Privacy Policy

Yappie is operated as a sole-proprietor application. For all privacy-related questions or requests, contact us at:

Email: help@yappie.online

Website: yappie.online

A. Information you provide directly

• Account information: your name and email address when you register.
• Password: stored in hashed form only; we never store or transmit your plaintext password.
• Language learning preferences: your target language, native language, accent preferences, learning goal, and session configuration choices.
• Feedback and support messages: anything you submit through our feedback or contact forms.

B. Voice and conversation data

IMPORTANT: When you start a live practice session, your microphone audio is captured by your browser and transmitted in real time to Google LLC via the Google Gemini Live API. This audio is used to generate AI-powered spoken responses and to produce a text transcript of the conversation.

We receive and store:

• Text transcripts of your conversations (what you said and what the AI said).
• Vocabulary words you choose to bookmark during a session.
• Grammar and phrase corrections identified in your speech.

We do NOT store raw audio recordings. Audio is streamed to Google and processed in real time; we only retain the resulting text.

C. Usage and billing data

• Session duration and timestamps.
• Number of practice sessions and cumulative practice time.
• Remaining speaking-time balance (measured in seconds).
• Subscription and payment status (but NOT your full card number — see Section 4 on Stripe).

D. Technical data collected automatically

• IP address (used for rate limiting and fraud prevention; not stored long-term).
• Browser type and language preferences.
• Authentication session cookies required to keep you logged in.

We use your information to:

• Create and maintain your account.
• Provide, operate, and improve the Yappie Service.
• Conduct live AI voice practice sessions.
• Analyze transcripts to identify grammar mistakes and save corrections to your account so you can review your progress.
• Track your learning streak, vocabulary, and goal progress.
• Process subscription payments and manage billing.
• Prevent abuse and enforce rate limits.
• Respond to support or feedback requests.
• Send transactional emails (e.g., password reset, payment receipts) via Supabase Auth.
• Forward contact form submissions (name, email, reason, and message) to our support inbox via Resend.

We do not sell your personal data. We do not use your data for advertising.

We rely on the following third-party services to operate Yappie. Each acts as a data processor on our behalf and is bound by their own privacy and security terms.

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following legal bases:

• Contractual necessity: Processing your account data, session data, and payment information is necessary to provide the Service you signed up for.
• Legitimate interests: Rate limiting, fraud prevention, and service security.
• Consent: Where we rely on consent (e.g., optional feedback submission), you may withdraw it at any time without affecting the lawfulness of prior processing.

• Account data: Retained as long as your account is active.
• Conversation transcripts and corrections: Retained indefinitely to support your progress history. You may delete them at any time from your dashboard.
• Vocabulary and phrase corrections: Retained until you manually delete them.
• Billing and payment records: Retained for 7 years to comply with financial record-keeping obligations.
• Rate-limiting data (IP addresses in Redis): Automatically expires within 60 minutes.

When you delete your account, all personal data except legally required billing records will be permanently deleted within 30 days.

Depending on your location, you may have the following rights:

• Right of access — Request a copy of the personal data we hold about you.
• Right to rectification — Ask us to correct inaccurate data.
• Right to erasure — Ask us to delete your account and personal data.
• Right to portability — Request your data in a machine-readable format.
• Right to object — Object to certain types of processing.
• Right to restriction — Ask us to limit how we use your data.
• Right to withdraw consent — Where processing is based on consent, withdraw it at any time.

California residents (CCPA): You have the right to know what personal information we collect, to request deletion, and to opt out of the sale of personal information. We do not sell personal information.

To exercise any of these rights, email us at help@yappie.online. We will respond within 30 days. We may need to verify your identity before fulfilling the request.

We use the following technologies:

• Authentication cookies: Set by Supabase to maintain your login session. These are strictly necessary for the Service to function.
• Locale preference cookie (NEXT_LOCALE): Stores your preferred display language. This is a functional cookie with no tracking purpose.
• Browser sessionStorage: Used during the onboarding flow to temporarily store your language preferences and trial session data. This data is stored locally in your browser only and is cleared when you close the tab.

We do not use advertising cookies, tracking pixels, or third-party analytics.

Live practice sessions require microphone access. Your browser will ask for permission before any audio is captured. You may revoke microphone permission at any time through your browser settings, which will prevent live sessions from functioning.

As stated in Section 4-A, audio is streamed in real time to Google's servers for AI processing. We do not record or retain raw audio files.

The Service is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, please contact us at help@yappie.online and we will delete the account promptly.

Users between 13 and 18 should use the Service only with the consent of a parent or legal guardian.

We implement industry-standard security measures including:

• All data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
• Passwords are hashed and never stored in plaintext.
• Database access is controlled via Supabase Row Level Security (RLS) policies.
• Administrative database operations use restricted service-role credentials that are never exposed to the client.
• Payment card data is never transmitted through our servers.

No system is completely secure. If you believe your account has been compromised, contact us immediately.

Yappie operates from the United States. If you access the Service from the EEA, UK, or other jurisdictions with data protection laws, your data may be transferred to and processed in the United States. Where required, we rely on Standard Contractual Clauses (SCCs) or equivalent mechanisms as provided by our third-party processors (Supabase, Stripe, Google, Upstash).

When you cancel your subscription:

• Your subscription ends immediately in our billing system.
• Any unused speaking-time seconds in your account are NOT deleted. You may continue to use them until they are exhausted.
• Your account, transcripts, vocabulary, and learning history remain intact.
• No new weekly speaking-time grant will be issued after cancellation.

To fully delete your account and all associated data, submit a deletion request to help@yappie.online.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top. For significant changes, we will notify you by email or by a prominent notice in the application. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact:

Yappie

Email: help@yappie.online

Website: [Yappie.online]

For EEA/UK residents: if you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.