Legal
Privacy Policy
We collect the information needed to run a language-learning account and its optional social, classroom, AI-tutor, and subscription features. We show no ads, use no tracking SDK, never record your voice, and never sell personal data.
1. Who is responsible
The data controller is Christ Jalabi, Sweden. Privacy questions and requests can be sent to gh0stking1@proton.me.
2. Information we collect and why
| Information | Purpose |
|---|---|
| Email address, hashed authentication credentials, display name, avatar choice, and optional Apple/Facebook sign-in name and email | Create, secure, and display your account; send account-recovery email. |
| XP, weekly XP, level, league, streak, hearts, gems, lesson progress, stars, achievements, and last-practice date | Save learning progress, game features, and weekly leaderboards across devices. |
| Friend relationships, direct-message text and timestamps, classroom memberships, class information, and in-app notifications | Provide the social, private messaging, classroom, and in-app inbox features you choose to use. |
| AI tutor messages and daily message count | Generate the tutor reply and enforce fair usage. Message content is processed for the reply but is not stored in our database. |
| App user ID, App Store or Google Play purchase receipt, product, and entitlement status | Validate, unlock, manage, and restore optional Super subscriptions. |
The legal basis is performance of the service you request and our legitimate interest in account security, fraud prevention, and fair-use enforcement. Where local law requires consent—especially for a child below the applicable age of digital consent—a parent or legal guardian must provide it.
3. Social and classroom visibility
Other signed-in users can see your display name, avatar, and progress statistics used for friend search and rankings. Your email and settings are not shown to other users. Direct messages are visible only to their sender and recipient. A teacher can see the display name, avatar, XP, weekly XP, streak, last-practice day, and lesson-completion count of learners who join that teacher's class.
4. Service providers
- Supabase, Inc. provides authentication, database, file storage, and realtime messaging. The project's primary database region is Europe (Ireland).
- Google LLC (Gemini API) processes recent tutor message text and lesson context when you choose to use the AI tutor. Messages go through our authenticated server function; we do not send your name, email, or account ID to Gemini.
- RevenueCat, Inc. processes the app user ID and store receipt/purchase/entitlement data required to validate and restore subscriptions. Apple or Google processes the payment itself; we never receive card details.
- Apple or Facebook supplies name/email only if you choose that provider for social sign-in.
These providers process information to deliver the stated service. We do not share information for advertising, data brokerage, or cross-app tracking.
5. AI tutor
The AI tutor sends a limited recent conversation and lesson context to our Supabase server function, which forwards it to Google Gemini and returns the generated reply. The conversation remains on your device for the session; our database stores only a per-user daily message count. Do not enter sensitive personal information in tutor messages.
6. Microphone and notifications
Speaking exercises are self-assessed. The app does not request microphone permission and does not capture, store, or transmit your voice. Practice reminders are local notifications scheduled on your device. We do not collect a remote push token.
7. Information we do not collect
We do not collect advertising identifiers, precise or coarse location, contacts, photos, files, microphone recordings, health data, or browsing history. The app includes no ad network, behavioral analytics SDK, attribution SDK, or cross-app tracking.
8. Retention and deletion
Account, learning, social, direct-message, classroom, and AI usage-count records are kept while the account exists. AI message content is not stored in our database. You can permanently delete the account and its associated live records in Settings → Delete account, or request help by email. A hosting provider may retain encrypted backups for a limited rotation period. Deleting an account does not cancel an App Store or Google Play subscription.
9. Children
SuryoyoLearn is intended for learners aged 13 and over (or the minimum age of digital consent in your country, if higher). We do not knowingly collect personal data from anyone below that age. If you believe a younger child has created an account, contact us and we will investigate and delete it. Teachers and parents who run a classroom are responsible for any consent required for the learners they enrol.
10. Your rights
Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object to processing of your personal data and to complain to a data-protection authority. Email gh0stking1@proton.me to exercise a right.
11. Security and changes
Data is encrypted in transit using HTTPS/TLS. Password authentication is handled by Supabase, and database access uses row-level security. We may update this policy as the service changes; the effective date above will be updated for material revisions.