🔒 Privacy Policy

Kelmet is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and protect your personal information when you use our mobile application (the "App") on iOS and Android.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address (required for all registration methods)
• Username (required for email sign-up only)
• Password (only for email sign-up; stored as a salted hash using bcrypt)
• Profile information (optional)
• Learning preferences and progress (automatically tracked)

Registration Methods

You can create an account using:

1. Google Sign-In - We receive: email, name
2. Apple Sign-In (iOS only) - We receive: email (or private relay), name (optional)
3. Email + Password - You provide: email, username, password

Email Verification

• Email verification is NOT required to use the App or receive your 20 free AI Credits.
• If we introduce email verification in the future, we will update this Privacy Policy and explain why it is needed.

1.2 Usage Data

We automatically collect:

• Lesson completion and progress
• Exercise results and scores
• Learning statistics and milestones
• App usage patterns (for product functionality and improvement)
• Device information (type, OS version)
• IP address (for security purposes, fraud prevention, and abuse detection)

Anonymous Usage Analytics (Consent-Based)

1.3 Audio Recordings

1.4 Purchase Information

Through Apple's In-App Purchase system (iOS) and Google Play Billing (Android):

• Subscription status
• Purchase history (as reflected by Apple / StoreKit or Google Play Billing)
• AI Credits balance (including free credits and purchased credits)
• Note: Payment details are handled exclusively by Apple or Google and never shared with us

2. How We Use Your Information

2.1 Core App Functionality

• Manage your account (required for App access)
• Provide personalized language learning experience
• Track your progress and adapt content to your level
• Save your exercise results and learning statistics
• Manage your subscription (if applicable)
• Process AI Credit purchases and usage
• Distribute 20 free AI Credits to new users
• Sync your learning data across devices

2.2 AI-Powered Features

• Pronunciation analysis: Audio → Azure Speech-to-Text → Gemini AI feedback
• Image description analysis: Your text → Gemini AI evaluation
• Open question responses: Your text → Gemini AI correction
• Role-play conversations: Your responses → Gemini AI dialogue management
• All AI processing is done without permanently storing your audio recordings

2.3 Communication

• Send lesson reminders and learning tips (only if you allow notifications where applicable)
• Important updates about the service
• Customer support responses

2.4 Advertising & Analytics (With Consent)

• Kelmet uses Firebase Analytics (provided by Google LLC) and Google Ads conversion tracking to measure how users discover and engage with the app, and to optimize our advertising campaigns.
• This tracking requires your explicit consent, which we request at first launch of the app.
• Kelmet does not use your data for advertising personalization or to display ads within the app.
• Kelmet does not track you across third-party apps and websites for advertising purposes.
• We do not sell your personal data to any third party.
• You can withdraw your consent at any time in Profile → Privacy. When you withdraw consent, all analytics tracking stops immediately.

3. Third-Party Services

3.1 Microsoft Azure Speech-to-Text

• Purpose: Convert audio recordings to text for pronunciation analysis
• Data shared: Temporary audio files (deleted after processing)
• Privacy / Security info: Microsoft Azure Speech-to-Text Data Privacy & Security

3.2 Google Gemini

• Purpose: Analyze language learning exercises and provide personalized feedback
• Data shared: User responses, exercise context, and (for pronunciation) the text output needed to generate feedback
• Privacy info: Google Gemini Privacy Information
• Note: We use Gemini to generate feedback for learning. Your content is sent to Google for processing as part of providing this feature, subject to Google's applicable terms for the services we use.

3.3 Google Cloud Platform (GCP)

• Purpose: Backend infrastructure, database, and storage required to run the App
• Compliance: We use GDPR-aligned infrastructure and apply appropriate safeguards for international transfers where required.

3.4 Apple In-App Purchases (iOS)

• Purpose: Process subscriptions and AI Credit purchases on iOS
• Data handling: All payment processing is handled by Apple. We do not receive your full payment card details.

3.5 Google Play Billing (Android)

• Purpose: Process subscriptions and AI Credit purchases on Android
• Data handling: All payment processing is handled by Google Play. We do not receive your full payment card details.
• Privacy Policy: Google Privacy Policy

3.6 RevenueCat

• Purpose: Subscription and in-app purchase management (e.g., entitlement status, purchase events, restoring purchases) on both iOS and Android
• Data shared: App user identifier (internal), subscription/purchase status, and related purchase events needed to provide access to paid features
• Privacy Policy: RevenueCat Privacy Policy

3.7 Apple Sign-In & Google Sign-In

• Purpose: Authentication and account creation
• Data shared: Email and name (as described in Section 1.1)
• Apple Privacy: Apple Privacy Policy
• Google Privacy: Google Privacy Policy

3.8 Firebase Analytics & Google Ads (Consent-Based)

4. Data Retention

4.1 Active Accounts

• We retain your account and learning data as long as your account is active
• Learning progress and history are preserved for educational continuity

4.2 Audio Recordings

• Audio recordings are deleted immediately after processing
• We do not permanently store your audio recordings
• We do not store speech-to-text transcriptions produced from your audio
• We may store non-audio learning outcomes (e.g., completion status, scores, feedback summaries) as part of your progress history

4.3 Security Logs

• We may retain limited security logs (including IP address and device/OS information) for abuse prevention, troubleshooting, and security.
• These logs are kept only as long as needed and are typically retained for up to 90 days, unless a longer retention period is required to investigate abuse or comply with legal obligations.

4.4 Analytics Data

• If you consent to analytics, Firebase Analytics retains event-level data for up to 14 months by default, then automatically deletes it.
• Aggregated reports (without individual user identification) may be retained longer for historical trends.

4.5 Account Deletion

• You can delete your account at any time in-app: Profile → Delete account
• You can also request account deletion via: info@kelmet.app
• All personal data will be permanently deleted within 30 days after deletion is requested/confirmed
• This includes your AI Credit balance
• Note: Apple and Google may retain purchase records in your account history on their respective stores. We do not control their retention of purchase records.

5. Data Security

• Encryption in transit: All data is transmitted via HTTPS/TLS
• Encryption at rest: Database encryption on Google Cloud Platform
• Password protection: Passwords are hashed and salted (bcrypt) for email sign-up
• Access controls: Role-based access to backend systems

6. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the right to:

• Access: Request a copy of all personal data we hold about you
• Rectification: Correct inaccurate or incomplete personal data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Portability: Receive your data in a structured format
• Restriction / Objection: Restrict or object to certain processing in specific cases
• Withdraw consent: For processing based on consent (e.g., analytics tracking), you can withdraw your consent at any time in Profile → Privacy, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise your rights, contact us at: info@kelmet.app

You also have the right to lodge a complaint with your local data protection authority.

7. Children's Privacy

• Kelmet is intended for users aged 13 and above
• We do not knowingly collect personal data from children under 13

8. International Data Transfers

• Your data may be processed on servers located in the EU and/or other countries where our service providers operate
• We use Google Cloud Platform and apply appropriate safeguards for international data transfers where required (for example, Standard Contractual Clauses)

9. Changes to This Policy

• We may update this Privacy Policy from time to time
• We will notify you of significant changes via email or in-app notification

10. Legal Basis for Processing (GDPR)

• Contract Performance: Account creation and data processing are necessary to provide the learning service
• Legitimate Interest: Improving our service and ensuring security (e.g., preventing abuse/fraud)
• Consent: Using optional features like pronunciation exercises, AI feedback, notifications (where applicable), and anonymous usage analytics via Firebase Analytics and Google Ads conversion tracking. Consent can be withdrawn at any time.

11. Contact Us

For any questions about this Privacy Policy or your data: