Privacy Policy

Version v5, 1 October 2026.

In short

We store what the trainer needs to work: your name, language settings, your level, your time zone, your attempts and their scores. We store recordings of your voice only if you agreed to it — you give that consent with the same single checkbox in the sign-up questions — and for no longer than 30 days. For the scoring itself, every recording goes to an external speech engine; that happens on every attempt, whether or not you allowed storage. From your recording of the test phrase we build a synthetic copy of your voice — it also lives for 30 days, the consent for it is optional, and you can withdraw it in the app. If you subscribe, we receive purchase details from Apple — without your card number. We do not train any models on your data and we do not hand your data to anyone for that purpose. We have no third-party analytics, no ads and no data sales. To erase everything, there is one button in your profile.

Who is responsible for your data

The data controller is Andrei Vasilev, an individual based in Georgia and the author of Semaphore. For any question about your data, write to millenium050@gmail.com: the "Email us" button on the "Profile" tab opens an email to this address. We answer within 30 days — the period the law allows.

What we collect, why, on what legal basis, and for how long

Below is everything we hold about you on our server. Each entry says what it is for, the legal basis on which we process it, and how long we keep it.

• Profile: your name, interface language, the language you are learning, your self-reported level, your device's time zone. Why: so the app speaks your language, and so "today" in the app matches your day — your phrase set, your day streak and your daily scoring limit all depend on the time zone. Basis: performance of our contract with you (the Terms). Kept: for as long as your account exists.
• Attempts and results: what you said, when, the overall score, per-word and per-sound scores, the full response from the speech engine. Why: to show you your own history and to calibrate the scoring — the right thresholds cannot be found without real attempts and their scores; your weak words are also what your personal phrases of the day are built around. Basis: performance of the contract (your history) and our legitimate interest (calibration). Kept: for as long as your account exists.
• Recordings of your voice. Why: so you can listen to yourself not only right away but a week later, and so old attempts can be re-scored when our analysis gets better. Basis: your consent — separate and revocable. Kept: 30 days, then deleted automatically.
• The synthetic copy of your voice. Why: so you can hear your own phrase pronounced correctly "in your own voice". Basis: your consent — separate, optional and revocable. Kept: 30 days, then deleted automatically — both our file and the voice itself at the vendor.
• Subscription: the Apple transaction number, the plan, the dates of the period, whether auto-renewal is on, whether a trial is running, the price, the currency, the storefront country. Why: to unlock your access and to show the state of your subscription in your profile. Basis: performance of the contract. Kept: for as long as your account exists. We do not have your card number or payment details — only Apple sees those.
• Consents: every "yes" and "no", with the date and the version of the text you were answering. Why: otherwise we would not know what you actually agreed to, and you could not check it. Basis: our own obligation to be able to demonstrate that consent was given. Kept: for as long as your account exists.
• Operational events: screens opened, onboarding and lesson steps, recording started and stopped, answers in exercises, the fact and score of each assessment, taps on the payment screen and restoring purchases and their outcome, a session id, the app version. Why: to understand how the product is used and where it breaks. Basis: our legitimate interest. Kept: for as long as your account exists.

The level you told us about yourself decides two things: which test phrase you say at the very start, on your first sign-in, and how complex your personal phrases of the day are written (two groups — beginner and intermediate). It does not affect the editorial daily phrase set — that set is the same for everyone and depends only on the date.

Delete your account and everything listed above is deleted with it.

The log of subscription messages

One exception has to be stated plainly. Subscription messages — a receipt from the phone or an Apple notification about renewal, cancellation or refund — that the server could not parse or could not tie to an account are kept in an operational log with no link to an account: this happens with a malformed message and with a notification that reaches us after your account has already been deleted. Otherwise there would be no way to sort things out if you later contact us about money. Such a record holds the Apple transaction number, the plan, dates, the amount and the internal number of the account — a random string that points to nothing once the account is gone; it carries no name and nothing else about you. Deleting your account does not touch these records, and this log has no expiry.

Recordings of your voice

Without consent to storage, nothing is stored on our server. Scoring still works as usual: it happens on the fly and does not need storage.

The copy on your phone is a separate matter. So that the "You" button on a card can play your recording back, the app keeps the recording of a phrase you said in its own folder on the device regardless of consent. Nothing is sent anywhere from that folder: the recording goes out for scoring separately, at the moment you speak (see "Where your voice goes"), not from there. The copy lives alongside the saved analysis of that phrase (the app remembers analyses for at most 40 recent phrases) and is removed when you record the same phrase again, when another account signs in on this phone, and when the account or the app itself is deleted. The consent and its withdrawal concern server-side recordings only.

