Trust center
Privacy & moderation
A plain-language description of the controls in this MVP. This is product documentation, not a substitute for jurisdiction-specific legal advice or a final production privacy policy.
What the app stores
Your profile, language preferences, messages, voice notes, Moments, photos, corrections, comments, follows, saved words, reports, and learning activity are stored in PostgreSQL. Photos and voice notes in this MVP are stored as encoded media data; production deployment should move them to encrypted object storage.
Private communication access
Private messages and voice notes are not available in a browse-all admin inbox. A moderator can reveal only an item reported by a conversation participant. Revealing evidence requires a case purpose and creates an append-only audit event. Public Moments, profiles, and corrections remain subject to ordinary moderation.
Reports and moderation
When you report an item, the reported content, your selected reason, and optional context are shared with moderators. For a chat report, only the selected message or voice note is shared—not the rest of your conversation. Moderators can dismiss a report or remove the reported content.
Account and security
Passwords are hashed with scrypt and a unique salt. Sign-in issues an opaque, revocable, HTTP-only session cookie, and every content-changing or private-data request verifies that session server-side — a browser cannot act as another user. Registration, sign-in, reports, translation, and message sending are rate-limited, and cross-origin request origins are rejected. Admin access exchanges the console key once for a signed, short-lived, HTTP-only moderator cookie.
Blocking
You can block any partner from their profile. A blocked relationship hides both accounts from discovery and Moments, removes existing follow links in both directions, hides the person from your notifications and conversation list, and prevents either side from sending or viewing messages while the block is active. Unblocking restores visibility.
Your data, portable and erasable
Profile → Download my data produces a portable JSON copy of your profile, conversations and media, Moments, learning history, follows, blocks, and reports. Profile → Danger zone permanently deletes your account and cascades through associated content; active sessions are revoked immediately.
PayPal payments
Premium uses PayPal Checkout. The server creates and captures orders using PayPal's Orders v2 API and stores order ID, capture ID, amount, currency, status, payer email, and membership dates. PayPal processes payment credentials; the app never receives card or bank details. Passes are one-time purchases with no automatic renewal. Verified PayPal webhooks synchronize completed payments, refunds, reversals, and denials.
Translation and speech
Text submitted for translation may be sent server-side to Google Translate or MyMemory. Text-to-speech uses your browser or operating system's installed speech engine. Do not submit sensitive personal data for translation. Production deployments should publish provider-specific data-processing terms.
Your controls
You can delete your own messages and Moments, edit your profile, switch profiles, and permanently delete your account from Profile → Danger zone. Account deletion cascades through associated app data. Legal retention or abuse-prevention exceptions would need to be documented before a production launch.