Privacy policy

Information we collect

Account information. When you sign in with Apple or Google, we receive a verified email address, an account identifier and, when available, your name and profile picture. Apple may provide a private relay address. We do not receive your Apple or Google password. We create a Clementine account ID and store a sign-in token securely on your device.

Learning information. We store course and lesson progress, review schedules and results, learning goals, preferences, reading history, saved items, streaks and character introduction history. Some records remain on your device; supported progress and history sync to your account. Saved exercise history can include submitted answers, transcripts and feedback. Texting exercises also save conversation turns so you can resume them.

Answers you submit for AI feedback. With your permission, we send the text or recording you choose to submit, together with relevant exercise or conversation context, to OpenAI. This includes writing, simulated email, texting and speaking exercises. OpenAI transcribes spoken submissions; we also use its models to evaluate answers and annotate transcripts. Before your first AI-dependent activity, we explain this processing and ask you to agree. These activities include AI writing checks, speaking activities that record, transcribe or evaluate your voice, and texting or email roleplay. If optional voice typing is available in an otherwise self-checked activity, we ask when you tap the microphone. Regular lessons, account settings, the library and saved progress remain available if you do not agree or later disable AI feedback.

We ask for operating-system microphone permission before recording, do not record in the background, and do not save submitted audio recordings in our server database. Simulated emails and texts are exercises, not messages to real recipients.

Optional help improving Clementine. You can choose to help us understand which lessons work well and improve the quality of our feedback. This is optional and off by default. You can enable both app-use information and written-answer examples together, or choose which to share.

Your App activity setting. If your app supports setting reports, we receive whether App activity is on or off, even when it is off, so our team can understand which sharing choices have been reported. This account-linked record includes a random app-installation identifier, the app identity (such as Clementine or Clementine Nightly), a change number and when we received the setting. It contains no lesson events or answers. We keep the latest reported setting for each installation until account deletion. An unchanged, successfully reported setting is not sent again on each app open. Offline changes are reported when a later connection succeeds; a past report does not prove your current choice. This reporting does not enable optional sharing or AI feedback.

If you allow written-answer examples, we keep extra copies of submitted written answers, exercise context, model feedback and technical evaluation details to check feedback quality. Authorized staff and AI tools supplied by OpenAI may examine these copies. This is separate from providing your answer feedback and keeping your learning history. A new quality-review copy is created only when you have enabled this choice and explicitly request an AI writing check or writing feedback. It does not include stored speaking recordings. AI feedback works the same if you choose not to help. This choice does not enable sharing API inputs or outputs with OpenAI for training its models, and choosing it before agreeing to AI feedback does not authorize us to send a lesson answer to OpenAI.

Usage and diagnostics. If you allow app-use information under Help improve Clementine, we collect account-linked events such as app opens, lesson and review activity, durations and synchronization results. Event properties use restricted identifiers and counters, not raw answers, recordings or profile details. Analytics is off by default. Separately, crash reports can include error messages, technical stack traces, app version, operating system and account or installation identifiers. Essential service logs, including request outcomes and timings, and saved learning progress are not controlled by the optional improvement setting.

We use limited parts of these existing records to calculate overall account, lesson-completion, support and service-reliability statistics. These totals include people who have not enabled optional sharing. This does not add tracking events or use your answer text, transcripts or recordings for analytics. Reports are restricted to authorized staff; small course-level breakdowns are withheld.

Feedback. We collect messages and content reports you send, with relevant app context. Opening the feedback form may capture the current app screen locally for preview. A screenshot is uploaded only if you select the attachment option and send the report. Please inspect the preview and omit images that contain sensitive information. Submitted images are stored privately and can be retrieved only through authorized staff access.

Notifications and beta testing. If you enable supported notifications, we store your preferences and the delivery information needed, such as a push token, email address and delivery status. Apple may provide TestFlight feedback, crash information and testing data under its TestFlight terms. Our hosting providers process connection information, such as IP addresses and request logs, to deliver and protect the service.

How we use information

We use this information to sign you in, associate learning records with your account, synchronize progress, deliver lessons and requested feedback, operate notifications you enable, investigate problems, answer support requests and prevent abuse. Optional analytics and writing-quality review help us improve the beta. We also use the limited overall statistics described above to understand whether lessons are being completed and the service is working. Where applicable, this use relies on our legitimate interest in evaluating and maintaining the service, with limited data and restricted access. We do not sell personal information, run targeted advertising or track you across other companies' apps and websites for advertising.

Where applicable, we process information to provide the service you request, for legitimate interests in operating and securing it, to meet legal obligations, or with your consent for optional activities.

Service providers and sharing

We use Apple and Google for sign-in, Vercel and Neon for hosting, storage and databases, Google Workspace for support and privacy-request email, and OpenAI for the AI processing described above. We do not deliberately include your name, email address or account ID in AI prompts; anything you type or say in an exercise may itself identify you. Avoid including sensitive personal information in exercises.

We do not opt in to sharing API inputs and outputs with OpenAI for model training. We disable optional storage of our Responses API calls. This does not eliminate all provider retention: OpenAI may retain data for abuse monitoring and other purposes described in its applicable service terms. Provider retention can differ by endpoint and model.

OpenAI is the current recipient of learner submissions for AI feedback. If we plan to send those submissions to a new AI provider, we will update this disclosure and ask you to agree again before doing so. A change to the model or handling within OpenAI does not necessarily require a new agreement when the disclosed purposes and data categories remain the same.

For enabled notification features, Resend delivers email and Expo and the operating-system push service deliver push notifications. These services receive delivery addresses or tokens and message content. Pre-recorded lesson audio is created from authored lesson scripts using Cartesia; learner recordings are not sent to Cartesia. The privacy-policy website is hosted with OpenAI Sites.

Authorized Clementine operators can access information needed to support learners and maintain the service. If you opt in to the leaderboard, other learners can see your chosen nickname, character avatar, completed-lesson count and rank. We may also disclose information when required by law, to protect rights and safety, or as part of a business transfer subject to appropriate privacy protections.

Retention and security

We keep account and saved learning records while your account is active, unless you request deletion. Optional raw writing-quality copies have a 30-day retention window; expired copies are removed by a daily cleanup job and are excluded from staff review after 30 days. This limit applies to the extra quality-review copies, not your saved learning history. We may keep aggregate findings that no longer identify learners or reproduce their submissions.

Usage-event cleanup removes events older than 120 days when new events are received; older records may remain longer if no new events arrive. Feedback and diagnostic records are kept as needed to investigate and resolve issues, or until you request their deletion. We keep a minimal deletion-request receipt to complete and confirm the request; we remove its contact email after confirmation and delete completed receipts after 90 days. Infrastructure logs and backups follow the relevant provider's retention schedule and may outlast deletion from active systems for a limited period. We may retain information where legally required.

We use encrypted network connections, secure device storage for sign-in tokens and access controls for account data. No storage or transmission method is completely secure. Information may be processed outside your country, including in the United States, where privacy laws may differ.

Your choices and account deletion

When you first choose an AI-dependent activity, select Allow and continue to permit the OpenAI processing described above, or leave the activity without agreeing. Your choice is remembered for the current account on that device. In Account → Privacy → AI feedback, you can disable permission at any time. Disabling it stops new user submissions to OpenAI from that device. You can continue using regular lessons, account settings, the library and saved progress, and can explicitly agree again when you later choose an AI-dependent activity. Disabling AI feedback does not require deleting your account.

Help improve Clementine in Account → Privacy controls optional app-use information and extra written-answer examples for feedback-quality review. Both start off. We invite you to choose when you first reach Learn on this device. Select Enable both, use either individual switch, or select Not now to leave both off. You can return to the same screen in Privacy; neither is required to use the app or AI feedback. You may make these choices before deciding whether to allow AI feedback. Optional sharing alone never authorizes us to send a lesson answer to OpenAI. Your choices are saved for the current account in that app installation; review them separately on other devices and in Clementine Nightly. Disabling AI feedback stops future user submissions from that device, but leaves the independent app-use and written-answer sharing choices as you set them. While AI feedback is disabled, no new writing-quality copy can arise because no new AI writing request is authorized. Turning off written-answer sharing also prevents new quality-review copies; existing copies still expire under the 30-day retention rule. These changes do not recall requests already sent or automatically delete saved history or previously collected records. Turning off app-use sharing stops the corresponding future optional analytics collection from this device. The account-deletion process below removes associated account data. You can also revoke microphone access in your device settings and manage notifications in Account → Notifications.

To delete your cloud account, use Account → Privacy → Delete account and confirm the request. Apple-linked accounts may require confirmation of your Apple sign-in so its authorization can be revoked. The app displays an accepted-request receipt and completion deadline. Rejected requests are identified; if a connection fails, check the request status before retrying. Cloud account access ends when the request is accepted. Our team completes deletion from active systems within 30 days and sends confirmation. This includes associated learning records, quality-review copies, notification delivery records and account-linked feedback and diagnostics. Anonymous reports may not be linkable to your account.

Signing out or uninstalling the app does not delete your cloud account. Cloud deletion does not remotely erase offline copies on your devices; use the app's local-data reset or remove the app to clear those copies. If you cannot access your account, email support@clementine.cc from its associated address.

You may also request access to, a copy of, correction of or deletion of your information. Depending on where you live, you may have additional rights to restrict or object to processing, withdraw consent or complain to a data protection authority. We may ask for enough information to verify that a request concerns your account.

Children

The beta is intended for adults and is not directed to children under 13. If you believe a child has provided us with personal information, contact us so we can investigate and delete it as appropriate.

Changes and contact

We will update the effective date when this policy changes and provide additional notice for material changes where required. Questions about this policy or your information can be sent to support@clementine.cc.