Privacy Policy

Last updated: October 9, 2026

This policy explains how SpeakRaja handles information when you use our English speaking-practice website and app. For privacy questions or account requests, contact the SpeakRaja operator at devarapalli.gopi8@gmail.com.

Accounts and practice progress

Login is optional for speaking practice. Hosted Studio generation requires a verified account. Guest session history and saved lessons stay in browser localStorage or app storage on your device. We use this information to show completed lessons, recorded duration, your practice calendar, and streaks.

If you sign in using Google on the website or Android app, Supabase handles authentication and stores your account information. Google sign-in provides your Google account identifier, email address, and basic profile information such as your name and profile picture. This information may be included in your Supabase account and the session cached on your device. We use it to identify your account and provide sign-in and progress sync, not to access your Gmail messages, contacts, or Drive files. Email-code sign-in is no longer offered.

When you sign in, this device's guest history and saved lessons move into your account. Synced data includes session and lesson identifiers, completion timestamps, local practice dates, recorded duration in seconds, saved lessons, and change identifiers used to prevent duplicate saves. Recordings, transcripts, and AI feedback are not part of synced progress.

Changes save locally before uploading. Account-specific caches, pending changes, and authentication sessions remain on the device after sign-out. Signing out returns the app to a separate guest profile; it does not erase these caches. App storage is not encrypted by SpeakRaja. Clearing device or browser data before a successful sync can permanently lose pending changes.

Recordings, speech, and AI feedback

Recording requires your microphone permission. You may practice without a microphone. Recording and local playback alone do not submit audio for hosted AI feedback.

When you request hosted AI feedback, your recording passes through our Vercel backend to Groq for speech recognition. The transcript is then sent to Ollama Cloud for grammar and phrasing feedback. Avoid including sensitive information or other people's personal information in recordings. Only submit audio you have permission to share.

SpeakRaja does not intentionally persist recordings, transcripts, or feedback on its backend or in the progress database. Feedback remains in app memory. Temporary audio may remain in device caches; providers and hosting services may retain data or technical logs under their own policies. Optional local development speech recognition processes audio locally instead of sending it to Groq, but correction may still use Ollama Cloud.

Example speech and improved-answer playback use your device or browser's speech service. That service may process text online under its provider's policies.

Video Conversation Studio

The optional browser Studio is separate from speaking practice and can use a configured local or hosted backend. Selecting a video creates a local preview without uploading it. When you approve AI processing and request generation, your video and text brief are sent to the configured Studio server. Selected video frames, your brief, and existing audio when present are sent to Google Gemini for video-aware script generation; the generated script is then sent for AI speech synthesis. Only upload media you have permission to share. Google's Gemini data and retention policies apply. Free-tier content may be used to improve Google products: do not submit confidential, sensitive, or other people's personal information. Our requests disable storage of interaction objects with store: false, which does not override Google's terms or guarantee zero provider retention.

The Studio server temporarily stores the uploaded video, sampled frames, extracted audio, generated voice, and merged output. These files are removed after the app downloads the result or after ten minutes for unclaimed results. Failed jobs are cleaned up; abrupt process termination can leave files in the operating system's temporary directory. A restart can interrupt generation or lose an unclaimed output. Generated scripts and preview URLs remain in app memory until replaced or Studio is closed. Downloaded videos remain wherever you save them. Studio media and scripts are not added to saved or synced practice progress. The voice is AI-generated, not a clone of a real person's voice.

Hosted Studio sends your Supabase access token to the backend to verify your account and restrict output downloads to the generating account. It reserves daily per-account and service-wide usage limits in Upstash before accepting an upload. The quota records contain a daily keyed hash of your account identifier and counters retained for up to two days, not raw account identifiers, emails, recordings, or scripts. Invalid uploads, failures, and cancellations can consume this allowance. Local Studio does not require sign-in. Providers and hosting services may independently retain security or technical logs under their own policies.

Website analytics and service protection

Public app and guide pages count website loads by mobile or desktop device type. Feature analytics record allowlisted actions such as starting a lesson or requesting feedback, a timestamp, and a device category. A random browser identifier is stored locally and sent to our analytics endpoint; the server hashes it to estimate distinct browsers. These identifiers are pseudonymous, not your account ID or email. Feature tracking respects Do Not Track and Global Privacy Control. View totals are separate and do not use that identifier.

Upstash Redis stores aggregate visit and feature counts without a scheduled expiry. Recent feature logs are limited to the latest 200 entries within a 30-day window; the stored log expires after 30 days of inactivity. Feature logs do not contain recordings, transcripts, email addresses, raw IP addresses, or search text. These standalone policy pages do not run app analytics scripts.

When configured, Google Analytics 4 measures public app and guide visits and named practice actions. Before loading Google Analytics, we check the country associated with your connection using Vercel's IP geolocation. Visitors identified as being in the European Economic Area (EU countries, Iceland, Liechtenstein and Norway) or United Kingdom are asked to accept analytics cookies first unless they already saved a choice. Unknown locations or failed location checks also require acceptance. In other recognized countries, analytics starts by default without a prompt unless you previously declined. The region endpoint returns only whether consent is required; it does not store your country or IP address. Location checks are approximate and can be affected by VPNs or proxies.

When analytics is enabled, Google may use analytics cookies and process cookie identifiers, browser and device information, and network information to produce usage reports. We do not send Google Analytics recordings, transcripts, feedback text, account identifiers, email addresses, search text, or URL query strings and fragments. Advertising storage, advertising personalization and Google signals are disabled in this integration. Admin and standalone legal pages are excluded.

Google Analytics is disabled if you previously declined it or your browser signals Do Not Track or Global Privacy Control. Use Analytics preferences at the bottom of the public app or guide pages to disable or enable it. Your explicit choice is stored locally and shared across tabs on the same origin; clearing that preference restores the regional default. Automatic startup outside the EEA/UK is not stored as consent, and location is checked again on each page load. Declining stops future Google Analytics collection and removes accessible Google Analytics cookies; it does not erase data already received by Google. Google Analytics retention depends on our property settings and Google's policies. This choice does not disable the separate first-party visit counters, feature analytics or service-protection records described above.

The protected admin dashboard also displays an aggregate count of non-deleted accounts linked to Google with a recorded sign-in, calculated from Supabase authentication records. This count does not reveal account details in the dashboard or connect accounts to anonymous feature events.

To limit hosted AI usage, the backend processes your IP address and stores a daily keyed hash plus usage counters in Upstash for up to two days, rather than storing the raw IP in those quota records. People sharing a network may share an allowance. Hosting and authentication providers may independently process IP addresses and security logs.

Service providers and sharing

We use information to deliver practice, authenticate accounts, sync progress, respond to requests, understand feature use, and protect the service. SpeakRaja does not sell your personal information or use Google account data for advertising. The app has no advertising system.

• Supabase: account authentication and progress storage.
• Google: optional Google sign-in and Google Analytics with the controls described above. See also how Google uses information from partner sites.
• Vercel: website hosting and API processing.
• Railway: optional Studio backend hosting and temporary media processing.
• Groq and Ollama: requested transcription and AI feedback.
• Google Gemini: optional Studio video-frame and audio analysis, script generation, and speech synthesis; free-tier data-use terms differ from paid-tier terms.
• Upstash: visit counts, feature analytics, and usage-limit records.

Providers may process information in countries other than your own. Their services, retention practices, and applicable laws may differ. Information may also be disclosed where required by law or reasonably necessary to address fraud, security incidents, or protect people's rights.

Retention, deletion, and your choices

• Guest data: use Settings to clear guest progress, or clear the site's browser data or app data.
• Synced progress: while signed in, clearing progress queues an account-wide reset. It takes effect on other devices when they sync. Older queued changes on those devices are discarded.
• Account deletion: email the contact below from your account email address and request deletion. We may verify ownership before acting. There is no self-service account-delete button. Deleting the Supabase auth account removes its progress and change records from the active database, but does not remotely wipe offline device caches.
• Retention: account and progress data remain until cleared or deleted. Opaque change identifiers remain until account deletion. Provider backups and security logs follow provider retention and legal requirements; deletion from active storage is not a promise of immediate removal from every backup.
• Google access: you can revoke SpeakRaja's access in your Google Account's third-party connections settings. This does not itself delete your SpeakRaja account or cached progress.
• Device permissions: revoke microphone access in browser or device settings. Continue as a guest to avoid account sync. Sync and sign out before clearing data on a shared device.

Depending on your location, you may have rights to access, correct, export, delete, restrict, or object to processing of your personal information, withdraw consent where applicable, or complain to a data protection authority. Contact us to make a request. We may need enough information to verify your identity, but we will never ask you to send a password, sign-in code, or access token.

Security and younger users

We use encrypted network connections and database access controls that restrict account progress to its owner. No online service or device storage is completely secure. Keep your device and email account protected.

SpeakRaja is not designed specifically for children. Where local law requires parental permission for a minor's use, that permission is required. A parent or guardian concerned that a child has provided personal information without the necessary permission can contact us to request its removal.

Contact and policy changes

For privacy, access, correction, export, or deletion requests, email devarapalli.gopi8@gmail.com. Support messages include the information you choose to provide and are used to handle your request. Do not include recordings or sensitive information unless needed for your request.

We may update this policy as the service changes. The updated policy will be published here with a revised date. Where required by law, we will provide additional notice or obtain consent.