Privacy Policy

Last updated: October 10, 2026

This Privacy Policy explains how Liam Nelson, a sole proprietor doing business as hablio.cc in Oregon ("hablio.cc", "we", "us"), handles information on the website hablio.cc (the "Service"). It should be read with our Terms of Service.

1. The short version

• You need an account to use most of the site. We collect only what we need to run it.
• We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
• You must be 13 or older to have an account. We do not knowingly collect personal information from children under 13.
• Google ads, if turned on, only load after you click Accept on our cookie banner, and they are requested as non-personalized.
• You can ask us to see, fix, or delete your data at [email protected].

2. Information we collect

Information you give us

Information	Why we collect it
Username	To identify your account. When your profile is public, signed-in users can find it in search and view it.
Email address	To verify your account and send you account emails. It is not shown on your profile or to other users.
Google sign-in information (optional)	If you choose Google sign-in, Google sends us your verified email address and a stable account identifier so we can sign you in. We do not store Google access tokens or read other Google account data.
Password	To let you sign in. We store only a salted, one-way hash (Argon2id), never the password itself.
Date of birth	Only to check that you are at least 13. We use it at signup and do not store it.
Profile picture (optional)	To show on your profile. It is visible to signed-in users when your profile is public.
Messages to Lola	To generate her replies. See "How Lola handles your messages" below.
Messages in Hablio Hangout	To show recent room messages, deliver private matches, filter content, and handle reports. AI practice chat is not stored.
Friend requests and private messages	To maintain accepted friendships, display friend lists, deliver private messages between friends, and show unread-message counts.
Emails you send us	To answer your request.

Information created by your use of the Service

Your lesson completion history, level and XP (progress points), learning streak and active days, daily lesson goal, profile visibility setting, a public profile ID that appears in your profile link, and the times you created your account, accepted the Terms and Privacy Policy, verified your email, and last logged in. Friend requests, accepted friend connections, private messages between friends, and whether a message has been read are also stored. Friends are visible to signed-in users who can view that profile. Historical Hablio Valley saves may also remain stored, including town position, coins, job, home, quest and collection progress, and chat messages from when that game was available. You can make your profile private in profile editing; private profiles are excluded from search and other users cannot view them.

Information collected automatically

Like most websites, our server receives your IP address, browser and device type, and the pages and files you request, and may keep these in ordinary server logs for security and troubleshooting. We use cookies as described in section 5. We do not use analytics tools or social media trackers.

How Lola handles your messages

Lola is an AI model that runs on our own server software. Your messages to her are not sent to any outside AI company. We keep roughly your last 12 messages in the server's temporary memory so she can follow the conversation. They are not saved in our database, and they are cleared when you reopen the Lola page or the server restarts. Please do not share sensitive information with her.

Hablio Hangout

Hablio Hangout is a text-only chat for signed-in, email-verified accounts. Worldwide room messages are shown to other room visitors and the most recent 500 messages are kept in the database. One-to-one messages are visible to the matched participants and are kept in the database until account deletion. Recent online and matchmaking presence is kept while you are active and becomes inactive after about 45 seconds without a connection. Lola and Mateo in Hablio Hangout are clearly labeled AI practice partners; their practice replies are generated from preset language-learning prompts and their conversations are not saved.

Messages are screened automatically for some personal contact details, links, and harmful language. These filters can miss content or block an ordinary message by mistake. Users can report a person; reports include the reporting account, reported account when applicable, reason, optional description, and time, and are available to the configured chat moderator. We do not promise live human review of every message or report. Do not share sensitive information in chat. You can ask us to delete your account and associated chat data by emailing [email protected].

Friends and private messages

Friend requests and accepted friendships are stored until either person removes the friendship or the account is deleted. Private messages are visible to the two friends in that conversation and are stored until either person removes the friendship (which deletes that conversation) or an account is deleted. The Messages menu shows unread-message counts. We do not send private messages to third-party messaging providers.

