Privacy Policy

• Account: email, name and password (stored only as a hash). If you sign in with Apple or Google, your account identifier at that provider and the email and name it shares.
• Onboarding answers: your goal, Hebrew level and topics of interest.
• Learning: which cards you studied, your answers and translations, exercise results, streak, points, achievements, daily tasks, card notes and favourites.
• Voice and transcripts: when you record a phrase or answer aloud, the recording is sent for speech recognition; we keep only the resulting text, and the audio is not stored on our servers. For calls with the AI conversation partner we keep the text of the conversation, its duration and its evaluation.
• Subscription: Premium status and dates, purchase identifiers and App Store or Google Play receipts used to verify purchases. We never receive your card details; payment is handled by the app store.
• Notifications: your device push token, notification settings, quiet hours and time zone.
• Technical data: IP address and device type when you sign in or change your password (security log), crash reports, and app usage events (for example, "session started", "call finished") with app version and platform.

On hebrewbites.com: if you join the waitlist, we receive your email and page language by email and use them only to tell you about the launch. The site uses Vercel Web Analytics, which collects anonymous visit statistics without cookies.

• To run your account, learning, AI calls and sync across devices.
• To evaluate your answers and pronunciation and give feedback.
• To verify purchases and unlock Premium.
• To send the notifications you allowed and service emails (email confirmation, password reset).
• To protect your account and find bugs in the app.
• To understand which parts of the app help people learn and improve them. These events stay with us and are not shared with advertising or analytics companies.

We share data only with services the app cannot work without, and only what they need:

• ElevenLabs — the voice conversation partner in calls. Your voice goes to it directly during the call, together with the name used to address you; the conversation text comes back to us.
• OpenAI — speech recognition for recorded phrases and spoken answers, and evaluation of translations and calls. It receives the audio or the text of the answer; your email and name are not sent.
• Microsoft Azure — app servers and database (data centres outside Israel).
• Sentry — crash reports. Only an internal user identifier is sent, without email or name.
• Expo, Apple Push Notification service and Firebase Cloud Messaging — push notification delivery.
• Apple and Google — sign-in, subscription payments and purchase verification.
• Resend — service emails.
• Vercel — website hosting and anonymous site statistics.

We may disclose data where required by law or a court order.

Account and learning data are kept while your account exists. Sent emails are kept for 90 days. Database backups are kept for 7 days.

When you delete your account, we delete the account, progress, transcripts, notes, favourites, settings, push tokens, subscription records and usage events. The security log (IP address and device type at sign-in) and crash reports are kept without a link to your account for up to 12 months. Conversations stored by ElevenLabs are deleted under its retention rules; to have them deleted sooner, write to us and we will pass the request on.

• Delete your account and data in the app: Profile → Delete account.
• Correct your name and email in the app: Profile → Edit profile.
• Get a copy of your data, or restrict or object to its processing — email vadim@hebrewbites.com and we will reply within 30 days.
• Turn off notifications in the app or phone settings. Turn off microphone access in your phone settings; calls and spoken exercises will not work without it.

If you believe we are violating your rights, you can contact the data protection authority in your country.

Data is sent over encrypted connections. Passwords are stored only as hashes and sign-in tokens in the device's secure storage. Only staff who need database access for their work have it.

The app is intended for people aged 16 and over. We do not knowingly collect data from younger children; if you learn that a child has created an account, contact us and we will delete it.

If we change this policy materially, we will tell you in the app or by email before the changes take effect. The date of the current version is shown at the top of this page.