Privacy Policy
Phraseback helps you learn languages by capturing audio from your tutoring sessions and turning it into structured insights. This policy explains what data we collect, how we process it, and what control you have.
What we collect
Audio recordings. When you record a session (via the desktop app), we capture the audio from your tutoring call. This includes your voice and your tutor's voice.
Transcripts and insights. We process your recordings to produce transcripts and linguistic insights (Nuance Cards, Gentle Corrections, Cultural Notes, Practice Prompts). These are stored as text in our database.
Calendar metadata. If you connect your Google Calendar, we read meeting titles and attendee email addresses to match sessions to tutors and pre-select your target language. We use this calendar metadata only to detect likely tutoring sessions and support the calendar features you enable.
Account information. Your name, email address, and profile photo from your Google or Apple sign-in provider. We also store your language preferences and subscription status.
Payment information. Billing details are collected and processed by Stripe. We do not store your card number or bank details on our servers.
Usage data. Basic analytics (page views, feature usage) via PostHog. For EU/EEA visitors, analytics are only loaded after you give consent. See the Cookies section below.
How we process your audio
Your audio follows this path:
- Upload. Recorded audio files are uploaded to Cloudflare R2 (object storage, zero-egress).
- Transcription. Audio is sent to OpenAI (GPT-4o Transcribe) to produce a text transcript. OpenAI handles the audio under its API terms to provide transcription and does not use it to train OpenAI models.
- Insight extraction. The transcript is sent to Anthropic (Claude) to identify and explain linguistic insights. Anthropic handles the transcript under its API terms to provide this analysis and does not use it to train Anthropic models.
- Storage. The resulting transcript and insights are saved in our Postgres database (hosted on Tiger Cloud) — those are what we keep, not the raw audio. Once a session has been processed into your transcript and learning notes, its raw recording is automatically deleted from our storage within 30 days. A recording that hasn't been processed (for example, one that failed) is kept no longer than your account itself — deleting your account deletes all of your recordings (see below).
At no point is your audio or transcript used to train any AI model.
What we store and for how long
| Data | Where | Retention |
|---|---|---|
| Audio recordings | Cloudflare R2 | Deleted after processing (kept up to 72h if processing fails) |
| Transcripts and insights | Tiger Cloud Postgres | While your account is active |
| Account info | Tiger Cloud Postgres | While your account is active |
| Calendar metadata | Tiger Cloud Postgres | While your account is active |
| Payment records | Stripe | Per Stripe's retention policy and legal requirements |
When you delete your account, we begin a 30-day grace period. After that, all your data (recordings, transcripts, insights, calendar links) is permanently deleted. Billing records required by law may be retained.
Third-party processors
We share data with these services, each for a specific purpose:
| Service | Purpose | Data shared |
|---|---|---|
| OpenAI | Audio transcription | Audio recordings |
| Anthropic | Insight extraction | Transcripts |
| Stripe | Payment processing | Billing details, email |
| Cloudflare | File storage (R2) | Audio recordings |
| Vercel | Web app hosting | Standard request logs |
| Resend | Transactional email | Email address, name |
| PostHog | Analytics (consent-gated for EU) | Anonymous usage events |
| Google / Apple | Authentication | OAuth profile data |
We do not sell your data to anyone. We do not share your data with advertisers.
Google Calendar data
Connecting Google Calendar is optional. Phraseback's core features — recording your sessions and generating language insights — work fully without it, and we do not request Calendar access during ordinary Google sign-in. You can connect it later in Settings, and disconnect at any time.
If you choose to connect it, Phraseback requests read-only access to your Google Calendar. We use it for one purpose: detecting your language-tutoring sessions. To do that, we inspect upcoming calendar event metadata, such as event titles, descriptions, attendee email addresses, times, and meeting links, to identify likely tutoring sessions, match a recording to the right tutor, and pre-select the lesson's target language. We do not use Google Calendar data for advertising, selling data, or any purpose unrelated to these calendar-detection features.
Phraseback's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We use Google Calendar data only to provide or improve the calendar-detection features described above.
- We do not sell Google Calendar data, and we do not transfer, sell, or use it for serving ads, including retargeting, personalized, or interest-based advertising.
- We do not allow humans to read Google Calendar data unless you give us affirmative permission to view specific data, it is necessary for security purposes, or it is necessary to comply with applicable law.
- You can disconnect Google Calendar at any time in Settings; recording and insights keep working without it.
Your rights
You have the right to:
- Access your data. Your sessions, transcripts, and insights are visible in the Phraseback journal at any time.
- Correct your data. Contact us to update inaccurate account information.
- Delete your data. You can delete your account from Settings. A 30-day grace period lets you change your mind. After that, deletion is permanent and irreversible.
- Export your data. Data portability features are planned. In the meantime, contact us to request an export.
- Object to processing. Contact us if you have concerns about how we use your data.
For EU/EEA residents, these rights are provided under the General Data Protection Regulation (GDPR). Our legal basis for processing is:
- Contract performance for core service features (recording, transcription, insight extraction)
- Legitimate interest for service improvement and security
- Consent for analytics (PostHog), which you can withdraw at any time
Cookies
Phraseback uses essential cookies only by default. These are required for authentication and session management.
Analytics cookies (PostHog) are loaded only after you give consent. If you are in the EU/EEA, a consent banner will appear on your first visit. You can accept or decline. Your preference is stored locally and respected on future visits.
We do not use advertising cookies or tracking pixels.
Children
Phraseback is not directed at children under the age of 16. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
Changes to this policy
If we make material changes to this policy, we will notify you by email or in-app notice at least 30 days before the change takes effect.
Contact
Questions about this privacy policy or your data:
Email: hello@phraseback.com
Last updated: June 2026