Speaking practice and your microphone

Some optional lesson challenges let you say a word aloud. The microphone is used only when you tap the "Tap and speak" button, and only for a few seconds. Speech is recognized by your browser's own speech service, not by us. In Chrome and Edge this may send audio to Google or Microsoft under their privacy policies. We never receive, record, or store your voice or the audio. You can skip speaking exercises at any time. Lesson audio normally uses your device's built-in voice. If Google Cloud Text-to-Speech is configured and you leave the online voice option enabled, the short Spanish lesson text you choose to play is sent to Google to synthesize audio; Hablio does not store that audio.

3. How we use information

• To create and secure your account, verify your email, and keep you signed in.
• To provide the Service: lessons, progress, profiles, search, and Lola.
• To check eligibility (age) and keep a record that you accepted our Terms and Privacy Policy.
• To protect the Service, prevent abuse and fraud, and fix bugs.
• To respond to your messages and requests.
• To show ads, if enabled and you have accepted.
• To follow the law.

We do not use your information to make decisions that have legal or similarly significant effects on you.

4. Sharing and third-party providers

We do not sell personal information. We share it only as described here:

Who	What they receive	Why
Google (Gmail email delivery)	Your email address and the text of the account emails we send you (such as the verification link).	To deliver account emails.
Google (optional sign-in)	Your email address and a stable Google account identifier, sent to Hablio after you choose Google sign-in.	To authenticate you and associate your Google account with your Hablio account. We do not request access to other Google data.
Google (ads), only if turned on and you click Accept	Your IP address, browser and device information, the page you are on, and cookie identifiers, collected by Google directly through its ad code.	To show and measure ads. Google acts under its own privacy policy: policies.google.com/privacy.
Your browser's speech recognition service (only when you tap the microphone button)	A short audio clip of your voice, sent by your browser directly to its vendor (for example Google in Chrome). We do not receive it.	To check your pronunciation in optional lesson challenges.
Google Cloud Text-to-Speech (only when online speech is configured and enabled)	The Spanish word or short phrase you choose to hear. Hablio does not store the returned audio.	To provide neural Spanish pronunciation audio.
Other signed-in users	Your username, profile picture, and level.	Profiles and user search.
Your accepted friends	Private messages you send in their one-to-one conversation. Friend lists are also visible to signed-in users who can view your public profile.	Friend features and private messaging.
Our web host and server operators	Data stored on or passing through our servers.	To run the Service.

We may also disclose information if required by law or legal process, to protect rights, safety, or security, or as part of a sale or transfer of the business (with notice to you if your information is affected).

5. Cookies and tracking

Cookies are small files stored in your browser. We use:

Cookie	Purpose	Lasts
Session cookie	Keeps you logged in and protects forms from forgery. Strictly necessary.	Up to 30 days once you log in
hablio_age_block	Remembers on this browser that the age check was not passed, so the signup form cannot be retried. Strictly necessary.	24 hours
hablio_consent	Remembers your cookie choice. Only used when ads are enabled.	About 6 months
Google ad cookies	Set by Google only if ads are enabled and you click Accept.	Set by Google

Ads and opt-out. Google ads load only after you click Accept, and we ask Google for non-personalized ads. If you click Decline, no ad scripts or ad cookies are loaded. You can change your choice at any time through "Cookie settings" in the footer (shown when ads are on). You can also block or delete cookies in your browser settings (the necessary cookies above are needed to log in), and see Google Ads Settings and the Digital Advertising Alliance opt-out.

Do Not Track. Our Service does not track you across other websites, and we do not change how it works in response to "Do Not Track" browser signals. We do not sell or share your information for advertising across sites, so there is nothing to opt out of, but you can still decline ad cookies as described above.

6. Children's privacy (COPPA)

• Not for children under 13. hablio.cc is a general-audience site and is not directed to children under 13. Accounts require you to be at least 13. We use a neutral date-of-birth check at signup and block the signup if the person is under 13.
• No knowing collection. We do not knowingly collect personal information from children under 13, and we have no parental-consent process because we do not allow under-13 accounts. If we ever decide to allow children under 13, we will first update this policy and obtain verifiable parental consent (for example, by a confirmation from the parent's email together with a further verification step) before collecting anything.
• What would be collected if a child got through. The same account information as for anyone else: username, email address, password hash, optional profile picture, progress, and timestamps, plus messages to Lola held temporarily as described above. We use it only to run the account. We never share it with third parties for their own purposes, except the email delivery service needed to send the verification email.
• Only what is necessary. We collect only what is reasonably necessary to take part in the Service and do not require more.
• No targeted ads or tracking of children. We do not show behavioral or targeted advertising to children and do not allow third-party tracking of children. Ad scripts are off unless a visitor accepts, ads are requested as non-personalized, and signup is blocked on browsers that fail the age check.
• If we find out. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will promptly delete the account and information.
• Parents' rights. A parent or guardian may email [email protected] to review the personal information we hold about their child, ask us to delete it, and refuse any further collection or use. Please include your child's username and the email address on the account and your own contact details; we may ask for information to confirm that you are the parent before sharing anything. We respond within 30 days.
• Contact for parents. hablio.cc, 685 40th St, Astoria, Oregon, or [email protected].

7. Retention and deletion

We keep account information for as long as your account exists. When you ask us to delete your account, we delete your account record, profile picture, and progress within 30 days. Copies in backups are removed in the normal backup cycle, and we may keep limited information we are legally required or need to keep (for example, to enforce a ban or resolve a dispute). Server logs are kept only as long as needed for security and troubleshooting. Accounts whose email was never verified may be deleted.

8. Security

We protect your information with measures including Argon2id password hashing, signed session cookies that scripts cannot read, protection against cross-site request forgery, email verification, checks on uploaded pictures, and limiting who can see profile data. No system is perfectly secure, so we cannot guarantee absolute security. Choose a strong, unique password and tell us right away if you suspect a problem.

9. Your privacy rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you and get a copy;
• correct inaccurate information (you can change your username and picture on your profile page);
• delete your information;
• opt out of sale, sharing, or targeted advertising (we do none of these as described above, and you can decline ad cookies);
• not be treated unfairly for using your rights.

To use a right, email [email protected] from the address on your account. We may need to verify your identity and will reply within 30 days (45 days where the law allows an extension). Residents of some states may also appeal a decision by replying to our response.

10. California (CCPA/CPRA and CalOPPA)

In the last 12 months we collected these categories: identifiers (username, email, public ID, IP address, and optional Google account identifier), internet activity (pages requested, learning progress), and optional images (profile picture). We collected them from you and your browser, for the purposes in section 3. We disclosed identifiers to Google for email delivery and optional sign-in (and for ads where you accepted). We do not sell or share personal information as those terms are defined in California law, and we do not knowingly sell or share the information of anyone under 16. We do not collect sensitive personal information as defined by California law, except account log-in credentials (stored as a hash). California residents have the rights in section 9; to use them, contact us as described there. Under CalOPPA, this policy describes the personal information we collect and the third parties it is shared with, how you can request changes, how we respond to Do Not Track signals (section 5), and how we will notify you of changes (section 13).

11. EU and UK users (GDPR)

We are not established in the EU or UK and do not target them, but people there may use the Service. For them, we are the data controller. Our legal bases are: performing our contract with you (account and Service), our legitimate interests (security, preventing abuse, improving the Service), your consent (ad cookies, which you can withdraw at any time), and legal obligations. You also have the right to access, correct, delete, restrict, or object to processing of your data, to data portability, and to withdraw consent. Contact us to use them. You may complain to your local data protection authority.

12. International data transfers

We are in the United States and our servers and providers (including Google) process data there and possibly elsewhere. If you use the Service from outside the US, your information will be transferred to and processed in the US, which may have different data protection laws from your country. Where required, we rely on appropriate safeguards, such as the transfer terms of our service providers.

13. Changes to this policy

We may update this policy. We will change the "Last updated" date, and for material changes we will email the address on your account or put a prominent notice on the site before the change takes effect. If we ever plan to collect new kinds of data from children, we will update this policy first and seek parental consent where the law requires.

14. Contact us

hablio.cc, Liam Nelson (sole proprietor)
685 40th St, Astoria, Oregon
Email: [email protected]