Privacy Policy

Information You Provide:

• Account details: name, email, password, authentication credentials
• Profile information: native language, target language, proficiency level, learning goals
• Learning interactions: exercise submissions, challenge responses, AI tutor chat inputs
• Support inquiries, feedback, and problem reports

Automatically Collected Information:

• Usage metrics: feature interactions, course progress, practice session duration
• Device information: device model, operating system version, client identifiers
• Diagnostic and log data: IP address, access timestamps, screen views, crash telemetry
• Authentication tokens and local device preferences

Microphone and Voice Data: The App requests microphone permission to enable the speech practice and interactive voice conversation features. We do not permanently record, store, or sell your voice audio recordings. Voice audio streams are transmitted over encrypted connections and processed in transient memory (RAM) in real time solely to generate transcriptions, evaluate pronunciation, and provide pedagogical feedback. Ephemeral audio buffers created during active sessions are disposed of when the session terminates. For platform-managed sessions, voice data is strictly excluded from foundation model training. Where a user voluntarily configures their own personal third-party API key in the App settings, data handling and model training policies are governed by their direct agreement with the key provider.

We do not sell personal data. We share necessary data with vetted service providers who operate under strict confidentiality and data protection obligations:

AI Model Providers & Processing Infrastructure:

• Platform-Managed AI (Google Cloud): When using Edyssey's platform infrastructure (including for Premium subscribers and platform-allocated capacity), natural language tutoring, translations, and speech evaluation are processed via enterprise Google Cloud services (Gemini API) under binding Data Processing Agreements (DPA). In accordance with enterprise terms, your personal data, prompts, conversational interactions, and voice inputs are never used to train, retrain, or improve Google's base or public foundation models.
• User-Supplied API Keys (BYOK): If you voluntarily elect to configure your own personal third-party API key (such as a Google AI Studio key) in the App settings, requests initiated with your key are transmitted directly to the third-party provider under your own developer account and project privacy settings. Data processing, privacy safeguards, and potential model training for user-supplied keys are governed independently by your direct agreement with the third-party provider.

App Distribution & Payment Processors: Apple Inc. (Apple App Store) and Google LLC (Google Play Store) provide authentication mechanisms and process all subscription transactions and in-app purchases. We do not store full credit card numbers or financial credentials on our servers.

Cloud Infrastructure & Hosting: DigitalOcean and cloud hosting providers for secure database hosting, distributed session caching, and backend API routing located within secure data centers.

Usage Analytics (Google Firebase): App interaction events and platform metadata are sent to Google Firebase Analytics to measure how the App is used.

Legal & Statutory Compliance: We may disclose information if required by applicable law, subpoena, or valid regulatory process, or to protect the rights, property, and safety of our users and the public.

How AI Profiling Works: To adapt to each learner's unique pace, Edyssey utilizes automated pedagogical profiling, including Token-Level Memory, mistake pattern tracking ("UserWeakSpot"), and conversational interest signals. These automated evaluations are designed exclusively for educational personalization and do not produce legal or similarly significant effects under GDPR Article 22.

Right to Clear AI Memory (GDPR Art. 17 & 21): Under GDPR Articles 17 ("Right to Erasure") and 21 ("Right to Object"), you have the absolute right to purge your automated AI learning profile without deleting your user account.

You can exercise this right at any time directly inside the App by opening Profile → Clear AI Memory. Activating this feature permanently and irreversibly erases:

• All AI tutor conversation history and chat logs
• All AI-inferred grammar, vocabulary, and pronunciation mistake patterns (weak spots)
• All adaptive learning steering signals and course context summaries
• In-flight speech practice transcriptions and dialogue feedback records

Clearing AI memory resets your AI personalization to a fresh baseline while safely preserving your account credentials, curriculum completion progress, earned XP, streaks, and active subscriptions.

We retain your personal data only as long as necessary to provide our services, maintain your educational progress records, and fulfill legal or accounting obligations.

You may request permanent deletion of your complete account and all associated personal data at any time via Profile → Delete Account in the App or by emailing legal@edyssey.app. Upon account deletion, all personal identifiers, credentials, and progress records are permanently purged after a 7-day grace period.

If you reside in the European Economic Area (EEA), United Kingdom, or jurisdictions with comparable data protection frameworks, you have the following rights:

• Right of Access (Art. 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): Request correction of inaccurate personal data.
• Right to Erasure (Art. 17): Request full account deletion or selective AI memory clearance.
• Right to Restriction (Art. 18): Restrict processing of your personal data under certain conditions.
• Right to Data Portability (Art. 20): Receive your data in a structured, commonly used format.
• Right to Object (Art. 21): Object to automated profiling or legitimate interest processing.
• Right to Withdraw Consent (Art. 7): Revoke previously granted permissions (e.g. microphone access) at any time.

To exercise any of these rights, contact our Data Protection team at legal@edyssey.app.

Supervisory Authority: You have the right to lodge a complaint with your local data protection authority or with our lead supervisory authority in Estonia:
Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)
Tatari 39, 10134 Tallinn, Estonia
Email: info@aki.ee | Website: www.aki.ee

We implement industry-standard technical and organizational security measures, including transport-layer encryption (TLS 1.3), encrypted storage, cryptographic token authentication, strict role-based access controls, and distributed database isolation. However, no internet transmission or electronic storage is completely infallible, and absolute security cannot be guaranteed.

In accordance with Article 8 of the GDPR and § 8 of the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus), the App is intended exclusively for individuals aged 13 years and older. We do not knowingly collect or solicit personal data from children under the age of 13. If we become aware that an individual under 13 has registered without verified parental consent, we will take immediate steps to delete their account and associated data.

We may update this Privacy Policy from time to time to reflect evolving regulatory requirements or architectural changes. If modifications are material, we will provide at least 30 days' advance notice through in-app banners, push notifications, or email before the revisions take effect. Continued use of the App following the effective date constitutes agreement to the updated policy.

For any questions, data subject requests, or compliance inquiries, please contact:

ReactLab OÜ (Registry code: 17276611)
Data Protection & Legal Affairs
Email: legal@edyssey.app