Privacy Policy — Speakate
Last updated: 10 September 2026
Speakate is a voice practice app. This policy explains what it stores, where it goes, and how to get rid of it.
Who runs the app
Rafael Hernandez Vantuyl ("we") operates Speakate. Questions or requests about your data: rhernandezvantuyl@gmail.com.
What we collect
Two things leave your device, and only because the app cannot work without them. A third — your voice — is recorded but never leaves. See "Recordings stay on your device" below.
Your account. An email address and a password. The password is never stored as text — it is hashed by our authentication provider and we cannot read it. We use the email to identify your account and nothing else. We do not send marketing email.
Your practice log. When you finish a drill, we record which drill it was, when you did it, which day it counted toward, which module it belonged to, and the points it earned. Your badges and your settings are stored the same way: your daily goal, your reminder preferences, and — if you answered the question at the start of the course — what you told us trips you up about your voice. That last answer sets the order of the modules, and that is the only use it has. No audio and no transcript is part of this.
Everything else the app shows you — your streak, your level, your statistics, your position on the path — is calculated from that log on your device. We do not store those figures.
Recordings stay on your device
Speakate records your voice, because hearing yourself back is most of how the practice works. Here is exactly what that means.
When the microphone is on. Only while you are pressing or holding a record control. The app asks for microphone permission the first time you do that, not when you open a screen, and it never records in the background or while the app is closed.
Where the recordings go. Into the app's own private storage on your phone. They are not uploaded, not backed up to us, and not shared with anyone. Deleting the app deletes them. The two "before" takes you record at the start of the course stay on your device for the length of the course so you can play them beside a later recording and hear the difference — that comparison happens entirely on your phone.
What we do with them. Nothing, because we never receive them. Your recording is stored and played back on your own device and nothing else happens to it: it is not measured, scored, or turned into text, by us or by anything on your phone.
No speech to text. The app does not convert your speech into text. It asks for no speech recognition permission and contacts no transcription service, on your device or anywhere else.
What we do not collect
- No audio reaches us. We never receive a recording, and the app produces no transcript and no measurement to send. Nothing about how your voice sounds is stored on our servers.
- No analytics or tracking. There is no analytics SDK, no advertising identifier, no third-party tracker, and no cross-app or cross-site tracking.
- No location, contacts, photos, or health data.
- No profiling and no automated decision-making.
Reminders
If you turn on voice nudges, the reminders are scheduled by your phone's own operating system and displayed by it. Their content is chosen on your device from a list built into the app. No reminder is sent from a server, and we are not told whether one was shown or opened.
Where your data is stored
On your device, and on our hosting provider Supabase (a database and authentication service), in the United States (US East, Northern Virginia). Supabase processes this data on our instructions as our service provider; they do not use it for their own purposes. Their privacy terms: https://supabase.com/privacy
If you are in Europe or the UK, this means your data is transferred to the United States. We rely on the standard contractual clauses in Supabase's data processing agreement to cover that transfer.
Cloudflare. Sign-in and sign-up are protected by Cloudflare Turnstile, an anti-bot check. Cloudflare receives your IP address and basic browser signals to confirm you are not a bot. It does not track you across sites and the data is not used for advertising. Their privacy policy: https://www.cloudflare.com/privacypolicy/
Resend. The confirmation code and password reset emails are delivered by Resend, an email service. Resend receives your email address and the contents of that message so it can send it, and uses your address for nothing else. Their privacy policy: https://resend.com/legal/privacy-policy
Data on your phone is held in the app's private storage. Your login session is encrypted, with the encryption key kept in the device keychain (iOS Keychain / Android Keystore).
Traffic between the app and the server is encrypted with TLS. Our database enforces row-level security, meaning each account can only ever read or write its own rows.
Who we share it with
Nobody. We do not sell, rent, or trade your data, and we share it with no third party other than the service providers named above. We would disclose data if legally compelled to, and would tell you unless prohibited from doing so.
How long we keep it
Until you delete it. There is no separate retention period: your account and practice log persist while the account exists.
Deleting your data
In the app: Settings → Privacy → Delete account. This permanently erases your account, practice log, badges and settings from our servers and from the device. It takes effect immediately and cannot be undone.
Clearing one device only: Settings → This device → Clear local copy removes the local cache. It does not delete your account, and your data downloads again on the next sync.
If you cannot access the app, email rhernandezvantuyl@gmail.com from your account's email address and we will delete it for you within 30 days.
Your rights
Depending on where you live — including under the GDPR (Europe/UK) and the CCPA/CPRA (California) — you may have the right to access your data, correct it, delete it, obtain a copy in a portable format, or object to how it is processed. We honour these requests regardless of where you live. Email rhernandezvantuyl@gmail.com and we will respond within 30 days.
Because we sell no data and run no advertising, there is nothing to opt out of for the purposes of the CCPA's "sale" or "sharing" provisions.
Our legal basis for processing under the GDPR is the performance of our contract with you: we hold your email to give you an account, and your practice log to give you the app's core function.
Children
Speakate is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, email us and we will delete it.
Changes
If we change this policy we will update the date at the top and, for anything that materially affects you, notify you in the app before it takes effect.