Privacy Policy

Information we collect and why

• Email address and user ID: used to sign you in, verify that you are the account holder, manage your account, and keep each person's data separate.
• Audio you send: used for transcription and pronunciation assessment.
• Transcripts of what you said, Spanish text you edited, questions and answers, and feedback results: used for conversation feedback, example rewrites, generating the next question, and showing your history.
• Answer times, the number of feedback uses, and processing status: used to let you review your practice, manage your allowance, and retry after a failure.
• Apple purchase identifiers, product, purchase environment, expiration date and cancellation information: used to verify a Plus purchase, apply your allowance, and restore purchases. Saystep Spanish does not receive your payment card information.
• Google Play purchase token, order number, product, expiration date and subscription state (if you buy Plus in the Android app): used to verify a Plus purchase, apply your allowance, and restore purchases. We do not keep the purchase token itself, only a hash of it for matching.
• Operational information such as access and error logs: used to provide the connection, prevent abuse, and investigate failures.
• The content of your inquiries and your contact details: used to answer your questions and to handle requests to access, correct or delete your information.

Practice on your device and what is sent to AI services

Practice that only records and plays back, recordings from Before / After one-sentence practice, and drafts are saved on your device. One-sentence practice recordings are never sent for AI feedback automatically.

When you ask for AI feedback, the app sends that audio and the practice information it needs to our analysis server. Nothing is sent until you agree on the consent screen shown before your first AI feedback. For AI feedback on a conversation, the transcript, the Spanish text you confirmed or edited, the question and the recent conversation are also sent to a text generation service. Do not record or type anything you do not want sent to AI services, or other people's personal information.

On-device storage uses the browser's storage area. It can be lost if you clear site data or uninstall the app.

Practicing offline

Tap "Go offline" at the top of the practice screens and the app sends nothing. Sign-in, AI feedback, purchase checks and usage statistics stop, and your recordings and practice history stay on this device only. Tap "Offline: on" to switch back at any time.

Outside services we use

• Supabase: email sign-in and account management, on a project shared with Saystep Korean, Saystep Chinese and Saystep French. One email address is one account across all of them, and deleting your account in any of them deletes that sign-in everywhere. In the iPhone app, deleting your account also erases your practice data for every language; on the websites, contact us to have practice data stored for the other languages erased as well.
• Microsoft Azure: our analysis server, storage, speech recognition and pronunciation assessment (Microsoft Azure Speech, which receives your audio), and failure monitoring. The analysis server and the speech assessment currently run on Microsoft Azure in the United States.
• OpenAI API: feedback on your wording in conversation, example rewrites, and generating the next question. We send text only, such as the question, the recognized text and your edited text. We never send your audio to OpenAI.
• Apple: Plus purchases, payment and subscription management on the App Store. When you buy, we pass a random user ID to Apple so the purchase can be matched securely to your Saystep Spanish account.
• Google: Plus purchases, payment and subscription management in the Android app (Google Play). When you buy, we pass a random user ID to Google so the purchase can be matched securely to your account.
• Our web hosting provider: delivery of the public web pages.

These services may process information outside the country where you live. Each provider handles it under its own service terms and data protection policies. We use an email service for inquiries to the operator.

Saystep Spanish does not use your practice data for advertising, or to track you across other companies' apps and websites for advertising purposes.

Retention and deletion

Recordings and drafts on your device are kept until you delete them or the stored data on the device is erased. Recordings from lessons and conversations that you send, along with recognized text, feedback, answer times and similar data, are stored on the server so that we can show your history and retry when needed. We keep this practice data until you delete individual items or delete your account. Plus purchase records are kept with your account to check that the subscription is active and to prevent abuse, and the records on the Saystep Spanish side are deleted when you delete your account. Purchase history and subscription management on Apple's side follow Apple's terms.

After you sign in, "Delete account" deletes your sign-in account, your practice data on the server, and this account's data in this browser. Data saved on other devices and audio you downloaded must be deleted on those devices. Signing out alone does not delete your practice data.

Disaster recovery backups may still contain information from before a deletion. Standard Azure backups are kept for up to 30 days. Local copies taken separately to verify restores do not currently have a uniform automatic deletion deadline. You can send requests about deleting backups to our support contact. When we restore from a backup, we apply the latest account deletion records so that deleted account data does not come back.

To keep deleted data from being recreated, we keep a deletion record containing a hash of the user ID. Contact us if a deletion does not finish or if you want to check what information we hold.

Security and your rights

We encrypt communications, require sign-in, control access per user, and keep administrative credentials separate. We use service providers only as far as needed to run the service, and we do not provide personal information to third parties for other purposes, except where the law requires it or in similar cases.

For requests to access, correct, stop the use of, or delete the information we hold, we verify that you are the account holder and then respond in accordance with applicable law.

Children

Saystep Spanish is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal information, contact us at menuchinekonu@gmail.com and we will delete it.

California residents

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). California residents can ask to know what personal information we hold about them or ask us to delete it by writing to menuchinekonu@gmail.com. We verify that you are the account holder before we act. We will not discriminate against you for exercising these rights.

Residents of Canada

Jun Murata is the person accountable for how Saystep Spanish handles personal information, and answers privacy questions and complaints at menuchinekonu@gmail.com. We collect and use your information with your consent, for the purposes described on this page. You can withdraw that consent at any time by deleting your account or by writing to us; AI feedback and sign-in then stop working for you, and practice on your device continues to work offline.

The operator is in Japan, and the services listed above process your information outside Canada, including in the United States and Japan. It is handled under the laws of those countries, and courts, law enforcement and national security authorities there may be able to obtain access to it. Residents of Quebec: this means your information is communicated outside Quebec.

You can ask to see the personal information we hold about you and to have it corrected or deleted. We verify that you are the account holder, and we answer within 30 days. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d'accès à l'information.

Contact and changes to this policy

Operator: Jun Murata
menuchinekonu@gmail.com

When we change this policy, we update the date and the content of this page. For changes that need new consent, we will ask you in an appropriate way.

Open Help and contact