Security

Last updated June 2026 · Language Ninja, a Riverun Pty Ltd product (ABN 65 663 364 154, Victoria, Australia).

We take a deliberately simple, defensive approach to security. Fewer moving parts, fewer trackers, and strict per-account isolation.

Accounts & passwords

Passwords are hashed with scrypt and a per-user random salt — we never store or log plain-text passwords. Sessions use a signed, HTTP-only cookie that cannot be read by JavaScript.

Data isolation

Every record — your profile, decks, cards, reviews, conversations, writing and classes — is scoped to your account at the database layer. One learner can never read or modify another learner's data.

Encryption in transit

All traffic is served over HTTPS/TLS. Connections to our database and AI provider are encrypted.

Minimal third parties

We deliberately avoid third-party advertising and analytics SDKs, which are a common source of data leakage in education apps. Our only subprocessors are our hosting, database and AI providers — listed on the Privacy page.

Classroom safeguards

Teachers manage classes via private join codes and can only see their own classes and rosters. No advertising is shown to any user, including students.

Reporting an issue

Found a vulnerability? Please email security@language-ninja.app. We appreciate responsible disclosure and will respond promptly.