If you allowed storage — that is the single checkbox in the sign-up questions on your first sign-in, one tap covering the Terms, recording storage and the synthetic voice — we keep recordings for 30 days and then delete them automatically: a nightly job on the server does it, not our memory.

Withdraw the consent and we delete every recording stored on the server. The scores and the analysis of the attempt stay: the voice goes, the score remains.

Where your voice goes

Scoring — an external engine, on every attempt. To produce a score, your recording is processed as you speak it by an external speech service — currently Microsoft Azure (Pronunciation Assessment). This happens regardless of the storage consent: without that processing there is no score at all. The processor receives the recording and the text of the phrase you are saying; it does not receive your name or your account. Microsoft's documentation states that for pronunciation assessment and real-time recognition it does not retain the audio and does not use it to train Microsoft's models (checked on 15 September 2026).

Reference audio is synthesised — your voice never goes there. When you listen to how a phrase or word should sound, speech is synthesised from text: phrases at normal speed by Cartesia, phrases in slow reading ("Slowly") by Google Gemini, single words and the examples in the sound guide by Microsoft Azure. Only the text and its transcription are sent. Your recording is never sent to these services.

Personal phrases of the day are written by Google Gemini, which receives nothing of yours. One or two phrases of the day are built around a word you struggled with. Our server picks the word from your scores, and only three things go to the model: the word itself in the required form, the day's topic and your level group (beginner or intermediate). Neither your name, nor your account number, nor your voice recording, nor your scores are part of that request. The finished phrases are stored with us and may be shown to other people with the same weak word. We use Google's free tier, and on it Google is entitled to use what is submitted to improve its own products, and its staff may read the content (Google's terms, checked on 15 September 2026). That is precisely why nothing that would tie such a request to you is ever sent.

A synthetic version of your voice (Cartesia). From your recording of the test phrase in the sign-up questions we build a synthetic copy of your voice, so you can hear that same phrase pronounced correctly "in your own voice". Cartesia receives three things: the recording, the text of the phrase, and an internal number for your account — a random string of letters and digits. The number is there so the copy of your voice has a name we recognise on their side and can always find and delete when it is yours; it carries no name, no address and nothing else about you, and outside our database it tells no one anything. The copy lives for 30 days and is then deleted automatically: a nightly job on our server removes our file and deletes the voice itself at Cartesia. We ask for consent at sign-in and it is optional: without it the pronunciation trainer works in full, you just do not hear "your own" voice.

We do not train models on your data

We have no speech model of our own and we are not building one. We do not hand your recordings to anyone for training: they go to the scoring engine for the sake of a single score and, per its documentation, do not stay there.

There is one exception — the synthetic copy of your voice: to build it, Cartesia needs your recording, and it keeps both the recording and the voice model on its side. That is covered below, under "What we cannot promise".

And so that nothing is left unsaid, here is what we really do with your data for the sake of the product: we look at the scores and sometimes re-score stored recordings when our analysis gets better. That is tuning numbers in our own code, not training a model, and the result never leaves our server.

Where all this lives and how it is protected

The database and files are in Supabase, region European Union (Frankfurt). The server side runs on Vercel, with its functions in Frankfurt too.

How it is protected — as facts, not as generalities:

• The app and the server only ever talk over a secure connection.
• Row-level security is on for every table: even with your access key, only your own rows can be read from the database, never anyone else's.
• Voice recordings sit in private storage, with access tied to your account; no public link to them exists.
• We hold no password at all: you sign in with Apple, so there is nothing to steal from us. Your session key sits in your phone's secure store (Keychain) and travels neither into backups nor to another device.
• The keys to external services live only on the server; not one of them ships inside the app you downloaded.

Nobody can promise perfect security and we will not either: what we answer for is the list above.

Transfers outside Europe

Our own data sits in the European Union. But all of our processors are US companies. Cartesia (speech synthesis and the voice copy) and Google (slow reading and writing personal phrases) process what we send them outside the European Economic Area. Supabase (database and files) and Vercel (the server side) run for us in Frankfurt, and Microsoft Azure processes the recording in a region we set on our side — but these are US companies too. Apple receives sign-in and purchase data on its own terms.

We use them on their public terms; we do not yet have separate signed data processing agreements with them — see "What we cannot promise".

Sign in with Apple and email

You sign in with Apple. From Apple we receive an account identifier and, on first sign-in, your name. We do not request and do not receive your email address from Apple — you will get no email from us, and if you write to us yourself, we see your address only in that message.

Analytics

Our analytics are our own: our server writes events into our own table. There are no third-party analytics SDKs, ad networks or trackers in the app. We do not sell your data and do not share it for advertising.

