Privacy policy

Version of 12 October 2026. The legally binding version is the Ukrainian one; this is a translation for convenience.

1. Who processes the data

The controller of personal data is individual entrepreneur (FOP) Riasna Sofiia Volodymyrivna, taxpayer ID (RNOKPP) 3872001402; address: 08205, Ukraine, Kyiv region, Bucha district, Irpin, Kobylianskoi Olhy St., building 1v/9, apartment 16; phone +380 75 245 00 87. Below — “we”.

Any question about data — access, correction, deletion, withdrawing consent, complaints: hello@kiralang.app.

This policy follows the Law of Ukraine “On Personal Data Protection” and, for users in the EEA and the UK, the GDPR and the UK GDPR. It covers the Kira Lang app for Android and iOS and the website kiralang.app.

2. What data and why

2.1. Learning progress — on your device

Completed lessons, learned words, experience (XP), day streak, crystals, the chosen level and interests, answers to the first-launch questions. This data is stored on your phone and is used to show progress and pick scenes. It is not uploaded to us as a whole — only a small slice together with a message (2.5).

2.2. Backup

If backup is enabled in your phone settings (Google on Android, iCloud on iPhone), the app’s data goes into your backup. The system does this, not us: we have no access to your backup. On Android the backup includes the app’s whole storage: your name, the answers to the first-launch questions, progress, settings, the consent and age marks, saved reports about AI replies (with the beginning of the reply text) and the cached PRO entitlement together with the purchase token. The “Delete my data” button clears the storage on the phone but does not delete a cloud backup that has already been made, and if you restore the app from such a backup, this data comes back to the device. You can delete the backup or turn backup off in the phone settings.

2.3. Microphone and speech recognition

The microphone turns on only while you hold the talk button; nothing is ever recorded in the background. While the button is held, the app records your message (no longer than a minute) and sends the recording to our server, and the server sends it to a speech-recognition provider (OpenAI) to turn it into text. The recording is needed only for that: we don’t keep it after the text is received; only the text comes back to the app.

If our server is unavailable, the app recognises speech with the phone’s own means — on the device or through the system recognition service, depending on your settings. In that case the recording is not sent to us.

2.4. Voicing the replies

Kira’s replies are voiced by a speech-synthesis service (OpenAI): it receives the text of Kira’s reply. Kira may address you by name if you gave it, so your name can end up in the text sent for voicing. The finished audio is temporarily kept in a cache in our server’s memory that is shared by all users and not linked to your identifier, until newer entries push it out or the server restarts. If the server is unavailable, the phone’s synthesiser voices the reply.

2.5. Conversation with Kira

Kira is artificial intelligence, not a person. Her replies are generated by a language model, not by an employee or a teacher.

For Kira to reply, the text of your message and a few previous messages of the dialogue are sent to our server and on to the language-model provider (OpenAI). A learning context goes with them: your name if you gave it when getting acquainted (so Kira can address you by name), level, native and interface language, the lesson topic and words, words from review, the chosen topics, the questionnaire answers about how you like to be corrected and how speaking aloud feels to you, your self-assessment of your speech, and the country from your phone settings — the safety protocol uses it to name your country’s helpline. On the server your messages and this context are not stored and not written to a log. The exceptions concern the texts of Kira’s replies, not your messages (they may contain your name if Kira addressed you by name): if you tap “translate” under a reply from Kira, its text goes to our server and to OpenAI, and the finished translation sits in the server’s shared cache for 30 days with no link to your identifier; for the voice cache see 2.4.

Before your first message the app asks for permission for this transfer. You can withdraw it at any time: Profile → “How it all works” → “Messages to AI”. Without it Kira doesn’t reply.

Not sent: your contacts, the contents of your phone, card details.

Please don’t type or say passwords, card numbers or other sensitive information in the dialogue — it is a learning conversation processed automatically. Kira’s rules state that she does not ask for card numbers, passwords and codes, documents, an exact address, a phone number or an email, uses invented details in role-play, and does not repeat personal data you wrote yourself. These are instructions to the language model, not a technical block: the model can make mistakes. We don’t use your messages to train models; under its terms the provider doesn’t use data received through its API for that either and keeps abuse-monitoring logs for up to 30 days.

