Privacy Policy

1. What we collect

• Account information: if you sign in with Google, we receive your Google profile name and email address through our authentication provider (Supabase Auth). We do not receive your Google password.
• Submitted essays: the IELTS writing task responses (Task 1 and Task 2) that you paste or type into the checker for grading.
• Speaking recordings: if you use the Speaking Practice module, the audio you record in your browser for pronunciation and fluency scoring.
• Usage data: how many checks you have used, your subscription plan, and your stored progress/history within the Service.
• Session identifiers: a first-party cookie (vid) that keeps you signed in and links your usage quota to your browser. No third-party advertising cookies are used.

2. How we use your data

• To grade your essays and score your speaking practice.
• To track your quota, subscription status, and progress.
• To show your essay history and improvement plans when you are signed in.
• To send service-related emails (account and billing notices). We only send marketing or re-engagement emails to users who signed in, and every such email includes an unsubscribe link.

3. AI processing of your content

Submitted essays and speaking responses are sent to our AI provider (DeepSeek API) to generate band scores and feedback. Content is processed solely to provide the grading result and is not used to train third-party models. We also analyse anonymised, aggregated patterns across submissions to calibrate and improve scoring accuracy (published in our Calibration Report); this never involves publishing your personal information or your essay with your identity attached.

4. Third-party processors

• Google — sign-in (OAuth) and profile/email.
• Supabase — authentication, database, and storage hosting.
• DeepSeek — AI grading and feedback generation.
• Creem — subscription payments and billing (card data is handled by Creem and never reaches our servers).
• Vercel — website and API hosting.

5. Storage, security, and retention

Data is stored in Supabase (hosted in Singapore) with access restricted by row-level security and server-side service keys. We keep your account data, essays, and history while your account is active. If you want your data deleted, email us and we will remove your account and associated data within 30 days, except where we must keep billing records for legal or accounting purposes.

6. Your rights

You can request access to, correction of, or deletion of your personal data at any time by emailing dogkyan@gmail.com. You can also control marketing emails with the unsubscribe link in any email we send. If you are in the EEA or UK, you have additional rights under GDPR (such as data portability and objection to processing); if you are a California resident, you have rights under CCPA/CPRA. We will not discriminate against you for exercising these rights.

7. Children

The Service is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child under 13 has provided us personal data, contact us and we will delete it.

8. Changes and contact

We will post any changes to this policy on this page with an updated date. Questions or requests: dogkyan@gmail.com.