Privacy Policy

Last updated: March 25, 2026

1. Overview

This Privacy Policy describes how Duolingo English Test ("we", "us", or "our") collects, uses, and protects your information when you use the Duolingo English Test mini-app ("Service").

2. Information We Collect

2.1 Authentication Data

• OCID: Your Open Campus ID identifier
• Wallet Address: Your Ethereum wallet address

2.2 Duolingo Test Data

When you sync your Duolingo account, we receive from Duolingo's Partner API:

• Overall Score: Your DET overall score (10-160)
• Subscores: Literacy, Comprehension, Conversation, Production
• SWRL Subscores: Speaking, Writing, Reading, Listening (when available)
• Test Date: When you took the test
• Certificate ID: Duolingo certificate identifier
• Verification Status: Whether the score is verified

2.3 Voucher Data

• Voucher redemption records
• Voucher usage history

2.4 Service Data

• Verifiable Credential issuance records
• Practice session history (if applicable)

2.5 Technical Data

• Browser type and version
• Device information
• IP address (anonymized)
• Usage analytics (via Google Analytics)

3. Third-Party Data Sharing

3.1 Duolingo Partner API

Data exchanged with Duolingo includes:

• Your Duolingo account identifier (for score lookup)
• Test scores and certificates (retrieved from Duolingo)

We do not share your OCID or blockchain data with Duolingo.

4. How We Use Your Information

We use collected information to:

• Verify and display your DET scores
• Issue Verifiable Credentials for verified scores
• Manage voucher distribution and redemption
• Provide practice resources and progress tracking
• Improve our service through analytics

5. Data Storage and Security

Your data is stored securely using Supabase with:

• Row-level security policies
• Encrypted connections (TLS/SSL)
• Access controls based on OCID authentication

6. Verifiable Credentials and Blockchain

When you request a VC for your DET score:

• Your score data is included in the credential
• The credential is issued to your OCID wallet
• Blockchain records are permanent and immutable

Note: Once issued, VCs cannot be deleted from the blockchain.

7. Third-Party Services

• Duolingo: Test score verification (Partner API)
• Supabase: Database and authentication
• Open Campus: OCID auth and VC issuance
• Google Analytics: Usage analytics
• Vercel: Hosting

8. Data Retention

We retain your data while your account is active. You may request deletion except for:

• Issued Verifiable Credentials (blockchain records)
• Data required for legal compliance

9. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request data deletion (where applicable)
• Disconnect your Duolingo account
• Opt out of analytics

10. Children's Privacy

This service is not intended for users under 13. We do not knowingly collect data from children under 13.

11. Changes to This Policy

We may update this Privacy Policy periodically. Changes will be posted with an updated revision date.

12. Contact Us

For privacy questions, contact privacy@ochub.xyz.