Privacy Policy

1. Information we collect

Account information

When you create an account, we collect your email address and generate a random display name for you. You can change your display name and optionally add a profile photo or avatar emoji. If you sign in with Google or Apple, we receive a basic profile token (name and email) from the corresponding provider.

Learning data

We collect data about your learning sessions to power the app. This includes the words you practice, your answers, whether they were correct, your response time, and session duration. We also track per-word progress such as mastery status, stability score, and review schedule, all to make sure the right words come back at the right time.

Voice & conversation data

The conversation feature lets you practice speaking with an AI tutor. When you take a turn, we record short audio clips from your microphone and send them to our AI provider (OpenAI) to be transcribed into text. We do not store the raw audio: the recording is discarded once it has been transcribed. We do keep the text transcript of the conversation (your transcribed utterances and the tutor's replies) so you can review your session and so we can improve lessons. We only access your microphone during an active conversation session.

Subscription & payment data

If you subscribe, your payment is processed by our payment providers, not by us. On iOS and Android, purchases are handled by the App Store and Google Play through RevenueCat. On the web, payments are processed by Stripe. We receive your subscription status, tier, and the events needed to keep your access in sync (for example a renewal or cancellation), along with a customer or transaction identifier. We never receive or store your full card number; that is held by the payment provider.

Competitive & social data

If you participate in duels or competitions, we store your results, rating, and match history. If you add friends, we store your connections. Reports and blocks are stored to keep the community safe.

Device information

We collect your timezone (to schedule notifications at reasonable hours) and a push notification token if you enable notifications. Like any internet service, our infrastructure and the third-party providers listed below automatically receive your IP address in connection logs, which is used for security, abuse prevention, and operating the service. We do not collect device model, OS version, advertising identifiers, or location data.

2. What we do not collect

We do not access your contacts, photo library, camera, location, browsing history, health data, or biometric information. The only photo we store is a profile picture you choose to upload, and the only microphone access is during an active conversation session (see above). We do not use any third-party analytics or tracking SDKs: no Mixpanel, no PostHog, no Firebase Analytics. We do not share your data with analytics or advertising providers. The only third parties that process your data are the service providers listed in section 4, which we use to operate the app.

3. How we use your information

• Providing the service: Powering learning sessions, scheduling word reviews, tracking your progress, and running duels and competitions.
• Notifications: Sending review reminders and daily practice nudges if you opt in. We respect your timezone and only send between 9am and 9pm local time.
• Social features: Showing your display name and learning languages to friends and on leaderboards.
• Safety: Processing reports and enforcing blocks to keep the community respectful.

4. Third-party services

We use a small number of third-party service providers to operate the app. We share only what each one needs to do its job:

• Supabase: database, authentication, and backend functions. Your data is stored on Supabase infrastructure with row-level security enforced at the database level.
• OpenAI: powers the AI conversation feature. When you practice speaking, your recorded audio is sent to OpenAI to be transcribed, and the conversation text is processed by OpenAI's models to generate the tutor's replies and spoken voice. OpenAI processes this data on our behalf to provide the feature.
• Amazon Web Services (AWS): file storage and content delivery. We store assets such as your uploaded profile photo and generated audio on AWS (Amazon S3, in the EU).
• RevenueCat: subscription and in-app purchase management for the App Store and Google Play. RevenueCat receives your user ID and purchase history to manage your subscription status.
• Stripe: payment processing for web subscriptions. Stripe handles your payment details and provides us with your subscription status and a customer identifier.
• Expo: delivers push notifications to your device using your notification token, if you have enabled notifications.
• Cloudflare Turnstile: protects sign-up and sign-in against bots and abuse. It may process your IP address and interaction signals to verify you are a human. It is not used for advertising or tracking.
• Google and Apple Sign-In: if you choose to sign in with Google or Apple, their standard OAuth flow applies and their privacy policy governs the data they collect.

Some of these providers (for example OpenAI) are based in the United States, so using those features involves transferring data internationally. We do not sell your data to any third party. We do not share your personal information for advertising purposes.

5. Data visible to other users

The following information may be visible to other users:

• Your display name and avatar: in duel results, competition leaderboards, and friend lists.
• Your learning languages: visible to friends.
• Your duel rating and competition scores: visible on leaderboards.
• Your group activity: if you join a group, other members can see your progress through the shared learning path, such as which units you have completed and when you last practiced.

Your email address, your detailed learning and conversation history, individual word-level progress, and notification settings are never visible to other users.

6. Data security

All data is transmitted over HTTPS. Our database enforces row-level security, meaning users can only access their own data through the client. Server-side operations (notifications, competition generation) use a separate service key with appropriate access controls.

7. Data retention & deletion

Your data is retained as long as your account is active. You can delete your account at any time from within the app. When you delete your account, all your data is permanently removed, including your profile, learning history, sessions, word progress, conversation history, friendships, duel history, and competition entries. This deletion is cascading and irreversible. If you have an active web subscription, deleting your account also cancels it with Stripe.

Ghost duel recordings are automatically cleaned up on a weekly basis after their retention period expires.

You also have the right to access a copy of your data or to correct it. To make a request, contact us at the address in section 10.

8. Children's privacy

wordbeat is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it.

9. Changes to this policy

We may update this Privacy Policy from time to time. If we make significant changes, we will notify you through the app or by email. Your continued use of wordbeat after changes are posted constitutes your acceptance of the updated policy.

10. Contact

If you have any questions about this Privacy Policy or your data, reach out to us at hello@wordbeat.co.