Privacy policy

This policy explains what personal data Hebbi collects, why, who else handles it, and what you can do about it. It covers the Hebbi app, on your phone or in your browser at app.hebbi.app, and this website, hebbi.app.

In short

We collect what Hebbi needs to work: your account, your settings and your practice.
Your voice recordings are sent to be checked or turned into text. We don't store them.
We don't sell your data, show ads, or use analytics or tracking tools.
You can delete your account, and everything in it, from the app at any time.

Who is responsible

Hebbi is made and run by Fan Zhong, an individual based in Spain, who is the controller of your personal data under the EU General Data Protection Regulation (GDPR). In this policy, “we” and “us” mean Fan Zhong. You can reach us about anything in it at support@hebbi.app.

What we collect and why

Your account

What: You sign in with your email address and a password, or with your Google or Apple account. With email, we keep your email address and password; with Google or Apple, the account identifier and email address they share with us, and the first name they give us. We never see your password: our sign-in provider keeps only a scrambled (hashed) form of it.
Why: To create your account, sign you in, and send the emails it needs: confirming your address, resetting your password, changing your email.
Legal basis: Our contract with you: we need it to provide Hebbi (GDPR article 6(1)(b)).
Kept: Until you delete your account.

Your name

What: The name you'd like Hebbi to call you, if you give one. It's optional.
Why: To greet you and show it on your profile.
Legal basis: Our contract with you.
Kept: Until you change or clear it, or delete your account.

Your languages and settings

What: The language you're learning, the language you speak best, your starting level, how much each dialogue should stretch you, how word meanings and highlighting are shown, and your time zone.
Why: To choose dialogues for you, show translations in your language, and end your days and streaks at your own midnight.
Legal basis: Our contract with you.
Kept: Until you delete your account.

Your practice

What: Which dialogues you were given and finished; for each line, which words you marked as missed or said wrong, and when; your level in each language; an estimate of how well you know each word you've met; how many lines you practiced each day; and, if you answer the question, whether you found a dialogue interesting.
Why: This is how Hebbi works: it is what your next dialogue is chosen from and what your progress screens show.
Legal basis: Our contract with you.
Kept: Until you delete your account.

Speaking practice

What: When you record a line, on your phone or in your browser, the recording goes to our server and on to the speech model that checks it. A recording made in a browser is first converted on our server into the format the phone apps record in. We keep what the model returns: a transcript of what you said, its feedback, and the result for each word. We also keep a one-way fingerprint of the request, which lets us recognise the same recording sent twice but cannot be turned back into it.
Why: To tell you how you did and update your practice.
Legal basis: Our contract with you.
Kept: We don't store the recording. The transcript and feedback are deleted after 30 days. The result for each word stays with your practice until you delete your account.

Questions about a line

What: The questions you ask about a line, and their answers. If you ask by voice, the recording is turned into text you can edit before sending; we don't keep the recording.
Why: To answer your question, and to keep your questions where you can find them again.
Legal basis: Our contract with you.
Kept: Questions and answers until you delete your account. Voice recordings are not stored.

Daily limits

What: A record of each use of a feature that costs us money to run (checking your speech, turning your voice into text, answering a question): which feature, and when, but not what was said or asked.
Why: To apply daily limits fairly and keep costs and abuse in check.
Legal basis: Our legitimate interest in keeping Hebbi affordable and protected from abuse (GDPR article 6(1)(f)).
Kept: Until you delete your account.

Technical data

What: Your IP address and basic details of each request, such as its time and your browser or device type, reach our hosting providers whenever the app or this website talks to them. Our own server's request logs record which kind of request was made, its result and how long it took, but not who made it.
Why: To deliver the app and this website, keep them secure, and fix problems.
Legal basis: Our legitimate interest in running a secure, working service.
Kept: Our server's logs are overwritten as they fill. Providers keep their logs for short periods under their own terms.

Messages to us

What: Your email address and what you write to us.
Why: To answer you.
Legal basis: Our contract with you when it's about your account; otherwise our legitimate interest in answering you.
Kept: As long as needed to help you and keep a record of what we agreed.

What we don't do

We don't sell or rent your data, and we don't show ads.
The app contains no analytics, advertising or tracking tools, and no crash-reporting service: errors are written only to your device's own log.
We don't use your data to train AI models.
Hebbi decides automatically which dialogue to give you next and how your speaking went. These decisions shape your practice and nothing else: they have no legal or similarly significant effect on you.

