Built from public records and checked 2026-10-22. Not an audit of Duolingo. How scores are made · spotted a mistake? Tell us.

Google Play apps

Duolingo

Language-learning app · Score 88/100 · Last checked 2026-10-22

The short version

Assume anything on a public profile can be collected by others.

Built from: public records, checked 2026-10-22.

Score breakdown

Security record83

Documented incidents and safeguards (public record, not a technical test)

Data jurisdiction88

Which laws and governments can reach your data

Ownership transparency90

How plainly the owner can be traced

Third-party exposure92

Documented analytics, advertising and attribution partners

Who owns it

Duolingo→Duolingo, Inc.

Parent based in: 🇺🇸 United States

Laws that can apply: US CLOUD Act, FISA 702

Where your data can go

Who	Country	Why they are involved
Amazon Web Services	🇺🇸 United States	Cloud hosting (named in its annual report)
Google Cloud	🇺🇸 United States	Cloud hosting (named in its annual report)

Jurisdictions touched: 🇺🇸 United States

What the public record says

mediumScraped data of about 2.6 million users circulated on a hacking forum

Data gathered through an exposed API, including emails, was sold in January 2023 and released free in August 2023. Duolingo said it came from scraping public profiles. Source

Sources

Duolingo annual report (10-K, FY2025)

Ownership, locations and data partners come from the company's own pages and filings where they exist. Last checked 2026-10-22.