Spokit Privacy Policy

Effective date: September 28, 2026

This Privacy Policy explains how PodFlyy LLC ("PodFlyy," "Spokit," "we," "us," or "our") collects, uses, discloses, and protects personal information when you use the Spokit mobile application for iOS (the "App") and related services, and when you contact us or visit spokit.app (together, the "Service"). This policy is published at spokit.app/privacy.

Spokit is a language-learning application. It turns typed or spoken practice prompts into phrase cards, translations, word-by-word ("token") analysis, optional audio pronunciation, and spaced-repetition review. With Speak, you can practice a spoken conversation with an AI conversation partner. With Catch, you can also photograph an everyday object and turn it into a phrase card.

If you have questions about this policy or your personal information, contact us at [email protected].

1. Who We Are (Data Controller)

The controller responsible for your personal information is:

PodFlyy LLC Email: [email protected] Website: spokit.app

For users in the European Economic Area ("EEA"), the United Kingdom ("UK"), and other regions with similar laws, PodFlyy LLC is the "controller" of your personal information. Our third-party service providers described in Section 6 act as our "processors" or independent controllers as noted.

2. Scope

This policy applies to personal information we process through the Spokit iOS App and the Service. It does not apply to third-party services that operate under their own privacy policies, including the Apple App Store, Apple ID, and any third-party website you reach through a link. We encourage you to review those third parties' privacy notices.

3. Information We Collect

We collect only the information we need to operate Spokit's language-learning features, manage your account and subscription, keep the Service secure and reliable, and provide support. We describe each category below, including its source and the purposes for which we use it.

3.1 Account and Authentication Data

• Email address, provided through Sign in with Apple, Google sign-in, or email/password sign-in.
• Name (optional), either typed by you in the App or provided by Sign in with Apple or Google if you choose to share it, used for in-app display.
• Account, session, and authentication-provider identifiers, including a Spokit user identifier, sign-in provider identifier, session and refresh tokens, and, for subscriptions, a RevenueCat app user identifier.

Source: you and your chosen sign-in provider (Apple or Google). Purpose: create and secure your account, authenticate you, and enable subscription restore and cross-device continuity.

3.2 Profile and Learning-Preference Data

• Native language and target language, learning goal and level, daily and weekly goals, reminder settings, in-app language, and audio/display preferences.

Source: you, during onboarding and in settings. Purpose: personalize your learning experience, generate relevant practice content, and deliver reminders you enable.

Spokit's current version does not ask for your age range, date of birth, or free-text location.

3.3 Learning Content and User-Generated Content

• Typed practice prompts and phrases; generated target-language and native-language phrases; saved phrase cards; word/token analysis and vocabulary; review history; journal/review entries; and the transcripts of answers you speak during review, which an AI model checks.

Source: you, and content generated for you by the Service in response to your input. Purpose: provide, store, and synchronize your learning content and progress.

3.4 Voice Recordings and Audio Data

• Short voice recordings that you choose to make when you use a speech feature (spoken practice prompts, Speak conversation turns, and spoken review answers), and the resulting transcription text.
• Generated audio (text-to-speech) for pronunciation and for Speak replies, produced for playback.

Source: you (microphone), and audio generated for you. Purpose: transcribe your speech into practice text and provide audio pronunciation. See Section 7 for audio-specific handling and retention.

3.5 Purchase and Subscription Data

• Subscription entitlement state, product identifiers, trial status, renewal/cancellation/expiration status, billing-period metadata, purchase-lifecycle events, and App Store/RevenueCat app user identifiers.

Source: Apple's App Store and our subscription processor (RevenueCat). Purpose: activate and manage your Spokit Pro subscription, enforce your credit allowance, send subscription-related notices, and support billing questions. We do not receive or store your full payment-card number; Apple processes all payments.

3.6 Product-Interaction and Usage Data

• App interaction and reliability events such as phrase creation, saved review items, audio failures, rate-limit events, subscription state changes, and credit usage.

Source: your use of the App. Purpose: operate credit and rate-limit systems, prevent abuse, diagnose failures, and improve reliability.

3.7 Device and Technical Data

• App version and configuration, your device's time zone setting (used for Catch's daily limit), and limited diagnostic and platform data needed for security, rate limiting, local notifications, app updates, and backend reliability.

Source: your device and our backend. Purpose: keep the Service secure, functional, and reliable.

3.8 Camera Photos and Catch

Catch is available only when you are signed in with a permanent account. It is not available to guest users. The Catch preview shown during onboarding uses sample photos included in the App; it does not use your camera and does not upload or save anything.

• Catch photos. Spokit uses the camera only after you open Catch and grant camera permission, and it takes a photo only when you press the shutter. Catch does not read your photo library. On your device, the App crops the photo to the area shown in the camera view, reduces it to at most 1024 pixels on its longest side, and saves it as a new JPEG image. Only this processed copy is uploaded to our backend. Our server then re-encodes it again, which removes metadata such as location, before it is used. The original camera photo stays on your device and is deleted after processing.
• Object cut-outs. After the object is identified, the App uses Apple's on-device Vision technology, guided by the object outline returned by the AI model, to cut the object out of the processed photo as a transparent image (a "sticker") and uploads it so it can be shown with your Catch. If the processed photo is no longer on the device you are using, the App downloads it from our backend to make the cut-out.
• Catch results. The object's name, translation, example phrase, word analysis, the object's position and outline in the photo, and optional pronunciation audio. If you edit a proposed card, we also process your edited text. If the object is already on your Shelf, we compare the proposed phrase with up to 20 of your existing phrases for that object to avoid duplicates.
• Catch request records. For each Catch, we keep a record of the request without the photo: the identified object's name and proposed card text, your language pair, the request's status, and your device's time zone. These records stay with your account until you delete your account.
• Sharing. If you tap Share, the App creates a temporary image of your Catch card or Shelf on your device and passes it to the iOS share sheet. The app or person you choose receives that image under their own terms. The App deletes its temporary copy after sharing.

Source: you (camera), and content generated for you from the photo. Purpose: identify the object you photographed, show you a proposed phrase card, and save the Catch to your Shelf and your deck if you tap Keep.

Please photograph everyday objects. Do not use Catch to photograph people, faces, documents, screens, or other private or sensitive material.

3.9 Speak Conversations and Conversation Memory

• Conversation turns. When you speak a turn in Speak, it is transcribed (see Section 7). The transcript, the recent turns of the conversation, your language pair and level, and your conversation memory (below) are sent to our AI providers to write Spokit's reply, check possible corrections, and prepare feedback on what you said. Spokit's reply is turned into audio by our text-to-speech provider.
• Conversation history and feedback. When conversation memory is on, we store a shortened copy of each turn (your transcribed words and Spokit's reply) together with the feedback shown to you and your responses to it, for example confirming a correction or telling us that the transcript is not what you said. Even when memory is off, we keep a copy of the latest turn for about 15 minutes so that an interrupted turn can be retried.
• Conversation memory. When conversation memory is on, the AI may remember short notes from your conversations, such as your interests, preferences, learning goals, or something you told it about yourself, and a running summary of your conversations in each language, so that later conversations can build on them. We keep up to 30 notes per language. The AI is instructed not to remember sensitive information such as health, religion, political views, sexuality, immigration status, addresses or contact details, finances, passwords, or details about other identifiable people, and we automatically filter notes for such content; this filtering may not catch everything.
• Your controls. Conversation memory ("Remember conversations") is on by default. In Profile → Conversation memory you can view your remembered notes, delete a single note, clear all notes, clear your conversation history, and turn memory off. Turning memory off stops new history and notes from being saved, but it does not delete what is already saved; use the clear options to delete it.

Source: you (microphone and your conversation), and content generated for you. Purpose: hold the conversation, give you feedback on your speaking, and personalize later conversations.

3.10 Advertising Measurement (Meta and TikTok SDKs)

We advertise Spokit on Meta (Facebook and Instagram) and TikTok. To measure whether those ads lead to app installs and subscriptions, the iOS App includes the Meta SDK and the TikTok Business SDK. These SDKs automatically send app events to Meta and TikTok: the App being installed and opened, whether you open it again the next day (TikTok), and App Store purchase and subscription events. The events include technical information about your device and the App, such as device model, operating-system version, app version, language, time zone, and identifiers that the SDKs create or read for this purpose.

We do not pass your name, email address, Spokit account identifier, learning content, voice recordings, transcripts, conversation memory, or photos to these SDKs. Spokit does not ask for App Tracking Transparency permission, so the SDKs cannot access your device's advertising identifier (IDFA), and IDFA collection is turned off in the Meta SDK. Meta and TikTok process this information under their own terms and privacy policies, including for their own purposes.

Source: your device and your use of the App. Purpose: measure the effectiveness of our own advertising campaigns.

3.11 Website Waitlist

If you join the waitlist on spokit.app, we collect your email address, the page you signed up from, any campaign tags in the link you followed (UTM parameters), and the time you agreed to receive emails. We use them to send you early-access and occasional product emails. You can unsubscribe or ask us to remove you at any time. To prevent abuse, we rate-limit sign-ups using a shortened one-way hash of your IP address.