What we record: usage events — screens opened (welcome, phrase feed, training, word of the day, course lesson, payment screen), onboarding steps, course lesson steps and completed lessons, recording started and stopped (by button, automatically or at the time limit), answers in the listening exercise, finishing the day's phrase feed and re-recording a phrase after practising a word, the fact and score of each assessment, taps on the payment screen and restoring purchases and their outcome (no amounts or payment details), a random session id (new on every launch and after half an hour away) and the app version. Your audio recordings and transcripts of your speech never go into these events; assessment events carry the score and the sound codes — how the scoring engine heard you. Events are linked to your account. Events from before you sign in are recorded without it, but once you sign in, events from the same session can be linked to your account via the session id — this is how we see the whole path from the first screen to sign-up.

The legal basis for this processing is our legitimate interest: understanding how the product is used and improving it. We do not ask for a separate consent; this data goes nowhere else and serves only product development.

Automated decisions

The app scores your pronunciation automatically — that is the whole point of it, and no human listens to your recordings or awards the scores. The score has no consequence for you beyond the screen: it shows how the engine heard you and picks the words for you to practise.

Two decisions are made automatically and do close something off: the daily scoring limit and access to the paid part. Both are worked out by simple rules — how many attempts you have made today, and whether you have an active subscription — and no "profile" of you is built for that. None of our automated decisions has legal consequences for you.

Children

The app is not designed for children and we do not deliberately collect their data. The App Store age rating is about content, not about the age at which a person may enter into a contract and consent to the processing of their voice. If a child uses the app, it is the parent or guardian who accepts the Terms and gives the consents.

The minimum age at which a person may consent for themselves differs by country (in the European Union it is between 13 and 16). We have not yet set our own threshold, and it is more honest to say so than to keep quiet: when we set one, it will appear here. If you are a parent and believe we hold your child's data without your knowledge, write to us and we will delete it.

Your rights

Withdraw the recording-storage consent — on the "Licences" screen in the app. Withdrawing it deletes every recording stored on the server; the copy on the phone itself (see "Recordings of your voice") is untouched — deleting the account or the app removes it.

Withdraw the synthetic-voice consent — on the "Licences" screen in the app, next to recording storage. Withdrawing it deletes the copy of your voice straight away, without waiting for the 30 days: both our file and the voice at Cartesia. You can keep using the app after withdrawing it — you simply get no new copy of your voice: the pronunciation trainer does not depend on it.

Withdrawing your acceptance of the Terms is the same thing as deleting your account: refusing the Terms means you can no longer use the app. The button is in the app — see the next item.

Delete your account — in the app: "Profile" tab → "Delete account". Deletion erases everything at once and forever: your profile, the history of attempts and scores, stored recordings, the copy of your voice (both our file and the voice at Cartesia), subscription details, consents and events. If you signed in with Apple, we also sever the link on Apple's side when deleting. If that fails — Apple is down, or a setting on our side is not yet in place — your data is still deleted, and you can sever the link yourself: Settings → your name → Sign in with Apple → Semaphore → Stop using Sign in with Apple. Deletion does not cancel the subscription itself — Apple runs it; turn off auto-renewal before deleting.

See what we hold, get a copy, correct what is wrong, restrict or object to the processing. Your attempts and scores are visible in the app; your name and languages can be edited in your profile. For anything else, write to us at the address above and we will answer within 30 days. One thing said plainly: there is no "export everything as a file" button in the app yet — we will gather it and send it by hand.

Complain about us. If you are in the European Economic Area and believe we handle your data wrongly, you have the right to lodge a complaint with the data protection supervisory authority in your country. We would be glad if you wrote to us first — but that is your right, not our condition.

What we cannot promise

We would rather name the limits plainly than hide them in generalities.

Cartesia and the copy of your voice. Cartesia does offer a "we store nothing" mode, but it does not cover voice cloning — the source recording and the voice model itself are kept on their side; that is how the service is built (checked against their documentation on 27 August 2026). We stand behind our own part: we delete our file and we delete the voice at Cartesia, either after the 30 days or straight away if you withdraw your consent. What we cannot vouch for is how quickly your data disappears from their backups: that would take a signed data processing agreement with Cartesia, and we do not have one yet.

Agreements with processors. We do not have separate signed data processing agreements (DPAs) with any of the external services — we use them on their public terms. This is an open item on our side, and we will close it here when we close it in fact.

Google's free tier. As stated above, on it Google is entitled to use what is submitted to improve its own products. We send no personal data there, but we cannot forbid Google to do this.

Changes

This policy will change as the app does. We will tell you in the app about material changes, and if what you agreed to changes, we will ask for your consent again: consent is versioned, and an old "yes" does not carry over to a new text.