Privacy Policy
This policy explains what personal data Odysseus English collects, why we collect it, who we share it with, and what you can do about it.
1. Who we are
Odysseus English ("we", "us", "our") provides a mobile application for learning and practising English (the "App"). This Privacy Policy applies to the App and to this website.
For the purposes of the EU and UK General Data Protection Regulation, we are the data controller of the personal data described below. You can reach us at any time at studio.anhtuanit@gmail.com.
2. What we collect
We collect only what the App needs to work and to improve. We do not sell your personal data.
2.1 Account information
You can use the App in one of two ways, and each collects a different amount:
- Sign in with Google. We receive from Google your email address, display name, and profile photo URL, plus the account identifier Google returns. We use these to create and recognise your account.
- Continue as a guest. No email, no name from a provider. We create an anonymous account identified only by a random identifier generated on your device, so your progress is saved. A guest account has no email address attached to it.
In both cases we also store an internal user ID, a display name, and a username generated for you.
The App has no password. There is no email-and-password registration and no password to reset — sign-in goes through Google, or not at all. We therefore never receive, store, or hash a password.
We also store a device identifier generated by the App on first launch. It is not the hardware ID, advertising ID, or IMEI; it is a random value we create, and it exists so a guest account stays attached to the device that created it. Reinstalling the App generates a new one.
2.2 Content you create
The App stores what you produce while learning, so your progress survives across devices:
- Answers to exercises, quiz results, scores, stars, points, and streaks.
- Saved words and vocabulary lists you create.
- How long you study, recorded as study sessions.
- Messages you type in the AI practice chat, and the tutor's replies. These are stored against your account so a conversation can be reopened. See section 3.
- Emails you send us for support.
2.3 Microphone and speech
Speaking exercises and the microphone button in the chat use your device's own speech recognition. This is worth being precise about, because it is not what most apps do:
- The App asks for microphone permission only when you first tap to speak. You can refuse and still use everything except the speaking exercises.
- We never receive your audio. The recording is handled by the speech recogniser built into Android and is not uploaded to our servers. We are not able to listen to it.
- Only the text transcript reaches us — and only when you submit an answer, or when you send a chat message you typed or dictated. In the chat, the transcript is placed in the input box for you to read and edit first; nothing is sent until you press send.
- On Android 12 and later, recognition normally runs on the device. On older versions Android routes it through Google's speech service, and Google's own privacy policy governs that step. We do not control which path your device takes.
2.4 Technical data
Our servers keep ordinary web-server request logs (IP address, timestamp, the endpoint called) for security and debugging. Beyond that:
- We do not run an analytics SDK. We do not record which screens you open, how long a session lasts, or which features you use.
- We do not run a crash-reporting SDK. If the App crashes, nothing is sent to us — please tell us by email instead.
2.5 What we do not collect
- We do not collect location of any kind — neither GPS nor a country derived from your IP address.
- We do not access your contacts, call logs, SMS messages, camera, or photo library. The App requests exactly two permissions: internet access, and microphone.
- We do not use advertising identifiers, and there is no advertising in the App.
- We do not collect payment card numbers. The App currently has no paid features; if that changes, payment would be handled entirely by the App Store or Google Play and we would receive only a confirmation that a purchase occurred.
- We do not collect special-category data (health, biometrics for identification, political opinions, religion, and similar).
3. The AI practice chat
The App includes a chat where you practise English with an AI tutor. This section describes it separately because it is the one feature that sends something you wrote to a company other than us.
- What leaves our servers. When you send a message, its text is forwarded to a third-party AI provider that generates the reply. The provider needs the earlier turns of the same conversation to answer in context, so it holds that conversation on its side.
- What we send with it. Only the message text and an opaque conversation identifier. We do not send your name, email address, user ID, or device identifier to the AI provider — it cannot tell who you are.
- What we store. Your messages and the tutor's replies are saved against your account so you can reopen a conversation, along with a count of the tokens the provider reported for billing.
- Do not type sensitive information. Treat the chat as you would a message to a teacher you do not know. Do not put passwords, financial details, health information, or anyone else's personal data into it.
The tutor is a language model and it can be wrong. It marks up your sentences and suggests corrections, and those corrections are sometimes unnecessary or mistaken — it will occasionally "correct" a sentence that was already right. Use it as practice, not as an authority.
The API key for the AI provider is held on our servers only. It is never shipped inside the App, and the App never talks to the AI provider directly.
4. How we use your data
| Purpose | Data used |
|---|---|
| Create your account and sign you in | Account information, device identifier |
| Save your learning progress and show it back to you | Content you create, account ID |
| Unlock the next level, award points and stars, count your streak | Exercise results, study sessions |
| Rank you on the leaderboard against other learners | Display name, points. Your email is never shown to others |
| Generate a reply in the AI practice chat | The message text you send — see section 3 |
| Limit the AI chat to a fixed number of messages per hour | Count of your own recent messages |
| Keep the service running and diagnose faults | Server request logs |
| Reply to your support requests | Email address and whatever you put in the email |
| Comply with legal obligations | Whatever the law requires |
We do not use your personal data to build advertising profiles, and we do not sell or rent it to data brokers.
5. Legal basis for processing (EEA and UK users)
If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR:
- Performance of a contract — to create your account, deliver lessons, and save your progress. Without this data the App cannot function.
- Legitimate interests — to keep the App secure, diagnose crashes, prevent abuse, and improve our product. We balance these interests against your rights and use aggregated or pseudonymous data wherever possible.
- Consent — for optional analytics where local law requires consent, and for any marketing email. You can withdraw consent at any time in the App's settings or by contacting us; withdrawal does not affect processing already carried out.
- Legal obligation — where we must retain or disclose data to comply with applicable law.
6. Sharing and third parties
We share personal data only with service providers that help us run the App, and only to the extent they need it. Each is bound by a contract that restricts them to processing data on our instructions.
| Provider | What it does | Data it may process |
|---|---|---|
| Google Firebase Authentication firebase.google.com/support/privacy |
Verifies who you are when you sign in with Google, and issues the anonymous identity used by guest accounts. Authentication only — we do not use Firebase for our database, file storage, analytics, or crash reporting. | Email address, display name, profile photo URL, provider account identifier |
| AI language-model provider | Generates the tutor's replies in the practice chat | The text of your chat messages and an opaque conversation identifier. No name, email, user ID, or device identifier — see section 3. |
| Google Cloud Run (Singapore) | Runs our server | All data listed in section 2, in transit and in memory while a request is served |
| Managed PostgreSQL database provider | Stores your account and learning data | All stored data listed in section 2 |
| Cloudflare R2 | Object storage for generated audio clips and any file uploads | Audio clips of exercise sentences. These are generated from lesson text and contain nothing personal. |
| Google Cloud Text-to-Speech (only on some deployments) | Turns lesson sentences into audio. Where the self-hosted speech engine is used instead, no data leaves our server for this. | Lesson text only — never anything you wrote |
| Apple App Store / Google Play | App distribution. The App has no paid features today; if that changes, purchases would be processed by the store. | Payment details would go to the store, never to us |
We may also disclose personal data:
- To comply with law — in response to a valid legal request from a competent authority, or where disclosure is necessary to protect our rights, your safety, or the safety of others.
- In a business transfer — if we are involved in a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data becomes subject to a different privacy policy.
The list of providers above is accurate as of the effective date. If we add a provider that materially changes how your data is handled, we will update this page and, where required, notify you in the App.
7. How long we keep data
| Data | Retention |
|---|---|
| Account information and learning content | For as long as your account exists |
| Chat conversations | Until you delete the conversation in the App, or delete your account. Deleting a conversation removes its messages from our database immediately. |
| Data after you delete your account in the App | Gone from our database immediately; purged from backups within 90 days |
| Data after you request deletion by email | Removed within 30 days, once we have verified the request; backups within 90 days |
| Server request logs | Up to 30 days |
| Sign-in sessions (refresh tokens) | Expire automatically; see section 8 |
| Support correspondence | Up to 24 months, so we can follow up on recurring issues |
| Records we must keep by law | For the period the law requires |
Conversations you have deleted are removed from our database, but the AI provider may retain its own copy of that conversation under its own retention schedule. We cannot delete it on their side on your behalf.
8. Security
We take reasonable and appropriate technical and organisational measures to protect your data, including:
- Encryption in transit using TLS for all traffic between the App and our servers.
- Encryption at rest for stored data, provided by our cloud infrastructure.
- No passwords exist to steal. Sign-in is delegated to Google, so there is no password database.
- Sign-in sessions are stored only as a one-way hash. The refresh token that keeps you signed in is never written to our database in readable form — only its SHA-256 digest is, and presenting a token rotates it. Someone reading the database could not use what they found to sign in as you.
- Error messages are scrubbed before they leave the server. Internal detail — database addresses, file paths, the address of the AI provider — is logged privately and replaced with a generic message in the response.
- Access controls that limit personal data to the people who need it to do their job.
- Regular updates of our dependencies and infrastructure.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a data breach affects your personal data and poses a risk to your rights, we will notify you and the relevant supervisory authority as required by law — in the EEA and UK, without undue delay and within 72 hours of becoming aware where feasible.
9. Your rights
Subject to applicable law, you have the right to:
- Access — obtain a copy of the personal data we hold about you.
- Rectification — correct data that is inaccurate or incomplete. Most of it you can edit directly in the App.
- Erasure — have your data deleted. See Deleting your account.
- Restriction — ask us to limit how we process your data while a dispute is resolved.
- Portability — receive your data in a structured, machine-readable format, or have it sent to another provider where technically feasible.
- Object — object to processing based on our legitimate interests, including profiling used to personalise lessons.
- Withdraw consent — at any time, where processing is based on consent.
- Complain — lodge a complaint with your local data protection authority. We would appreciate the chance to address your concern first.
