Title: After a mandatory signup for a Duolingo account, <i>anyone</i> using their iPhone and Android (and possibly web) apps can add you as a &#x27;friend&#x27;, without requiring any confirmation from you whatsoever.<p>This is mostly just annoying and might be considered &#x27;typical growth hacking&#x27;, but also constitutes a privacy risk: your &#x27;friends&#x27; are notified whenever you are online, have completed a number of lessons, or whatever. The Duolingo privacy policy (https:&#x2F;&#x2F;store.duolingo.com&#x2F;pages&#x2F;privacy-policy) is obviously a cut-and-paste job (for a NYSE-listed-company, really?) that doesn&#x27;t address concerns like this at all.<p>In the Duolingo app, you get notifications like &#x27;your friends congratulated you on 14 days of being online&#x27; and, more worryingly, &#x27;XXX congratulated you on completing 10 lessons today&#x27;. Nevermind that you don&#x27;t know who XXX is, and can&#x27;t do anything about notifications about your online state being sent to them. Even if you have removed XXX as a &#x27;friend&#x27; from your in-app Duolingo profile aeons ago.<p>So, there is a &#x27;privacy&#x27; option in the Duolingo app. This apparently (again, pretty much without notification, much less consent) requests a ZIP export of all your data (FYI: I&#x27;m in the EU, US experiences may differ). Which takes up to 30 days (Sure, ZIP is not the most efficient file format, but <i>that</i> slow?)<p>But, at least there is an email address: privacy@duolingo.com (pretty much the only contact details you&#x27;ll get as a fully paid up Duolingo customer). Sending a <i>very</i> polite email reply to the minders of this account about the continuous harassment by &#x27;friends&#x27;, however, is a mistake.<p>You will not receive a reply, but your paid Duolingo account will be disabled pretty much immediately. Leaving you, I guess, to sort things out with Google&#x2F;Apple&#x2F;your credit card company.<p>&#x27;Typical growth hacking&#x27;... Oh, joy...
Upvote: