Phonimo privacy notice

Effective date: 22 October 2026

This notice covers the Phonimo app and website, operated by Guilherme Passero. For privacy requests, contact [email protected].

Android and iOS offer the same practice, progress, optional analytics and subscription features. Phonimo account sign-in is available only on Android. Availability depends on the installed app version.

Account, recordings, and progress

Creating a Phonimo account is optional on Android. Online recording uses a technical identifier to manage recording limits without asking for your name, email or password. Signing in with email/password or Google uses your email and account identifier. Password recovery uses your email. Our server keeps a protected account identifier, never passwords or raw sign-in credentials.

Recording is optional. To assess pronunciation, we send your recording and exercise to Microsoft Azure Speech in West Europe. Audio stays only in memory: up to five seconds may wait for the connection, then is sent or cleared when the attempt ends. In word review, guided lessons, conversations and classics, you can explicitly play the latest recording to compare it with the reference. Its separate playback copy stays only in device memory during that exercise and is cleared when you leave, record again or background the app. It is never saved to a file, backed up or played automatically. Server sessions and results are cleared within five minutes.

Preferences and progress stay on your device until uninstallation. Android crash reports and limited app, device, installation, activity, timing and error data help keep the service reliable. They exclude audio, transcripts, sign-in credentials and raw assessment responses.

Optional analytics

With your consent, we collect usage data to understand which features are used most and improve Phonimo.

On Android and iOS, analytics stays off unless you choose “Share usage data”. Choosing “Not now” or dismissing the prompt keeps it off without limiting free activities. Change your choice in You → Privacy and settings.

We collect activity starts, completions, abandonments, time spent, available scores, activity identifiers and content versions. We also count taps on navigation options and Today’s main plan button. Completed initial tests also include available scores by sound, sound identifiers, scoring versions and the country set in your device region. This setting does not establish where you live or are located.

We also measure onboarding steps viewed and completed, active time, recording attempts and errors, microphone-permission outcomes, and whether the optional diagnostic is started or deferred.

Analytics also collects sessions, app version, device/platform and approximate location from your IP address, and may record purchase product, value and currency. It uses an installation identifier, not your account identity. We send no audio, transcripts, exercise text, personal notes or payment credentials. We do not sell personal data or use it for advertising or profiling. With consent, Android crash reports may also include activity events and scores.

Google retains event and user data for 14 months without extending this period for new activity. This limit does not erase standard aggregate reports. We do not keep a separate copy of analytics reports.

Turning off analytics and deleting history

Turning analytics off stops future collection without deleting history. “Request deletion of analytics history” also clears local analytics data and asks Google to delete data associated with this installation. The identifiers needed for these requests stay on your device for up to 14 months after last use.

We retry encrypted deletion requests until Google accepts them, then remove the identifiers and keep a protected receipt for 30 days. Google completes deletion later; acceptance does not confirm completion. Losing local data or uninstalling may prevent identifying older history. Contact support for help. Account deletion does not change analytics consent or delete analytics history.

Privacy-choice counts

On Android and iOS, even with analytics off, we count privacy choices and registered analytics-deletion requests. We receive the choice, screen, platform, time and a random receipt, without account or analytics identifiers. Counts describe received actions, not unique people or completed deletions. Protected receipts stay for 30 days to prevent duplicates; delayed delivery and reinstalls can affect totals.

Choices may wait on your device for up to seven days before delivery. These counts and app logs exclude request IP addresses.

Recording time and purchases

We keep recording-limit records, including used and reserved seconds. Audio sent for assessment counts in whole seconds, rounded up per recording, even without feedback. We reserve the maximum duration before assessment; if processing remains unresolved after two minutes, the full reservation counts. These records exclude recordings, exercise text, transcripts and scores. Plan allowances and billing conditions are in the Subscription Terms.

Shared capacity records do not contain account identifiers or purchase credentials. Free recording depends on shared capacity, and emergency limits can stop any plan. Deleting an account does not reset capacity or delete these shared records. They cover the current week and the 12 previous weeks.

Subscriptions use Google Play on Android and the App Store on iOS. To verify purchases and prevent sharing, we keep subscription status, billing dates, protected purchase references and records of your 18+ and Terms confirmations. Purchase credentials are used only for verification; we do not keep card details or dates of birth. For Google Play, Google Cloud temporarily holds purchase notifications, including purchase credentials, in the Netherlands for up to 24 hours while delivering them. They are deleted after delivery.

Restoring an App Store subscription can recover it onto the current installation even when its previous Phonimo identity is unavailable. We keep protected purchase links and recording-usage receipts so restoration preserves the billing period and consumed allowance. These receipts follow the recovered subscription and retain the current week and the 12 previous weeks. Restoration does not merge learning history or private feedback from the previous identity. Signed store evidence is used transiently for verification.

Feedback, website, and providers

After a session, you can tell us whether it was useful and, if you wish, leave a comment of up to 500 characters. We link this feedback to your Phonimo identifier and basic session information so it can be included when you export or delete your data. Comments are encrypted and only the authorized Phonimo administrator can read them. We do not store copies on your device or include comment text in technical logs, crash reports or email alerts.

The website uses your browser language. A language you choose stays in your browser until changed or site data is cleared, without tracking or sending it to our server.

Our providers are Firebase (technical identities on both platforms, Android sign-in, Android crash reports and optional analytics), Apple (iOS subscriptions), Google Play (Android subscriptions), Google Cloud (hosting), Azure Speech (pronunciation assessment), Resend (deletion confirmations and feedback alerts), and Cloudflare Email Routing (support email forwarding).

Why we process data and international safeguards

We use identity, recordings, recording limits and purchase verification to provide the service under our contract with you. Optional feedback and analytics rely on consent. Security, abuse prevention, privacy-choice records and support rely on our legitimate interest in operating and protecting the service.

Providers must protect data at least as well as this notice and applicable law require. Processing may take place outside your country. Providers’ data-protection terms describe safeguards for transfers outside the European Economic Area, such as European Commission adequacy decisions or standard contractual clauses. The applicable safeguards depend on the provider and service. See the Google processing terms and Microsoft data-protection addendum, or contact support for information or a copy of the safeguards.

How long we keep data and what you can export

Account and technical identity records stay until deletion, with no automatic expiry for inactivity. Recording-limit records cover the current week and the 12 previous weeks. Completed purchase-verification requests stay up to seven days; purchase notifications and duplicate checks, 30 days; inactive purchase records, 90 days after expiry; feedback, up to 90 days. Deleting server data removes linked records from our active database. We retry identity-service cleanup until it succeeds, keeping the identity reference encrypted while it is pending. After completion, we erase that reference and keep a protected identity reference for 30 days to prevent stale requests from recreating data. A protected random completion receipt remains without a link to your identity so a returning device can confirm deletion.

Your export includes retained feedback, current recording allowance, subscription status and dates, policy versions and adult confirmation. It excludes billing and recording-limit history and internal purchase or reservation references.

Security logs may contain IP addresses and technical request information for up to 30 days, even with analytics off. They exclude recordings, transcripts and raw assessment responses. Crash-report removal begins after 90 days. Support emails stay until resolution or requested deletion.

We keep eight encrypted daily backups and seven days of recovery logs. Deleted data remains isolated for up to eight successful daily backup cycles. Restores must respect later deletion requests; otherwise the copy is discarded. Encryption, access controls and retention limits protect your data.

Your rights and choices

Delete an email-linked Phonimo account in the Android app or at phonimo.app/delete-data. The website uses your account email and a one-time confirmation, keeping request data for up to one hour. Opening the link does not delete your account: you must confirm deletion. You may need to sign in again.

In iOS builds with server-data controls, open You → Privacy and settings to export or delete the server data associated with the current installation, including an identity without an email-linked account. This also removes any currently connected sign-in account, but does not delete local learning history or analytics history.

Uninstalling does not delete your server-side identity or recording-limit records. For an identity without an email-linked account, contact support while you still have access to the installation so we can help verify your request. Losing access may prevent us from identifying its records.

Deleting Phonimo does not stop billing. Manage or cancel subscriptions separately in Google Play or the App Store, wherever you subscribed.

Contact support to request access, correction, deletion, restriction or portability, or to object to processing based on legitimate interests, where applicable. You can withdraw analytics consent in the app; withdrawal does not affect earlier lawful processing. You may complain to the Dutch Autoriteit Persoonsgegevens. Material processing changes require updating this notice and the applicable store privacy declarations before release.