Who handles your data

We use these providers to run Hebbi. They handle your data on our behalf, to provide their service to us, and each receives only what its job needs.

Supabase

Does: Sign-in, the database that holds your account and practice, and storage for the dialogues' audio.
Receives: Your account and everything Hebbi stores for it, as listed above. Recordings never reach it.
Where: Our database is hosted in the EU, in Ireland. Supabase, Inc. is based in the United States.

Amazon Web Services

Does: Hosts the Hebbi server the app talks to.
Receives: Every request from the app, including recordings on their way to be checked or converted. The server doesn't store recordings.
Where: In the EU, in Ireland.

Alibaba Cloud (Qwen) or Google (Gemini)

Does: Checks what you said when you record a line. We use one of the two at a time and may switch between them.
Receives: Your recording, the dialogue and line you were saying with its translation, and the languages involved. Not your name or email address.
Where: May be processed outside the European Economic Area.

OpenAI

Does: Answers your questions about a line.
Receives: Your question, your earlier questions and answers about the same line, and the dialogue with its translations and word meanings. Not your name or email address. We ask OpenAI not to store the answers it gives.
Where: The United States.

ElevenLabs

Does: Turns a question you ask by voice into text.
Receives: The recording of your question, and nothing that identifies you.
Where: May be processed outside the European Economic Area, including in the United States.

Resend

Does: Sends your account's emails.
Receives: Your email address and the email's content.
Where: The United States.

Cloudflare

Does: Hosts this website and the web app at app.hebbi.app, and runs the hebbi.app domain.
Receives: The IP addresses and request details of everyone who opens this website or the web app.
Where: A worldwide network; Cloudflare, Inc. is based in the United States.

If you sign in with Google or Apple, that company confirms who you are and shares your email address and name with us. It does so as an independent company under its own privacy policy, as do Google Play and the App Store if you install Hebbi from them.

Data outside the EU

Some of these providers are based in, or may process data in, countries outside the European Economic Area, including the United States. When your data leaves the EEA, the transfer is protected by an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework for companies certified under it, or by the European Commission's standard contractual clauses. Ask us at support@hebbi.app for details.

How long we keep it

Your account, settings, practice and questions: until you delete your account.
The transcript and feedback of a spoken line: 30 days.
Voice recordings: we don't store them.
Backups: copies of our database kept to recover from failures are replaced by newer ones over time, so data you delete leaves them within a limited time. We don't use them for anything else.

When you delete your account, everything linked to it in our database is deleted at once. Delete your accountexplains how.

Your rights

Under the GDPR you can ask us to:

give you a copy of your data, including in a format you can take elsewhere;
correct data that is wrong;
delete your data;
limit how we use your data while a question about it is settled;
stop using your data where we rely on our legitimate interests.

Some of this you can do yourself in the app: change your name, email or password in the Profile tab, or delete your account. For anything else, write to support@hebbi.app. We answer within one month, and may ask you to confirm that the request comes from your account's email address.

You can also complain to a data protection authority. In Spain that is the Agencia Española de Protección de Datos (AEPD),www.aepd.es. You can also go to the authority where you live or work.

On your device

The app keeps some data on your phone. When you use Hebbi in a browser at app.hebbi.app, it keeps the same data in that browser's local storage, not in cookies:

your sign-in session, in your phone's secure storage or your browser's local storage;
your settings, such as theme, playback and vibration;
where you left off in a dialogue, and practice waiting to be sent while you're offline;
the audio of dialogues you've played, so a line isn't downloaded twice.

Signing out or deleting your account removes your session and your practice from the phone or browser. Your settings stay until you uninstall the app or clear the site's data in your browser. The microphone is used only while you record, and only with the permission your phone or browser asks you for; on a phone, each recording's file is deleted as soon as the app has read it.

This website

hebbi.app sets no cookies, runs no analytics or tracking, and loads nothing from other companies' servers. Cloudflare, which hosts it, processes your IP address to deliver the pages and protect the site.

Children

Hebbi is not meant for children under 14, and we don't knowingly collect their data. If you believe a child under 14 has given us personal data, write to support@hebbi.app and we'll delete it.

Security

Everything between the app, our server and our providers travels over encrypted connections. Passwords are stored only in hashed form, the server lets each account reach only its own data, and on a phone your session is kept in the device's secure storage.

Changes to this policy

When we change this policy we update the date at the top. If a change affects how we use your data in a way that matters, we'll tell you by email before it takes effect.