This policy explains what personal data Piaf ("we", "us") collects, why we collect it, and who processes it on our behalf. It applies to the Piaf web and mobile applications.
1. Data we collect
Account data: email address and authentication credentials.
Google sign-in data: if you sign in with Google, we receive your Google account's name, email address and profile picture. We use them only to create and identify your Piaf account and show your name and picture in the app. We do not access your Google contacts, Drive, Gmail or any other Google data, and we never sell or share it.
Learning data: module progress, XP, streaks, practice scores, mistakes, and review flags.
AI conversations: questions you ask the Piaf tutor and the responses generated, including saved cheatsheets and roleplay transcripts.
Billing data: subscription status and a customer identifier held by our payment processor. We do not store card numbers.
Technical data: aggregate, privacy-preserving analytics about app usage.
2. How we use your data
To provide the learning experience and personalise tutoring to your level and progress.
To enforce free-tier usage limits and manage paid subscriptions.
To maintain, secure, and improve the service.
3. Processors we share data with
We use the following sub-processors to operate Piaf:
Supabase — database, authentication, and storage.
Cloudflare — hosting, edge functions, and analytics.
Google (Gemini API) — AI tutor response generation.
Voyage AI — text embeddings for curriculum retrieval.
Lemon Squeezy — payment processing and subscription management.
Your AI conversation content is sent to Google and Voyage AI solely to generate responses. We do not sell your personal data.
4. Data retention and deletion
We retain your account and learning data for as long as your account is active. You may request deletion of your account and associated data at any time by contacting us; deletion cascades to your progress, conversations, and cheatsheets.
5. Your rights
Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data, and to object to certain processing. Contact us to exercise these rights.