Privacy Policy
This Privacy Policy explains how SayLuma ("SayLuma," "we," "us," or "our") handles information when you use the SayLuma English-learning service. SayLuma is intended for users age 13 and older.
1. Information we collect
Account information. We use your email address and authentication information to create and secure your SayLuma account. Password handling and authentication are provided through Supabase; SayLuma does not display or store your password in readable form.
Learning profile and progress. We may store your optional name, native language, English level, learning goal, accent preference, daily goal, selected tutor, interface preferences, saved vocabulary, completed practice sessions, lesson summaries, streak/progress information, and learning-path position.
Subscriptions and purchase information. On Android, Google Play processes your payment credentials directly. SayLuma does not receive card numbers, bank-account information, or Google payment credentials. SayLuma and RevenueCat process subscription and purchase status, entitlement information, product and base-plan identifiers, transaction and original-transaction identifiers, purchase, renewal, and expiration dates, refund or revocation state, price and currency where available, and related purchase-history information. We use this information for paid-feature access, subscription verification, support, fraud and security, and subscription-performance analytics.
Conversation and voice information. Text you type and recent conversation context are sent to our AI service so the tutor can respond. When you use the microphone, your recording is transmitted for speech-to-text processing. SayLuma does not intentionally keep raw microphone recordings after transcription. Tutor conversation transcripts are currently saved in your browser/device storage rather than in SayLuma's cloud database.
AI-response reports. If you report a tutor response, we store the report reason, your optional comment, the reported response (limited to 2,000 characters), a SHA-256 hash of the full response, and up to 500 characters of the immediately preceding message you sent. We also store the tutor, app/platform details, time, and your account identifier so we can investigate abuse and prevent report spam. We do not store the rest of the conversation with the report.
Usage and security information. We maintain limited AI-usage counters, and SayLuma and its providers may receive ordinary network and request metadata such as IP address, request timing, browser or device information, errors, and security events. SayLuma does not use this information to determine your physical location.
2. How we use information
We use information to authenticate users; provide personalized English practice; generate tutor replies, transcription, and speech; save vocabulary and progress across devices; review reported AI content; investigate safety or abuse issues; prevent reporting abuse or spam where appropriate; protect the service from excessive automated use; troubleshoot errors; provide account recovery; and comply with legal obligations.
3. AI processing and OpenAI
SayLuma uses OpenAI's API to provide AI tutor responses, speech transcription, and generated tutor voices. Before SayLuma first sends your text or voice-derived content to OpenAI, we ask for your explicit permission. Depending on the feature, information sent to OpenAI may include your message, limited recent conversation context, learning level and preferences, audio you submit for transcription, or tutor text that is converted to speech. You can review or revoke this permission from Profile. Revoking it prevents further AI tutoring transmissions unless you allow processing again.
OpenAI states that API inputs and outputs are not used to train its models by default unless the API customer explicitly opts in. OpenAI may retain certain API data for limited periods for safety, abuse monitoring, or service operation under its then-current policies. AI-response reports submitted through SayLuma are stored by SayLuma and are not sent to OpenAI.
4. Other service providers
Supabase provides account authentication, database storage, and Row Level Security for cloud learning data. Vercel hosts the web application and server-side functions. Resend helps deliver account and authentication emails. Google Play processes Android subscription purchases and payment credentials under its terms. RevenueCat validates purchases and processes subscription status, entitlement information, purchase history, and related identifiers on SayLuma's behalf. jsDelivr delivers the Supabase client library and may process ordinary connection metadata needed to provide that content. These providers process information as needed to provide their services and under their applicable privacy and security terms.
5. Local device storage
SayLuma uses browser storage to keep your signed-in session and an account-specific local copy of app state. In the current version, tutor conversation transcripts are stored locally on the device. You can use Clear conversation history on this device to remove local tutor transcripts. Clearing browser/site data may also remove local information.
6. Data sharing and selling
We do not sell your personal information. SayLuma does not currently use third-party advertising trackers or behavioral advertising. We disclose information to service providers described above, when you direct us to do so, or when reasonably necessary for security, fraud prevention, legal compliance, or protection of rights and safety.
7. Data retention
Cloud account and learning data, AI-consent records, and AI-response reports are generally kept while your account remains active. Local conversation history remains on your device until you clear it, delete the account through SayLuma on that device, clear browser storage, or remove the app/site data. Deleting your account removes your authentication account, cloud learning profile and associated cloud learning data and requests deletion of the corresponding RevenueCat customer and RevenueCat-held customer purchase information. SayLuma may retain limited de-linked billing transaction, security, fraud-prevention, accounting, payment-dispute, support, or legal audit records where reasonably necessary for those purposes. Provider logs, backups, and safety records may remain for limited periods under provider policies or where reasonably necessary for security or legal obligations.
8. Your choices and rights
You can edit profile information, export your current SayLuma data from the Profile screen, clear local conversation history, and permanently delete your SayLuma account and associated cloud learning data from Profile → Delete account and data. If you cannot access the app, you may request deletion through our public Delete Account page. Account deletion also removes SayLuma's local account data on the device where you perform the deletion. Deleting a SayLuma account does not cancel an active Google Play subscription or stop future Google Play renewals; you must manage or cancel that subscription separately through Google Play. If you later restore a valid purchase, RevenueCat may recreate subscription information needed to validate it. Depending on where you live, you may have additional privacy rights such as access, correction, deletion, portability, restriction, or objection.
9. Security
SayLuma uses authenticated API routes, Supabase Row Level Security, encrypted HTTPS connections, and server-side secrets for privileged actions such as account deletion. No online service can guarantee absolute security.
10. International processing
SayLuma and its service providers may process information in the United States and other countries. Data-protection laws may differ from those in your country. Where required, providers use contractual or other legal mechanisms for international data transfers.
11. Age requirements
SayLuma is intended for users age 13 and older and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that a child under 13 has created an account or provided personal information, we may delete the account and associated information. If you believe a child under 13 has used SayLuma, please contact us at privacy@sayluma.app.
12. Changes to this policy
We may update this Privacy Policy as SayLuma changes. Material changes will be reflected by updating the effective date and, when appropriate, by providing an additional notice in the service.
13. Contact
Privacy questions and privacy-rights requests may be sent to privacy@sayluma.app.
Speak your language. Learn English.