🔒 Privacy Policy

Kelmet is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and protect your personal information when you use our mobile application (the “App”).

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address (required for all registration methods)
• Username (required for email sign-up only)
• Password (only for email sign-up; stored as a salted hash using bcrypt)
• Profile information (optional)
• Learning preferences and progress (automatically tracked)

Registration Methods

You can create an account using:

1. Google Sign-In - We receive: email, name
2. Apple Sign-In - We receive: email (or private relay), name (optional)
3. Email + Password - You provide: email, username, password

Email Verification

• Email verification is NOT required to use the App or receive your 20 free IA Credits.
• If we introduce email verification in the future, we will update this Privacy Policy and explain why it is needed.

1.2 Usage Data

We automatically collect:

• Lesson completion and progress
• Exercise results and scores
• Learning statistics and milestones
• App usage patterns (for product functionality and improvement)
• Device information (type, OS version)
• IP address (for security purposes, fraud prevention, and abuse detection)

1.3 Audio Recordings

1.4 Purchase Information

Through Apple's In-App Purchase system:

• Subscription status
• Purchase history (as reflected by Apple / StoreKit)
• IA Credits balance (including free credits and purchased credits)
• Note: Payment details are handled exclusively by Apple and never shared with us

2. How We Use Your Information

2.1 Core App Functionality

• Manage your account (required for App access)
• Provide personalized language learning experience
• Track your progress and adapt content to your level
• Save your exercise results and learning statistics
• Manage your subscription (if applicable)
• Process IA Credit purchases and usage
• Distribute 20 free IA Credits to new users
• Sync your learning data across devices

2.2 AI-Powered Features

• Pronunciation analysis: Audio → Azure Speech-to-Text → Gemini AI feedback
• Image description analysis: Your text → Gemini AI evaluation
• Open question responses: Your text → Gemini AI correction
• Role-play conversations: Your responses → Gemini AI dialogue management
• All AI processing is done without permanently storing your audio recordings

2.3 Communication

• Send lesson reminders and learning tips (only if you allow notifications where applicable)
• Important updates about the service
• Customer support responses

2.4 No Advertising Tracking

• Kelmet does not use the IDFA for advertising.
• Kelmet does not track you across apps and websites for advertising purposes.
• We do not sell your personal data.

3. Third-Party Services

3.1 Microsoft Azure Speech-to-Text

• Purpose: Convert audio recordings to text for pronunciation analysis
• Data shared: Temporary audio files (deleted after processing)
• Privacy / Security info: Microsoft Azure Speech-to-Text Data Privacy & Security

3.2 Google Gemini

• Purpose: Analyze language learning exercises and provide personalized feedback
• Data shared: User responses, exercise context, and (for pronunciation) the text output needed to generate feedback
• Privacy info: Google Gemini Privacy Information
• Note: We use Gemini to generate feedback for learning. Your content is sent to Google for processing as part of providing this feature, subject to Google’s applicable terms for the services we use.

3.3 Google Cloud Platform (GCP)

• Purpose: Backend infrastructure, database, and storage required to run the App
• Compliance: We use GDPR-aligned infrastructure and apply appropriate safeguards for international transfers where required.

3.4 Apple In-App Purchases

• Purpose: Process subscriptions and IA Credit purchases
• Data handling: All payment processing is handled by Apple. We do not receive your full payment card details.

3.5 RevenueCat

• Purpose: Subscription and in-app purchase management (e.g., entitlement status, purchase events, restoring purchases)
• Data shared: App user identifier (internal), subscription/purchase status, and related purchase events needed to provide access to paid features
• Privacy Policy: RevenueCat Privacy Policy

3.6 Apple Sign-In & Google Sign-In

• Purpose: Authentication and account creation
• Data shared: Email and name (as described in Section 1.1)
• Apple Privacy: Apple Privacy Policy
• Google Privacy: Google Privacy Policy

4. Data Retention

4.1 Active Accounts

• We retain your account and learning data as long as your account is active
• Learning progress and history are preserved for educational continuity

4.2 Audio Recordings

• Audio recordings are deleted immediately after processing
• We do not permanently store your audio recordings
• We do not store speech-to-text transcriptions produced from your audio
• We may store non-audio learning outcomes (e.g., completion status, scores, feedback summaries) as part of your progress history

4.3 Security Logs

• We may retain limited security logs (including IP address and device/OS information) for abuse prevention, troubleshooting, and security.
• These logs are kept only as long as needed and are typically retained for up to 90 days, unless a longer retention period is required to investigate abuse or comply with legal obligations.

4.4 Account Deletion

• You can delete your account at any time in-app: Profile → Delete account
• You can also request account deletion via: info@kelmet.app
• All personal data will be permanently deleted within 30 days after deletion is requested/confirmed
• This includes your IA Credit balance
• Note: Apple may retain purchase records in your Apple account history. We do not control Apple’s retention of purchase records.

5. Data Security

• Encryption in transit: All data is transmitted via HTTPS/TLS
• Encryption at rest: Database encryption on Google Cloud Platform
• Password protection: Passwords are hashed and salted (bcrypt) for email sign-up
• Access controls: Role-based access to backend systems

6. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the right to:

• Access: Request a copy of all personal data we hold about you
• Rectification: Correct inaccurate or incomplete personal data
• Erasure: Request deletion of your personal data (“right to be forgotten”)
• Portability: Receive your data in a structured format
• Restriction / Objection: Restrict or object to certain processing in specific cases

To exercise your rights, contact us at: info@kelmet.app

You also have the right to lodge a complaint with your local data protection authority.

7. Children's Privacy

• Kelmet is intended for users aged 13 and above
• We do not knowingly collect personal data from children under 13

8. International Data Transfers

• Your data may be processed on servers located in the EU and/or other countries where our service providers operate
• We use Google Cloud Platform and apply appropriate safeguards for international data transfers where required (for example, Standard Contractual Clauses)

9. Changes to This Policy

• We may update this Privacy Policy from time to time
• We will notify you of significant changes via email or in-app notification

10. Legal Basis for Processing (GDPR)

• Contract Performance: Account creation and data processing are necessary to provide the learning service
• Legitimate Interest: Improving our service and ensuring security (e.g., preventing abuse/fraud)
• Consent: Using optional features like pronunciation exercises, AI feedback, and (where applicable) notifications

11. Contact Us

For any questions about this Privacy Policy or your data: