Firebase Installations privacy information

• Firebase App Check (Google LLC)

  What for: confirms that requests come from the genuine app.

  Data: an attestation from Apple's App Attest or Google Play Integrity and a short-lived App Check token.

  Google LLC processes this data on our behalf, under its data processing terms. Firebase App Check privacy information

• Firebase Cloud Messaging (Google LLC), Android only

  What for: delivers notifications to Android devices (see Notifications).

  Data: an installation identifier and a push token.

  Google LLC processes this data on our behalf, under its data processing terms. Firebase Cloud Messaging privacy information

• Apple AdServices (Apple Inc.), iOS only

  What for: tells us, once per installation, whether an Apple Search Ads campaign led to your download.

  Data: a token that Apple creates on your device. Apple answers with the campaign, ad group and keyword of the ad, the type of conversion and the date of the click, or that no Apple ad was involved, and we record the answer in Google Analytics.

  Apple Inc. decides for itself how it uses this data, under its own privacy policy. Apple Ads privacy information

• Google Ads (Google LLC)

  What for: counts which of our ad campaigns led to installs, completed lessons and purchases.

  Data: the usage events we count as conversions (the first opening of the app, completed lessons and purchases), which Google Analytics shares with our Google Ads account. Advertising personalization is turned off on this link.

  Google LLC decides for itself how it uses this data, under its own privacy policy. Google Ads privacy information

• Claude (Anthropic, PBC)

  What for: an AI assistant that helps us sort reports and prepare answers to emails.

  Data: the text of a report, with its user ID, or of an email, when we work on it.

  Anthropic handles this data under the terms of our account with it. Anthropic privacy policy

• GoDaddy Professional Email (GoDaddy)

  What for: hosts our support mailbox, support@iocodo.com.

  Data: the emails you send us and our replies.

  GoDaddy stores this data for us. GoDaddy privacy policy

Apple (App Store) and Google (Google Play) also handle your download and any purchase, under their own privacy policies. If you sign in with Apple or Google, they share with us the data described in Accounts and sign-in.

We do not sell your personal data.

7. Notifications

Russio uses notifications in two ways.

• Daily reminders. They stay off until you turn them on, and your phone schedules them. You can change their time or turn them off in Settings.
• Registration on Android. When the Android app starts, it registers your phone with Firebase Cloud Messaging, a Google service, without asking you. The iOS app does not do this.

The registration stores the push token with your user ID and subscribes your phone to:

• two general topics: everyone who uses Russio, and Russio on Android
• after you change the language the app explains in, a topic for that language

This lets us send a notification to everyone, to the people who use one language, or to one account.

On Android 13 and later, no notification appears unless you allow Russio's notifications, which the app asks for only when you turn on reminders. On any Android version you can turn them off in your phone's settings. That stops them from appearing, but the registration stays while the app is installed.

Signing out or deleting your account deletes the token we stored with that account, but not the registration of your phone: the app keeps it and stores the token again with the new guest account.

8. Reports and emails you send us

When you tap Something looks wrong? and send a report, or ask for another language for the explanations, the app sends us:

• the item and the type of problem
• the text that was on screen
• the detail you add, if you add one (up to 500 characters)
• the language the app explains in, the app version and the date
• your user ID, so the report is deleted with your account

Please do not write personal details in the detail field.

If you email us, from the app or directly, we receive your email address, the name your email shows and what you write. The email the app prepares for you adds the app version, the platform and the system version, and you can read and change the draft before you send it.

We read reports and emails to fix the course and to answer you. To sort them and prepare answers, we also use Claude, an AI assistant made by Anthropic, which then receives the report or the email.

Our internal dashboard, which runs on Google Firebase, keeps a copy of the newest reports so we can follow each fix.

9. The Russio pages on iocodo.com

The Russio pages on iocodo.com use these services:

• Firebase Hosting (Google LLC)

  What for: serves the pages.

  Data: standard server logs, which include your IP address.

  Google LLC processes this data on our behalf, under its data processing terms. Firebase Hosting privacy information

• Google Fonts (Google LLC)

  What for: supplies the fonts of the Russio landing pages, the Cyrillic keyboard page and the privacy, terms and support pages.

  Data: your IP address and browser details, which your browser sends when it loads a font.

  Google LLC decides for itself how it uses this data, under its own privacy policy. Google Fonts privacy information

• Cloudflare Web Analytics (Cloudflare, Inc.)

  What for: counts visits to the Russio landing pages in every language and to the two learning guides.

  Data: the address of the page, the page that sent you there, your browser, system and device type, how fast the page loaded, and your IP address, from which Cloudflare derives your country.

  Cloudflare, Inc. processes this data on our behalf, under its data processing terms. Cloudflare privacy policy

The landing page remembers in your browser which language version you used, so it opens in that language next time. That choice stays in your browser.

10. Where data is processed

IOCODO LLC is registered in the United States. Our service providers may process your personal data:

• in the European Union: Russio's database (Cloud Firestore) and the daily copy of the usage events (BigQuery)
• in the United States only: accounts (Firebase Authentication)
• in the United States and in other countries where their providers run servers: the other services in this policy

Where European, UK or Swiss data protection law requires a safeguard for this, we rely on:

• the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, for providers certified under them (you can check a provider on dataprivacyframework.gov)
• the Standard Contractual Clauses approved by the European Commission, with the UK Addendum and the Swiss adjustments, which are part of our providers' data processing terms

You can ask us for a copy of these safeguards at support@iocodo.com.

11. How long we keep data

Here is how long we keep each kind of personal data. Items marked automatic are deleted on a fixed schedule, without anyone having to ask.

• Your account and what our database keeps with it

  Until you delete your account, in the app or by email. This covers the progress backup, the device record, the Android push token, your reports and language requests, and any Russio Pro gift.

• Guest accounts that hold no progress, no purchase and no report

  Deleted in our periodic clean-up once they are at least 90 days old and have not been used for 90 days.

• Copies of the newest reports in our internal dashboard

  Until we delete them. Deleting your account in the app does not reach them; if you ask us by email, we delete them too.

• Usage events in Google Analytics

  14 months. automatic

• The daily copy of the usage events in BigQuery

  60 days. automatic

• Crash and error reports

  90 days. automatic

• IP addresses that Firebase Authentication logs

  A few weeks. automatic

• Installation identifiers

  Firebase keeps them until we ask it to delete them, and then removes them within 180 days. Deleting your account in the app does not ask for this.

• Reports and emails we work on with Claude

  As long as Anthropic keeps them under the terms of our account with it.

• Emails you send us

  As long as we need them to deal with your request and any dispute about it.

• Server logs and visit counts of the Russio pages

  As long as Google and Cloudflare keep them under their own rules.

• What the app keeps on your phone

  Until you uninstall the app. Delete account also erases your learning data on the device, and Reset course erases your progress.

When you delete your account or ask us to delete your data, we delete it as described here, unless the law requires us to keep part of it.

12. How we protect data

Data travels between the app and our service providers over encrypted connections (HTTPS).

Our providers encrypt the data they store for us, and the access rules of our database limit what each user can read and change. Access to our systems is limited to the people who run Russio, and only to run and support it.

If a security incident puts your personal data at risk, we tell you and the competent authorities when the law requires it.

13. Your choices in the app

What you can decide in the app today:

• use Russio as a guest, or sign in with Apple or Google; Settings, then Sign out returns the device to a new guest account
• send a report, a language request or an email only when you choose to
• turn daily reminders on or off, and choose their time, in Settings
• erase your progress with Settings, then Reset course; the app also erases it from the backup the next time it syncs
• delete your account with Settings, then Delete account (see Deleting your data)
• on Android, allow or block Russio's notifications in your phone's settings

The app has no setting today for usage statistics, crash reports, the measurement of our ads or the registration for notifications on Android. You can object to them by writing to us, as described in Your rights.

14. Your rights

Wherever you live, you can ask us to:

• tell you what personal data we have about you, and give you a copy
• send that copy to you, or to another company, in a machine-readable format
• correct data that is wrong or incomplete
• delete your data
• stop or limit a use of your data, including any use based on our legitimate interests

To ask, write to support@iocodo.com. It is free. We reply within one month, and we may ask you to confirm that the data is yours before we act.

You can also withdraw any consent you gave, at any time. This does not affect what we did with your data before you withdrew it.

Deleting your data

You can delete your account and its data:

• in the app: Settings, then Delete account, the last item on the page. This deletes:
  • your account, guest or signed in
  • what our database keeps with it: the progress backup, the device record, the Android push token, your reports and language requests, and any Russio Pro gift
  • your learning data on the device (your settings stay)
  The app then starts again with a new, empty guest account.
• by email: write to support@iocodo.com with the subject "Russio Account Deletion", and if you signed in with Apple or Google, tell us the email address of that account. We delete your account and its data within 30 days, together with the copies of your reports in our dashboard, and confirm by reply.

We cannot find a guest account from an email address. If you use Russio as a guest, delete it in the app.

Deleting your account does not delete usage statistics, crash reports or installation identifiers, which Russio does not store with your account. They are deleted as described in How long we keep data. Data that stays on your device is deleted when you uninstall the app.

Complaints

You also have the right to complain to an authority:

• in the European Union and the European Economic Area, the data protection authority of the country where you live or work (list of authorities); in Italy, the Garante per la protezione dei dati personali
• in the United Kingdom, the Information Commissioner's Office
• in Switzerland, the Federal Data Protection and Information Commissioner
• in Brazil, the Agência Nacional de Proteção de Dados
• in the United States, the attorney general of your state

If you are in Brazil, you have the rights listed in article 18 of the LGPD (Lei 13.709/2018), and you can use them as described above.

15. Privacy rights in US states

Several US states, including California, Colorado, Connecticut, Oregon, Texas and Virginia, give their residents privacy rights. We give the same rights to everyone in the United States:

• to know what personal information we collect, use and disclose, and to get a copy of it
• to correct it
• to delete it
• to opt out of the sale of your personal information, of its use for targeted advertising and of profiling that has legal or similarly significant effects
• to appeal if we turn down your request
• not to be treated differently for using any of these rights

The personal information we collect, where it comes from, why we use it and who receives it are described in What we use data for and Who receives data.

We do not sell your personal information. To measure our own ads, Google Analytics shares some app events with our Google Ads account, with advertising personalization turned off, and on iOS Apple tells us whether one of its ads led to your download.

To use these rights, write to support@iocodo.com, or have someone you authorize write for you. We reply within 45 days. If we turn your request down, you can appeal by replying with the word "Appeal" in the subject. We answer an appeal within 45 days, and if you still disagree you can contact the attorney general of your state.

16. Notices for some countries

Canada

The service providers listed in Who receives data collect and keep data for us. They may process it outside Canada, in the European Union, the United States and other countries where they run servers. The courts and authorities of those countries can have access to it under their laws.

Japan

What the app sends from your device to other companies, who receives it and why is set out in Japanese on 外部送信について.

Korea

This policy in Korean, with the automatic collection, the processing we entrust to other companies and the processing abroad, is on 개인정보 처리방침.

Brazil

For parents, guardians, children and adolescents in Brazil: the risks we assessed for young users and how Russio protects them, in Portuguese (Lei 15.211/2025, art. 16).

17. Children

Russio is not meant for children under 13. The app itself does not ask your age, but where the law sets an age for agreeing on your own to usage statistics and crash reports, the buttons and switches that allow them state that age (for example "Allow, I'm 16 or older"); if you are younger, leave them off, and the app then collects no usage statistics and no crash reports.

Where a law asks us to (in Brazil and in some US states, for example), the app asks your app store for your age range, and the store or your phone may ask you or your parent whether to share it. The app uses the range only for what those laws require and does not store it; on your device it keeps only the decisions it made from the range.

If the range places you under the age for agreeing on your own, everything that needs your consent stays off. In Brazil, if it places you under 13, the app also leaves out the one reading text rated 14.

If we learn that a child under 13 has given us personal data, we delete it. If you think this has happened, write to support@iocodo.com.

18. "Do Not Track" and other companies

Some browsers and devices can send a "Do Not Track" signal. There is no common standard for responding to it, so Russio and its pages on iocodo.com do not change what they do when they receive one. The choices described in this policy are how you control your data.

Apart from the service providers listed in Who receives data and The Russio pages on iocodo.com, we do not let other companies collect personal data about your activity over time and across other apps and websites through Russio.

Two of those providers do so to measure our own advertising: Apple, through AdServices on iOS, and Google, through Google Ads.

19. Changes to this policy

We update this policy when Russio or the law changes, and the date at the top shows when the current version took effect. If a change affects how we use data you have already given us, we tell you in the app before it applies, and we ask for your consent again where the law requires it.

This version was last updated on September 29, 2026.

20. Contact

IOCODO LLC
Postal address: 30 N Gould St Ste N, Sheridan, WY 82801-6317, United States
Email: support@iocodo.com