Privacy Policy

Learn Dutch: Speak NL — Last updated: October 2, 2026

1. Introduction

Welcome to Learn Dutch: Speak NL (the "App", "we", "us" or "our"). This Privacy Policy explains what information the App handles, why, who else processes it, and the rights you have.

The App is private by default: your learning progress lives on your device, there is no account to create, and we do not keep a profile of you on any server.

2. Information we collect

2.1 Data stored only on your device

The App stores its data on your device with React Native AsyncStorage under the keys learn_dutch_progress_v1, learn_dutch_notification_runtime_v1 and speechConsentAt. We never receive a copy. It includes:

• Learning progress: completed lessons, words and phrases you have learned, phrase strength, review schedule and recent mistakes
• Streak and study history: study days, last study date and daily statistics
• App state: energy, coins, daily goal progress and smart reviews used today
• Preferences and onboarding answers: your app language, companion, the display name you choose, daily goal, reminder settings and the reason you gave for learning Dutch
• Subscription status: premium flag, plan type and expiry date, mirrored from RevenueCat
• Reminder state: which local reminders are scheduled and when one was last shown
• Speaking notice: the date you accepted the speaking-practice notice described in section 3

Deleting the App, or using Reset journey in the App, removes this data. Reset journey clears lesson progress, phrase strength, streak, coins and today's goal.

2.2 Audio from speaking exercises

When you do a speaking exercise, the App records a short clip with your microphone. The clip is:

• sent over HTTPS to our speech service, a Supabase Edge Function
• forwarded by that service to OpenAI's audio transcription API, which turns it into text; only the audio and a neutral instruction go to OpenAI, and our service then compares the text with the Dutch phrase
• not stored, logged or kept by us once the result is returned

OpenAI processes the audio as our sub-processor under its API terms. Audio sent through the API is not used to train OpenAI's models, and OpenAI keeps it only for a limited period for abuse monitoring. See OpenAI's Privacy Policy.

2.3 Speech service rate limiting

To protect the speech service from abuse, it keeps a request counter per client for one-minute and one-day windows, plus one total daily count for the whole service. The per-client counter is keyed by a one-way SHA-256 hash of the network address the request came from. It holds no audio, no text, no readable IP address and nothing that identifies you.

2.4 Subscription and purchase data (RevenueCat)

If you buy a premium subscription, Apple or Google processes the payment and RevenueCat manages the subscription. RevenueCat may process:

• an anonymous app user identifier generated on your device
• purchase transaction identifiers, product and price
• subscription status, trial status and entitlement data

We never receive your payment card details. See RevenueCat's Privacy Policy.

2.5 Advertising data (Google AdMob, free users)

The free version shows ads served by Google AdMob. When an ad is requested, Google may process:

• device identifiers (on Android the advertising ID; on iOS an identifier for vendors, because the App does not request tracking permission and the iOS advertising identifier is not available)
• IP address, which Google may use to estimate a general location
• ad interactions such as impressions and taps
• device information such as model and operating system version, plus diagnostic and performance data of the ads SDK

The App asks Google for non-personalised ads only, so your interests and activity in other apps are not used to choose the ads you see. Premium subscribers do not see ads. See Google's Privacy Policy and how Google uses data from apps that use its services.

2.6 Data we do not collect

• Name, email address, phone number or account credentials (there is no sign-in)
• Precise location
• Contacts, calendar, photos or files
• Stored voice recordings
• Analytics or behavioural tracking of our own

2.7 CCPA categories of personal information

Category	Collected	Source
Identifiers (device or advertising ID, anonymous purchase ID)	Yes, by AdMob and RevenueCat	Your device
Commercial information (subscription purchases)	Yes, by RevenueCat	App Store or Google Play
Internet or network activity (ad interactions)	Yes, by AdMob, free users only	Your device
Audio (speaking exercises)	Processed transiently, not stored by us	Your microphone, when you record
Approximate location (from IP address)	By AdMob, for ads	Network request
Name, email, precise location, financial account details	No	—

3. Microphone and audio

• Before your first speaking exercise, the App explains that your short recording is sent to our server and transcribed by OpenAI, and that we do not keep it. Recording starts only after you continue.
• The App asks for microphone access only for speaking exercises.
• The microphone records only while you hold or tap the record control in a speaking exercise. It never listens in the background.
• Recordings travel over encrypted HTTPS and are used only to produce your pronunciation feedback.
• You can withdraw microphone access at any time in your device settings and skip speaking exercises; the rest of the App keeps working.

4. How we use your data

Purpose	Data used	Legal basis (GDPR)
Deliver lessons and track your progress	Data on your device	Contract
Pronunciation feedback	Audio clip (transient), the Dutch phrase you practised	Contract; consent for microphone access
Protect the speech service from abuse	Hashed network address and request count	Legitimate interest
Manage premium subscriptions and trials	RevenueCat identifiers and purchase data	Contract
Show non-personalised ads to free users	Data processed by Google AdMob	Consent where the law requires it (EEA, UK, Switzerland); otherwise legitimate interest
Study reminders	Reminder settings on your device	Consent (notification permission)

We do not make automated decisions that have legal or similarly significant effects on you.

5. Legal bases for processing (GDPR)

If you are in the European Economic Area, the UK or Switzerland, we rely on:

• Contract: providing the learning service and subscriptions you ask for.
• Consent: microphone access, notifications, and storing or reading information on your device for ads. You can withdraw consent at any time in the App or in your device settings.
• Legitimate interests: preventing abuse of the speech service and showing non-personalised ads that keep the free version free.
• Legal obligation: complying with applicable law.

6. Speech processing details

What the App sends:

• the audio clip (base64 encoded, usually 2 to 10 seconds)
• the Dutch phrase you were asked to say (for example "Goedemorgen") and its pronunciation hint
• the language code (nl), the audio format and the phrase's internal identifier

What goes to OpenAI: only the audio clip and a neutral instruction ("Dutch speech from a language learner"). The phrase text stays on our server, where it is used to score the transcript.

What comes back: a transcript, a similarity score and normalised text.

What we keep: nothing from the request. The Edge Function processes it in memory. The only record is the anonymous rate-limit counter described in section 2.3.

All traffic to the speech service and to OpenAI uses HTTPS with TLS encryption.

7. Reminders

Study reminders are scheduled on your device as local notifications. The App does not register for remote push notifications and sends no device token to us. You can turn reminders off in the App or in your device settings.

During a free trial, study reminders pause. Instead, if notifications are allowed, the App schedules one reminder about a day before the cancellation deadline, which is 24 hours before the trial ends, so you can decide whether to keep the subscription. Study reminders resume after the trial, also if you do not open the App.

8. Data storage and security

• On your device: stored in the App's sandboxed storage and protected by your device's security, including encryption at rest on current iOS and Android versions.
• Speech service (Supabase): requests travel over TLS; audio is not persisted. See Supabase's Privacy Policy.
• Subscriptions (RevenueCat): stored on RevenueCat's servers with industry-standard encryption.
• Ads (Google AdMob): handled on Google's infrastructure.

No system is completely secure. If you find a security issue, please email us right away.

9. Data sharing

We do not sell, rent or trade personal information. Data is shared only with:

• Supabase, which hosts the speech service (processor; audio not retained)
• OpenAI, which transcribes speaking clips (sub-processor; not used for training)
• RevenueCat, which manages subscriptions (processor)
• Google AdMob, which serves ads to free users (independent controller for advertising data)
• Apple and Google, which distribute the App and process in-app purchases
• authorities, where the law requires it, or a successor in the event of a merger or acquisition, in which case you will be told in advance

10. Data retention

• Data on your device: until you delete the App or use Reset journey. We have no copy.
• Speech audio: not retained by us; discarded as soon as the result is returned. OpenAI keeps API data only for a limited period for abuse monitoring.
• Rate-limit counters: deleted after at most 30 days.
• RevenueCat: for the life of your subscription plus RevenueCat's legal retention period.
• Google AdMob: according to Google's retention policies.

11. Your privacy rights

Depending on where you live, you can ask to access, correct, delete or receive a copy of your personal data, restrict or object to processing, and withdraw consent at any time. Most of your data sits on your device and can be changed or deleted there directly. For data held by RevenueCat or our speech service, email us.

If you are in the EEA, the UK or Switzerland you may also complain to your data protection authority, for example the Dutch Autoriteit Persoonsgegevens or the Bulgarian Commission for Personal Data Protection.

To exercise a right, email bora.nikolai.mindwise@gmail.com with the subject "Privacy Rights Request". We reply within 30 days (up to 45 days for complex requests). Exercising your rights never changes the service you receive.

12. Data deletion

• Progress on your device: use Reset journey in the App (Progress tab), or delete the App. On Android you can also clear the App's storage in system settings.
• Subscription history at RevenueCat: email us with the subject "Data Deletion Request" and we will ask RevenueCat to delete it.
• Advertising: see section 14.

Step-by-step instructions are in our Data Deletion Guide.

13. Third-party services

Service	Purpose	Data	Privacy policy
Supabase	Hosts the speech service	Audio clip and phrase text (transient), hashed address counter	supabase.com/privacy
OpenAI	Speech-to-text for pronunciation feedback	Audio clip (transient)	openai.com/policies/privacy-policy
RevenueCat	Subscriptions and trials	Anonymous user ID, purchase data	revenuecat.com/privacy
Google AdMob	Ads for free users and the consent message	Device identifiers, IP address, ad interactions, device and diagnostic data	policies.google.com/privacy
Apple App Store	Distribution and in-app purchases	Purchase records	apple.com/legal/privacy
Google Play	Distribution and in-app purchases	Purchase records	policies.google.com/privacy

14. Advertising, consent and tracking

The App uses no cookies and no tracking of its own. Advertising works as follows:

• EEA, UK and Switzerland: before any ad is requested, Google's consent message asks how Google and its partners may store and use information for ads, for example to measure ad performance. You can change your choices at any time with Privacy choices in the Progress tab.
• Everywhere: the App requests non-personalised ads only. Ads are chosen from context such as the App itself, not from a profile of you.
• iOS: the App does not request App Tracking Transparency permission, so the iOS advertising identifier is not shared and the App does not track you across other companies' apps and websites.
• Android: you can reset or delete your advertising ID in Settings > Google > Ads (or Settings > Privacy > Ads).

The App does not respond to browser Do-Not-Track signals because it is not a website; use the controls above instead.

15. US state privacy rights

Residents of California, Virginia, Colorado, Connecticut, Utah and other US states with privacy laws have rights to know, access, correct, delete and port their personal data and to opt out of targeted advertising, sale or profiling. We do not sell personal information and do not share it for cross-context behavioural advertising outside the advertising described in section 14. Email bora.nikolai.mindwise@gmail.com with your state and request; we respond within 45 days. If we deny a request you may appeal by replying with "Privacy Rights Appeal" in the subject, and then contact your state attorney general.

16. International data transfers

The App is operated from Bulgaria. Supabase, OpenAI, RevenueCat and Google may process data in the United States and other countries. Where GDPR requires it, these transfers rely on the EU-US Data Privacy Framework or Standard Contractual Clauses. Email us for details.

17. Children's privacy

The App is not directed at children under 13 (or under 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has provided personal information through the App, email us and we will act promptly.

18. Changes to this policy

We may update this policy. The "Last updated" date at the top shows the latest version. For material changes we will give notice in the App or on this page.

19. Contact us

Back to legal documents