Privacy Policy

What We Collect

Your email address (for signing in), the display name you choose, your onboarding answers (region, goal and level), your timezone, lesson progress, XP and streaks, and your subscription status. What you write or say in practice: your tutor conversations, practice answers and the text of your spoken answers, plus the facts you mention to the tutor that it remembers for later sessions. When you practice speaking, your recording is sent to be graded and we don't store it. With each analytics event we also keep your device and browser type (the browser's user agent) and a random ID this browser or app makes, which joins your account when you sign up.

How We Use It

To provide the learning experience, track your progress, personalize lessons and the tutor, send the emails described below, and process payments. We don't sell your data.

AI Features and Your Permission

The AI tutor and speech scoring use two partners, Anthropic and Microsoft Azure Speech (below). Before your first tutor message or your first recording, the app asks once whether it may send them your practice. If you choose Not now, those features stay off and the rest of the app works. You can change your answer any time in Profile; if you aren't signed in, it is kept on your device.

Teacher Inquiries

If you send us a note from the For teachers page, we keep your name, email, school or organization, role, class details and message so we can reply about our teacher pilot, and we delete them if you ask at privacy@boricuaspeak.com.

Daily Game Scores

When you finish the daily Guess the Region set, we keep your score with a random ID your browser makes for the game (and your account, if you are signed in) to show how everyone did that day. We don't keep your IP address or your answers, and deleting your account deletes its scores. Like the rest of the app, the game's analytics events record your device and browser type and the random ID described above. If you are signed in, the set also earns XP, which counts toward your total and your weekly league, and we keep how much with your score. If you are signed in, friends you have accepted can see your first name and score for that day's set. They can also see how many days you played that week, your total and your best day. A result link you share carries that day's score, never your name.

Third Parties

We use the services below to run BoricuaSpeak. Each has their own privacy policy. We share only what's necessary for these services to function:

• Supabase (database and sign-in): your account and what the app keeps for you, such as your email, progress, XP, tutor chats, speaking scores and subscription status.
• Stripe (payments on our website): your email address and payment details when you pay on the website. We never see your full card number.
• Apple (in-app purchases and Sign in with Apple): the App Store handles purchases in our iOS app and tells us what you bought, not your payment details. If you sign in with Apple, Apple shares your name and email address (or a private relay address if you hide your email), and we keep the token Apple issues for your account so we can revoke it when you delete your account.
• Google (Google Play purchases and Google sign-in): Google Play handles purchases in our Android app and tells us what you bought, not your payment details. If you sign in with Google, Google shares your name, email address and profile picture. Notifications in our Android app are delivered through Firebase Cloud Messaging, which receives your device's notification token and the notification text. When our Android app shows ads, Google AdMob serves them and receives your device's advertising ID.
• Microsoft Azure Speech (speaking practice): your voice recordings, to turn them into text and grade your pronunciation, once you allow it, and the lesson and tutor text it reads aloud.
• Google Cloud Text-to-Speech (lesson and Real Message audio): the text it turns into audio: lesson phrases, and in Real Message the Spanish versions of your message that you choose to hear. We keep the audio and its text in a shared cache, without your name or account, so the same phrase plays faster next time; deleting your account doesn't remove it.
• Anthropic (AI tutor and feedback): once you allow it, the text of your tutor conversations and practice answers (typed, or transcribed from your recording), your Street Mode, story and conversation chain replies, the messages you check in Real Message and I Heard This, and the phrases you score in the Sound Local test, to write replies, grades and feedback. After a tutor conversation it also reads the conversation to note facts you mentioned (like your work, family or plans), which the tutor brings up in later sessions.
• Sentry (crash reports): crash and performance data, such as what went wrong, on which screen, your device and browser type, and your account's random ID, with emails and sign-in tokens removed before a report is sent.
• Resend (sending our emails): your email address and the name on your profile, for account emails, reminders, weekly recaps and the marketing emails described below.
• Vercel (website hosting): hosts our website and counts page visits without cookies and without identifying you.
• Meta (advertising measurement, described below): on our website and in our Android app only, which pages you visited and whether you signed up or paid, with a scrambled (hashed) email address when you sign up or buy a plan. Never from our iOS app.

Data Storage

Your data is stored securely in Supabase with row-level security. Your tutor conversations are kept until you delete your account: they count toward the free daily limits, show in your history, and give the tutor the facts it remembers about you.

Emails

We send account emails (signing in, purchases, and your trial ending or ended, which can include a discount). If you turn on email reminders, we also send practice reminders and weekly recaps. We may also email you to bring you back, for example when you haven't practiced in a while or didn't finish a checkout. These marketing emails use your email address and the name on your profile. Reminder and marketing emails have an unsubscribe link, and turning off email reminders in Profile stops them too.

Your Rights

You can view, export, or request deletion of your data at any time. Start from Profile settings or visit /delete-account for instructions. Contact us for data export requests. If you signed in with Apple, deleting your account also revokes BoricuaSpeak's access to your Apple ID.

Cookies

We use localStorage for authentication tokens. The one exception to a no-cookies site is Meta's pixel, described below, which sets cookies in your browser to measure our ads. We use no other tracking or analytics cookies.

Advertising Measurement

We use Meta's pixel on our website and in our Android app to measure whether our Facebook and Instagram ads work. It sets cookies in your browser and tells Meta which pages you visited and whether you signed up, started a trial or paid. When you sign up or buy a plan, we also send Meta a scrambled (hashed) version of your email address so it can match the sign-up or purchase to an ad without receiving the address itself. None of this happens in our iOS app: the pixel doesn't run there, and signing up or buying in the app sends Meta nothing. We never share your lessons, recordings or progress with Meta. You can opt out through Meta's ad settings, and browser tools such as ad blockers stop the pixel entirely.

Contact

Questions about privacy? Email us at privacy@boricuaspeak.com.