Other people. If you name other people in the conversation or talk about them, that information is processed like the rest of the message: it goes to our server and to OpenAI and is not stored on the server; the basis is our legitimate interest in providing you with the service (section 3). Please don’t name full names, contact details or sensitive details of other people: you don’t need them to practise the language (the same is said in the terms of use, section 13).

Explicit phrases about danger. Our server checks every message of yours for explicit phrases about suicide, self-harm or violence (phrases are recognised in the app’s 13 languages and in Italian). The check runs before the limits are checked: in such a message the limits and the subscription screen do not apply. If a phrase is found, Kira replies under the safety protocol and names your country’s helpline; if the language model did not reply or did not name the number, the server substitutes a message with the number itself. The text of such a message is not stored and does not go into a log; the server only adds one to an anonymised daily counter for the language of the phrase found — without your identifier. The message itself, like any other, goes to OpenAI (see above); a match creates no notification or record about you.

2.6. Reports about AI replies and feedback

If you report one of Kira’s replies, the app saves on the device and sends us the reason, the beginning of Kira’s reply text (up to 400 characters), the lesson, the app version, the language and the platform, together with the anonymous identifier (2.10). We need this to tune the filters.

Feedback about the app. Your profile has a “Help make Kira better” form, and after a few lessons the app may ask how things are going. If you send feedback, our server receives the reasons you chose, your text (up to 500 characters), the app version, the interface language, the platform and the anonymous identifier. We don’t ask for your name or email. Don’t write anything in feedback you wouldn’t want to tell us: the text goes as is.

Reports and feedback are read by the app’s owner and used only to improve the product. They are stored on our server together with the anonymous identifier: no more than the last thousand entries, older ones are pushed out by newer ones; there is no time limit on storage besides that. An entry is deleted when newer ones push it out, when you tap “Delete my data”, or when the 12-month inactivity period ends (section 6).

2.7. Purchases

The subscription is set up and paid for through Google Play or the App Store. We never see or store card details — the store processes them. We receive the purchase receipt (token): the server uses it to check with the store that the subscription is active and keeps the PRO entitlement, the subscription state and the payment history (date, plan, status — without card details). The receipt token itself stays on the server together with the PRO entitlement until the data is deleted or the retention period ends (section 6).

With every purchase the app attaches a code computed from your anonymous identifier (the identifier itself cannot be recovered from the code). The store returns it in the receipt and in payment notifications; with it our server can match the purchase to your anonymous identifier even if the app has not been opened for a long time.

2.8. Analytics in the app

The app sends usage events to Google Firebase Analytics: app opening, onboarding steps (the step number, not your answers), passing the age check (without your answer), decisions about consents and reminders, showing the subscription screen, purchase and restore attempts and their outcome (with the amount and currency reported by the store), starting a conversation, finishing a lesson, reports about AI replies (reason code and lesson number) and feedback (reason codes), opening notifications, use of individual app features. These events show where people get stuck — without them changes to the learning would be made blindly. Event parameters contain only lesson numbers, reason, source and screen codes, numbers, the plan identifier, the amount and the currency. Conversation content, your name, the answers to the first-launch questions and the words you learn don’t go into analytics. Besides events, Firebase itself collects technical details: device model, OS version, country, language and an app installation identifier that Firebase creates itself. That identifier is not the “Support ID” (2.10): we do not pass our anonymous identifier (2.10) into analytics.

In EEA countries, the UK and Switzerland analytics and crash reports are turned on only after you agree on the first screen; no analytics events or crash reports are sent before you answer (the anonymous sign-in and the app check, 2.10, do not depend on this choice). In other countries they are on by default. The app works out on the phone itself whether consent is needed — from the country in the language settings or from the time zone, not from the IP address or the SIM card; if it cannot tell, the same applies as in other countries: analytics is on and can be turned off. You can turn them off at any time: Profile → “How it all works” → “Analytics”; the choice applies immediately.

2.9. Crash reports

If something breaks in the app, a report goes to Google Firebase Crashlytics: the error text, the stack trace, the phone model, the OS version and the app version. The report contains no conversation content, words or progress. It is turned off with the same switch as analytics.

