Privacy Policy

Summary

We collect the minimum data necessary for the app to function, personalize learning, and improve quality. We do not sell data and do not use it for targeted advertising.

1. What Data We Collect

We may collect and process the following data:

• Contact Information: name, email address — during registration, support inquiries, or communication subscriptions.
• Identifiers: Device ID, internal User ID, and the token your device uses to receive push notifications.
• Usage Data: product interactions, the words you look up, your answers to onboarding questions (for example, your goals, whether you live abroad and how you heard about Wispy), other usage statistics.
• Learning content: the answers you write, the words you add to your dictionary, and the text transcripts of your spoken and written practice conversations.
• Purchases: subscription status and history. For card payments — amounts and dates, a reference to the saved card issued by the payment provider, and a one-way fingerprint of the card that cannot be turned back into its number; we use it to give the free trial once per card. We never receive or store the full card number.
• Diagnostics: crash data, performance data, recordings of app sessions in which all text and images are hidden (see Sentry in section 4), other diagnostic information.

About your voice. During spoken practice your speech is streamed to the speech services listed in section 4 so that it can be recognised and answered in real time. We keep the text transcript of the conversation — it is what lets you review the conversation afterwards and lets the app see which words you actually used. We do not store the audio recording of your voice on our servers.

We do not request or process special categories of data such as health data or biometric identifiers. Your voice is processed to recognise speech and assess pronunciation, never to identify you.

2. How We Use Data

• Providing core app functionality and personalizing vocabulary learning.
• Usage analytics to improve quality and UX.
• Ensuring security, preventing abuse, and fixing bugs.
• Processing payments and managing subscriptions.
• User communication: support responses, technical notifications, and important updates.
• Reminders and offers by email and push notification. You can unsubscribe with the link in any email and turn notifications off in your phone's settings.
• If you left your email on our website to hear about the Android app (the form was open until October 15, 2026), we send one email about its release and use the address for nothing else.

Processing is carried out based on the developer's legitimate interests, performance of the user agreement, and (where necessary) your consent.

3. Signing In with Google and Apple

You can create an account and sign in with Google or Apple instead of choosing a password. We request the minimum sign-in scopes and nothing beyond them.

Google Sign-In. We request only the standard OpenID scopes openid, email and profile, and receive from your Google Account:

• your email address;
• your name and profile picture, if your account has them;
• a stable Google account identifier, which we store so that we recognise you the next time you sign in.

We use this data for one purpose — creating your account and signing you in. We do not request access to Gmail, Drive, Contacts, Calendar or any other Google service, and we have no ability to read them. If an account with the same email address already exists, we link the Google identifier to that account instead of creating a second one.

Wispy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data, do not use it for advertising, do not use it to train machine-learning models, and do not allow humans to read it — except with your explicit permission, where necessary for security or to comply with the law.

Sign in with Apple. We receive your email address and, on the first sign-in only, your name. If you choose Hide My Email, Apple gives us a relay address instead of your real one, and the app works normally with it. One consequence is worth knowing: if you later sign in with Google, the email addresses will differ, so you will get a second, separate account rather than access to the first one.

Deleting this data. Sign-in data is deleted together with your account. In the app, open the Profile tab, tap your name or email at the top and choose Delete account; you can also ask us by email without the app. Both ways are described on the Delete your account page. Separately from that, you can revoke Wispy's access at any time in your Google Account permissions, or, for Apple, in Settings → your Apple Account → Sign in with Apple. Revoking access stops future sign-ins but does not by itself delete the account — use Delete account for that.

4. Data Sharing and Disclosure

We do not sell personal data and do not share it with third parties for their own marketing purposes.

Data may be processed by trusted service providers (processors) who help us run the app: hosting, speech and language models, payments, email, notifications, analytics, and crash reporting. These providers are required to:

• use data only according to our instructions and for specified purposes;
• ensure a level of protection no less than ours;
• delete or anonymize data upon completion of processing.

The providers we currently rely on, and what each of them receives:

• Microsoft Azure — our servers (in the Netherlands), storage of app content such as word pronunciation audio and images, and service logs.
• Prisma — hosting of our database (Prisma Postgres, in Germany). Your account and learning data are stored there.
• Redis Cloud — the queue for background tasks such as scheduled emails. It holds your internal user ID and which task to run — not your answers or conversations.
• Anthropic (Claude models) — checking the sentences you write, looking up the words you search for, hints and feedback during and after conversations, and, depending on our settings, the replies of your conversation partner. These requests contain the text of your answers and conversation transcripts.
• Google Gemini — the replies of your conversation partner in spoken and written conversations. These requests contain the conversation transcript and the scenario.
• Azure OpenAI Service (OpenAI models run by Microsoft) — details for the words in your dictionary, translations, and checking your answers in exercises. These requests contain the words and the text of your answers.
• ElevenLabs — speech recognition and speech synthesis: during spoken practice your voice is streamed to ElevenLabs to turn it into text, and the voice of your conversation partner and word pronunciations are generated there.
• LiveKit — real-time audio transport during spoken conversations.
• Azure AI Speech (Microsoft) — pronunciation assessment: the recording you make is sent for assessment and is not stored by us.
• RevenueCat — subscriptions bought in app stores. Receives purchase data, your internal user ID and analytics ID, and some of your onboarding answers (how you heard about Wispy, whether you live abroad, when you need results) — not your learning content.
• YooKassa (YooMoney) — card payments. You enter card details on YooKassa's page, not in Wispy. We receive the payment status, a reference to the saved card for renewals, and the card's masked number and expiry date, from which we keep only the one-way fingerprint described in section 1.
• Resend — sending emails. Receives your email address, your name and the content of the email, and records whether it was delivered and opened.
• Hostinger — our mailbox: the letters you send to info@wispylang.app.
• Amplitude — product analytics: which screens and features are used, together with your internal user ID, a device ID, the device brand and operating system, approximate location derived from the IP address, and your onboarding answers.
• Sentry — crash and error diagnostics and performance monitoring. Receives technical details of errors, your IP address, and recordings of app sessions in which all text and images are hidden on your device before upload.
• Langfuse — technical records of our model requests (which feature, which model, timing and cost, your internal user ID), so we can check quality and fix failures. The text of the requests is masked.
• Expo — delivery of push notifications (receives your device's notification token and the text of the notification) and delivery of app updates.
• Firebase Cloud Messaging (Google) — delivery of push notifications to Android devices.
• Apple — Sign in with Apple (section 3), App Store purchases, and delivery of notifications to iPhones.
• Google Sign-In — signing in with Google, as described in section 3.

Spoken practice necessarily sends your voice to the speech services listed above — without that the feature cannot work at all. If you would rather your voice was not processed, the written parts of the app work independently of it.

This website. The site is hosted by Vercel. We count visits with Google Analytics and Yandex Metrica, which use cookies; Metrica also records how pages are scrolled and clicked. Errors on the site are reported to Sentry, without session recordings.

We may also disclose data if required by law or to protect the rights and security of users and the service.

5. Retention Periods

• Account and contact data — until account deletion or within 24 months after last activity.
• Learning content, purchase records we hold and notification history — until account deletion.
• Your voice — not stored: it is processed in real time (section 1).
• Messages sent through Feedback in the app — kept after account deletion so that we can act on them; deleted on request.
• Diagnostic and log records — typically up to 18 months, then anonymization or deletion.
• Payment records held by app stores and payment providers — kept by them as required by law.

Periods may vary if required by law or for dispute resolution and security purposes. What exactly is deleted when you delete your account, and what is kept, is listed on the Delete your account page.

6. Data Security

We apply technical and organizational security measures: data encryption during transmission, access control, incident monitoring, and backup. However, no method of transmission or storage can guarantee absolute security.

7. Your Rights

Depending on your jurisdiction (e.g., GDPR/EEA, UK GDPR, CCPA/CPRA), you may:

• request access to your data and a copy of it;
• correct inaccuracies or delete data;
• restrict processing or object to it;
• receive data in a portable format;
• withdraw consent (if processing is based on consent).

To exercise your rights, contact us using the details below. We will respond within a reasonable time and within legal requirements.

Deleting your account. You can delete your account in the app, or ask us by email without installing the app. Step-by-step instructions are on the Delete your account page.

8. Children

Our service is not intended for children under 13 years old (or another age established by local law). We do not knowingly collect data from such users. If you believe a child has provided us with data, contact us — we will delete such information.

9. International Transfer

Data may be processed on servers and by service providers in different countries. Our servers and database are in the EU (Microsoft Azure in the Netherlands, Prisma in Germany). Several providers from section 4 process data in the United States — for example Sentry, Amplitude and Redis Cloud — and YooKassa processes card payments in Russia. We ensure appropriate safeguards for cross-border data transfers in accordance with applicable law (e.g., standard contractual clauses).

10. Changes to This Policy

We may update this policy from time to time. The current version is always available on this page, and the update date is indicated at the top. Significant changes will be additionally communicated to users.

11. Contact Us

For privacy questions and data subject rights requests, contact us:

• Data controller: IE PzzleTech
• Address: Korchagina 134, Rudny, Kostanay region, Kazakhstan
• Email: info@wispylang.app