Spokit does not show third-party advertising in the App, and we do not sell your personal information. Apart from the advertising-measurement SDKs described in Section 3.10, we do not share information about your use of Spokit with advertising companies.

4. How We Use Your Information

We use personal information to:

1. Create, authenticate, and manage your account and sessions.
2. Generate language-learning phrases, translations, token analysis, speech transcription, and optional pronunciation audio; hold Speak conversations and give feedback on your speaking; and identify objects in photos you take with Catch.
3. Store and synchronize your learning content and progress across sessions and devices, and, if conversation memory is on, remember details from your Speak conversations to personalize later ones.
4. Operate the credit allowance, subscriptions, rate limits, abuse prevention, and security controls.
5. Send you service and transactional messages (for example, password-reset, welcome, trial, and subscription-lifecycle emails), and, if you join our website waitlist, early-access and product emails.
6. Provide customer support and respond to your requests, including account deletion and data-access requests.
7. Maintain, secure, and improve the reliability of the Service, diagnose failures, and measure the effectiveness of our own advertising campaigns (see Section 3.10).
8. Comply with legal, tax, billing, App Store, and security obligations, and enforce our Terms of Use.

We do not use your learning content, voice recordings, transcripts, conversation memory, or Catch photos to serve advertising, and we do not sell them.

5. Legal Bases for Processing (EEA/UK)

If you are in the EEA or UK, we rely on the following legal bases under the GDPR and UK GDPR:

Where we rely on legitimate interests, we have balanced those interests against your rights. You may object to processing based on legitimate interests as described in Section 10.

6. Third-Party Service Providers (Processors)

We share personal information with a limited set of service providers who process it on our behalf to operate specific features. We do not sell this information. Except for Meta and TikTok as described in Section 3.10, providers are permitted to use it only to provide their service to us. Spokit uses the following third-party providers in this version:

For Catch, we send the processed photo inside the request itself; we do not store it in a separate file service at OpenRouter or Google. We configure Catch requests so that OpenRouter uses only provider endpoints that it lists as not retaining request data (zero data retention) and not using it for training. Providers still process each request to return a result. For our other AI features, OpenRouter and the model providers process the request content under their own terms, which may allow them to keep it for a limited period (for example, to monitor abuse) and, depending on the provider, to use it to improve their services. These providers may be located outside your country (see Section 9).

We may also disclose personal information (a) to comply with law, legal process, or lawful government requests; (b) to enforce our Terms or protect the rights, safety, and security of our users, the public, or PodFlyy; and (c) in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honor this policy or notify you of any material change.

7. Microphone and Audio Handling

Audio is handled carefully and only when you choose to use a speech feature:

• Recorded only on your action. Spokit accesses the microphone only after you grant permission and only while you actively record a practice prompt, a Speak turn, or a spoken review answer. You can type instead of speaking wherever the App offers typing.
• Used to transcribe your speech. When you submit a recording, it is temporarily stored in our backend (Convex) and sent to our speech provider (ElevenLabs) solely to produce a transcription.
• Input recordings are deleted promptly. After transcription completes, the underlying voice recording you submitted is deleted from our storage. Unused upload grants expire within a short window (about ten minutes) and are cleaned up automatically. We do not retain a library of your practice recordings.
• Generated audio. Text-to-speech audio generated for playback may be stored so you can replay it. Audio that is not attached to saved content is deleted after 14 days; audio for a saved phrase is kept while the phrase exists. When you delete your account, your generated audio is deleted, except audio of phrase text that other learners also use, which is kept without any link to you.
• Provider processing. Audio and phrase text sent to ElevenLabs are processed by ElevenLabs to provide transcription and synthesis to us, under ElevenLabs' terms; we do not authorize its use for advertising.

Please do not record sensitive, confidential, or regulated information as practice content.

8. Data Retention

We keep personal information only as long as needed for the purposes described in this policy, then delete or de-identify it. Specific practices include:

We may retain limited information longer where required to comply with legal obligations, resolve disputes, prevent fraud, or enforce our agreements.

9. International Data Transfers

We are based in the United States, and our service providers may process and store personal information in the United States and other countries that may have data-protection laws different from those in your country. Where we transfer personal information out of the EEA, the UK, or Switzerland, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), or another lawful transfer mechanism. You may contact us at [email protected] for more information about these safeguards.

10. Your Rights and Choices

Depending on where you live, you may have some or all of the following rights regarding your personal information:

• Access / know — request confirmation of whether we process your personal information and a copy of it.
• Correction — request that we correct inaccurate information.
• Deletion — request that we delete your personal information.
• Portability — request a copy of certain information in a portable format.
• Restriction / objection — restrict or object to certain processing, including processing based on legitimate interests.
• Withdraw consent — withdraw consent where we rely on it, without affecting prior processing.

