Privacy policy

Vocele is an iPhone app for learning languages by speaking. The app and this website at vocele.app are run by Yauheni Malashchytski ("we", "us"), an individual entrepreneur (sole trader) based in Georgia, who is the controller of your personal data: the person who decides how it is used and is responsible for it.

• Controller: Yauheni Malashchytski, an individual entrepreneur (sole trader), Georgia
• Email: support@overx.ai
• Postal address: available on request by email

The App Store shows these details on Vocele's page. They are the data types the app declares to Apple, in Apple's own names and with Apple's purposes, and the sections below explain each one in plain words.

Data used to track you

• Device ID (Third-Party Advertising): Apple's advertising identifier, only if you turn on attribution and allow tracking (Section 15)

Data linked to you

• User ID (App Functionality): your account identifier (Section 4)
• Email Address (App Functionality): the address your Apple or Google sign-in gives us (Section 4)
• Name (App Functionality): the name your Apple or Google sign-in shares, if it does (Section 4)
• Other Data Types (App Functionality, Analytics): your learning profile and setup answers (Section 5)
• Coarse Location (App Functionality): the country we infer from your IP address, shown as a flag if you join a leaderboard (Section 5)
• Audio Data (App Functionality): your voice when you speak in an exercise (Section 6)
• Other User Content (App Functionality): what you write and the coach's conversations with you (Section 7)
• Other Usage Data (App Functionality): how much of your plan you have used, and your progress (Section 10)
• Purchase History (App Functionality): your subscription status (Section 12)
• Customer Support (App Functionality): messages you send us (Section 13)
• Crash Data (App Functionality): crash reports (Section 14)
• Performance Data (App Functionality): how fast the app works for you (Section 14)
• Device ID (Third-Party Advertising): the advertising identifier above (Section 15)

• No password: you sign in only with Apple or Google.
• No phone number, contacts, photos or health data from your iPhone.
• No precise location: no GPS. We work out only your country, from your IP address (Section 5).
• No payment card or bank details: Apple handles every payment (Section 12).
• No advertising inside the app.

You need an account to use Vocele, and you create it by signing in with Apple or with Google. There is no email-and-password sign-in and no guest account. When you sign in we receive and store:

• your email address. With Sign in with Apple you can hide your real address, and then we only receive a private relay address from Apple;
• your name and profile picture, if Apple or Google shares them with us;
• an account identifier, which is how we keep your learning data together;
• an identifier for your device and the device's name, to keep your sessions secure.

We use these to run your account, to sign you in on your devices and to contact you about the service. We do not send marketing email. Signing in is covered by Apple's Privacy Policy or Google's Privacy Policy, whichever you use.

To build your lessons we keep the languages you learn and the language the app talks to you in, your level in each language, your time zone and the times you want reminders.

When you set the app up you can also tell us your age range, your goals, how you heard about Vocele and how you like to learn. Every one of these questions can be skipped. We use the answers to shape your daily plan and how the coach talks to you, and in total to understand who Vocele helps.

We work out your country from your IP address. It is not your precise location. If you join a leaderboard, your country is shown there as a flag (Section 11).

Vocele listens only while you are doing something spoken that you started: a lesson, a chat with the coach, a pronunciation drill or a duel. Your recording is sent to our speech providers so that what you said can be transcribed and scored.

• Recordings are not kept after they have been processed.
• The transcript and the scores are kept with your progress, for up to 400 days.
• On your iPhone, your recent takes are kept so you can listen back. You can delete them, and they are removed when you sign out or delete your account.
• Some short answers are recognised by Apple's speech recognition, on your iPhone where it supports that; otherwise iOS sends that recording to Apple, under Apple's privacy policy.

Two features keep a recording on purpose, and only if you opt in:

• Arena duels. If you take part, your duel takes can be played to other learners as their opponent. They are kept for 30 days after you last refreshed them, or until you withdraw your consent.
• Week's Best. If you enter, your showcase take can be played to other learners of that language. It is deleted 30 days after its week ends, or when you withdraw.

Other learners hear these takes under a generated handle, never your name.

We keep your chat messages, the answers you type, the words you save and the translations you ask for, so your history is there next time and the coach can correct you. The messages in a conversation are kept for up to 180 days after it ends; its topic and the short summary the coach writes of it stay while your account exists. Words you save stay in your vocabulary while your account exists.

The coach remembers some facts about you between conversations, such as your job or a trip you are planning, so lessons can be about your life. You can see these AI memories, and delete any of them or all of them, in Settings → My Data.

The coach's replies, corrections, feedback, translations and spoken audio are produced by AI. To do that, what you write and say is processed by AI providers on our behalf (Section 18). They receive what each request needs and nothing more.

We do not use your content to train AI models.

Automated systems help us find abuse and harassment, and signs that someone may be at risk. They may limit what an account can do or suspend it, and they may show you crisis resources.

If an automated decision affects you, you can contest it: write to support@overx.ai and a person will review it. You can also give your point of view and ask us to explain the decision. This is your right under Article 22 of the GDPR and the UK GDPR, and we give it to everyone.

We keep your vocabulary and its review schedule, the exercises you do, your streaks and achievements, and how many minutes you have spoken and how much of your plan you have used. This is what your daily plan, statistics and allowance are built from.

It is kept while your account exists. Your exercise history is kept for up to 400 days.

Nothing you do in Vocele is public unless you choose to make it so.

• Leaderboards, the public duel board, the Arena and Week's Best, if you opt in, show a handle the app generates for you, your score, your country flag and, for the Arena and Week's Best, your takes (Section 6).
• Friends you add see your activity, such as wins and level-ups, and your challenge ratings.
• Roadmap ideas you submit may be shown publicly after we review them.
• Anything you share yourself, such as an invite link, a share card or a clip, goes wherever you send it.

Subscriptions are sold and paid for through Apple's App Store. We never see your card or bank details. We receive the status of your purchase and subscription (which plan, when it renews or lapses, and whether it was refunded), linked to your account, through our subscription and purchase management provider. That is how the app knows what your plan includes.

When you write to us through the in-app support chat or the feedback form, we receive your message, your email address if you give it, and your device model, iOS version and app version, so we can answer and fix what you report. A customer-support messaging provider handles these messages for us. We keep them for up to 24 months.

The app sends us crash reports, performance measurements and usage events, linked to your account. We use them to keep Vocele working, to find what is slow or broken and to understand, in total, which parts help people learn. They never contain the text of what you said or wrote. We keep them for up to 13 months.

Our own analytics do not use your advertising identifier.

We want to know which ads and links bring people to Vocele, so we spend money where it reaches people who want to learn a language. This is measurement, and Vocele itself shows no ads.

• Apple. If you found Vocele through an ad on the App Store, Apple can tell us which campaign led to the install, without telling us who you are.
• AppsFlyer. AppsFlyer matches an install to the ad or link that led to it. It starts only after you turn on attribution in Settings → My Data, wherever you live. It then receives information about your device and the install, such as the device model, iOS version, app version, your IP address and when the app was installed and opened. It reads Apple's advertising identifier (IDFA) only if you also choose Allow when iOS asks whether Vocele may track you. Using the advertising identifier this way is tracking as Apple defines it, and the App Store lists it so. AppsFlyer's Privacy Policy.

Under California law, giving AppsFlyer this information can count as "sharing" personal information for cross-context behavioural advertising (Section 25). To stop it, turn attribution off in Settings → My Data, turn off tracking for Vocele in iOS Settings → Privacy & Security → Tracking, or use AppsFlyer's opt-out page. Saying no changes nothing else in the app.

If you agree, this website uses Google Analytics, from Google, to count visits and see which pages help. It measures the pages you visit, how you use the site, your device and browser type, and your approximate location worked out from your IP address. Google receives your IP address and details of your browser and device. We have turned off Google's advertising features, so it is not used for advertising. How Google uses data from sites that use its services.

Nothing is measured until you choose Accept in the cookie banner. If you choose Reject, nothing loads. If your browser sends the Global Privacy Control signal, we treat it as Reject and do not show the banner. To change your choice or withdraw your consent, choose Cookie settings at the bottom of any page; withdrawing removes the analytics cookies.

Cookies this website sets:

• _ga and _ga_0ZQBJJGWPG: Google Analytics, only after you accept, to tell visits apart. They last up to 14 months, and we keep the analytics for no longer than 14 months.
• vocele_consent: your answer to the cookie banner, for about 6 months.

Our hosting provider receives your IP address and basic details of each visit to deliver the page and protect the site.

Where the GDPR, the UK GDPR or a similar law applies, these are our legal bases:

Where we rely on legitimate interests we have weighed them against your interests, and you can object at any time (Section 24). Where we rely on consent, you can withdraw it at any time without affecting what happened before.

We use service providers to run Vocele. Each receives only what its part of the service needs, processes it on our instructions under a data-processing agreement, and may not use it for its own purposes. By category, they are:

• AI language-model providers
• Speech-recognition and pronunciation-assessment providers
• Text-to-speech providers
• Cloud hosting and storage (in the European Union)
• Subscription and purchase management
• Customer-support messaging
• DNS/content delivery and security

We name any provider on request: write to support@overx.ai.

These companies receive data for their own part and under their own policies:

• Apple: the App Store, Sign in with Apple, purchases and speech recognition. Apple's Privacy Policy.
• Google: Sign in with Google, and Google Analytics on this website if you accept cookies. Google's Privacy Policy.
• AppsFlyer: mobile attribution, only if you turn it on (Section 15). AppsFlyer's Privacy Policy.

Other learners see what you choose to make public (Section 11). We may also disclose data when the law requires it, or to protect someone's safety.

Your data is hosted in the European Union. Some of our providers process data outside the EU and the EEA, including in the United States. Where they do, the transfer relies on an adequacy decision or on the European Commission's Standard Contractual Clauses, with the UK Addendum for data from the UK. We are based in Georgia, outside the EEA and the UK. You can ask us for a copy of the safeguards at support@overx.ai.

When you delete your account we erase your data within 30 days, including from backups, which roll off within 30 days. We keep three things: purchase records, as above; copies of messages you sent to support, for up to 24 months; and a one-way fingerprint of your sign-in for up to 2 years, which cannot be turned back into your identity and is used only to stop the same person claiming the free allowance again and again.

You can delete your account in the app at any time: Settings → Account → Delete account. This erases your account and your sign-in record, your learning profile, progress, saved words, conversations, AI memories, transcripts, scores and any takes you shared, and removes your data from your iPhone. It also revokes Vocele's access to your Apple sign-in, and we ask our attribution and subscription-management providers to delete their records about you. It cannot be undone. Deleting your account does not cancel an Apple subscription: cancel that in your Apple Account settings.

To get a copy of your data, write to support@overx.ai. We send it in a machine-readable format within 30 days.

Your data is encrypted in transit and at rest, and access to it is limited to the people who need it to run Vocele. No system is perfectly secure. If a breach affects your personal data and is likely to put you at risk, we will tell you and the authorities as the law requires.

Vocele is not directed at children under 13. In the EEA and the UK it is not for anyone under 16 unless a parent or guardian consents, or the law of their country sets a lower age. If we learn that we have collected data from a child without that, we delete it. If you think a child has given us personal data, write to support@overx.ai.

Under the GDPR and the UK GDPR, and in the same way wherever you live, you have the right to:

• access your personal data and get a copy of it;
• correct it if it is wrong;
• delete it;
• restrict how we use it while a question about it is settled;
• receive the data you gave us in a portable, machine-readable form;
• object to processing based on our legitimate interests;
• withdraw your consent at any time, without affecting what happened before;
• contest an automated decision and have a person review it (Section 9);
• complain to a data protection authority.

Brazil's LGPD and similar laws elsewhere give you comparable rights, and we honour them the same way.

To use a right, write to support@overx.ai. We may ask for something that confirms the request is yours, so we never hand your data to someone else, and we answer within 30 days. If a request is complex we may need up to two more months, and we will tell you why. We will not treat you differently for using a right.

We are supervised by Georgia's Personal Data Protection Service. If you are in the EU, the EEA or the UK, you can also complain to the data protection authority where you live or work. We would rather you came to us first.

If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the rights below, and this section is our notice at collection. We give residents of other US states with similar laws the same rights.

• Categories we collect: identifiers (account identifier, email address, name, device identifier, IP address, and the advertising identifier if you allow it); commercial information (your subscription); audio (your voice in exercises); internet or other electronic network activity (usage, crash and performance data, and website analytics if you accept); approximate location (your country); inferences (your level and what the coach remembers about you); and the content of what you write and send us. We collect them from you and your device, for the purposes in Section 17, and keep them as Section 20 says.
• Categories we disclose for business purposes, to the service providers in Section 18: all of the above, each provider only for its part.
• Sharing. If you turn attribution on, we give AppsFlyer identifiers and internet activity (Section 15). That can count as "sharing" for cross-context behavioural advertising. You can opt out of sharing by turning attribution off in Settings → My Data, turning off tracking for Vocele in iOS Settings → Privacy & Security → Tracking, or choosing Ask App Not to Track when iOS asks. This website treats a Global Privacy Control signal as an opt-out (Section 26).
• We do not sell personal information for money, and have not done so in the past 12 months.
• Your rights: to know what we collect, use and disclose; to delete it; to correct it; to opt out of sharing; to limit the use of any sensitive personal information to what is needed to give you the service; and not to be treated differently for using these rights. Make a request at support@overx.ai. An authorised agent may act for you with your signed permission, and we check requests as Section 24 describes.

This website honours the Global Privacy Control signal: if your browser sends it, we treat it as Reject for cookies and as an opt-out of sharing, and do not show the cookie banner. There is no agreed standard for the older Do Not Track signal, so we do not respond to it separately; the website loads no analytics without your consent either way.

If we change what we collect or why, we update this page and the app's privacy details together, and the dates at the top change. If a change is material, we announce it in the app or by email at least 30 days before it takes effect. From this version on, each version we replace stays available at a dated address on this site.

• Controller: Yauheni Malashchytski, an individual entrepreneur (sole trader), Georgia
• Email: support@overx.ai
• Postal address: available on request by email

Questions about this policy, or a request about your data: support@overx.ai.