Privacy Policy
We record your voice, your writing and the rhythm of your typing. Here is exactly why, exactly for how long, and exactly who else sees it.
Last updated 2026-09-28
Draft, not yet in force. The operator’s legal name, address and contact address are still blank, and this document has not been reviewed by a lawyer. Fill in lib/legal/identity.ts and have it reviewed before publishing or submitting to Paddle. This notice removes itself.
1. Who is responsible
[LEGAL NAME], of [REGISTERED ADDRESS], is the data controller for IELSPEAK. For anything on this page, write to [CONTACT EMAIL].
2. What we collect
- Account data. Your email address, display name, time zone, age bracket, and — if you give them — your test date and target band.
- Audio. Recordings of your speaking sessions.
- Transcripts. Text of what you said, and the examiner’s side of the conversation.
- Written work. Essays you write, and what you type during copywork.
- Keystroke timing. When each key was pressed, to the millisecond. See section 5, which explains this properly.
- Usage data. Which features you used and when, so we can compute streaks, leagues and progress.
3. Why we collect it
To deliver the service: to give feedback on what you said and wrote, to compute band estimates, to track progress over time, and to check that practice sessions are genuinely yours. We do not sell any of it, we do not use it for advertising, and we do not give it to third-party model providers for training.
The lawful basis is performance of our contract with you for everything needed to run the service, and your explicit consent for recording audio, which we ask for separately before your first speaking session.
4. How long we keep it
- Audio: 90 days, then deleted. Every recording carries an expiry date and a nightly job removes it from storage. We keep recordings this short on purpose — the transcript is what feedback is built from, and the audio has done its job long before then.
- Transcripts, essays, scores and progress: for as long as your account exists, because they are the record of your improvement.
- Everything: deleted when you delete your account.
5. Keystroke timing, in plain words
When you type in the studio we record the timing of your keystrokes. We use it for two things. The first is integrity: human typing has a characteristic unevenness, and pasted or scripted input does not, so this is how we tell whether a session was actually typed. The second is teaching — where your typing hesitates tends to be where the grammar is hard, and that is worth showing you.
We do not use keystroke timing to identify you, we do not compare it against other people to recognise you, and we do not share it. It is deleted with the rest of your data when you delete your account. We are telling you about it in its own section because a service that collects typing biometrics quietly deserves the story it eventually gets.
6. Who else processes your data
These are our sub-processors. Each one is here because the service cannot work without it, and each is bound to process data only on our instructions.
| Processor | What it does | Where |
|---|---|---|
| OpenAI | Speech recognition, conversation, and written feedback | United States |
| Supabase | Database, authentication, and audio storage | European Union |
| Paddle.com Market Ltd | Payments, invoicing, and tax as merchant of record | United Kingdom |
| Vercel | Application hosting and delivery | United States |
| Deepgram | Transcription of recorded speaking practice answers | United States |
Some of these are outside the UK and the European Economic Area. Where that is the case, transfers rely on the standard contractual clauses those providers publish.
7. Deleting your account
There is a button. It is in your account settings, it works immediately, and it removes your profile, your recordings, your transcripts, your essays and your progress. You do not have to email anyone and we do not try to talk you out of it.
One thing survives: a dated record that a deletion happened, with no personal data in it. We keep it because being able to prove we honoured a deletion request is part of honouring it.
8. Your rights
You can ask us for a copy of your data, ask us to correct it, ask us to delete it (or do it yourself, above), object to a particular use, or withdraw consent to recording — which will end access to speaking, since there is no speaking practice without a microphone. Write to [CONTACT EMAIL] and we will respond within thirty days. If we get it wrong, you can complain to your local data protection authority.
9. Children
You must be at least 16 to hold an account, and we enforce that at sign-up rather than asking you to confirm it. We do not knowingly collect data from anyone younger. If you are under 16 and studying with a school or centre, that organisation should contact us so parental consent can be handled properly; we are building that route and it is not open yet. If you believe a younger child holds an account, tell us and we will delete it.
10. Consent to record
Before your first speaking session we ask you to agree to being recorded. It is a separate, explicit step, it is never pre-ticked, and we log the date you agreed. You can withdraw it at any time under section 8.
11. Cookies
We set the cookies needed to keep you signed in, and nothing else. There is no advertising tracking and no third-party analytics cookie, which is why this site has never shown you a consent banner.
12. Changes
If we add a sub-processor, change what we collect, or change how long we keep it, we will update this page and its date, and tell registered users by email when the change is material.