Privacy Policy

1. Who We Are

Say It Fluently ("we", "us", "the app") is a CEFR-based language learning application built with Flutter. The app helps users learn languages through spaced repetition, adaptive quizzes, and structured exam preparation.

We are the data controller responsible for your personal data processed through the app. For any privacy-related questions or requests, you can reach us at support@vitrify.no.

2. Data We Collect

2.1 Account Information

When you create an account, we collect:

• Email address — used for authentication, password recovery, and account identification.
• Username — a display name shown on leaderboards and in friend lists.
• Password — hashed by our authentication provider (Supabase Auth). We never store plaintext passwords locally or in our database.
• Age — collected during onboarding to verify eligibility and tailor content.
• Learning preferences — target language, current CEFR level, and learning goal.

2.2 Learning Progress & Usage Data

As you use the app, we store:

• Vocabulary — words you have learned, their SRS (spaced repetition) review levels, and review history.
• Study plans — your generated training schedules and sessions.
• Test sessions — quiz scores, test durations, and question types practiced.
• Metrics — total XP, level, streaks, study time, and achievement progress.
• Achievements — badges and milestones earned.

2.3 Social Data

If you use the social features, we store:

• Friendships — connections between you and other users.
• Friend requests — pending requests you send or receive.
• Leaderboard participation — your username, XP, level, and online status appear on leaderboards visible to other authenticated users.

2.4 Analytics Events

The app logs lightweight analytics events (such as dashboard views, button taps, calendar interactions, and leaderboard views) to a local file on your device. This data is not transmitted to any external analytics service. We do not use Firebase Analytics, Google Analytics, Amplitude, Mixpanel, or any other third-party analytics SDK.

2.5 Authentication Tokens

On the web version of the app, a Supabase Auth refresh token is stored in a first-party cookie (sif_rt) so your session persists across browser restarts. This cookie is set with SameSite=Lax and the Secure flag (on HTTPS connections), and expires after 365 days. On native platforms (Android, iOS), no cookie is used.

2.6 Summary of Data Collected

Data Category	Examples	Stored Locally	Stored in Cloud
Account	Email, username, age, learning preferences	Yes	Yes (Supabase)
Progress	Vocabulary, SRS history, study plans, test scores, XP, streaks, achievements	Yes	Yes (Supabase)
Social	Friendships, friend requests, leaderboard entries	No	Yes (Supabase)
Analytics	Dashboard views, button taps, calendar interactions	Yes (local file only)	No
Auth tokens	Supabase refresh token (web only)	Cookie (web only)	Managed by Supabase Auth
Device IDs	—	No	No
Location	—	No	No

3. How We Collect Data

• Directly from you — when you create an account, set learning preferences, or use app features.
• Automatically as you use the app — progress, metrics, and analytics events are generated during normal use.
• From OAuth providers — if you sign in with Google, Apple, Microsoft, or Facebook, we receive your email address and a provider-specific identifier. We do not access your contacts, posts, or other profile data from these providers.

4. Why We Collect Data & Legal Basis

Purpose	Data Used	Legal Basis (GDPR)
Provide authentication and account management	Email, password (hashed), OAuth identifier	Contract performance (Art. 6(1)(b))
Track learning progress and personalize content	Vocabulary, SRS history, study plans, test scores, XP, level	Contract performance (Art. 6(1)(b))
Enable social features (friends, leaderboards)	Username, XP, level, online status, friendships	Contract performance (Art. 6(1)(b))
Sync data across devices	Full profile data (sanitized, password excluded)	Contract performance (Art. 6(1)(b))
Maintain and improve app functionality	Local analytics events (not transmitted externally)	Legitimate interest (Art. 6(1)(f))

5. Where Data Is Stored

5.1 Local Storage

Your profile, progress, metrics, and local analytics are stored in a file called users.json on your device. On web, this uses IndexedDB; on native platforms (Android, iOS), it uses the device's file system. This data remains on your device even when you are offline.

5.2 Cloud Storage (Supabase)

When you are signed in, your data is synced to a Supabase backend for cross-device access and social features. The following tables are used:

• profiles — username, avatar path, target language, XP, level, online status, last seen, auth UID.
• user_data — your full profile as a JSON blob (vocabulary, SRS, study plans, metrics, achievements). Passwords are stripped before upload.
• friendships — bidirectional friendship connections.
• friend_requests — pending friend requests.
• auth.users (Supabase Auth) — email, hashed password, OAuth provider linkage.

6. Third-Party Services

6.1 Supabase

We use Supabase for authentication, database hosting, and cloud sync. Supabase processes data on our behalf as a data processor. See the Supabase Privacy Policy.

6.2 OAuth Providers

If you sign in with a social provider, that provider processes your authentication:

• Google Privacy Policy
• Apple Privacy Policy
• Microsoft Privacy Statement
• Facebook Privacy Policy

We only receive your email address and a provider-specific user identifier from these services. We do not request access to your contacts, posts, friends lists, or any other data from these providers.

7. Data Retention

• Account & progress data — retained for as long as your account is active. When you delete your account, all cloud data is permanently removed (see Section 10).
• Local data — remains on your device until you delete your account in the app or uninstall the app.
• Analytics events — stored locally only. Not transmitted to any server. Cleared when you delete your account or uninstall the app.
• Auth tokens — the refresh token cookie expires after 365 days. It is cleared immediately on sign-out or account deletion.
• Social data — friendships and friend requests are removed immediately when your profile is deleted (via database trigger).

8. Data Security

We take the following measures to protect your data:

• Password hashing — passwords are hashed by Supabase Auth using industry-standard algorithms. Plaintext passwords are never stored.
• Data sanitization — before uploading your profile to the cloud, the password field is stripped. Cloud uploads never contain plaintext passwords.
• Row Level Security (RLS) — all database tables enforce RLS policies. Users can only read and write their own data. Profile reads are open for leaderboard functionality, but writes are restricted to the authenticated owner.
• HTTPS / TLS encryption — all data transmitted between the app and Supabase is encrypted in transit.
• Secure cookies — the refresh token cookie is set with Secure and SameSite=Lax flags on HTTPS connections.
• Server-side account deletion — a database RPC (delete_account) removes all user data, profile rows, friendships, and the auth account in a single operation.

9. Your Privacy Rights

9.1 GDPR (EU/EEA/UK)

If you are in the EU, EEA, or UK, you have the right to:

• Access — request a copy of your personal data.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your account and all associated data.
• Restriction — request that we limit processing of your data.
• Data portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — withdraw consent for processing based on consent (where applicable).

To exercise these rights, email us at support@vitrify.no. We will respond within one month.

9.2 CCPA/CPRA (California)

If you are a California resident, you have the right to:

• Know — request disclosure of the categories and specific pieces of personal information we collect.
• Delete — request deletion of your personal information.
• Opt out of sale — we do not sell personal information, so no opt-out is necessary.
• Non-discrimination — you will not receive a degraded service for exercising your rights.

9.3 Other Jurisdictions

Users in other jurisdictions may have additional rights under their local privacy laws. Contact us at support@vitrify.no for assistance.

10. How to Delete Your Data

You can delete your account and all associated data at any time:

10.1 In the App

1. Open the app and go to your Profile screen.
2. Tap "Delete Profile".
3. Confirm the deletion when prompted.

This will:

• Remove your profile, progress, and all local data from your device.
• Delete your user_data and profiles rows from the Supabase database.
• Automatically remove all friendships and friend requests (via database trigger).
• Delete your Supabase Auth account (email, password hash, OAuth linkage).
• Sign you out and clear the refresh token cookie.

10.2 By Email

You can also request account deletion by emailing support@vitrify.no from the email address associated with your account. We will process your request within 30 days.

11. Cookies & Local Storage

The web version of the app uses a single first-party cookie (sif_rt) to store a Supabase Auth refresh token for session persistence. This cookie:

• Is set only on the web version (not on Android or iOS).
• Expires after 365 days.
• Uses the SameSite=Lax and Secure flags.
• Does not track you across other websites.
• Is cleared on sign-out or account deletion.

The app also uses IndexedDB (web) or local file storage (native) to store your profile and progress data locally. This is essential for the app to function and is not used for tracking.

We do not use any third-party cookies, advertising cookies, or tracking pixels.

12. Children's Privacy

The app is not directed at children under 13 (or under 16 in certain EU member states). We collect age during onboarding to help verify eligibility. If we learn that we have collected personal data from a child under the applicable age without verifiable parental consent, we will delete that data promptly. If you believe a child has provided us with personal data, please contact us at support@vitrify.no.

13. International Data Transfers

Your cloud data is stored in Supabase's infrastructure. Supabase offers region selection, and your data may be processed in regions outside your country of residence. By using the app, you acknowledge that your data may be transferred to and processed in countries with different data protection laws. We rely on Standard Contractual Clauses (SCCs) where required to ensure appropriate safeguards for international transfers.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or app features. We will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Material changes will be communicated through the app or via email when feasible.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• Email: support@vitrify.no
• Website: vitrify.no

For privacy-related requests, please include the email address associated with your account so we can verify your identity.