Privacy Policy

1. Who we are

SPANYX (“we”, “our”) provides a mobile-first Spanish learning experience including lessons, games, and slang content. This policy applies globally and is designed to comply with the EU GDPR, the UK GDPR, the California CCPA/CPRA, and similar laws.

2. Data we collect

• Account: Google email, name, profile photo URL.
• Onboarding: nationality, native language, CEFR level.
• Learning: lesson progress, scores, streaks, XP, tokens.
• Payments: Stripe customer + transaction IDs (no card data).
• Technical: device, browser, IP, language, error logs.
• Cookies: see §7.

3. How we use it

• Provide and personalize lessons.
• Process token purchases and prevent fraud.
• Improve the product (anonymized analytics, with consent).
• Comply with legal obligations.

We do not sell your personal information and we do not use your data to train AI models.

4. Voice call recording

SPANYX offers voice calls and, where applicable, video calls between users for language practice. Calls use real-time communication technology and are not recorded by default. If, in the future, any feature requires recording, we will request your explicit consent before any recording takes place.

4a. Call metadata

We may store certain technical metadata related to calls, such as date and time, duration, participant identifiers, connection status, connection quality, termination reason, and any associated reports. This metadata does not include the content of conversations.

4b. Microphone & camera permissions

The app will request access to your microphone when required to place or receive a call. Camera access is only requested when you start or accept a video call. You can revoke these permissions at any time from your browser or device settings.

4c. Safety & moderation

Certain data may be used to prevent abuse, investigate reports, detect fraud, protect the safety of the community, and enforce our Terms of Service.

4d. Blocking & reporting data

We may store information related to blocks between users, reports submitted, moderation decisions, and disciplinary actions. This data is used exclusively to maintain the safety and integrity of the platform.

4e. Profile visibility during calls

During a call, your partner may see certain information from your profile, such as your username, profile photo, native language, target language, Spanish level, and country or region — but only where such information is part of your public profile. Private information such as your email address, postal address, phone number, or payment details is never shared with other users.

4f. Real-time communication technology

Calls rely on real-time communication technology (for example, WebRTC or an equivalent technology). To establish a connection, certain technical data required for the service to function — such as IP addresses or other network identifiers — may be exchanged between participants and the supporting infrastructure.

4g. Emergency services

Calls within SPANYX are not a substitute for emergency services and must not be used to contact police, fire, medical, or any other emergency services.

5. Legal bases (GDPR)

• Contract: account, lessons, payments.
• Consent: analytics, marketing.
• Legitimate interest: security, fraud prevention, abuse moderation.
• Legal obligation: tax records, lawful requests.

6. Your rights

EU/UK (GDPR): access, rectification, erasure, restriction, portability, objection, and the right to lodge a complaint with your supervisory authority.

California (CCPA/CPRA): right to know, delete, correct, opt-out of sale/sharing (we do not sell), limit use of sensitive information, and non-discrimination.

You can exercise these rights from your profile (export and delete) or by emailing us.

7. Cookies & local storage

We use three categories:

• Necessary: session, security, basic functionality. Always on.
• Analytics: anonymized usage metrics (PostHog). Off by default.
• Marketing: campaign measurement and personalized communications. Off by default.

You can change your preferences at any time from your Profile.

8. Sub-processors

Supabase (hosting, database), Stripe (payments), Google (authentication), Sentry (error monitoring), PostHog (analytics, only with consent).

9. International transfers

Some sub-processors are based in the United States. Transfers rely on Standard Contractual Clauses or equivalent safeguards.

10. Retention

• Account & learning data: until you delete your account.
• Payment records: 7 years (legal/tax).

11. Children

SPANYX is not directed to children under 13 (or 16 in the EU). We do not knowingly collect their data.

12. Contact

Privacy requests: please use the in-app account deletion / export tools, or contact us through the email associated with your Google account.