01What we collect
The app stores your account details and learning data.
- Account details can include a phone number, an email address or both, a username, full name, date of birth and a profile picture if you add one. When you sign up with a phone number, Twilio texts a six-digit code to it before the account is made. Sign-up asks for one of the two; you can add the other later in Settings. An email address you give is not confirmed when you give it: we email you a code right after sign-up, or when you add it in Settings, and until you confirm it the address can sign you in with your password but cannot receive a password reset or be joined to an Apple or Google sign-in. Accounts made this way also have a random sign-in address that we create for our sign-in provider and that never receives mail. Sending that code can make our sign-in provider hold the address briefly; that copy is deleted when you confirm it, or within about a day if you do not. If you leave sign-up before the account is finished, the unfinished account and the number or email it held are deleted by a daily cleanup once they are 72 hours old. A picture can come from your camera or photo library; the server re-encodes it to a 512 px JPEG and keeps it in the sign-in database. Your date of birth is what you enter, and we do not verify it.
- Your account time zone. When you let the app set it from where you are, the phone reads an approximate location once, works out the time zone on the phone, and sends the server the time zone and the words "device location". The coordinates stay on the phone.
- Your settings: the language the app speaks to you in, the language you're learning, and your level from A1 to C2. Why you are learning and your daily goal are stored on your profile if you give them.
- Everything learning produces: your card schedule, your XP, your streak (and any time we paused its clock because our servers were slow or down), what you write in the language you're learning, your chat threads (including the tapback reactions you give).
- Your days. For each day we prepare for you, we keep its four tasks, which of them you have finished, and your answers, messages and results in them. The database rows are stored with our database provider, Supabase, and the day's lesson text and audio files are stored in Cloudflare R2. The rows and the lesson text are kept until you reset the course or delete your account. The audio files also expire from R2 after 90 days.
- When you finish your first day before you finish onboarding, a small record of it: when you finished, your local date, which tasks were done, and a one-way hash of the guest device key. The app uses it to show that day as finished after you sign in again and to hold your next lesson until the next day. It earns no points and counts as no lesson.
- If you rate the first day's flashcards before you sign up, the app sends those ratings (Again, Hard, Good or Easy for each card) with your sign-up. The server keeps them with that first-day record and adds the ones that match a card in your course to your card schedule, so your next lesson reviews the cards you found hard.
- Voice input can include spoken task summaries, spoken answers in the Language Basics drill and bug-report dictation.
- Purchase records: the plan you bought, where you bought it, and when it renews or ends. ¡YapZee! has no free trials. The $5 launch special comes in two forms, a one-month purchase that does not renew (kept as the same kind of record, with the date its month ends) and a $5 monthly plan that renews until you cancel. We store no card details.
- Old free-trial codes: ¡YapZee! has no free trials any more, so we no longer make or keep these. Until October 19, 2026 we kept one-way keyed codes of a phone number, an email address, the store's subscription number and, for website purchases, the card fingerprint Stripe gives us (never the card number), only to stop a free trial being used twice. The table that held them is deleted when our server updates. We also no longer use Apple's DeviceCheck service; a yes/no flag we set on Apple's side earlier is held by Apple, and we cannot read or clear it.
A recording of your voice is personal data, whatever you say in it. A voice session also records the internet (IP) address it came from. Our code does not create a voiceprint or use your voice to identify you.
On your phone, the app keeps the audio file of a prepared Speaking Practice or Listening task so it plays at once; when you are signed in, the day's Speaking Practice audio is downloaded while the Home screen shows the day being prepared. The file name includes your account ID, or the word guest. The app removes these files when the day finishes, when it replaces them, and when you sign out, change account or reset progress.
When you are signed in, the app may also fetch your next lesson before it starts, while the app is open or, on an iPhone, in an occasional background refresh that iOS allows while the app is closed. It keeps that lesson's text (the Today card and the reading, listening and texting tasks) in the phone's cache folder, unencrypted, under a file name made from a one-way hash of your account and course, no more than the next two lessons and 60 MB, and the listening and Speaking Practice audio as above. The lesson stays locked until our server says your next day has started. The app removes these files when you sign out, change account or reset progress, and removes the text once our server confirms that day. So that a background refresh can work while the phone is locked, the app keeps your sign-in session in the iPhone's Keychain on that device only, readable once you have unlocked the phone since it last started; it is not synced to iCloud Keychain and does not move to another phone when you restore a backup.
When you are signed in on an iPhone, the app also sends our server the push token iOS gives it, and our server stores it with your account ID. When our server has your next lesson ready, it sends that token to Apple's push service with a silent wake-up that carries no lesson content, no name and no account ID and shows nothing on your screen; iOS may then let the app download the lesson in the background, as described above. The app does not ask permission to show notifications for this. We delete the token when you delete your account, when you sign out on the phone (the app asks our server to delete it just before the session ends and waits at most three seconds; if that request does not get through, the token stays until one of the other cases), or when Apple tells us it no longer works; if another account signs in on that phone, the token moves to that account and is no longer linked to yours. We never use it for analytics or advertising.
An Android phone does the same through Google's Firebase Cloud Messaging. The Firebase software in the Android app registers the app installation with Google to get a push token, the app sends that token to our server, and our server stores it with your account ID. When your next lesson is ready, our server sends the token to Google with a data-only message that carries no lesson content, no name and no account ID and shows nothing on your screen; Android may then let the app download the lesson in the background. The app does not ask permission to show notifications for this. We delete the token in the same cases as above, and also when Google tells us it no longer works. We never use it for analytics or advertising.
The app also keeps a few small notes in its own storage on the phone, and does not send them to us: which one-time tips you have already seen; the name of the time zone your phone was in when it last set your daily reminder, so a trip is noticed and the reminder follows the new zone; when you are signed in, the last state of your day the Home screen drew (the lesson date, your course and language, whether it was your first day, which tasks were finished, whether the day was still being prepared or the next one was being written, and the address, size, length and checksum of the day's Speaking Practice audio file), stored under your account ID so Home can show your day as soon as the app opens instead of a blank wait; the app stops using it after your next local midnight and replaces it the next time Home draws your day, and removes it when you sign out, change account or turn on a stricter content setting; and, if a saved first-day record on the phone cannot be read, an untouched copy of it kept aside on the phone for support. If you leave sign-up part way, the app keeps the step you were on and what you had entered (your phone number or email, the code check's result, birthday and name) for up to a day so you can pick up where you left off; on an iPhone it also keeps the password you typed, in the iPhone's Keychain on that device only. It never keeps a code. It removes all of this when your account is made or when you back out of sign-up. Resetting progress or signing out removes some of these notes and not others, so a few can stay on the phone until you remove the app.
02Signing in with another account
The app offers sign-in with Google, Facebook (run by Meta Platforms) and Apple. The public website currently shows Coming soon for social sign-in. When you choose one, that company signs you in and tells Supabase, our sign-in provider, the identity details it shares, such as an account identifier, name, email or profile picture. From Facebook we ask only for your public profile and email address. That company also learns that you signed in to ¡YapZee!, under its own privacy policy, which we do not control. Facebook does not prove your email address to us, so a new account made with Facebook confirms its email with a one-time code before the account is finished. Deleting your ¡YapZee! account does not delete your Google, Facebook or Apple account, and it sends no deletion request to those companies; the app may still appear in your Facebook Apps and Websites list until you remove it there.
Where connected-account controls are available, they let you link or remove supported sign-in providers. The server checks account ownership and recovery requirements before a change. We do not request your friends list or contacts through these sign-in flows.
03Where each recording goes
The recordings aren't handled the same way, so here's each one.
Reading and listening summaries can be dictated. When you let go of the mic, the recording is sent to our server for transcription and the words appear in the text box for you to edit. The app deletes the recording file from your phone as soon as it has read it to send. If the connection drops or our server fails before it answers, the app holds that audio in its memory only, never saved to your phone's storage, so you can send it again with Try again; it is discarded once it is sent, when you start a new recording, when you leave the summary, or when the app is closed. Our server does not keep the recording or those dictated words; the text you send is what gets graded and saved as your summary. An unfinished first-day backup can include up to two recordings saved by an earlier version of the app, each at most 2 MiB. Those backup recordings expire 720 hours after first acceptance. Retries do not extend the period. Expired recordings stop being restored, and a successful cleanup removes their stored bytes. The transcription request does not create a separate retained audio copy in our adapter. This does not establish the speech provider's own retention.
Language Basics answers are spoken. When you let go of the mic on a card, the recording is sent to our server, which sends it to a speech-to-text provider to turn it into words. For some cards (letters, numbers, sound words and words with a rolled r or an ñ), our server may also convert the recording and send it to Microsoft Azure AI Speech, together with the word on the card, to score how closely your answer matches that word. No name, account identifier or age is sent with the recording. The app deletes the recording from your phone once it has read it for sending; a recording that is left behind is removed by a later cleanup. Our server does not store the recording: it holds it in memory for the check, and the copy it converts for Microsoft is a temporary file that is deleted when the conversion ends. This does not establish the providers' own retention.
Bug-report dictation: Dictation is offered only to a learner aged 16 or older with a paid voice-dictation entitlement who has not turned off usage statistics. Guests type their reports, and the mic isn't shown. The recording is sent to our server and a speech-to-text provider (Groq or OpenAI) for transcription, and is also stored as a file at Sentry alongside the report, even if transcription fails.
04Why we have it
Learning records support progress, review scheduling and lesson preparation. To grade what you write and say, and to reply to you in Texting, we send your written answers, your transcripts and the lesson they belong to, to the AI companies listed below. Texting also sends your first name so your partner can use it, and the kind of tapback reaction you give (one of twelve, such as a heart). We do not send your account ID, email, phone number or date of birth with them. You choose your starting level. Later stage changes come from software thresholds on your learning records, or from your own change in Settings. No person reviews these decisions. Account details support sign-in, recovery and age checks; purchase records support paid access. Diagnostics help investigate errors.
Accounts require a date of birth showing age 13 or older. If you are 13 to 17, your practice is handled the same way as an adult's and goes to the same companies. Three things differ by age: optional product analytics are blocked when age is unknown or under 16, under 18, lesson content is always kept family-friendly, whatever the setting says (from 18 you can choose), and a bug report from someone under 16 carries typed words plus screen, course and device details. The sign-in step takes the date of birth you enter and the guest question about age is answered on the phone only. The AI companies are told when a learner is under 18 so they keep content suitable, but not your date of birth. We do not collect a parent's contact details and we do not check a parent's permission. A parent or guardian can write to support@yapzee.ai; we will assess the request and may need to confirm the account first. A phone number proven with its code, at sign-up or later, can support sign-in and recovery where text delivery is available. These account checks do not replace any consent or parental-permission requirement that applies to a particular use.
05Who else touches it
The services below support different features. Use depends on the feature and its configuration. This is not a claim that every service receives every person's data. Tally hosts the beta-interest form, AgentMail handles company email, including support requests and anything you send in them, and Resend sends sign-in and password-reset email and, when configured, the deletion notice. The app and this website load no advertising SDK. App stores also handle their own account and purchase information.
06Some of that happens off your phone
Your device doesn't call most of those companies directly. The audio from the reading and listening tasks and from Language Basics answers goes to our server first, and the server sends it on to a speech-to-text provider; for some Language Basics cards the server also sends it to Microsoft Azure AI Speech. It's still your data leaving, so it's listed that way rather than hidden behind the word "infrastructure".
Our app uses the analytics and diagnostics services described below. We have not completed the contractual and jurisdiction review needed to state every legal basis, international-transfer mechanism and retention period. We have not confirmed how long each AI company keeps what we send, or whether it uses it to improve its own systems, and the requests we send set no retention or training option, so we make no promise about either. Our database (Supabase, US East), our servers (Railway, US East) and our analytics project (PostHog US) are in the United States, and the speech scoring resource (Microsoft, East US) is too; we have not verified where the other companies process data. Contact us before submitting information you do not want processed through the described services.
07What Sentry gets, and what it doesn't
This is the one people assume is anonymous, so it gets said in full rather than summarised.
Crash and error reports go to Sentry automatically in release builds. They carry device details and the error, and no account ID, email, username or screenshot. A bug report you choose to send is different. If your account or your guest age answer shows 16 or older and you have not turned off usage statistics, it can carry a screenshot and, if you dictated it, the recording. When you are signed in it is tagged with a code derived from your account ID, not your account ID, email or username; we can recompute that code from your account ID, so it still links the report to your account. Guarded private screens are left out of screenshots. Optional attachments can fail. If you are under 16, or your age is not on record, a bug report carries the words you typed (with email addresses and phone numbers removed), the screen you were on and your recent screens, your course, level and the lesson date and task, and device details; it carries no account ID, email, username, screenshot or recording. The Sentry SDK disables default personal-information attachment, session replay and app-session tracking. Sentry may still derive a city-level location from the connection, and crash reports built by the phone's native layer can carry a random installation identifier that is not linked to your account. Our Sentry plan keeps reports for about a month. Our account-deletion process searches Sentry for bug reports tagged with your code and deletes them one at a time. It cannot find crash reports or under-16 reports, which carry no such code; they expire with that retention period. We have not confirmed a complete deletion schedule at Sentry.
Our servers also report failures to Sentry without an SDK. The API sends a fixed label (for example, that an account-deletion check found data still at a vendor), the task and step, a code, the version and which process sent it. They never send exception text, a request, an account or a transcript. The phone does the same for a few handled failures from a closed list of handled failures (for example a Speaking request the server could not serve, an audio download that failed, and a sign-in or sign-up failure, with only the kind of fault: device storage, network, timeout, a server refusal or unknown), and a native build adds its short commit code.
When a learner's next lesson fails to generate for good, our server also sends Sentry one alert per learner per day. It carries a short learner reference (the first 8 characters of the internal account ID, which is neither the full ID nor a name or email), the date, the error code, the failing step, the attempt count and the level band. It never carries a name, email, phone number or lesson content.
08What we deliberately don't send PostHog
PostHog is told which model ran and what it cost. It is not sent the prompt or the answer. A lesson prompt carries your memory state and every mistake you've made in writing, and handing that to an analytics company is a decision nobody asked us to make.
What PostHog does get besides that. If you are 16 or older and have not turned off usage statistics, the app and our servers send it a few counts under your account ID (before you have an account, a random device ID): which onboarding or sign-up screen you reached, how long a visit to the app lasted as a range such as 1 to 5 minutes, whether you allowed or refused notifications, how many milliseconds Speaking Practice took to start playing after you tapped Play and whether it played from the copy on your phone, what your day cost us to run in dollars along with the lesson date, your course, language and stage. They hold no lesson text, answers or audio. Our servers also send totals under one shared label with no account, device or date: what days cost us to run, with the course and language, for learners PostHog may not measure (such as under 16 or opted out) and for our own AI test accounts, how long some requests take as a range, and subscription events (a kind such as purchase or cancellation, and whether RevenueCat or Stripe reported it). Our AI test accounts are never measured as people. The server also keeps the dollars each day cost beside that day's lessons, so account erasure and Reset Progress cover them. Our servers also count, for each account and local date, how many AI model calls were made and how many bytes of text were sent to the voice provider, so a runaway cost can be spotted; they hold no lesson text, answers or audio, are deleted with the account, and are purged after five weeks. Alert emails to our own admin address can name an account ID when one account's usage is unusually high.
For the reviewed server AI usage events, PostHog receives a fixed provider-error label when a call fails. The adapter does not send the exception text, lesson prompt or model answer. Other product events and feedback are separate flows.
