Privacy Policy
Effective July 21, 2026 · Version 2026-07-21
MostSpoken (“we”, “us”) is a language-learning app. This policy explains what personal data we process, why, the legal bases we rely on under the EU General Data Protection Regulation (GDPR), and the rights you have. Questions or requests: ruslan.shchuchkin@gmail.com.
Who is responsible for your data
The data controller for MostSpoken is the operator of this app, reachable at ruslan.shchuchkin@gmail.com. We decide how and why your personal data is processed.
What data we collect
- Account data. When you sign in with Google, we receive your email address and basic profile (name, avatar). We store a user identifier, your display name, and preferences (theme, native/target language, daily goal).
- Learning content and progress. Your chats with the AI teacher and practice partner, the words and grammar you study, mistakes and progress, spaced-repetition schedule, streaks, and personalization notes the teacher records to help you.
- Audio. Text-to-speech is generated for words and sentences; if you use voice replies, the recording is sent for transcription. We do not build a voiceprint.
- Technical data. Standard server logs (IP address, request metadata) generated by our hosting provider to deliver and secure the service.
Why we use it and our legal bases
- To provide the service — running lessons, tracking progress, remembering where you are. Legal basis: performance of a contract (Art. 6(1)(b)).
- To keep the service secure and working — logging, abuse prevention, debugging. Legal basis: legitimate interests (Art. 6(1)(f)).
- To generate audio and process voice replies you choose to send. Legal basis: performance of a contract, and your action initiates it.
We do not use your data for advertising, and we do not sell it.
Who we share it with (sub-processors)
We rely on the following processors, each bound by a data processing agreement. We share only what each needs to perform its function.
| Processor | Purpose | Location |
|---|---|---|
| Supabase | Database and authentication hosting (your account, learning data, chat transcripts) | European Union (Frankfurt, eu-central-1) |
| Vercel | Application hosting, serving, and content delivery | European Union region (configurable per deployment) |
| OpenRouter | Routing chat/lesson text to the language model that powers the teacher and practice partner | Routes to the model provider that serves the selected model (global routing; an EU-provider pin is available but not currently enabled) |
| OpenAI | Text-to-speech (word/sentence audio) and speech-to-text (voice replies); fallback text model | United States (EU data residency available; see docs/gdpr.md) |
| Google sign-in (OAuth) authentication | United States / global |
International transfers
Your account database and text (chat/lesson) processing are hosted in the European Union. Some processors (for example audio and Google sign-in) may process data in the United States. Where data leaves the EEA, transfers are covered by the European Commission’s Standard Contractual Clauses or an equivalent safeguard.
How long we keep it
We keep your account and learning data for as long as your account is active. When you delete your account, all of it is permanently removed from our database, and deletion propagates to our processors under their own retention terms. Server logs are retained by our hosting provider for a short period for security and diagnostics.
Your rights
Under the GDPR you can:
- Access & portability — download a copy of your data.
- Erasure — delete your account and all associated data.
- Rectification — correct your profile details.
- Restriction & objection — limit or object to certain processing.
- Withdraw consent — where processing relies on consent.
- Complain — to your local data protection authority.
You can export or delete your data yourself from your profile, or contact us at ruslan.shchuchkin@gmail.com.
Children
MostSpoken is not directed to children under 16. We do not knowingly collect their data; if you believe a child has provided us data, contact us and we will delete it.
Changes to this policy
We may update this policy. Material changes bump the version above, and continued use after an update constitutes acceptance of the revised policy.
See also our Terms of Service.