Privacy Policy for SmartReader: Learn English

1. Data controller

The data controller responsible for the SmartReader: Learn English application is:

2. Scope of this policy

This policy applies to the Android and iOS versions of SmartReader: Learn English and to the backend services used by the application.

General use of the SmartReader website is covered by the separate Website Privacy Policy.

3. Personal data we process

3.1 Account and identity information

When you create or use an account, we may process:

• Your email address.
• Your display name.
• Your Firebase user identifier.
• Your profile photo URL when it is provided through Google Sign-In.
• Authentication, session, IP address, user-agent, and security information processed by Firebase Authentication.

3.2 Learning data

To provide synchronization and learning features, the application may store:

• Stories that you create, adapt, import, or save.
• Saved vocabulary and review information.
• Favorites and reading progress.
• Learning streaks and activity history.
• Quiz, grammar, listening, and speaking results.
• Application settings and learning preferences.

3.3 Content submitted to AI features

When you choose an AI-powered feature, we process the content necessary to provide that feature. Depending on the feature, this may include:

• Story titles, topics, levels, prompts, and full story text.
• Text submitted for adaptation, translation, or analysis.
• Quiz and grammar requests.
• Dictionary and contextual language requests.
• Voice Tutor conversation history and your transcribed answers.

For Voice Tutor, the full story text, story title, learning level, conversation history, and current question number may be sent to the AI service so that it can provide a relevant response.

3.4 Microphone recordings and speech data

Microphone access is optional and is requested only when you use a speaking, pronunciation, shadowing, or voice conversation feature.

Your recording may be temporarily stored in the application cache, encoded, and transmitted through our Firebase backend to OpenAI for speech transcription or pronunciation processing. The application may receive:

• The transcribed text.
• A pronunciation similarity score.
• Word-level pronunciation results.

The backend creates a temporary audio file for transcription and deletes it after successful processing. Voice recordings used for pronunciation and Voice Tutor are not intentionally stored in Firestore or Firebase Storage.

Audio generated for Voice Tutor is returned to the application, saved temporarily in the device cache, and deleted after playback, when playback is stopped, or when the Voice Tutor screen is closed.

3.5 Camera and OCR data

Camera access is optional and is requested only when you choose to scan text.

On Android, text recognition is performed on the device using Google ML Kit. The scanned image and recognized text are not sent to Google servers by the ML Kit text-recognition API.

The application may create a temporary image file on your device while text recognition is running. Recognized text may later be stored or sent to an AI feature only when you choose to use or save that text.

3.6 Technical and security data

Firebase, Google Cloud, and application security services may process limited technical information such as:

• IP address and request metadata.
• Application and device integrity information.
• Firebase App Check tokens and attestation information.
• Technical errors and service logs.
• Application version and backend function information.

We do not sell personal data and do not use personal data for targeted advertising.

4. How we use personal data

We process personal data to:

• Create, authenticate, and protect user accounts.
• Synchronize learning data between devices.
• Provide reading, vocabulary, and learning functions.
• Generate or adapt educational stories.
• Provide AI Tutor, quiz, grammar, and translation features.
• Transcribe speech and evaluate pronunciation.
• Generate temporary spoken responses.
• Respond to support and privacy requests.
• Prevent abuse, fraud, and unauthorized access.
• Maintain, diagnose, and improve the application.
• Comply with applicable legal obligations.

5. Legal bases under the GDPR

Where the GDPR applies, we rely on one or more of the following legal bases:

• Performance of a contract: processing needed to provide your account and the application features you request.
• Consent: optional access to the microphone, camera, or other permission-based features where consent is required.
• Legitimate interests: service security, fraud prevention, technical maintenance, support, and protection of our legal rights.
• Legal obligations: processing necessary to comply with applicable laws or valid legal requests.

You may withdraw consent for optional permissions through your device settings. Withdrawal does not affect processing that was lawful before consent was withdrawn.

6. Service providers and data sharing

We share data only when necessary to provide the application, protect the service, comply with the law, or respond to your request.

6.1 Google Firebase and Google Cloud

We use Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Firebase App Check, and related Google Cloud infrastructure for authentication, synchronization, backend processing, storage, and security.

Google generally acts as a processor for customer data submitted through Firebase services.

6.2 Google Sign-In

Where available, you may sign in using Google. Google provides the application with the account information you authorize, such as your email address, display name, account identifier, and profile photo URL.

6.3 Google ML Kit

On Android, Google ML Kit is used for on-device text recognition. Input images and recognized output are processed locally by the ML Kit API.

6.4 OpenAI

We use the OpenAI API for selected text-generation, tutoring, speech-transcription, pronunciation, and text-to-speech features.

Data sent to OpenAI may include prompts, story text, conversation history, transcribed answers, audio recordings, and other content needed to perform the feature you selected.

OpenAI states that API inputs and outputs are not used to train its models by default unless the API customer expressly opts in. Certain API data may be retained for a limited period for abuse monitoring, security, or legal requirements.

6.5 Other AI providers

Depending on the selected function and current backend configuration, limited text may also be processed by Google Gemini or DeepSeek for selected translation, grammar, or language processing tasks.

6.6 Legal disclosures

We may disclose data when required by law, a valid legal process, or when reasonably necessary to protect users, the application, our rights, or the public.

We do not sell or rent personal data to advertisers or data brokers.

7. Artificial intelligence notice

AI-generated responses may be incomplete, inaccurate, or inappropriate for a particular situation. They are provided for educational assistance and should not be treated as professional, medical, legal, financial, or other specialist advice.

Do not submit confidential information, passwords, payment-card details, government identification numbers, medical records, or other unnecessary sensitive information through AI features.

The application does not use AI output to make decisions that produce legal or similarly significant effects about you.

8. Data storage and retention

• Account information and synchronized learning data are generally retained while your account remains active.
• Data stored locally on your device may remain until you delete it, clear the application storage, or uninstall the application.
• Temporary microphone recordings and Voice Tutor audio are kept only for the time needed to process or play them, subject to device cache and operating-system behavior.
• OpenAI may retain certain API request data for up to 30 days for abuse monitoring, depending on the endpoint and account configuration, unless a longer period is legally required.
• Firebase Authentication information is retained until the associated account is deleted. Removal from provider backup systems may take up to 180 days.
• Support correspondence may be retained for the time needed to resolve the request and protect legal rights.

We may retain limited information for longer when required by law, necessary for fraud prevention, security, dispute resolution, or the establishment, exercise, or defense of legal claims.

9. Account and data deletion

You may request deletion in either of the following ways:

• Use the account-deletion option in the application profile settings.
• Visit the Account Deletion page.
• Email privacy@smartreaderenglish.com.

The in-app deletion process requires a recent authentication for security. It deletes the Firebase Authentication account and the account data stored under the user's Firebase identifier in Cloud Firestore.

Some data stored only on your device may remain until you clear the application storage or uninstall the application. Provider backup deletion may take additional time as described in Section 8.

We may request reasonable information to confirm that an external deletion request relates to your account.

10. Security

We use reasonable technical and organizational safeguards, including encrypted network connections, Firebase Authentication, access controls, application-integrity checks, and restricted backend access.

No system is completely secure. You are responsible for protecting your account credentials and for notifying us if you believe your account has been compromised.

11. International data transfers

Our service providers operate internationally. Personal data may therefore be processed in the United States or other countries outside your country of residence.

Where required, transfers from the European Economic Area are protected by appropriate safeguards, such as adequacy decisions, the EU-U.S. Data Privacy Framework where applicable, or Standard Contractual Clauses approved by the European Commission.

12. Your privacy rights

Subject to applicable law, you may have the right to:

• Request access to your personal data.
• Request correction of inaccurate data.
• Request deletion of your data.
• Request restriction of processing.
• Receive certain data in a portable format.
• Object to processing based on legitimate interests.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with a data protection authority.

To exercise your rights, contact privacy@smartreaderenglish.com.

You may also lodge a complaint with the Austrian Data Protection Authority:

13. Children and young users

SmartReader: Learn English is intended for users aged 13 and older. It is not directed to children under 13.

Where processing relies on consent, users below the applicable age of digital consent must have authorization from a parent or legal guardian. In Austria, a child under 14 requires the consent or authorization of the person holding parental responsibility for consent-based information-society services.

If you believe that a child has provided personal data without the required authorization, contact us so that we can investigate and take appropriate action.

14. Changes to this policy

We may update this Privacy Policy when the application, service providers, legal requirements, or data-processing practices change.

The current version will be published on this page with an updated effective date. Where required, we will provide additional notice in the application.

15. Contact

Questions, privacy requests, and complaints may be sent to: