Privacy Policy

Phraseback helps you learn languages by capturing audio from your tutoring sessions and turning it into structured insights. This policy explains what data we collect, how we process it, and what control you have.

What we collect

Audio recordings. When you record a session (via the desktop app), we capture the audio from your tutoring call. This includes your voice and your tutor's voice.

Transcripts and insights. We process your recordings to produce transcripts and linguistic insights (Nuance Cards, Gentle Corrections, Cultural Notes, Practice Prompts). These are stored as text in our database.

Practice and learning content. When you use the practice features, we keep the material you create and the material we generate for you: your saved Words, your solo and lesson practice attempts (including read-aloud recordings of your own voice, kept so you can replay and compare them), the practice scripts and reading passages we generate, and your Reading Practice history. This content is stored as text and audio while your account is active.

Calendar metadata. If you connect your Google Calendar, we read meeting titles and attendee email addresses to match sessions to tutors and pre-select your target language. We use this calendar metadata only to detect likely tutoring sessions and support the calendar features you enable.

Account information. Your name, email address, and profile photo from your Google or Apple sign-in provider. We also store your language preferences and subscription status.

Payment information. Billing details are collected and processed by Stripe. We do not store your card number or bank details on our servers.

Usage data. We use PostHog for basic product analytics, and only after analytics consent has been accepted. We do not use autocapture or automatic pageview capture. EU/EEA visitors are shown a consent banner; in regions where the banner is not shown, analytics remain off unless you have otherwise opted in. See the Cookies section below.

How we process your audio

Your audio follows this path:

1. Upload. Recorded audio files are uploaded to Cloudflare R2 (object storage, zero-egress).
2. Transcription. Audio is sent to OpenAI (GPT-4o Transcribe) to produce a text transcript. OpenAI handles the audio under its API terms to provide transcription and does not use it to train OpenAI models.
3. Insight extraction. The transcript is sent to Anthropic (Claude) to identify and explain linguistic insights. Anthropic handles the transcript under its API terms to provide this analysis and does not use it to train Anthropic models.
4. Storage. The resulting transcript and insights are saved in our Postgres database (hosted on Tiger Cloud) — those are what we keep, not the raw audio. Once a session has been processed into your transcript and learning notes, its raw recording is deleted from our storage right away. A recording that isn't processed successfully (for example, if it failed or was interrupted) is kept for up to 72 hours so we can retry, then deleted automatically. If your session produced an audio recap episode, that episode is kept alongside your other insights while your account is active. Deleting your account deletes all of your recordings (see below).

Practice recordings are handled differently from tutoring-session audio. When you record yourself reading aloud in solo or lesson practice, those recordings may also be transcribed or analyzed by AI systems when needed to provide feedback, comparison, and related practice features. We retain these practice takes while your account is active so you can replay and compare them, and we delete them when your account is deleted.

At no point is your audio or transcript used to train any AI model.

What we store and for how long

When you delete your account, we begin a 30-day grace period. After that, your recordings (including your practice read-aloud takes), transcripts, insights, saved Words, practice and reading history, and calendar links are permanently deleted. A limited set of records may remain: billing and tax records the law requires us to keep, plus internal accounting records that we anonymize so they can no longer be linked to you. Payment records held by Stripe follow Stripe's own retention policy.

Third-party processors

We share data with these services, each for a specific purpose:

We do not sell your data to anyone. We do not share your data with advertisers.

Google Calendar data

Connecting Google Calendar is optional. Phraseback's core features — recording your sessions and generating language insights — work fully without it, and we do not request Calendar access during ordinary Google sign-in. You can connect it later in Settings, and disconnect at any time.

If you choose to connect it, Phraseback requests read-only access to your Google Calendar. We use it for one purpose: detecting your language-tutoring sessions. To do that, we inspect upcoming calendar event metadata, such as event titles, descriptions, attendee email addresses, times, and meeting links, to identify likely tutoring sessions, match a recording to the right tutor, and pre-select the lesson's target language. We do not use Google Calendar data for advertising, selling data, or any purpose unrelated to these calendar-detection features.

Phraseback's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google Calendar data only to provide or improve the calendar-detection features described above.
• We do not sell Google Calendar data, and we do not transfer, sell, or use it for serving ads, including retargeting, personalized, or interest-based advertising.
• We do not allow humans to read Google Calendar data unless you give us affirmative permission to view specific data, it is necessary for security purposes, or it is necessary to comply with applicable law.
• You can disconnect Google Calendar at any time in Settings; recording and insights keep working without it.

Your rights

You have the right to:

• Access your data. Your sessions, transcripts, insights, saved Words, and reading history are visible in the Phraseback app at any time.
• Correct your data. Contact us to update inaccurate account information.
• Delete your data. You can delete your account from Settings. A 30-day grace period lets you change your mind. After that, deletion is permanent and irreversible.
• Export your data. You can export your vocabulary — your saved Words — to CSV or JSON yourself from the Words page. A full export of everything else — sessions, transcripts, and insights — isn't self-service yet; contact us and we'll prepare one.
• Object to processing. Contact us if you have concerns about how we use your data.

For EU/EEA residents, these rights are provided under the General Data Protection Regulation (GDPR). Our legal basis for processing is:

• Contract performance for core service features (recording, transcription, insight extraction)
• Legitimate interest for service improvement and security
• Consent for analytics (PostHog), which you can withdraw at any time

Cookies

Phraseback uses essential cookies only by default. These are required for authentication and session management.

Analytics cookies (PostHog) are loaded only after you give consent. If you are in the EU/EEA, a consent banner will appear on your first visit. You can accept or decline. Your preference is stored locally and respected on future visits.

We do not use advertising cookies or tracking pixels.

Children

Phraseback is not directed at children under the age of 16. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to this policy

If we make material changes to this policy, we will notify you by email or in-app notice at least 30 days before the change takes effect.

Contact

Questions about this privacy policy or your data:

Email: hello@phraseback.com

Last updated: July 2026