🔒 Privacy Policy

Kelmet is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and protect your personal information when you use our mobile application (the "App") on iOS and Android.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address (required for all registration methods)
• Username (required for email sign-up only)
• Password (only for email sign-up; stored as a salted hash using bcrypt)
• Profile information (optional)
• Learning preferences and progress (automatically tracked)

Registration Methods

You can create an account using:

1. Google Sign-In - We receive: email, name
2. Apple Sign-In (iOS only) - We receive: email (or private relay), name (optional)
3. Email + Password - You provide: email, username, password

Email Verification

• Email verification is NOT required to use the App or receive your 20 free AI Credits.
• If we introduce email verification in the future, we will update this Privacy Policy and explain why it is needed.

1.2 Usage Data

To provide the learning service and protect it against abuse, we collect operational data such as:

• Lesson completion and progress
• Exercise results and scores
• Learning statistics and milestones
• Activity needed to provide app features and maintain learning progress; optional product usage Analytics is described separately below.
• Device information (type, OS version)
• IP address (for security purposes, fraud prevention, and abuse detection)

Optional Usage Analytics (Consent-Based)

1.3 Audio Recordings

1.4 Purchase Information

Through Apple's In-App Purchase system (iOS) and Google Play Billing (Android):

• Subscription status
• Purchase history (as reflected by Apple / StoreKit or Google Play Billing)
• AI Credits balance (including free credits and purchased credits)
• Note: Payment details are handled exclusively by Apple or Google and never shared with us

2. How We Use Your Information

2.1 Core App Functionality

• Manage your account (required for App access)
• Provide personalized language learning experience
• Track your progress and adapt content to your level
• Save your exercise results and learning statistics
• Manage your subscription (if applicable)
• Process AI Credit purchases and usage
• Distribute 20 free AI Credits to new users
• Sync your learning data across devices

2.2 AI-Powered Features

• Pronunciation analysis: Audio → Azure Speech-to-Text → Gemini AI feedback
• Image description analysis: Your text → Gemini AI evaluation
• Open question responses: Your text → Gemini AI correction
• Role-play conversations: Your responses → Gemini AI dialogue management
• All AI processing is done without permanently storing your audio recordings

2.3 Communication

• Send lesson reminders and learning tips (only if you allow notifications where applicable)
• Important updates about the service
• Customer support responses

2.4 Optional Analytics and Campaign Measurement

• Kelmet uses Firebase Analytics, provided by Google, for optional usage statistics after you give consent.
• Our Firebase / Google Analytics project is linked to Google Ads for campaign measurement. This link does not give permission to use iOS Analytics data for personalized advertising or tracking across other companies’ apps and websites.
• For the updated iOS release, advertising storage, advertising user data, and advertising personalization permissions remain disabled in the Analytics configuration, including when you allow usage statistics.
• For iOS campaigns, we may use Apple’s privacy-preserving attribution system, SKAdNetwork, where configured and supported, to receive campaign attribution signals without collecting the IDFA. Availability and detail depend on Apple’s privacy thresholds and reporting windows; this does not provide individual user tracking.
• Kelmet does not display advertisements inside the app or use Analytics data for personalized advertising.
• We do not sell your personal data to third parties.
• Withdrawing Analytics consent disables further optional Analytics collection. Data necessary to operate your account, learning progress, and purchases continues to be processed.

3. Third-Party Services

3.1 Microsoft Azure Speech-to-Text

• Purpose: Convert audio recordings to text for pronunciation analysis
• Data shared: Temporary audio files (deleted after processing)
• Privacy / Security info: Microsoft Azure Speech-to-Text Data Privacy & Security

3.2 Google Gemini

• Purpose: Analyze language learning exercises and provide personalized feedback
• Data shared: User responses, exercise context, and (for pronunciation) the text output needed to generate feedback
• Privacy info: Google Gemini Privacy Information
• Note: We use Gemini to generate feedback for learning. Your content is sent to Google for processing as part of providing this feature, subject to Google's applicable terms for the services we use.

3.3 Google Cloud Platform (GCP)

• Purpose: Backend infrastructure, database, and storage required to run the App
• Compliance: We use GDPR-aligned infrastructure and apply appropriate safeguards for international transfers where required.

3.4 Apple In-App Purchases (iOS)

• Purpose: Process subscriptions and AI Credit purchases on iOS
• Data handling: All payment processing is handled by Apple. We do not receive your full payment card details.

3.5 Google Play Billing (Android)

• Purpose: Process subscriptions and AI Credit purchases on Android
• Data handling: All payment processing is handled by Google Play. We do not receive your full payment card details.
• Privacy Policy: Google Privacy Policy

3.6 RevenueCat

• Purpose: Subscription and in-app purchase management (e.g., entitlement status, purchase events, restoring purchases) on both iOS and Android
• Data shared: App user identifier (internal), subscription/purchase status, and related purchase events needed to provide access to paid features
• Privacy Policy: RevenueCat Privacy Policy

3.7 Apple Sign-In & Google Sign-In

• Purpose: Authentication and account creation
• Data shared: Email and name (as described in Section 1.1)
• Apple Privacy: Apple Privacy Policy
• Google Privacy: Google Privacy Policy

3.8 Firebase Analytics and Google Ads

4. Data Retention

4.1 Active Accounts

• We retain your account and learning data as long as your account is active
• Learning progress and history are preserved for educational continuity

4.2 Audio Recordings

• Audio recordings are deleted immediately after processing
• We do not permanently store your audio recordings
• We do not store speech-to-text transcriptions produced from your audio
• We may store non-audio learning outcomes (e.g., completion status, scores, feedback summaries) as part of your progress history

4.3 Security Logs

• We may retain limited security logs (including IP address and device/OS information) for abuse prevention, troubleshooting, and security.
• These logs are kept only as long as needed and are typically retained for up to 90 days, unless a longer retention period is required to investigate abuse or comply with legal obligations.

4.4 Analytics Data

• Optional Analytics data is collected only with your consent. User-level and event-level data subject to the Google Analytics retention setting is retained for the configured period, up to 14 months, and then subject to Google Analytics’ automatic deletion process.
• Identifier retention may be renewed by new activity if the corresponding setting is enabled. Standard aggregated reports are not subject to the same retention setting and may be retained longer for historical trends.
• Withdrawing consent stops further optional Analytics collection; it does not automatically erase previously collected data. You can request deletion by contacting info@kelmet.app.

4.5 Account Deletion

• You can delete your account at any time in-app: Profile → Delete account
• You can also request account deletion via: info@kelmet.app
• All personal data will be permanently deleted within 30 days after deletion is requested/confirmed
• This includes your AI Credit balance
• Note: Apple and Google may retain purchase records in your account history on their respective stores. We do not control their retention of purchase records.

5. Data Security

• Encryption in transit: All data is transmitted via HTTPS/TLS
• Encryption at rest: Database encryption on Google Cloud Platform
• Password protection: Passwords are hashed and salted (bcrypt) for email sign-up
• Access controls: Role-based access to backend systems

6. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the right to:

• Access: Request a copy of all personal data we hold about you
• Rectification: Correct inaccurate or incomplete personal data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Portability: Receive your data in a structured format
• Restriction / Objection: Restrict or object to certain processing in specific cases
• Withdraw consent: For processing based on consent (e.g., optional Analytics), you can withdraw your consent at any time in Profile → Privacy, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise your rights, contact us at: info@kelmet.app

You also have the right to lodge a complaint with your local data protection authority.

7. Children's Privacy

• Kelmet is intended for users aged 13 and above
• We do not knowingly collect personal data from children under 13

8. International Data Transfers

• Your data may be processed on servers located in the EU and/or other countries where our service providers operate
• We use Google Cloud Platform and apply appropriate safeguards for international data transfers where required (for example, Standard Contractual Clauses)

9. Changes to This Policy

• We may update this Privacy Policy from time to time
• We will notify you of significant changes via email or in-app notification

10. Legal Basis for Processing (GDPR)

• Contract Performance: Account creation and data processing are necessary to provide the learning service
• Legitimate Interest: Ensuring service security, preventing abuse and fraud, and necessary operational troubleshooting. This does not replace consent for optional Analytics
• Consent: Using optional features like pronunciation exercises, AI feedback, notifications (where applicable), and optional usage statistics via Firebase Analytics. Advertising measurement on Android is subject to the applicable consent and device settings. Consent can be withdrawn at any time.

11. Contact Us

For any questions about this Privacy Policy or your data: