Privacy Policy

Effective date: November 8, 2026

1. What We Collect

When you use Vocly, we collect the following information:

• Account information: Your email address and display name when you sign in with Google or Apple.
• Guest accounts: You can use Vocly without signing in. The app then creates an anonymous guest account (an anonymous Firebase account with a random account ID, no email and no name). Your moments, lessons and learning data are saved on our servers under that guest account. Because a guest account has no sign-in, it cannot be opened again on a new phone; you can connect it to Apple or Google at any time to keep your data and use it on other devices. If you delete a guest account, its data is deleted.
• Beta access information: If you request early access, we collect your email address and chosen language, plus any optional name, social profile, discovery source, or first-moment note you provide.
• Pricing suggestions: If you send pricing feedback, we collect your suggested monthly amount and currency, optional comments, and an optional email address for follow-up. We use a hashed network address to limit repeated submissions.
• User-generated content: The stories, memories, and scenarios you enter into the app to generate language lessons.
• Photos: The Vocly app does not ask for, read or upload photos from your device. Pictures in your lessons are illustrations that Vocly creates from the words of your moment; they are not your own photos. Older versions of the app allowed a photo cover on a moment. Any such photo you added earlier remains private to your account and is deleted when you delete your account.
• Voice recordings: If you dictate a moment, practise pronunciation or send a voice message to the Lina conversation coach, the recording is sent to our servers and to OpenAI to transcribe it or give pronunciation feedback, but only after you have agreed to AI processing in the app. Vocly's servers do not save the recording after the request is processed. What OpenAI keeps, and for how long, is set by OpenAI's API data policy (see section 3). You can read what is shared, and withdraw your agreement, under Settings → AI & your data.
• Lina conversation coach: The messages you send to the Lina coach, and the text of your lessons, are sent to OpenAI to write Lina's replies. Lina is an AI, not a person, and can make mistakes.
• Community sharing: If you choose to share a moment to Community, its title, story, words and phrases, and your display name are visible to other Vocly users. Your personal photo is not shared. You can unshare at any time.
• Games: If you play VO-NO or Fastest Fingers with other people, they see your display name, profile picture and scores. At a VO-NO table, each player also shares up to 30 words they have learned (the word and its meaning, never stories or photos). Only people at the same table can see them. Games against practice bots are not shown to anyone else.
• Learning data: Your vocabulary progress, practice scores, review history, and language preferences.
• Voice preferences: Your selected voice and speech speed settings (stored locally on your device).
• Usage data: Basic app and website usage analytics to help us improve the experience, such as which screens and first-run steps are used. This includes the general type of device and browser you use (for example iPhone, Android or desktop). Analytics use a random session identifier that Vocly creates; we do not read your device's advertising identifier or serial number. When you are signed in, usage events can be linked to your account.
• Mobile notifications and device identifier: If you enable notifications, we store your notification settings (sound preference, timezone and, for learners who chose them earlier, days), plus a Vocly device installation identifier and a push token for that phone, linked to your account. Notification opens, daily-card views and practice activity are linked to your account and used to avoid redundant reminders, to keep notifications working, and to understand which features are useful. We use this identifier for these purposes only and not for advertising or tracking. Notifications need a connected (not guest) account.
• Home-screen widget (iPhone): If you add the Vocly widget, the app writes your streak, a word of the day taken from your own moments (or an everyday word), the title of that moment and, if you gave one, your first name to storage on your phone that only the widget can read. This information stays on your device and is not sent to us by the widget.

2. How We Use Your Data

We use your information to:

• Create personalized language lessons from your stories using AI (OpenAI).
• Generate pronunciation audio for vocabulary and phrases, and reply to you in the Lina conversation coach.
• Track your learning progress and schedule reviews using spaced repetition.
• Improve the app experience and fix bugs.
• Review pricing suggestions and, if you provide an email address, follow up about your feedback. Sending a suggestion does not subscribe you to marketing emails.
• Administer the private beta, send installation instructions, and request relevant product feedback when you consent to beta emails.
• Send opted-in mobile notifications about available daily inspiration, due practice or genuine speaking invitations, and diagnose notification-provider failures.

3. Third-Party Services

Vocly uses the following third-party services:

• Firebase (Google): Authentication (including anonymous guest accounts), database (Firestore), file storage and cloud functions. Firebase Privacy Policy
• Resend: Delivers transactional emails, including pricing feedback notifications to the Vocly team.
• OpenAI: AI-powered lesson generation, practice questions, the Lina conversation coach, speech-to-text, pronunciation feedback, image generation and content moderation. Your stories, messages and (for dictation and pronunciation) voice recordings are sent to OpenAI's API to generate vocabulary, phrases, translations, practice and replies, and stories you choose to share to Community are checked by OpenAI's moderation service before they are shown to others. OpenAI Privacy Policy
• ElevenLabs: Pronunciation audio. Words, phrases and story text are sent to ElevenLabs to create spoken audio, plus short descriptions used to create optional background sounds. ElevenLabs Privacy Policy
• Apple and Google (speech recognition): Live dictation in the app can use your phone's own speech recognition service (Apple on iPhone, Google on Android). That audio is handled by Apple or Google under their terms and is not sent to Vocly by that service.
• Stripe (website subscriptions only): The Vocly app contains no purchases. Some accounts can start a paid subscription on the Vocly website, which is processed by Stripe; Stripe receives your payment details and email address and we receive your subscription status. We do not see or store your card number. Stripe Privacy Policy
• Google Sign-In / Apple Sign-In: For account authentication. If you signed in with Apple, deleting your account asks you to confirm with Apple once more; we use that confirmation only to revoke Vocly's access with Apple, and do not keep Apple's token afterwards.
• Expo Push Service, Apple Push Notification service and Firebase Cloud Messaging: Route opted-in mobile notifications to registered devices. Notifications do not include the private text of your memories.

4. Data Storage & Security

Your data is stored securely in Google Firebase (Firestore) with the following protections:

• All data is encrypted in transit (HTTPS/TLS) and at rest.
• Firestore security rules ensure users can only access their own data.
• Authentication tokens are required for all API requests.
• Voice preferences are stored on your device. Pronunciation audio is cached so it plays quickly (see section 7).

5. What We Do NOT Collect

• We do not collect your location data.
• We do not collect your contacts or phone number.
• We do not use your camera, and the app does not access your photo library or your files.
• We do not track you across other apps or websites.
• We do not sell, rent, or share your personal data with advertisers.

6. Microphone & Speech Recognition

Vocly requests microphone access only when you choose to speak: to dictate a moment or to practise pronunciation.

• Live dictation can use your device's speech recognition service (Apple on iPhone, Google on Android), under that provider's terms.
• Voice input and pronunciation practice send your recording to our servers and to OpenAI for transcription or feedback, after you have agreed to AI processing. Vocly's servers do not save the recording after the request is processed.
• The microphone is used only while you are recording. Vocly does not record in the background.

7. Data Retention & Deletion

Your data is retained as long as your account is active. You can:

• Delete individual memories: Remove specific stories and their associated vocabulary from within the app.
• Delete your account: In the Vocly app, tap your profile icon, open Settings and tap Delete my account (this works for guest and signed-in accounts). Or email us at the address below to request deletion. Your account, moments, lessons and learning data are deleted within 30 days.
• Shared pronunciation audio: So the same audio isn’t created twice, Vocly keeps a shared cache of generated pronunciation audio for words, phrases and sentences. Cache files are named by a code derived from the text and voice, are not linked to your account, and stay in the cache after you delete your account. Audio created only for your account is deleted with it.
• Sign in with Apple: Deleting your account removes it and its data from Vocly. You can also remove Vocly from your Apple ID under Settings > your name > Sign-In & Security > Sign in with Apple.
• Leave the beta list: Reply to a beta email or contact us to stop beta communication and request deletion of your beta signup information.

8. Children's Privacy

Vocly is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or by email. Continued use of Vocly after changes constitutes acceptance of the updated policy.

10. Contact Us

If you have questions about this Privacy Policy or want to request data deletion, contact us at:

Email: support@vocly.my