Website blueprint · 3 h ago

www.duolingo.com

“Duolingo - The world’s most popular way to learn”

Template-written 83 evidence items REA analysed 6 scripts
What this means for you

Duolingo talked to 20 outside services on a first visit, including 10 that measure visits or show ads.E10E15E22E16

  • Before you click anything, the page loads analytics or ad services: Google Analytics / Tag Manager, Meta Pixel, Google Ads / DoubleClick, Media.net and Meta / Facebook.E10E15E22E16E18E20
  • 19 cookies were set in your browser, 3 of them by other companies' domains.E40E44E45

What it is

  • The site describes itself as: “Free, fun, and effective courses in languages and more. Learn with quick, science-based lessons personalized to you.”E2
  • It's built with React (common tools for building web apps).E49
  • In your browser it can ask to use your camera or microphone, can ask to send you notifications, can copy text to your clipboard, installs a background script (offline use, push messages) and 2 more.E55E56E57E58E59E60
  • It has sections such as /register, /course, /chess, /math, /efficacy and /en.E83
  • While loading, it called 6 endpoints on its own servers, such as /0/web.json, /2023-05-23/config, /batch and 3 more.E63E64E65E66

Where your data goes

Analytics & trackingCount visits and record what you do on the page. 4
www.googletagmanager.comGoogle Analytics / Tag Manager: Google's visitor analytics and tag loader 4×E10
www.google-analytics.comGoogle Analytics / Tag Manager: Google's visitor analytics and tag loader 2×E15
analytics.google.comGoogle Analytics / Tag Manager: Google's visitor analytics and tag loader 1×E22
connect.facebook.netMeta Pixel: Facebook/Meta tracking pixel (ad measurement) 2×E16
AdvertisingShow ads and follow you across sites to target them. 6
googleads.g.doubleclick.netGoogle Ads / DoubleClick: Google's ad network (serving and measuring ads) 2×E18
ad.doubleclick.netGoogle Ads / DoubleClick: Google's ad network (serving and measuring ads) 1×E20
stats.g.doubleclick.netGoogle Ads / DoubleClick: Google's ad network (serving and measuring ads) 1×E23
www.googleadservices.comGoogle Ads / DoubleClick: Google's ad network (serving and measuring ads) 1×E26
cs.media.netMedia.net: contextual ads 1×E27
www.facebook.comMeta / Facebook: Facebook ad tracking 1×E25
Sign-in & accountsLog you in or manage accounts. 1
accounts.google.comGoogle Sign-In: log in with Google 2×E11
Consent & bot protectionCookie banners, CAPTCHAs and bot checks. 3
www.recaptcha.netGoogle reCAPTCHA: bot check 3×E8
cdn.cookielaw.orgOneTrust: cookie consent banner 6×E6
geolocation.onetrust.comOneTrust: cookie consent banner 1×E9
FontsDownload typefaces. 1
fonts.gstatic.comGoogle Fonts: fonts 1×E21
CDNs & hostingDeliver files (scripts, images) quickly from servers near you. 2
d35aaqx5ub95lt.cloudfront.netAmazon CloudFront: CDN 97×E7
www.gstatic.comGoogle static files: Google's static file CDN 5×E14
Not identifiedServices we don't have in our list yet. 3
c.tupsrv.comnot identified 3×E17
www.google.comnot identified 3×E19
analytics.tupsrv.comnot identified 1×E24

How key features work

Payments

Payments are handled by Stripe.js, so card or payment details go to them, not only to this site.E53

Stripe.js

Sign-in and accounts

Sign-in and account features show up in its code or traffic (/users/undefined/streak-goal-current, /users/undefined/streak-goal-next-options, /api/v1/sessions/math-tutor, /api/userReply and 1 more).E67E68E71E11

/users/undefined/streak-goal-current/users/undefined/streak-goal-next-options/api/v1/sessions/math-tutor/api/userReplyaccounts.google.com

Loading its content

Its content loads from its own API while you browse (/0/web.json, /2023-05-23/config, /batch, /api/1/courses/list and 2 more).E63E64E65E66E67

/0/web.json/2023-05-23/config/batch/api/1/courses/list/users/undefined/streak-goal-current/users/undefined/streak-goal-next-options

Drawing and editing in the browser

The page draws and edits graphics in your browser using the canvas.E62

canvas

Measuring what you do

Visits and clicks are measured with Google Analytics / Tag Manager, Meta Pixel and Google tag (gtag.js) (found in its traffic or its code).E10E15E22E16E50

Google Analytics / Tag ManagerMeta PixelGoogle tag (gtag.js)

How ads get picked

Ads are chosen through ad networks and exchanges (Google Ads / DoubleClick, Media.net and Meta / Facebook); they receive details about your visit to bid on the ad space.E18E20E23E26

Google Ads / DoubleClickMedia.netMeta / Facebook

Saving data on your device

It saves data in your browser (a service worker, IndexedDB (a browser database), localStorage and sessionStorage), so some things persist between visits.E58E59E60E47

service_workerindexeddblocal_storagelocalStoragesessionStorage

Cookies and storage

Names only. We never store the values.

CookieSet forKeptWhose
logged_out_uuidE28duolingo.com about 365 daysthe site
langE29duolingo.com about 365 daysthe site
wuuidE30www.duolingo.com until you close the browserthe site
tslE31duolingo.com about 365 daysthe site
luE32duolingo.com about 365 daysthe site
initial_referrerE33duolingo.com about 365 daysthe site
lrE34duolingo.com about 365 daysthe site
lpE35duolingo.com about 365 daysthe site
OptanonConsentE36duolingo.com about 180 daysthe site
_gidE37duolingo.com about 1 daysthe site
_gat_UA-21595814-1E38duolingo.com about 0 daysthe site
_gcl_auE39duolingo.com about 90 daysthe site
test_cookieE40doubleclick.net about 0 daysother company
_ga_CSFDVCPQ4FE41duolingo.com about 400 daysthe site
_gaE42duolingo.com about 400 daysthe site
_fbpE43duolingo.com about 90 daysthe site
usp_statusE44media.net about 185 daysother company
data-maxE45media.net about 365 daysother company
g_stateE46www.duolingo.com about 180 daysthe site

localStorageE47: lastExternalReferrer, lastExternalReferrerTime, _gcl_ls, duo.state

sessionStorageE48: _tup

Pages and API calls

Pages it links to

//register/course/chess/math/efficacy/en/courses/business/super/gift/duolingo-max/help/faq/guidelines/terms/privacy

Endpoints

Called while loading (seen) or named in the code (code).

zombie.duolingo.com/0/web.jsonseenE63
www.duolingo.com/2023-05-23/configseenE64
excess.duolingo.com/batchseenE65
www.duolingo.com/api/1/courses/listseenE66
www.duolingo.com/users/undefined/streak-goal-currentseenE67
www.duolingo.com/users/undefined/streak-goal-next-optionsseenE68
/v1/next_n_challengescodeE69
/v1/historycodeE70
/api/v1/sessions/math-tutorcodeE71
/v2/mistakescodeE72
/api/1/detect_duplicatescodeE73
/api/1/fully_connect_duplicatescodeE74
/api/1/shakira/featurescodeE75
/api/2/shakira/slack_report_typescodeE76
/api/2/shakira/suggested_featurescodeE77
/api/2/shakira/report_issuecodeE78
/api/userReplycodeE79
/api/1codeE80
/v1/refreshCredscodeE81
/v1/chooseServercodeE82

Evidence

Every sentence above points to one of these. Code references show the file, line:column and the short identifier that matched, never the site's code itself.

E1
Page title: Duolingo - The world’s most popular way to learn
page title · https://www.duolingo.com/
E2
Page description: Free, fun, and effective courses in languages and more. Learn with quick, science-based lessons personalized to you.
page description · https://www.duolingo.com/
E3
Site name: Duolingo
page site_name · https://www.duolingo.com/
E4
Main heading: The most fun way to learn languages, chess, and more!
page h1 · https://www.duolingo.com/
E5
5 request(s) to www.duolingo.com
types: 4 fetch, 1 document
GET https://www.duolingo.com/ · fetch · 5 requests · network recording
E6
6 request(s) to cdn.cookielaw.org
types: 3 fetch, 2 script, 1 xhr
GET https://cdn.cookielaw.org/scripttemplates/otSDKStub.js · fetch · 6 requests · network recording
E7
97 request(s) to d35aaqx5ub95lt.cloudfront.net
types: 54 image, 19 script, 13 fetch
GET https://d35aaqx5ub95lt.cloudfront.net/js/manifest-9de2ea75.js · image · 97 requests · network recording
E8
3 request(s) to www.recaptcha.net
types: 2 script, 1 document
GET https://www.recaptcha.net/recaptcha/enterprise.js · script · 3 requests · network recording
E9
1 request(s) to geolocation.onetrust.com
types: 1 xhr
GET https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location · xhr · network recording
E10
4 request(s) to www.googletagmanager.com
types: 4 script
GET https://www.googletagmanager.com/gtm.js · script · 4 requests · network recording
E11
2 request(s) to accounts.google.com
types: 1 script, 1 stylesheet
GET https://accounts.google.com/gsi/client · script · 2 requests · network recording
E12
1 request(s) to zombie.duolingo.com
types: 1 fetch
GET https://zombie.duolingo.com/0/web.json · fetch · network recording
E13
8 request(s) to excess.duolingo.com
types: 8 xhr
GET https://excess.duolingo.com/batch · xhr · 8 requests · network recording
E14
5 request(s) to www.gstatic.com
types: 2 script, 1 stylesheet, 1 image
GET https://www.gstatic.com/recaptcha/releases/nY0xPItgwtlvjEjk2TqdwOQz/recaptcha__en.js · script · 5 requests · network recording
E15
2 request(s) to www.google-analytics.com
types: 1 script, 1 xhr
GET https://www.google-analytics.com/analytics.js · script · 2 requests · network recording
E16
2 request(s) to connect.facebook.net
types: 2 script
GET https://connect.facebook.net/en_US/fbevents.js · script · 2 requests · network recording
E17
3 request(s) to c.tupsrv.com
types: 2 image, 1 script
GET https://c.tupsrv.com/v1/analytics.js · image · 3 requests · network recording
E18
2 request(s) to googleads.g.doubleclick.net
types: 1 script, 1 fetch
GET https://googleads.g.doubleclick.net/pagead/viewthroughconversion/728842606/ · script · 2 requests · network recording
E19
3 request(s) to www.google.com
types: 2 fetch, 1 image
GET https://www.google.com/rmkt/collect/728842606/ · fetch · 3 requests · network recording
E20
1 request(s) to ad.doubleclick.net
types: 1 fetch
GET https://ad.doubleclick.net/ccm/s/collect · fetch · network recording
E21
1 request(s) to fonts.gstatic.com
types: 1 font
GET https://fonts.gstatic.com/s/roboto/v48/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 · font · network recording
E22
1 request(s) to analytics.google.com
types: 1 fetch
GET https://analytics.google.com/g/collect · fetch · network recording
E23
1 request(s) to stats.g.doubleclick.net
types: 1 ping
GET https://stats.g.doubleclick.net/g/collect · ping · network recording
E24
1 request(s) to analytics.tupsrv.com
types: 1 script
GET https://analytics.tupsrv.com/v1/tracking.js · script · network recording
E25
1 request(s) to www.facebook.com
types: 1 image
GET https://www.facebook.com/tr/ · image · network recording
E26
1 request(s) to www.googleadservices.com
types: 1 fetch
GET https://www.googleadservices.com/pagead/conversion/397119219/ · fetch · network recording
E27
1 request(s) to cs.media.net
types: 1 image
GET https://cs.media.net/cksync · image · network recording
E28
Cookie 'logged_out_uuid' set for duolingo.com
kept for about 365 days
cookie logged_out_uuid on duolingo.com · value not stored
E29
Cookie 'lang' set for duolingo.com
kept for about 365 days
cookie lang on duolingo.com · value not stored
E30
Cookie 'wuuid' set for www.duolingo.com
session cookie
