Privacy Policy

This policy explains what AceTalk (the “service”) collects, how it is used, which third-party processors handle it, how long it is kept, and how you delete it. The service is operated by [Operator legal name] (“we”).

This policy describes what the service actually does. How your data is handled is defined by this policy and the code's real behaviour — not by marketing language.

We collect only what the service needs:

• Account information: the email address you sign in with; and, when you sign in with Apple or Google, the name and user identifier from that account. The service has no passwords.
• Learning preferences: your native language, goal, self-reported level, topics of interest and daily practice duration — chosen at setup or edited later.
• Practice data: practice sessions, your voice recordings and their transcripts, the coach's replies and corrections, course progress, due review items, and your chat history with the coach.
• Usage analytics: first-party events (for example, which screen was opened, whether a practice completed). Event fields are restricted to predefined enum values — an email address, a recording or any free text cannot be written by design. Before sign-in, analytics are associated with a random anonymous identifier.
• On-device data: your setup draft is stored on your own device (app storage, or browser storage on the web).

We do not collect your contacts, location or advertising identifiers, and we do not track you across apps.

• To provide the core features: transcribing your recordings, generating the coach's replies and corrections, synthesising the coach's voice, and scheduling your reviews and next lesson;
• Account and security: sending sign-in codes, keeping you signed in, and preventing code abuse;
• Product analytics: aggregated understanding of which parts need improvement. Analytics events contain enum values only — no emails, recordings or transcripts;
• Optional marketing email: only if you explicitly opt in; opting out never affects the service.

We do not sell your personal information, do not use it for advertising, and do not use your recordings or conversations to train models we develop or fine-tune.

To provide the service, the following processors handle your data on our behalf, to the minimum extent necessary. Their processing is governed by their own privacy policies, which you can find on their websites:

• DeepSeek (AI language model): processes the transcript of what you said and the necessary conversation context, to generate the coach's replies, corrections and native-language explanations;
• Alibaba Cloud DashScope (speech recognition and synthesis): processes practice recordings and the coach's reply text, to transcribe your voice and synthesise the coach's voice;
• Resend (email delivery): processes your email address and the code content, to deliver sign-in codes.

Apart from these cases and a legal compulsion, we do not share your personal information with third parties.

• Sign-in codes: stored as hashes, valid for 10 minutes after issuing, then dead;
• Sign-in sessions: at most 30 days, revoked on sign-out;
• Practice data (sessions, recordings, transcripts, progress, chats): kept until you delete your account;
• Analytics events: when you delete your account, the link between events and your identity is severed (de-identified) and the events are kept for aggregate statistics.

Deletion is immediate and irreversible. You can start it in the app (Me → Delete account) or on the web: your account, sign-in methods, practice records, recordings and chats are deleted immediately, and the recordings are removed from storage at the same time. Deletion cannot be undone.

• Correction: learning preferences (native language, goal, level, topics, daily duration) can be edited anytime in settings;
• Export: the service does not offer a self-service export yet. You can request a copy of the information associated with your account through the contact below, and we will respond within a reasonable period;
• Withdrawing marketing consent: turn it off in the app anytime, or contact us.

Minors under 14 should use the service with a guardian's consent. If we learn that we have collected a minor's personal information without that consent, we will delete it promptly.

We take technical measures proportionate to the risk: sign-in tokens are stored only as hashes; traffic is encrypted in transit; analytics events are validated server-side against a field whitelist, so free text cannot enter them; logs never contain request bodies. No system is perfectly safe, but our collection principle is minimisation — we do not collect what the features do not need.

We may update this policy as the service evolves and publish the new version and date on this page. If the purposes, data categories or processors change materially, we will notify you in advance in the app or through the contact details you left us.

This policy is written in English, which is the master version. Any translation, including the Chinese version, is provided for convenience; in case of conflict, the English version prevails.

Questions about this policy or your information: [contact email].