How to exercise your rights

• Delete your account and data in the App. You can delete your account at any time from Profile → delete account. This removes your Spokit account and associated learning data, including your phrases, tokens, reviews, journal entries, language decks, Speak conversation history and conversation memory, Catch objects, photos, and request records, saved and generated audio, usage events, and sign-in records, except limited information we must retain for legal, security, tax, billing, or fraud-prevention reasons. Information that Apple, RevenueCat, Meta, or TikTok already received is handled under their own policies.

  Deleting your Spokit account does not cancel an active App Store subscription. Manage or cancel your subscription in your Apple ID settings (Settings → your name → Subscriptions), and see the Terms of Use for subscription details.

• Manage conversation memory in the App. In Profile → Conversation memory you can delete a single remembered note, clear all notes, clear your Speak conversation history, and turn memory off.

• Delete a Catch in the App. You can delete an object from your Shelf. This deletes its photo and object cut-out. The object's text record (without a photo) stays with your account until you delete your account, and any phrase the Catch added to your deck stays until you delete that phrase or your account.

• Contact us. For access, correction, portability, or any other request, email [email protected]. We will verify your request and respond within the time required by applicable law. You may use an authorized agent where the law permits; we may ask for proof of authorization.

We will not discriminate against you for exercising your privacy rights.

EEA/UK residents may lodge a complaint with their local data-protection authority (in the UK, the Information Commissioner's Office). We would appreciate the chance to address your concerns first.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, provides the rights described below.

Categories of personal information we collect (as defined by California law):

Sources, purposes, and disclosures. We collect these categories from the sources and for the business purposes described in Sections 3–7. We disclose personal information to the service providers listed in Section 6 for those business purposes only, and to Meta and TikTok for advertising measurement as described in Section 3.10.

Selling and sharing. We do not sell your personal information for money. The app events that the Meta and TikTok SDKs send for advertising measurement (Section 3.10) may count as "sharing" for cross-context behavioral advertising under California law. Apart from those events, we do not sell or share personal information.

Do Not Sell or Share My Personal Information. These events are not linked to your name, email address or Spokit account, so we cannot match them to you after they are sent. To stop them, delete the App from your device. You can also email [email protected] with the subject "Do Not Sell or Share", and we will handle your request as California law requires.

Sensitive personal information. We do not use or disclose sensitive personal information for purposes that would require offering a right to limit under the CPRA.

Your California rights include the right to know, the right to delete, the right to correct, and the right to non-discrimination for exercising your rights. To exercise them, delete your account in the App or contact [email protected]. We will verify your request as required by law. Authorized agents may submit requests with proof of authorization.

Residents of other U.S. states with comprehensive privacy laws may have similar rights and can exercise them the same way.

12. Children's Privacy

Spokit is intended for a general audience and is not directed to children. You must be at least 13 years old (and at least 16 in the EEA, or the minimum age of digital consent in your country) to use Spokit, or older where required by local law and the App Store.

We do not knowingly collect personal information from children under 13 (or under the applicable minimum age in your region). If you believe a child has provided us personal information, contact [email protected] and we will delete it. Spokit is not part of the Apple Kids Category and does not use content directed to children.

13. Security

We use managed, industry-standard providers for our backend, authentication, storage, and email delivery, and we apply access controls, encryption in transit, short-lived upload credentials, and rate limiting to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please keep your device and sign-in credentials secure, and avoid submitting sensitive or confidential information as practice content.

14. Apple App Store Privacy ("Nutrition Label") Mapping

Spokit's App Store privacy details describe the data the App collects. The data Spokit collects to provide its features is linked to your identity and used for App Functionality:

The Meta and TikTok SDKs described in Section 3.10 also collect identifiers created or read by those SDKs, app install and launch events, and purchase events, which are used to measure our advertising. The App Store listing shows our current declarations, including how Apple's definition of tracking applies.

15. Advertising and Tracking

Spokit does not display third-party advertising in the App. It does not ask for App Tracking Transparency permission and does not collect your device's advertising identifier (IDFA). The Meta and TikTok SDKs described in Section 3.10 send app install, launch, and purchase events and device information to Meta and TikTok so that we can measure our own advertising campaigns. We do not sell your personal information.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our features, service providers, or legal requirements. When we make material changes, we will update the "Effective date" above and, where appropriate, provide additional notice in the App or by email. Your continued use of Spokit after an update takes effect means you accept the revised policy.

17. Contact Us

For any privacy question or request, contact:

PodFlyy LLC Email: [email protected] Website: spokit.app