To exercise any of these rights, email studio.anhtuanit@gmail.com from the address registered to your account. We respond within 30 days and may ask you to verify your identity before acting. Exercising your rights is free; we may charge a reasonable fee only for manifestly unfounded or excessive repeat requests.
10. Deleting your account
You can permanently delete your account and its data at any time, from inside the App. It cannot be undone.
10.1 In the App — immediate
- Tap your name at the top of the Home screen to open Account.
- Scroll to the bottom and tap Xoá tài khoản (Delete account).
- Read what will be removed, type DELETE to confirm, and tap Xoá vĩnh viễn (Delete permanently).
Deletion happens straight away — not in 30 days. You are signed out the moment it completes, and the account no longer exists.
10.2 By email — if you cannot open the App
Email studio.anhtuanit@gmail.com with the subject line Account deletion request.
- If you signed in with Google — send the email from the Google address you used to sign in. That is how we verify the request is yours. There is no password to quote; the App has none.
- If you used the App as a guest — guest accounts have no email attached, so tell us the username shown on the Account screen and roughly when you started using the App. If you have already uninstalled the App, a guest account can no longer be identified; it will simply expire unused.
We acknowledge emailed requests within 5 business days and complete them within 30 days.
10.3 What is deleted
Deleting from inside the App removes all of the following at once, in a single database transaction — not over 30 days:
- Your account profile: name, username, email address, avatar, points, and streaks.
- Your progress through the levels: stars, best scores, attempts, and the point history behind them.
- Your skill levels and experience, and every study session recorded.
- Saved words and vocabulary lists.
- Every AI chat conversation and every message in it.
- Your sign-in identities and every saved session, so you are signed out everywhere.
- Anything else held against your account — including quiz attempts, notifications addressed to you, registered devices, and uploaded files, together with the stored file itself. The deletion covers the whole account, not a chosen list of it.
Your Google sign-in identity is deleted too, not only our copy of it. Signing in with the same Google account afterwards does not bring anything back — it creates a new, empty account.
Backups that already contain this data are rotated out within 90 days.
Two things are not covered, and it is more honest to say so than to imply otherwise:
- Emails you sent us. Support runs over ordinary email, so your messages sit in a mailbox, not in the App's database — deleting your account cannot reach them. Ask us in your email and we will delete the thread separately.
- The AI provider's copy of your conversations — see 10.4.
We otherwise keep only server request logs (up to 30 days, see section 7) and anything we must retain to deal with fraud, abuse, or a legal claim.
Deleting by email instead removes exactly the same things; only the timing differs, because a person has to verify the request first — see 10.2.
10.4 Deleting a single conversation instead
If you only want to remove one AI chat, open the Chat tab, tap the bin icon next to a conversation, and confirm. That deletes the conversation and all of its messages from our database immediately, without touching the rest of your account.
In either case, the AI provider may retain its own copy of a conversation under its own retention schedule. We cannot delete it on their side on your behalf — see section 3.
11. Children's privacy
The App is not directed at children under 13, and we do not knowingly collect personal data from children under 13. In the EEA, the minimum age is 16 unless your country has set a lower age (13, 14, or 15) — in that case the local age applies.
If you are below the applicable age, please do not use the App or create an account. If we learn that we have collected personal data from a child below that age without valid parental consent, we will delete it promptly.
If you are a parent or guardian and believe your child has provided us with personal data, contact studio.anhtuanit@gmail.com and we will remove it.
12. International data transfers
Our servers run in Singapore. Our service providers operate globally, so your personal data may also be processed in other countries — including the United States, where several of the providers listed in section 6 are established — whose data protection laws may differ from those in your jurisdiction.
Where we transfer personal data out of the EEA, the UK, or another jurisdiction with transfer restrictions, we rely on an appropriate safeguard — normally the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant), or a finding of adequacy for the destination country. You may request a copy of the relevant safeguard by contacting us.
13. California residents
If you are a California resident, the California Consumer Privacy Act as amended by the CPRA gives you the right to know what personal information we collect and how we use it, the right to delete it, the right to correct it, the right to opt out of its sale or sharing, and the right not to be discriminated against for exercising these rights.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising as those terms are defined under the CCPA. We have not sold or shared personal information in the preceding 12 months.
The categories of personal information we collect are listed in section 2, the purposes in section 4, and the recipients in section 6. To make a request, email studio.anhtuanit@gmail.com. You may use an authorised agent; we will ask for proof of their authority.
14. Changes to this policy
We may update this Privacy Policy as the App evolves or as the law changes. The "last updated" date at the top always reflects the current version.
If a change materially affects how we handle your personal data, we will give you notice in the App or by email before it takes effect, and where the law requires it, we will ask for your consent. Continuing to use the App after a change takes effect means you accept the updated policy.
15. Contact us
Questions, requests, or complaints about this policy or your personal data:
Email: studio.anhtuanit@gmail.com
Typical response time: within 5 business days; formal data rights requests within 30 days.