Privacy Policy
This policy explains what personal data HeyFluent collects when you use the app, why we collect it, who we share it with, and the rights you have over it. We have written it in plain language and kept it specific to what the product actually does.
Contents
1Who we are
HeyFluent is a language-learning web app operated by Benjamin Christopher Dawson, based in Zürich, Switzerland ("we", "us"). We are the data controller for the personal data described in this policy, which means we decide why and how it is processed.
Postal address: 8 Bucheggstrasse, 8037 Zürich
Contact for privacy matters: show email address
Because we are established in Switzerland and offer the service to people in the European Economic Area, this policy is written to meet both the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR).
2The data we collect
Account and identity
When you create an account, sign-up and log-in are handled by our authentication provider, Clerk. Clerk collects and stores your email address, your password (which we never see), and any name you provide. Within HeyFluent itself we store only your Clerk user ID, which links your account to your learning data.
Your learning content and progress
To make daily practice work, we store what you do in the app, keyed to your account:
- Progress and mastery data: drill statistics, which words and grammar points you know or are weak on, streaks, and study time, per language.
- Text you write: your writing compositions, your typed answers to listening exercises, and the vocabulary example sentences you save. These are stored so you can review your history.
- Speaking practice: transcripts of your spoken conversations with the AI practice partner (produced by your browser's speech recognition), and the AI's feedback, which may quote phrases you said.
- Reading and session logs: which texts you read, minutes spent, and words you looked up.
Reminders and accountability
If you turn on reminders, we store your reminder email address, your practice goal, timezone, and any implementation-intention plan text you enter (your cue, time and place for studying). If you add an accountability partner, we store that person's name and email address so we can send them your weekly progress. See section 10.
Payments and subscription
If you subscribe to HeyFluent Pro, payment is handled by Stripe on Stripe-hosted checkout pages. Your card details are entered directly with Stripe and never reach our servers. We store only your Stripe customer and subscription identifiers and your current plan status.
Usage analytics
We use PostHog (EU-hosted) to understand how the app is used: page views and events such as which skill you opened, which language you switched to, and when a subscription checkout was started. These events are linked to your user ID. We do not send the text you write to our analytics.
Technical data
Like any web service, our hosting provider processes standard technical data needed to deliver the app, such as your IP address and browser type, as part of serving requests and keeping the service secure.
3How and why we use it, and our legal basis
| What we do | Why | Legal basis (GDPR) |
|---|---|---|
| Run your account and save your progress across sessions and devices | To provide the core service you signed up for | Performance of a contract |
| Give AI feedback on your writing, speaking and listening; look up words | These are features of the service | Performance of a contract |
| Send reminder, streak and partner emails | You asked us to | Consent (you opt in, and can turn it off) |
| Take payment and manage your subscription | To provide the paid tier | Contract, plus legal obligation for financial records |
| Product analytics to improve the app | To understand and improve how the app is used | Consent, or our legitimate interest where consent is not required |
| Keep the service secure and prevent abuse | To protect users and the service | Legitimate interest |
Under the Swiss FADP we do not always need one of the bases above to process your data lawfully, but we have set them out for transparency and because they apply to our EU users.
4AI processing of your practice
Several features send your input to AI providers so the app can respond:
- Your writing, speaking transcripts and listening answers are sent to Amazon Web Services (Bedrock), processed in an EU region, to generate feedback.
- Words you look up while reading (the word plus the surrounding sentence) and song lyric requests you type are sent to Anthropic to generate a translation or lyrics.
- Short phrases are sent to Amazon Polly (AWS) to generate spoken audio.
These providers process your input only to return a result to you. They do not use it to train their models. The AI gives you educational feedback on your language practice; it does not make any decision about you that has legal or similarly significant effects.
5Who we share it with
We do not sell your personal data and we do not share it for advertising. We share it only with the service providers ("processors") that make the app work, each acting on our instructions under a data processing agreement:
| Provider | What they do | Data involved |
|---|---|---|
| Clerk | Accounts and login | Email, password, name, session |
| Vercel | Hosting and app functions | Technical request data; all data in transit |
| Upstash / Vercel KV | Database storage | Your learning data, settings and progress |
| PostHog | Product analytics (EU-hosted) | Usage events, user ID |
| Stripe | Payments and subscriptions | Payment details, subscription status |
| Resend | Sending reminder and digest emails | Recipient email and name, your practice stats |
| Amazon Web Services | AI feedback (Bedrock) and speech (Polly) | Your compositions, transcripts, answers, text to speak |
| Anthropic | AI for word lookups and lyrics | Word plus sentence; song query |
We may also disclose data if required by law, or to establish, exercise or defend legal claims.
6International data transfers
Some of our providers are based in the United States (Clerk, Vercel, Stripe, Resend and Anthropic). When your data is transferred outside Switzerland or the EEA, we rely on appropriate safeguards: the European Commission's Standard Contractual Clauses, the Swiss addendum to those clauses, and, where applicable, the provider's certification under the EU-US and Swiss-US Data Privacy Framework. Our analytics (PostHog) and AI feedback (AWS Bedrock and Polly) are processed in EU regions.
7Cookies and local storage
We keep client-side storage to a minimum:
- Essential: Clerk sets cookies to keep you signed in. We store your user ID in your browser's local storage so the app can work offline, plus a small flag recording whether you have seen the "Add to Home Screen" prompt. The app cannot function without these.
- Analytics: where you have consented, or where consent is not required, PostHog sets cookies and local-storage entries to recognise your session for usage analytics.
We do not use advertising or third-party tracking cookies.
8How long we keep it
- Account and learning data: kept while your account is active, so your progress is there when you return. Deleted when you delete your account or ask us to.
- Session histories (writing, speaking, listening, reading): we keep a rolling window of your most recent sessions and automatically prune older entries.
- Weekly usage counters: expire after 14 days.
- Cached song lyrics: expire after 30 days and are not linked to you.
- Billing records: retained as long as required by Swiss and EU accounting law.
- Analytics: retained according to our analytics provider's data-retention settings.
9Your rights
Under the GDPR and the Swiss FADP you have the right to:
- access the personal data we hold about you, and receive a copy;
- have inaccurate data corrected;
- have your data deleted (for example by deleting your account);
- restrict or object to certain processing;
- receive your data in a portable format, or have it sent to another provider;
- withdraw consent at any time, without affecting processing already carried out.
To exercise any of these, email us at show email address. We will respond within the time limits set by law.
If you believe we have mishandled your data, you can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC), or, if you are in the EEA, to your local data protection authority.
10Accountability partners
If you add an accountability partner, you give us the name and email address of another person, and we email them your weekly practice summary with your email as the reply-to. Only add someone who has agreed to this. You are responsible for having their permission, and you can remove them at any time in the app, which stops the emails.
11Children
HeyFluent is not intended for children under 16, and we do not knowingly collect data from them. If you believe a child has given us personal data, contact us and we will delete it.
12Security
We protect your data with encryption in transit (HTTPS), access controls, and reputable infrastructure providers. No online service can be completely secure, but we take reasonable steps to protect your data and to notify you and the relevant authority if a breach requires it.
13Changes to this policy
We may update this policy as the app changes. When we do, we will change the "last updated" date above, and for significant changes we will give you notice in the app or by email.
14How to contact us
For any question about this policy or your data, email show email address, or write to us at 8 Bucheggstrasse, 8037 Zürich.