Privacy Policy

Introduction

Welcome to Joe Speaking, operated by JUST JOE TECHNOLOGIES INC. ("we," "our," or "us"). We are committed to protecting your privacy and handling your data in an open and transparent manner. This Privacy Policy explains how we collect, use, share, and protect your information when you use our English speaking practice application.

Joe Speaking is designed with a privacy-first, local-first approach. Your data stays on your device unless you explicitly choose to enable cloud synchronization through authentication.

ChatGPT Plugin and Connected AI Clients

If you connect Joe Speaking to ChatGPT or another compatible AI client, you must first sign in and explicitly approve read-only access. The connection is limited to your own cloud-synced Joe Speaking account.

In response to your requests, the connection may provide question-bank progress; practice history and record metadata; transcripts, scores, and learner-facing feedback when those fields are available; and saved Collection items such as selected text, notes, tags, explanations, and review status. It does not provide your password, raw audio files, payment details, API keys, or internal diagnostic identifiers.

You can disconnect a client at any time from Connected Apps. Data received by the connected client is also subject to that provider's privacy policy.

Information We Collect

1. Local-Only Users (Unauthenticated)

If you use Joe Speaking without signing in, all your data stays on your device:

• Practice sessions, recordings, and transcripts stored in browser IndexedDB
• Application settings and preferences stored locally
• No personal information is collected or transmitted
• No tracking or analytics (unless you explicitly opt-in)

2. Authenticated Users (Cloud Sync Enabled)

When you sign in with a supported Apple, Google, or Microsoft account, we collect:

Account Information:

• Email address
• Full name (when provided by your sign-in provider)
• User ID (unique identifier)
• Account creation date

Practice Data:

• Audio recordings of your speaking practice
• Transcripts of your speech
• AI-generated feedback and scores
• Session metadata (title, topic, duration, test type)
• Collections (vocabulary, grammar notes, pronunciation tips)
• Daily and weekly review summaries

IELTS Speaking Simulator Data:

• Real-time audio streams during simulated IELTS Speaking tests
• Live transcripts generated during the simulation
• IELTS-format questions displayed during simulation (Part 1, 2, and 3)
• Simulation session recordings and timing data
• Cue card topics and preparation notes (Part 2)
• AI examiner interactions and follow-up questions

Settings & Preferences:

• Target test type (IELTS, CELPIP) and target scores
• ASR provider preferences (local vs. cloud)
• Your own API keys for third-party services (such as Google Gemini, OpenAI, AssemblyAI, or Soniox): saved only on your device and sent, when a request needs one, to our server or directly to that provider; we do not store them on our servers
• Model preferences for transcription

Technical Data:

• Device information (browser, OS, hardware capabilities)
• Sync status and logs
• Error logs and diagnostic information (via Sentry, 10% sample rate)
• Reliability diagnostics about app steps (see Reliability Diagnostics below)

Payment Information:

• Credit balance and transaction history
• Stripe payment IDs (payment intents, sessions)
• Apple App Store transaction identifiers for iOS in-app purchases, when App Store purchases are available
• Transaction metadata (date, amount, credit package purchased)
• Note: We do not store or process your credit card information directly. Web payments are handled by Stripe. iOS in-app purchases, when available, are handled by Apple.

How We Use Your Information

We use your information to:

• Provide core functionality: Store and sync your practice sessions across devices
• Generate AI feedback: Analyze your speech and provide personalized improvement suggestions
• Transcribe audio: Convert your speech to text using local or cloud-based services
• IELTS Speaking Simulator: Provide authentic IELTS Speaking test simulations with real-time transcription, AI examiner interactions, and timed practice sessions
• Track progress: Generate daily and weekly review summaries
• Improve the service: Analyze usage patterns (with your consent) to enhance features
• Process payments: Handle credit purchases for cloud transcription services
• Prevent fraud and abuse: Rate limiting and security monitoring
• Provide customer support: Respond to your inquiries and technical issues

Third-Party Services

We integrate with the following third-party services:

Each service has its own privacy policy. We encourage you to review their policies:

• Supabase: https://supabase.com/privacy
• Google: https://policies.google.com/privacy
• Apple: https://www.apple.com/legal/privacy/
• Microsoft: https://privacy.microsoft.com/privacystatement
• PostHog: https://posthog.com/privacy
• Sentry: https://sentry.io/privacy
• Stripe: https://stripe.com/privacy
• OpenAI: https://openai.com/policies/privacy-policy/

Advanced Examiner (OpenAI GPT-Live)

The Advanced examiner in the IELTS Speaking Simulator is powered by OpenAI's GPT-Live voice model. It processes your data only when you are signed in and start an Advanced test.

• How your voice reaches OpenAI: When the test starts, your device connects to OpenAI over WebRTC and your microphone audio streams directly from your device to OpenAI. Our server sets up the connection but does not relay your audio.
• Recording stored by OpenAI: We ask OpenAI to store a recording of each test session, including your voice and the examiner's. After the test, our server downloads this recording to score your test and to let you replay it. If you use your own OpenAI API key and your OpenAI project does not allow stored sessions, some app versions run the test without this recording and use the audio clips of your answers instead.
• Scoring: Our server sends the recording, or the audio clips of your answers when there is no recording, to an OpenAI audio model, which listens to your answers to produce your scores.
• What we keep: A copy of the recording and audio clips of your answers are stored in Backblaze B2, and the transcript of the conversation is stored in our Supabase database. We keep them like your other practice data: until you delete the test or your account.
• What OpenAI keeps: OpenAI keeps its copy of the recording for a limited period under its own data retention terms. See OpenAI's privacy policy.
• Whose OpenAI account is used: By default, the test runs on Joe Speaking's OpenAI account and is paid for with your credits. If you add your own OpenAI API key in Settings, the test runs on your own OpenAI account instead, no credits are charged, and OpenAI's handling of the session is also governed by your agreement with OpenAI. Your key is saved on your device and sent to our server only when a test needs it; we do not store it on our servers.

Reliability Diagnostics

When you are signed in, the app and our servers record diagnostic events about how key steps perform, so we can find and fix slow or failing parts of Joe Speaking. These diagnostics are part of running the service and are separate from the optional PostHog analytics described below.

What we record:

• Timings and status of app steps, such as page loads, exam stages, connecting to the examiner, uploads, transcription, and feedback
• Coarse network quality, such as round-trip time and packet loss in broad ranges
• App version, build, and platform (for example, iOS app, mobile web, or desktop web)
• The country your connection comes from, as reported by our hosting provider's network edge
• Identifiers that link each event to your account and to the same test or recording

What we never record:

Transcripts, audio, prompts, or any text you type or say. Each field is limited to numbers, yes or no values, predefined labels, and identifiers. We do not store your IP address in these records.

• Purpose: Reliability and performance only
• Access: Stored in our Supabase database with server-only access; they are not available in the app or to other users
• Retention: Each record expires 45 days after we receive it and is then deleted by an automatic cleanup that runs every hour; records are also deleted with your account if your account is deleted

Data Security

We implement robust security measures to protect your data:

• Encryption in transit: All data transmitted over HTTPS/TLS
• API keys stay on your device: Your own third-party API keys are not stored on our servers
• Row Level Security (RLS): Database policies ensure users can only access their own data
• Secure authentication: OAuth 2.0 through supported Apple, Google, and Microsoft providers
• Rate limiting: Protection against abuse and unauthorized access
• Least-privilege access: Authenticated access is limited by user identity and deployment controls; designated test accounts do not receive broader data access

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Your Privacy Rights

You have the following rights regarding your personal data:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data
• Portability: Export your data in a standard format (available in Settings)
• Withdraw consent: Opt-out of analytics at any time
• Object to processing: Object to certain types of data processing

To exercise these rights, please contact us at the email address provided below.

Analytics & Cookies

Analytics are disabled by default. We use PostHog for product analytics, but only with your explicit consent:

• Analytics tracking requires opt-in through Settings
• You can withdraw consent at any time
• We do not collect personally identifiable information in analytics events
• Session replay is disabled

We use essential cookies and local storage for:

• Authentication and session management
• Storing your practice data locally
• Remembering your preferences and settings

Data Retention

We retain your data as follows:

• Practice data: Retained indefinitely until you delete it or close your account
• Account information: Retained until account deletion, which you can request from Account settings
• Analytics data: Retained for up to 7 years for business analysis (if opted-in)
• Error logs: Retained for 90 days for debugging purposes
• Advanced examiner recordings and transcripts: Retained like practice data until you delete the test or your account; OpenAI's own copy follows OpenAI's retention terms
• Reliability diagnostics: Expire 45 days after we receive them and are then deleted by an hourly automatic cleanup
• Payment records: Retained for 7 years for tax and legal compliance

Children's Privacy

Joe Speaking is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from your country. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last Updated" date
• Sending an email notification for significant changes (if you have an account)

Your continued use of Joe Speaking after changes become effective constitutes acceptance of the revised Privacy Policy.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

GDPR Compliance (EU Users)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR):

• Right to be informed about data collection and use
• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Rights related to automated decision-making

Our lawful bases for processing your data are your consent (for the optional PostHog analytics), performance of contract (for providing the service), and our legitimate interests (for the always-on reliability diagnostics and for operating the service securely).

CCPA Compliance (California Users)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to opt-out of the sale of personal information (we do not sell your data)
• Right to deletion of personal information
• Right to non-discrimination for exercising your rights

We do not sell your personal information to third parties.