Privacy Policy

1. Who We Are

The data controller of personal information collected through the Service is:

Orator is a public-speaking and voice-training application that records your voice, applies automated and AI-based analysis to that voice, and provides educational feedback, lessons, drills, and scenario-based practice.

2. Summary

Here is the short version. The full details are in the rest of this document.

• We collect account information, voice recordings, transcripts and analytics derived from those recordings, content you post, device and usage information, and subscription metadata from Apple.
• We use it to operate the Service, generate AI-based speech feedback, authenticate you, run our subscription business, debug, secure the Service, comply with law, and (in de-identified or aggregated form) improve our models.
• We share it with our infrastructure and AI sub-processors (such as OpenAI, Microsoft Azure, Groq, Cartesia, Modal, Supabase, and Apple), and where required by law.
• We do not sell your personal information for money.
• We do not use your voice to biometrically identify you.
• You have rights to access, correct, delete, export, and (in some jurisdictions) restrict or object to our processing of your information.
• You are responsible for the content of your recordings, including ensuring that any other person whose voice is captured has given any required consent.

3. Information We Collect

3.1 Information You Provide Directly

• Account information. When you register, we collect your email address, password (stored only as a salted hash; we never see your plaintext password), display name, and any profile information you choose to add. If you sign in with Apple, we receive a unique Apple identifier and (depending on your settings) your email and name.
• Subscription information. When you purchase a Pro or Elite subscription, the transaction is processed by Apple. We receive a transaction receipt and subscription status from Apple — we do not receive your full credit-card or bank-card information.
• User Content. Content you submit to the Service, including community posts, comments, replies, profile customizations, and any text, image, or audio you choose to share.
• Communications with us. If you email us, send a support request, complete a survey, or report a problem, we will receive the contents of that communication.

3.2 Voice Data

• Audio recordings.When you use a feature that requires you to speak (lessons, drills, voice practice, AI scenarios, debate mode, story mode, article distillation, word-of-the-day pronunciation, live coach, etc.), the Service records your voice from your device’s microphone. These recordings (“Voice Data”) are uploaded to our backend, transmitted to one or more of our AI sub-processors for transcription and analysis, and may be retained on our servers as described in Section 7.
• Transcripts and derived data.We extract a written transcript of your speech (word-level timestamps, phonemes, and similar artifacts), as well as numerical analytic features such as pace, filler counts, pause lengths, pitch, jitter, shimmer, formants, energy, clarity, confidence, pronunciation scores, and similar speech-coaching metrics (“Speech Analytics”). Transcripts and Speech Analytics are stored alongside your account.
• Voice is not used for biometric identification. We use Voice Data and the features derived from it solely to provide speech-coaching feedback, generate transcripts, and improve the Service. We do not use your voice to identify you as a unique individual, to authenticate you, or to perform voice-print matching against other recordings. We do not sell, license, lease, trade, or otherwise disclose your voice to third parties for biometric identification or marketing purposes.

3.3 Information Collected Automatically

• Device and technical information. Device model, operating system version, app version, language and locale, time zone, screen size, and a generated installation identifier.
• Usage information. Lessons started/completed, drills attempted, scores, streaks, achievement badges earned, time spent in features, screens viewed, taps and gestures (where instrumented), and similar engagement metrics.
• Diagnostics and crash logs. Error reports, stack traces, performance metrics, network errors, and similar diagnostic information.
• Approximate location. We may infer general location (such as country or region) from your IP address. We do not collect precise GPS location.
• Push notification token. If you opt in to push notifications, we receive a device-specific push token from Apple Push Notification Service.

3.4 Information from Third Parties

• Apple Sign-In. If you sign in with Apple, we receive the information you authorize Apple to share, which may include a private relay email address.
• Apple App Store / In-App Purchase. Apple shares with us subscription status, renewal events, and transaction identifiers necessary to grant or revoke access to paid features.
• AI / speech processors. Our AI and speech sub-processors return transcripts, scores, and AI-generated text or audio back to us. These outputs are stored with your account so we can show you your history.

3.5 What We Do Not Collect

We do not intentionally collect: precise GPS location, full payment card numbers, government-issued ID numbers, health records, biometric identifiers used for identification, or any information from children under 13.

4. How We Use Your Information

We use the information described above for the following purposes:

(a) Provide the Service. Run lessons and drills, record and analyze your speech, return AI-generated feedback, run AI scenarios, render the user interface, sync your progress across devices, deliver content, and authenticate your account.

(b) Operate our subscription business. Verify subscription status with Apple, grant or revoke access to paid features, send transactional emails (receipts, renewal notices, billing-related issues), and respond to refund requests.

(c) Communicate with you. Send service-related notifications, security alerts, important updates to these policies, and respond to support requests. Where you have opted in (or where applicable law allows), we may also send marketing emails or push notifications about new features or content. You can unsubscribe at any time using the link in any marketing email or by adjusting notification settings on your device.

(d) Improve the Service. Analyze usage patterns, debug, fix crashes, evaluate the quality of AI-generated output, and develop new features. Where we use Voice Data, transcripts, or User Content for improvement of analytics or AI models, we work with de-identified or aggregated data wherever feasible. We do not use your raw recordings to train third-party general-purpose AI models without your separate, opt-in consent.

(e) Secure the Service. Detect, investigate, and prevent fraud, abuse, account takeover, denial-of-service, intellectual-property violations, and breaches of our Terms.

(f) Comply with legal obligations. Respond to lawful government requests, enforce our Terms, defend ourselves in legal disputes, comply with audit and tax requirements, and meet other obligations under applicable law.

(g) With your consent. Any other use disclosed at the time of collection or for which you have given consent.

Legal Bases (EEA / UK Users)

If you are in the European Economic Area or United Kingdom, our legal bases for processing are:

• Performance of a contract — to provide the Service you requested.
• Legitimate interests — to secure the Service, prevent fraud, debug, and improve our product, where those interests are not overridden by your rights.
• Consent — for processing of sensitive data (such as voice recordings), marketing communications, and any other processing for which we ask for consent. You may withdraw consent at any time without affecting prior processing.
• Legal obligation — to comply with applicable law and lawful requests.

5. How We Share Your Information

We do not sell your personal information for money. We share information only as described below.

5.1 Service Providers and Sub-Processors

We rely on third-party service providers to operate the Service. These providers process information on our behalf, under contractual obligations, and are not authorized to use it for their own purposes. Our sub-processors include (this list may change as we evolve the Service; we will keep it current):

Each of these providers operates under its own terms and privacy policy. We require them to use appropriate safeguards consistent with this Privacy Policy and applicable law, but we do not control their independent practices.

5.2 Legal and Safety Disclosures

We may disclose information when we believe in good faith that disclosure is necessary to:

• comply with a law, regulation, subpoena, court order, or other legal process;
• enforce our Terms or other agreements;
• protect the rights, property, or safety of the Company, our users, or the public;
• detect, prevent, or address fraud, security, or technical issues; or
• respond to a government or regulatory request.

5.3 Business Transfers

If the Company is involved in a merger, acquisition, financing, reorganization, bankruptcy, receivership, sale of assets, or transition to another provider, your information may be transferred as part of that transaction. We will notify you (for example, by email or in-app notice) and require any successor to honor this Privacy Policy or provide an opportunity to delete your information.

5.4 With Your Consent or at Your Direction

If you choose to share content publicly (for example, by posting in a community feature) or to integrate the Service with another product, the information you choose to share will be handled according to that destination’s terms. You can revoke consent at any time, but doing so does not affect prior disclosures.

5.5 Aggregated and De-Identified Information

We may create and share aggregated or de-identified data (data that cannot reasonably be used to identify you) for any purpose, including research, benchmarking, marketing, and product improvement.

6. International Data Transfers

The Service is operated from the United States and may be supported by sub-processors in other countries. If you access the Service from outside the United States, your information will be transferred to, processed in, and stored in the United States and other jurisdictions where laws may differ from those in your country.

For users in the European Economic Area, United Kingdom, or Switzerland, we rely on appropriate transfer mechanisms (such as Standard Contractual Clauses) where required by law.

7. Data Retention

We retain your information for as long as your Account is active, for as long as needed to provide the Service, and for as long as required to meet our legal, accounting, tax, regulatory, security, fraud-prevention, and dispute-resolution obligations.

Specifically:

• Account information is retained while your Account exists, plus a reasonable period (generally up to 90 days) after deletion to allow for recovery and to fulfill legal obligations.
• Voice Data (raw recordings)may be retained on our servers and on sub-processor systems for a limited period (typically 30–90 days, depending on the feature) to enable replay, dispute resolution, debugging, and quality control. Voice Data uploaded to certain sub-processors may be deleted earlier or later according to that sub-processor’s retention policy.
• Transcripts and Speech Analytics are retained alongside your Account so you can see your history. They are deleted with your Account.
• Subscription and transaction records are retained for the period required by tax, accounting, and audit obligations (typically up to 7 years).
• Aggregated or de-identified data that cannot reasonably be linked to you may be retained indefinitely.

When the retention period ends, we will delete or anonymize the information, subject to technical or legal constraints (for example, information in routine backups will be deleted on the normal backup-rotation schedule).

8. Security

We use commercially reasonable administrative, technical, and physical safeguards to protect your information, including encryption in transit (TLS/HTTPS), encryption at rest where feasible, access controls, audit logging, and regular review of our security practices.

However, no system is perfectly secure. We cannot guarantee the absolute security of any information transmitted to or stored by the Service. You are responsible for keeping your account credentials confidential and for notifying us immediately of any suspected unauthorized access.

In the event of a data breach affecting your information, we will notify you and applicable regulators as required by law.

9. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights with respect to your personal information. To exercise any of these rights, contact us at the email address in Section 1.

9.1 Rights for All Users

• Access. Request a copy of the personal information we hold about you.
• Correction. Request that we correct inaccurate or incomplete information.
• Deletion. Request that we delete your account and personal information. You can also delete your account from within the Service.
• Withdraw consent. Where we rely on your consent to process information (for example, Voice Data), you may withdraw it at any time. Withdrawal will not affect processing that occurred before withdrawal, and may limit your ability to use parts of the Service.
• Opt out of marketing communications. Use the unsubscribe link in any marketing email or your device notification settings.

9.2 Additional Rights for Users in the European Economic Area, United Kingdom, and Switzerland (GDPR / UK GDPR)

• Restriction of processing.
• Objection to processing based on legitimate interests.
• Data portability — receive a copy of your data in a structured, commonly used, machine-readable format.
• Lodge a complaint with your local data protection authority. We would, however, appreciate the chance to address your concerns directly first.

9.3 Additional Rights for California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended:

• Right to know what categories of personal information we have collected, the sources, the purposes, and the categories of third parties with whom we share it.
• Right to delete personal information we have collected, subject to certain exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of “sale” or “sharing” of personal information. We do not sell personal information for money, and we do not “share” personal information for cross-context behavioral advertising.
• Right to limit use of sensitive personal information.Voice recordings may be considered “sensitive personal information” under California law. We use voice recordings only for the purposes described in Section 4 and do not use them to infer characteristics about you for marketing or to disclose for cross-context behavioral advertising.
• Right to non-discrimination. We will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us at the email address in Section 1. We will verify your request by asking you to confirm information associated with your Account. You may also designate an authorized agent to make a request on your behalf.

9.4 Other U.S. State Rights

If you reside in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or another U.S. state with a comprehensive privacy law, you may have rights similar to those described above (access, correction, deletion, portability, opt-out of targeted advertising or sale where applicable). Contact us at the email address in Section 1 to exercise these rights.

9.5 Voice and Sensitive Data Notice

Some U.S. states and other jurisdictions impose specific obligations on the collection of voice recordings or other “biometric” information. As stated in Section 3.2, we do not use your voice to biometrically identify you. We treat Voice Data with care and use it only for the speech-coaching purposes described in this Privacy Policy and the Terms. If you do not consent to this processing, please do not use the recording features of the Service.

10. Children’s Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13 without verified parental consent, we will delete that information promptly.

If you are between 13 and 17, you may use the Service only with the consent and supervision of a parent or legal guardian who has agreed to the Terms on your behalf, as described in the Terms.

If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us at the email address in Section 1.

11. Cookies, Analytics, and Tracking

The Orator mobile application does not rely on browser cookies. However:

• Mobile identifiers. We may use device-level identifiers (such as a generated install ID or, with your consent on iOS, the IDFA) for analytics, security, and product-improvement purposes. You can reset or limit these identifiers in your device settings.
• Apple App Tracking Transparency.On iOS, we will request permission via Apple’s App Tracking Transparency framework before engaging in any tracking that requires it. You may grant or deny this permission, and change it later in your device settings.
• Analytics. We use product-analytics tools to understand how users interact with the Service. These tools collect device, usage, and event data, but do not (in our use) collect raw recordings.
• Website cookies. If we operate a marketing or support website, that site may use cookies for functionality, analytics, and (where allowed) advertising. A separate cookie disclosure will be provided on the website where required.

We honor “Global Privacy Control” or similar opt-out signals where required by law.

12. Push Notifications

If you opt in to push notifications, we will send you reminders, streak nudges, lesson updates, and other messages. You can disable push notifications at any time from your device’s settings.

13. Third-Party Links and Services

The Service may contain links to or integrate with third-party websites, services, or content. We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies before providing them with any information.

14. Do Not Track

Some browsers transmit “Do Not Track” signals. Because there is no industry standard for how to interpret them, the Service does not currently respond to “Do Not Track” signals, but we honor specific opt-out rights described in Section 9.

15. Account Deletion

You can delete your Account at any time from within the Service or by emailing us at the address in Section 1. When you delete your Account:

• We will permanently delete or anonymize your Account information, profile, transcripts, Speech Analytics, and User Content within a reasonable period (generally 30 days), subject to legal retention requirements (such as transaction records).
• Some information may persist in routine backups until those backups are rotated out on our standard schedule.
• Information that has been disclosed to sub-processors will be deleted in accordance with each sub-processor’s deletion procedures.
• Aggregated or de-identified information that cannot reasonably be linked to you may be retained.
• If you have an active subscription, deleting the Account does not automatically cancel future Apple billing. You must cancel through your Apple ID subscription settings as described in the Terms.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email (to the address associated with your Account) and/or by posting a prominent notice in the Service or on our website at least thirty (30) days before the change takes effect, unless a shorter period is required by law. Continued use of the Service after the effective date of a change constitutes your acceptance of the updated Privacy Policy. The “Last Updated” date at the top of this document indicates when it was last revised.

17. Contact Us

For questions, requests, or complaints about this Privacy Policy or our handling of your personal information, contact us at:

If you reside in the European Economic Area or United Kingdom and we are required to designate a representative under Article 27 of the GDPR or UK GDPR, we will provide that information here once designated.