Privacy Policy
Last updated: October 29, 2026
SkyLingoSift ("the app," "the Service") is operated by Purple Hardstone LLC, a Georgia limited liability company (5555 Whittlesey Blvd Suite 1200 #1145, Columbus, GA 31909, United States) ("we," "us," or "our"). This policy explains what personal data the Service handles, why, and what rights you have over it. For residents of the European Economic Area, the UK, or Switzerland, Purple Hardstone LLC acts as the data controller for the personal data described below.
1. Account options and what each creates
- Sign in with Apple — confirms you're a real person on this device only. The result (and any name/email Apple shares) is stored locally on your device; we never receive or store it on our servers, and no server-side account is created.
- Google or Email/username — creates a real account via Supabase Authentication, which stores your email and, for email sign-in, a salted/hashed password on Supabase's infrastructure, not ours. If you choose a username, we also store a small username-to-account lookup record in the same project. Our backend never sees or stores your password in plain text.
A Google or Email/username account also lets your profile, settings, and learning progress sync across devices signed into that same account. Apple sign-in stays local to each device and never syncs, since it never creates a server-side account to sync with.
2. What we collect
- Account data: email, optional username, display name, and (for a Google or Email/username account) authentication metadata managed by Supabase.
- Learning data: vocabulary progress, session history, streaks, and app settings — stored locally on your device always, and additionally synced to our Supabase project for a Google or Email/username account so it follows you to another device.
- Speech input: transcribed to text on-device by your operating system's speech recognition. For Pronunciation Gym drills and Conversation practice specifically, a short recorded clip of that turn is also sent to our backend and forwarded to Microsoft Azure's Speech service to score pronunciation or improve transcription accuracy — Azure processes the clip and returns a result, we do not retain the audio afterward. Translator and all other speech input stay on-device only; we never receive or store raw audio outside the two features above.
- Conversation text: text you type or speak during practice is sent to our backend, which forwards it to OpenAI's API solely to generate that turn's reply/correction, then discards it — we do not log or retain conversation content on our servers.
- Voice output: the companion's spoken reply is generated via Microsoft Azure's neural text-to-speech service through our backend; if unavailable, the app falls back to your device's built-in text-to-speech, which runs entirely on-device.
- Usage/activity data: the time of your most recent activity, kept on your account record and visible to our support staff (the same way your billing/CRM record is); plus a separate log of activity timestamps used only to generate aggregate, service-wide health metrics (e.g. how many learners are actively using the Service right now) — never sold, shared, or used for advertising.
- Billing/CRM records: name, email, country, subscription plan, and invoice history, kept for the life of your account and — for tax and business record-keeping — for a period after a self-service cancellation, even though your login and local learning data are deleted at that point.
- Diagnostic data: we use Sentry to collect crash reports and error diagnostics (stack traces and device/OS information) so we can fix bugs — this is not an advertising, marketing-analytics, or tracking SDK. We do not collect device advertising identifiers, and we do not build advertising profiles.
- Anonymous website traffic: when you visit one of our public web pages (this homepage, sign-up, account, or legal pages), we log the page path, a timestamp, the resolved country your request came from, a coarse device category (mobile/tablet/desktop), and where you came from (e.g. a search engine, social network, or campaign link, derived from the page's referring site and/or its link parameters) — all to generate aggregate traffic statistics. We do not use cookies for this, and we never store your IP address or your browser's User-Agent string. To count how many distinct visitors (not just page loads) we see each day, we compute a one-way cryptographic hash from your IP address, User-Agent, and the current date, and store only that hash — never the underlying IP/User-Agent themselves. This hash is salted with a secret only we hold and deliberately changes every day, so it can never be used to recognize the same visitor across two different days, build a profile, or link to anything else we know about you. We also erase this hash from our records once the day it was created on has ended, keeping only the aggregate statistics (page, country, device category, and traffic source) for the 90-day retention window described below.
3. How we use it and our legal basis
We process personal data to: provide and maintain the Service (contractual necessity); process your subscription (contractual necessity); respond to support requests (legitimate interest); and comply with tax and legal record-keeping obligations (legal obligation). We do not use your data for advertising, and we do not sell or share it with data brokers.
4. Third parties we use
OpenAI, L.L.C. (processes conversation text, server-side, via our backend, to generate the companion's reply/correction), Microsoft Corporation (Azure Speech service — processes a short recorded clip of a Pronunciation Gym drill or Conversation turn, server-side via our backend, to score pronunciation or transcribe speech, and separately generates the companion's spoken voice via Azure's neural text-to-speech; audio clips are not retained after processing), Supabase(authentication, and, for a Google/Email account, synced learning data), and Sentry (crash and error diagnostics, to help us find and fix bugs). Each acts as our data processor for these purposes. We do not share your data with any other third party, and we do not sell or rent personal data to anyone.
5. International data transfer
Our infrastructure and service providers are based in the United States. If you access the Service from outside the U.S., your data will be transferred to and processed in the U.S., which may have different data protection laws than your home jurisdiction. Where required, we rely on our processors' standard contractual clauses or equivalent safeguards for such transfers.
6. Data retention
Local learning data persists on your device until you delete the app or cancel your account. Synced learning data and account credentials persist until you cancel your account. Beyond that, we keep different kinds of data for different lengths of time, summarized below:
| Data | Retention |
|---|---|
| Account/CRM record after cancellation | 90 days (in case of a refund dispute or late resubscribe), then your name, email, and country are anonymized |
| Invoices and billing records | 7 years, for tax and accounting obligations |
| Activity log | 35 days, then automatically deleted |
| Most-recent-activity time | Life of the account (same as billing/CRM records) |
| Anonymous website traffic log | 90 days, then automatically deleted |
| Database backups | Approximately 7 days (our hosting provider's standard backup window) |
| Deletion requests | Honored within 30 days of your request |
We do not collect SMS consent records (we don't send SMS messages) or maintain a separate security audit log today, so no retention period applies to either.
7. Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent where processing is based on it. California residents specifically have the right to know what personal information we collect, to request its deletion, and to non-discrimination for exercising these rights — and, as stated above, we do not sell or share personal information as those terms are defined under California law, so there is no opt-out to exercise for that. To exercise any of these rights, contact us at the email below; we will respond within the time required by applicable law. You may delete your own account and local/synced learning data at any time from Profile → Manage subscription without contacting us at all.
8. Security
We rely on industry-standard safeguards from our infrastructure providers, including encryption in transit (TLS) and access-controlled credential storage (Supabase Authentication, which we never see the plaintext of for passwords). No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. In the event of a data breach affecting your personal data, we will notify affected users and relevant authorities as required by applicable law.
9. Children's privacy
The Service is not directed at children under 13 (or the minimum age required by your local law, if higher), and we do not knowingly collect personal data from them. If we learn that we have inadvertently collected personal data from a child under this age, we will delete it. Parents or guardians who believe their child has provided us personal data should contact us at the email below.
10. Your controls
You can cancel a Google or Email/username account at any time from Profile → Manage subscription — this deletes your login and the learning data on that device, and marks your billing record as cancelled (kept for tax/business purposes, never deleted, as described above). Apple sign-in never creates a server-side account, so uninstalling the app removes everything associated with it.
11. Changes to this policy
We may update this policy as the Service evolves. Material changes will be reflected by an updated "Last updated" date, and, where required by law, we will provide additional notice before the change takes effect.
12. Contact
For any question about this policy or to exercise a data right described above, contact support@skymraud.com.