cookie wuuid on www.duolingo.com · value not stored
E31
Cookie 'tsl' set for duolingo.com
kept for about 365 days
cookie tsl on duolingo.com · value not stored
E32
Cookie 'lu' set for duolingo.com
kept for about 365 days
cookie lu on duolingo.com · value not stored
E33
Cookie 'initial_referrer' set for duolingo.com
kept for about 365 days
cookie initial_referrer on duolingo.com · value not stored
E34
Cookie 'lr' set for duolingo.com
kept for about 365 days
cookie lr on duolingo.com · value not stored
E35
Cookie 'lp' set for duolingo.com
kept for about 365 days
cookie lp on duolingo.com · value not stored
E36
Cookie 'OptanonConsent' set for duolingo.com
kept for about 180 days
cookie OptanonConsent on duolingo.com · value not stored
E37
Cookie '_gid' set for duolingo.com
kept for about 1 days
cookie _gid on duolingo.com · value not stored
E38
Cookie '_gat_UA-21595814-1' set for duolingo.com
kept for about 0 days
cookie _gat_UA-21595814-1 on duolingo.com · value not stored
E39
Cookie '_gcl_au' set for duolingo.com
kept for about 90 days
cookie _gcl_au on duolingo.com · value not stored
E40
Cookie 'test_cookie' set for doubleclick.net
kept for about 0 days
cookie test_cookie on doubleclick.net · value not stored
E41
Cookie '_ga_CSFDVCPQ4F' set for duolingo.com
kept for about 400 days
cookie _ga_CSFDVCPQ4F on duolingo.com · value not stored
E42
Cookie '_ga' set for duolingo.com
kept for about 400 days
cookie _ga on duolingo.com · value not stored
E43
Cookie '_fbp' set for duolingo.com
kept for about 90 days
cookie _fbp on duolingo.com · value not stored
E44
Cookie 'usp_status' set for media.net
kept for about 185 days
cookie usp_status on media.net · value not stored
E45
Cookie 'data-max' set for media.net
kept for about 365 days
cookie data-max on media.net · value not stored
E46
Cookie 'g_state' set for www.duolingo.com
kept for about 180 days
cookie g_state on www.duolingo.com · value not stored
E47
localStorage: 4 key(s) saved in your browser
localStorage keys: lastExternalReferrer, lastExternalReferrerTime, _gcl_ls, duo.state · values not stored
E48
sessionStorage: 1 key(s) saved in your browser
sessionStorage keys: _tup · values not stored
E49
React found in the code
d35aaqx5ub95lt.cloudfront.net/js/4779-9b5aed3c.js @ 2:361046 · “react.element” · pattern scan
E50
Google tag (gtag.js) found in the code
www.duolingo.com/ (page HTML) @ 1:13162 · “googletagmanager.com/gtag” · pattern scan
E51
Meta Pixel found in the code
www.duolingo.com/ (page HTML) @ 1:14736 · “connect.facebook.net/en_US/fbevents” · pattern scan
E52
Sentry found in the code
d35aaqx5ub95lt.cloudfront.net/js/4779-9b5aed3c.js @ 2:116138 · “__SENTRY__” · pattern scan
E53
Stripe.js found in the code
d35aaqx5ub95lt.cloudfront.net/js/4779-9b5aed3c.js @ 2:186723 · “js.stripe.com” · pattern scan
E54
reCAPTCHA found in the code
www.duolingo.com/ (page HTML) @ 108:480 · “grecaptcha” · pattern scan
E55
Uses the browser ability: camera_mic
can ask to use your camera or microphone
d35aaqx5ub95lt.cloudfront.net/js/7459-fb2812f0.js @ 1:14684 · “getUserMedia(” · pattern scan
E56
Uses the browser ability: notifications
can ask to send you notifications
d35aaqx5ub95lt.cloudfront.net/js/app-4d4b32e8.js @ 2:937228 · “Notification.requestPermission” · pattern scan
E57
Uses the browser ability: clipboard_write
can copy text to your clipboard
d35aaqx5ub95lt.cloudfront.net/js/app-4d4b32e8.js @ 2:494433 · “clipboard.writeText(” · pattern scan
E58
Uses the browser ability: service_worker
installs a background script (offline use, push messages)
d35aaqx5ub95lt.cloudfront.net/js/app-4d4b32e8.js @ 2:348342 · “serviceWorker.register(” · pattern scan
E59
Uses the browser ability: indexeddb
stores data in your browser's built-in database
d35aaqx5ub95lt.cloudfront.net/js/4779-9b5aed3c.js @ 2:727356 · “indexedDB.open(” · pattern scan
E60
Uses the browser ability: local_storage
saves small bits of data in your browser
d35aaqx5ub95lt.cloudfront.net/js/app-4d4b32e8.js @ 2:685803 · “localStorage.setItem(” · pattern scan
E61
Uses the browser ability: web_worker
runs work in a background thread
d35aaqx5ub95lt.cloudfront.net/js/app-4d4b32e8.js @ 2:827501 · “new Worker(” · pattern scan
E62
Uses the browser ability: canvas
draws graphics on a canvas
d35aaqx5ub95lt.cloudfront.net/js/5314-33cb86aa.js @ 1:11229 · “getContext("2d"” · pattern scan
E63
The page called /0/web.json on zombie.duolingo.com (GET)
GET https://zombie.duolingo.com/0/web.json · fetch · network recording
E64
The page called /2023-05-23/config on www.duolingo.com (GET)
GET https://www.duolingo.com/2023-05-23/config · fetch · network recording
E65
The page called /batch on excess.duolingo.com (POST)
POST https://excess.duolingo.com/batch · xhr · network recording
E66
The page called /api/1/courses/list on www.duolingo.com (GET)
GET https://www.duolingo.com/api/1/courses/list · fetch · network recording
E67
The page called /users/undefined/streak-goal-current on www.duolingo.com (GET)
GET https://www.duolingo.com/users/undefined/streak-goal-current · fetch · network recording
E68
The page called /users/undefined/streak-goal-next-options on www.duolingo.com (GET)
GET https://www.duolingo.com/users/undefined/streak-goal-next-options · fetch · network recording
E69
The code names the endpoint /v1/next_n_challenges
d35aaqx5ub95lt.cloudfront.net/js/app-4d4b32e8.js @ 2:439687 · “/v1/next_n_challenges” · pattern scan
E70
The code names the endpoint /v1/history
d35aaqx5ub95lt.cloudfront.net/js/app-4d4b32e8.js @ 2:439973 · “/v1/history” · pattern scan
E71
The code names the endpoint /api/v1/sessions/math-tutor
d35aaqx5ub95lt.cloudfront.net/js/app-4d4b32e8.js @ 2:450477 · “/api/v1/sessions/math-tutor” · pattern scan
E72
The code names the endpoint /v2/mistakes
d35aaqx5ub95lt.cloudfront.net/js/app-4d4b32e8.js @ 2:451533 · “/v2/mistakes” · pattern scan
E73
The code names the endpoint /api/1/detect_duplicates
d35aaqx5ub95lt.cloudfront.net/js/app-4d4b32e8.js @ 2:453919 · “/api/1/detect_duplicates” · pattern scan
E74
The code names the endpoint /api/1/fully_connect_duplicates
d35aaqx5ub95lt.cloudfront.net/js/app-4d4b32e8.js @ 2:453990 · “/api/1/fully_connect_duplicates” · pattern scan
E75
The code names the endpoint /api/1/shakira/features
d35aaqx5ub95lt.cloudfront.net/js/app-4d4b32e8.js @ 2:454066 · “/api/1/shakira/features” · pattern scan
E76
The code names the endpoint /api/2/shakira/slack_report_types
d35aaqx5ub95lt.cloudfront.net/js/app-4d4b32e8.js @ 2:454147 · “/api/2/shakira/slack_report_types” · pattern scan
E77
The code names the endpoint /api/2/shakira/suggested_features
d35aaqx5ub95lt.cloudfront.net/js/app-4d4b32e8.js @ 2:454217 · “/api/2/shakira/suggested_features” · pattern scan
E78
The code names the endpoint /api/2/shakira/report_issue
d35aaqx5ub95lt.cloudfront.net/js/app-4d4b32e8.js @ 2:454391 · “/api/2/shakira/report_issue” · pattern scan
E79
The code names the endpoint /api/userReply
d35aaqx5ub95lt.cloudfront.net/js/app-4d4b32e8.js @ 2:455559 · “/api/userReply” · pattern scan
E80
The code names the endpoint /api/1
d35aaqx5ub95lt.cloudfront.net/js/app-4d4b32e8.js @ 2:456717 · “/api/1” · pattern scan
E81
The code names the endpoint /v1/refreshCreds
www.gstatic.com/recaptcha/releases/nY0xPItgwtlvjEjk2TqdwOQz/recaptcha__en.js @ 352:293 · “/v1/refreshCreds” · pattern scan
E82
The code names the endpoint /v1/chooseServer
www.gstatic.com/recaptcha/releases/nY0xPItgwtlvjEjk2TqdwOQz/recaptcha__en.js @ 354:5 · “/v1/chooseServer” · pattern scan
E83
56 links to pages on the same site
page links · https://www.duolingo.com/ · /, /register, /course, /chess, /math, /efficacy, /en, /courses, /business, /super, /gift, /duolingo-max

Limits

  • We only see what your browser sees: code and requests on a first visit, without logging in or accepting cookie banners. What the servers do with data is invisible from outside.
  • Site code is usually minified (compressed), so names are partly lost and some code may be only partly analysed.
  • Some trackers only load after you accept cookies or log in, so the real list can be longer.
  • This text was written from fixed templates because no AI writer was available. It uses exactly the same evidence.
  • REA hit its size budget on parts of 29 large bundle file(s); those parts weren't fully analysed.

Facts, not judgements: this page describes what the code and traffic show, not anyone's intent. Not financial advice. Blueprint id oSjSZikE.