Privacy Policy
Phraseback helps you learn languages by capturing audio from your tutoring sessions and turning it into structured insights. This policy explains what data we collect, how we process it, and what control you have.
What we collect
Audio recordings. When you record a session (via the desktop app), we capture the audio from your tutoring call. This includes your voice and your tutor's voice.
Transcripts and insights. We process your recordings to produce transcripts and linguistic insights (Nuance Cards, Gentle Corrections, Cultural Notes, Practice Prompts). These are stored as text in our database.
Calendar metadata. If you connect your Google Calendar, we read meeting titles and attendee email addresses to match sessions to tutors and pre-select your target language. We do not read the content of other calendar events.
Account information. Your name, email address, and profile photo from your Google or Apple sign-in provider. We also store your language preferences and subscription status.
Payment information. Billing details are collected and processed by Stripe. We do not store your card number or bank details on our servers.
Usage data. Basic analytics (page views, feature usage) via PostHog. For EU/EEA visitors, analytics are only loaded after you give consent. See the Cookies section below.
How we process your audio
Your audio follows this path:
- Upload. Recorded audio files are uploaded to Cloudflare R2 (object storage, zero-egress).
- Transcription. Audio is sent to OpenAI (GPT-4o Transcribe) to produce a text transcript. OpenAI processes the audio in real time and does not retain it after transcription, per their API data usage policy.
- Insight extraction. The transcript is sent to Anthropic (Claude) to identify and explain linguistic insights. Anthropic does not use API inputs to train models and does not retain data beyond 30 days, per their API data policy.
- Storage. The resulting transcript and insights are saved in our Postgres database (hosted on Tiger Cloud). Raw audio is stored only while we process your session: once processing succeeds and your transcript and learning notes have been created, we delete the recording from our storage. If processing fails or is interrupted, we keep the recording for up to 72 hours to retry, then delete it automatically.
At no point is your audio or transcript used to train any AI model.
What we store and for how long
| Data | Where | Retention |
|---|---|---|
| Audio recordings | Cloudflare R2 | Deleted after processing (kept up to 72h if processing fails) |
| Transcripts and insights | Tiger Cloud Postgres | While your account is active |
| Account info | Tiger Cloud Postgres | While your account is active |
| Calendar metadata | Tiger Cloud Postgres | While your account is active |
| Payment records | Stripe | Per Stripe's retention policy and legal requirements |
When you delete your account, we begin a 30-day grace period. After that, all your data (recordings, transcripts, insights, calendar links) is permanently deleted. Billing records required by law may be retained.
Third-party processors
We share data with these services, each for a specific purpose:
| Service | Purpose | Data shared |
|---|---|---|
| OpenAI | Audio transcription | Audio recordings |
| Anthropic | Insight extraction | Transcripts |
| Stripe | Payment processing | Billing details, email |
| Cloudflare | File storage (R2) | Audio recordings |
| Vercel | Web app hosting | Standard request logs |
| Resend | Transactional email | Email address, name |
| PostHog | Analytics (consent-gated for EU) | Anonymous usage events |
| Google / Apple | Authentication | OAuth profile data |
We do not sell your data to anyone. We do not share your data with advertisers.
Your rights
You have the right to:
- Access your data. Your sessions, transcripts, and insights are visible in the Phraseback journal at any time.
- Correct your data. Contact us to update inaccurate account information.
- Delete your data. You can delete your account from Settings. A 30-day grace period lets you change your mind. After that, deletion is permanent and irreversible.
- Export your data. Data portability features are planned. In the meantime, contact us to request an export.
- Object to processing. Contact us if you have concerns about how we use your data.
For EU/EEA residents, these rights are provided under the General Data Protection Regulation (GDPR). Our legal basis for processing is:
- Contract performance for core service features (recording, transcription, insight extraction)
- Legitimate interest for service improvement and security
- Consent for analytics (PostHog), which you can withdraw at any time
Cookies
Phraseback uses essential cookies only by default. These are required for authentication and session management.
Analytics cookies (PostHog) are loaded only after you give consent. If you are in the EU/EEA, a consent banner will appear on your first visit. You can accept or decline. Your preference is stored locally and respected on future visits.
We do not use advertising cookies or tracking pixels.
Children
Phraseback is not directed at children under the age of 16. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
Changes to this policy
If we make material changes to this policy, we will notify you by email or in-app notice at least 30 days before the change takes effect.
Contact
Questions about this privacy policy or your data:
Email: hello@phraseback.com
Last updated: June 2026