Privacy

Who holds your data

The data controller for everything described here is Kindsay. Write to support@kindsay.com about anything on this page, including the requests in Your rights.

There is no separate data protection officer and no support desk — that address is the only one, and it is read by the person who built the app.

Your voice is not recorded

No recording of you is ever written to disk — not on the server, not in the browser.

While you talk, the microphone audio is streamed straight to our speech-to-text provider and turned into text as you go. The audio is never saved to a file, and nothing plays it back later: the app has no way to replay a call, because there is nothing to replay. What survives the call is the text — what you said, what the speaker said, and the corrections made from it. The only audio files on our server are the synthesised speaker voices, which are cached so that the same line doesn't have to be generated twice. They are not yours — and nothing you said is ever sent to the service that makes them.

What we keep

If you only join the waitlist

Your email address, the moment you sent it, which form on the page you used, the plan you had selected if you had selected one, and the record of your consent: when you ticked the box and the sentence that was next to it. The row also holds a random code, which is what the unsubscribe link in our email carries so that it works without you signing in. That is the whole row. No account is created and nothing else is collected.

If you have an account

• Who you are: your email address, your first name, the emoji you picked, your level (B2, C1 and so on) and how intensive you want lessons to be.
• If you sign in with Google: Google gives us your email address, your name and a link to your profile picture. They sit in your login record; the app itself uses the email and your first name, and never shows the picture. Google tells us nothing else about your account, and we never post, read mail or touch anything on Google on your behalf. Google's own side of the sign-in is covered by their privacy policy.
• Who you learn with: the email address of the person you invited as a partner, or who invited you, and whether that invitation was accepted.
• Your lessons: each call — when it started and ended, how many minutes you actually spoke, which speaker, which scenario or lesson, and whether you finished it.
• Your mistakes: every correction, which keeps the phrase you said, the corrected version, the explanation and the grammar point behind it. This is the part of the app that is worth anything, and it is a record of your English.
• What your speakers remember: after each call a few short notes about your life that you mentioned — your work, plans, the people in it ("has a job interview on Fri 10 Oct") — so the next call can ask how it went. At most fifteen, the oldest dropped first. You see them all on Profile and can delete any of them, or all, at any time.
• Your progress: exercise attempts and scores, lessons completed, expressions you have met, and the report written after each call.
• Payments: your Stripe customer reference, which plan you are on, its status and its renewal date, and a record of each purchase and refund. Card numbers never reach us — the card is typed on Stripe's own checkout page, and we are told only that it worked.
• Technical: server logs and your IP address, used to apply rate limits and spot abuse.
• A visit count: when a page is opened we keep the page, the site that linked you to it if there was one, the country, region and nearest city your address is listed under, and a one-way code made from the day, your address and your browser. The place comes from a list we hold ourselves (DB-IP Lite, db-ip.com, used under CC BY 4.0) — your address is not sent anywhere and is not kept, and the city it gives is often the provider's exchange rather than where you are. The code tells two visitors apart on the same day and nothing else — see Cookies.

Why we are allowed to keep it

• The waitlist email — your consent (GDPR Art. 6(1)(a)). You gave it by ticking the box on the form, and we store the moment you ticked it and the exact sentence you agreed to, so that we can show what was asked and what was answered. You can take it back at any time, through the unsubscribe link in any email we send or by writing to us.
• Your account and your lessons — the contract with you (Art. 6(1)(b)). The app cannot teach you without keeping track of what you said and what you got wrong.
• Logs, rate limits, abuse checks and the visit count — our legitimate interest(Art. 6(1)(f)) in the service staying up, not being run up as a bill by strangers, and in knowing whether anyone is finding it.
• Payment and accounting records — a legal obligation (Art. 6(1)(c)) under Polish tax law.

Who else sees it

Kindsay depends on a few companies to run. Each is given only what it needs to do its job, under a data processing agreement, and none of them may use your data for their own purposes.

Where a company processes data outside the European Economic Area, it does so under the European Commission's standard contractual clauses. We do not sell your data, and we do not share it with advertisers — there are no advertisers.

How long it is kept

• A waitlist email: until you unsubscribe or ask us to drop it. If you unsubscribe we keep the address on a do-not-email list rather than erasing the row, so that it cannot be added back by someone else typing it into the form; it is used for nothing else. Ask us to erase it altogether and we will, the same day.
• Account data: for as long as the account exists. Delete the account and it goes with it, the same day.
• Payment records: as long as Polish tax law requires them to be kept, which is longer than the account itself.
• Server logs: a short rolling window, days rather than months.
• The visit count: 90 days, then the rows are deleted.

Your rights

Under the GDPR you may ask for a copy of your data, ask for it to be corrected or deleted, ask us to restrict or stop a particular use, object to processing based on legitimate interest, and ask for your data in a portable form. Where we rely on your consent, you can withdraw it at any time without giving a reason — that does not undo what was done while it stood.

Deleting your account is a button, not a request: Profile → Delete account. It removes your profile, progress, attempts, calls, corrections, reports and what your speakers remember, cancels any subscription, and deletes the login itself.

If you would rather we did it, or you want any of the other rights above, email support@kindsay.com. If you think we have handled your data badly, you can complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

Cookies and counting

No tracking cookies, no advertising, no analytics company — which is why this site has never shown you a cookie banner.

We do count how many people open the pages, but we do it ourselves, on our own server. When a page has loaded, a few lines of our own code in it tell our server which page it was and which site linked you there — that's how we tell people from the robots that fetch pages without opening them. No cookie, no pixel, nothing stored in your browser, and nothing is sent to anyone else. What a count keeps is the page you opened, the site that linked you to it if there was one, and a one-way code made from the day, your address and your browser — so that two people are not counted as one. Your IP address is not stored, the code is different tomorrow and cannot be tied to yesterday's or to your account, and the rows are deleted after 90 days.

The app does store a few things in your own browser, which never leave it and are not used to follow you anywhere: your sign-in session, so that you stay signed in; the plan you clicked on the pricing section, so it is still selected when you come back; and, briefly, the email you just signed out with, so the page can offer you the way back in. Clearing your browser data clears all of it.

Children

Kindsay is not intended for anyone under 16, and accounts are not knowingly created for them. If you believe a child has an account here, email us and it will be removed.

Changes to this page

If what we do with your data changes, this page changes with it and the date at the top moves. If the change is a significant one and you have an account, we will email you about it rather than hope you re-read the page.

See also the terms.