09Feedback you choose to send
The website's Contact and Help forms open a message in your email app. They do not themselves send or save its text. A separate, older Feedback & ideas popup remains reachable at /popups/feedback; sending that form sends your message to PostHog with a random submission identity. That route does not verify age. Your browser keeps the last-send time for that tab to space out submissions. Avoid passwords, health information and other private details in feedback.
In-app feedback also uses PostHog, but its sending checks include the app's age and privacy-refusal rules. Account deletion by account ID does not establish removal of website feedback filed under a separate random identity.
10The website you're reading this on
Cloudflare serves this website. Appearance and sound preferences use browser storage. Website hosting and any external service you open can receive connection information such as your IP address.
The main website does not load a product-analytics SDK, session replay or mouse tracking. The separate feedback popup sends a survey only when you submit it. Beta-signup links open Tally, whose collection is separate from the app account.
Appearance and sound are the preferences saved in this browser. Contact messages are not saved there.
11Getting a copy of your data
There is no export button in the app. Email support@yapzee.ai to request a copy. We verify the account before sharing data.
The support export tool exists, but complete provider coverage and the delivery procedure have not been verified end to end. We cannot describe that as a working complete export yet. Tell support what you need so the request can be assessed.
12Deleting your account
Settings, Danger Zone, DELETE ACCOUNT. A pop-up asks you to confirm, and the app then signs you out and clears what it keeps on the phone for your account. Seven days to change your mind, and signing back in during that week calls it off. After that, the account and its data are permanently deleted, apart from the retained records the delete-account page names. We have not set a retention period for learning records beyond the deletion windows and the short expiries described here (Memory outside-use probation rows expire after 720 hours, and guest voice grants, which hold IP addresses with no account link, are purged after 7 days); they stay until you delete the account or reset your progress. The lesson audio we generate for you and the diagnostic records of how a lesson was built are removed automatically from Cloudflare R2, the audio about 2,160 hours and the diagnostic records about 720 hours after they are created, so a day you leave unfinished for longer than that starts fresh when you return.
After the seven-day cancellation window, account routes refuse access and the next successful closure job removes the sign-in identity. That prevents new sessions. Protected learning routes also check that the identity still exists, so an old access token does not preserve access after closure.
A daily server job checks for identity closure and account-data removal from day seven. Failed steps are retried. These are scheduled thresholds, not a guarantee that every provider copy disappears on that date. If you want yours finished sooner, write to support@yapzee.ai and say so.
Full instructions are on the delete-account page. Six retained categories are listed below. Four have direct account or device links. Shared content may also contain identifying material. That page names the retained categories and the limits of their retention information.
13The companies a deletion never reaches
Different services receive different parts of the data. The automated deletion process reaches only the systems described below; it does not erase every copy held by every service.
The automated process removes account-owned records in Supabase and files in Cloudflare R2, and requests deletion of the account-linked PostHog person and events and of the Sentry bug reports tagged with your account code. Shared pronunciation audio, shared lesson-sentence audio and grading caches are excluded. PostHog processes deletion asynchronously. A successful request does not prove every copy is already gone. A later daily check reads PostHog and Sentry for leftovers and alerts us if any remain.
The automated purge does not send deletion requests to Railway, Fish Audio, Groq, OpenAI, Microsoft Azure AI Speech, OpenRouter, InferenceNet, DeepInfra, Morph, Google, Meta, Twilio, Resend, RevenueCat, Stripe, Apple's push service, Tally or AgentMail. Whether those services retain a copy depends on the service and its settings. We have not yet verified a complete retention schedule for those copies.
14Reaching a person
Email support@yapzee.ai to request access, correction, deletion or to raise a privacy complaint. Available rights and deadlines depend on the law that applies. We may need proportionate information to verify the request. Never send a password or verification code. Regulator links are on Delete your account.
Found a security problem instead? support@yapzee.ai. Please write there rather than posting it publicly, and you will get an answer.
Everything else is support@yapzee.ai, and the help page has a form that fills the mail in for you.
15When this page changes
If something in the app changes what we collect, this page gets updated. The date at the top is when the wording last changed. The app does not ask you to accept each new version, so check back here.