Privacy Policy

1. What we collect

Account data. Your email address and, if you sign in with Google, the basic profile information Google returns (name and account identifier). If you sign up with a password, authentication is handled by Supabase and we never see the password itself.

Learning data. Your chosen native and target languages, practice transcripts, scenario attempts, feedback and assessments, vocabulary and knowledge-graph entries, experience points, streaks and achievements.

Voice recordings. When you speak, your recording is sent to our speech-to-text provider to be transcribed.

Technical data. A coarse country code derived from your connection (used for regional leaderboards), your timezone (used to calculate streaks correctly), and aggregate usage analytics about which pages and features are used. If you enable practice reminders, we store the push subscription your browser issues.

Billing data. If you subscribe, Stripe processes your payment and we store only your Stripe customer and subscription identifiers plus your plan status. We never receive your full card number.

2. Why we use it, and on what legal basis

• To provide the service — creating your account, generating practice conversations, transcribing speech, producing feedback and tracking progress. Basis: performance of our contract with you.
• To process payments and manage subscriptions. Basis: performance of our contract, and compliance with tax and accounting obligations.
• To keep the service secure and available — enforcing usage limits, detecting abuse and preventing fraud. Basis: our legitimate interest in protecting the service and its users.
• To understand how the product is used in aggregate and improve it. Basis: our legitimate interest in developing the service.
• To send you practice reminders, where you have switched them on. Basis: your consent, which you can withdraw at any time in settings.

3. Automated processing by language models

To generate conversation replies, corrections, translations and speech, the content of your practice sessions is sent to the third-party AI providers listed below. This is inherent to how the service works. We send the minimum needed to produce the response and do not send your email address or billing details to these providers.

We do not sell your personal data, and we do not use your practice content to train our own models.

4. Who processes your data

We share data with the following processors, each bound to use it only to provide their service to us:

We may also disclose data where legally required, or to establish or defend legal claims.

5. International transfers

Some of these providers process data outside Singapore, including in the United States. Where we transfer personal data internationally we rely on the recipient’s contractual commitments to provide a comparable standard of protection, including standard contractual clauses where applicable.

6. How long we keep it

• Account and learning data: for as long as your account exists. Delete your account and we remove it, except where we must retain records for legal reasons.
• Voice recordings: not retained (see section 1).
• Billing records: retained for the period required by tax and accounting law, typically five years.
• Aggregate analytics and usage-cost records: retained in a form that does not identify you individually.

7. Your rights

Depending on where you live — including under Singapore’s Personal Data Protection Act and, for users in the EU or UK, the GDPR — you may have the right to:

• Access the personal data we hold about you, and receive a copy of it.
• Correct data that is inaccurate or incomplete.
• Delete your account and the personal data associated with it.
• Object to, or ask us to restrict, processing based on our legitimate interests.
• Withdraw consent for practice reminders at any time.
• Receive your data in a portable, machine-readable format.
• Lodge a complaint with your local data protection authority.

To exercise any of these, email chatlingo.co@gmail.com. We will respond within the period required by applicable law, and within 30 days at the latest.

8. Children

The service is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child under that age has created an account, contact us and we will delete it.

9. Cookies and local storage

We use cookies and browser storage that are strictly necessary to run the service — keeping you signed in, remembering your language and interface preferences, and supporting offline use as an installed app. Our analytics provider is configured to measure usage without cookies or cross-site tracking. We do not run advertising trackers.

10. Security

Data is transmitted over encrypted connections and stored in access-controlled managed infrastructure. No system is perfectly secure, but if a breach affects your personal data and is likely to result in significant risk to you, we will notify you and the relevant authority as required by law.

11. Changes and contact

We will update this policy as the service changes and will note the revision date at the top. For any privacy question or request, contact us at chatlingo.co@gmail.com.