Privacy Policy

1. Information we collect

• Account information: your email address, display name, and a securely hashed password. We never store your password in plain text.
• Learning data: the content you create and your progress, including lessons, exercises, quiz answers and scores, CEFR levels, saved vocabulary, chat messages with the AI teacher, assessment results, XP, streaks, and achievements. This is used to personalise your learning.
• Preferences: optional settings such as your native language (used by the in-app Guide) and your assistant name.
• Location (optional, off by default): if you explicitly turn on location tracking in your Profile, your device shares its approximate coordinates once per day. We store the coordinates and a human-readable place name and use it only to personalise your experience. You can turn this off at any time, and deleting your account removes the history.
• Audio: when you do speaking practice, your device records short audio clips. Depending on the transcription method in use, the recording is either transcribed on your device (in your browser, so the audio does not leave it) or sent to a speech-to-text provider to produce a transcript. That transcript is then evaluated by AI to score your speaking. Recordings are stored only temporarily and are automatically deleted after a limited period, and deleting your account removes them.
• Usage and activity: in-app actions (for example completing a lesson or starting a practice session) used to build your Learning Journey and improve the Service.
• Payment information: when you upgrade, payments are processed by our payment gateway. We receive a payment status and reference and record your plan. We do not collect or store your full card details.

2. How we use your information

• To provide and personalise the learning experience.
• To generate AI lessons, exercises, feedback, podcasts, and tutor responses.
• To verify your email, secure your account, and send service emails.
• To process upgrades and manage your subscription.
• To maintain, troubleshoot, and improve the Service.

3. Service providers we share data with

We do not sell your personal data. To run the Service, we share the minimum necessary data with trusted providers who process it on our behalf:

• PayHere for processing payments.
• OpenRouter (serving the DeepSeek model) to generate the text content: lessons, exercises, corrections, and AI teacher chat replies. The relevant learning text is sent to produce a response.
• Google (Gemini) for audio: text-to-speech for spoken narration and podcasts, and, for speaking practice, speech-to-text to transcribe the audio you record. The relevant text or audio is sent to Google to produce the result.
• Resend for sending verification and password-reset emails.
• OpenStreetMap Nominatim to convert shared coordinates into a place name (only if you enable location).

We may also disclose information if required by law or to protect the rights, safety, and security of our users and the Service.

4. Cookies and sessions

We use a secure session cookie to keep you signed in. Sessions are stored on our server side. We do not use third-party advertising or tracking cookies.

5. Data retention and security

We retain your data for as long as your account is active. Passwords are hashed, traffic is served over HTTPS, and we apply standard security headers and access controls. No method of transmission or storage is perfectly secure, but we take reasonable measures to protect your information.

When you delete your account, we remove your personal data, including your profile, learning data, saved content, location history, and stored audio recordings. For security and to meet legal obligations, we may keep limited security-audit records (for example login, new-device, and account-change events, with the email and IP address captured at the time) for a period afterwards. These are used only to protect the Service, not to profile you.

6. Your rights and choices

• Access and update your profile details from the Profile page.
• Turn location tracking on or off at any time.
• Delete your account from the Profile page, which removes your personal data (subject to the limited security-log retention described above).
• Contact us to ask about the data we hold about you.

7. Children

The Service is not directed to children under 13. If you believe a child has provided us personal data, contact us and we will remove it.

8. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the date at the top of this page.

9. Contact

Questions about your privacy? Contact us at [email protected].