2.10. Anonymous identifier and notifications

So that the server knows whose requests it is handling, the app, at launch, if it has no identifier yet (first launch or after clearing data), gets an anonymous Firebase Authentication identifier. It isn’t linked to your name, email or Google or Apple account. It is needed to count the daily free minutes, tell subscribers apart and not give paid replies to just anyone. The same identifier is shown in the app as the “Support ID”; it lives until you delete the app, clear its data or tap “Delete my data”.

The identifier is obtained before the consent screens, because without it the server accepts no request. At the same time the app passes an authenticity check — Firebase App Check (on Android through Google Play Integrity): Google receives details about the app and the device, and our server receives confirmation that the request came from the genuine app and not from an automated script. Firebase also creates an app installation identifier. These operations do not depend on your choice about analytics.

For notifications with news and tips the app gets a device token from Firebase Cloud Messaging and passes it to our server — but only if you yourself turned on “News and tips” (off by default) and allowed notifications in the system. To turn it off: Profile → “Reminders”. Reminders and Kira’s calls are not notifications from our server: the app schedules them on the phone itself.

Signing in to an account. The app has no sign-up: we don’t ask for an email address or a password. The exception is a service account that Kira Lang gives to specific people, for example an app store reviewer. If you sign in to such an account (“Sign in” on the first screen), Firebase Authentication processes that account’s email address and password (the password is stored only as a hash), and our server receives from Firebase a signed token with the account identifier and the PRO flag; the email address is not stored in our data. If you haven’t been given such an account, this doesn’t concern you.

3. Legal bases

• Performance of the contract (the terms of use): conversation, speech recognition and synthesis, the subscription and PRO entitlement, limits, reports, support — Art. 11 of the Law of Ukraine “On Personal Data Protection”, Art. 6(1)(b) GDPR.
• Consent: analytics and crash reports in the EEA, the UK and Switzerland, notifications with news and tips (you turn them on yourself), the email address left earlier in the website form, website analytics and pixels — Art. 6(1)(a) GDPR. You can withdraw consent at any time; this doesn’t affect the lawfulness of processing before withdrawal.
• Legitimate interest: analytics and crash reports in other countries (with the option to refuse), protecting the service from abuse, including anonymous sign-in and the app authenticity check, the safety protocol, technical logs and backups of the server, anonymised server statistics, reports and feedback that you send, information about other people named in your message — Art. 6(1)(f) GDPR.

4. What we don’t do

• We don’t sell or pass data to ad networks or data brokers.
• We don’t show ads in the app.
• We don’t build targeting profiles.
• We don’t require sign-up: the app has no account or password.
• We don’t read your files, contacts, calls or messages.

5. Who the data is shared with

OpenAI, Google Firebase, Hetzner, Resend and Google in the Play Console process data on our instructions and for the purposes described here. The app stores (Google Play, Apple App Store) process payment data as independent controllers under their own rules; Google, Meta and TikTok act the same way on the website (section 8). Transfers outside Ukraine and the EEA: Google is certified under the EU-US Data Privacy Framework; OpenAI is bound by the EU Standard Contractual Clauses in its data processing agreement; transfers from Ukraine rely on performing the contract with you (Art. 29 of the Law of Ukraine “On Personal Data Protection”).

6. How long we keep it

• On the device — until you delete the app, clear its data or tap “Delete my data”. A cloud backup of the phone (2.2) lives by the system’s rules.
• Messages and voice recordings — not kept on our server after the reply; at the model provider — abuse-monitoring logs for up to 30 days.
• Translation and audio of Kira’s replies — a translation you requested by tapping sits in the server’s shared cache for 30 days; the voiced audio sits in the server’s memory cache, limited in size, until newer entries push it out or the server restarts. The caches are not linked to your identifier.
• Reports and feedback — no more than the last thousand entries; there is no time limit on storage besides that. Deleted together with the other server data: with “Delete my data” or after 12 months of inactivity.
• Subscription details and server counters (the PRO entitlement and the purchase receipt token, subscription state, the in-app payment history, daily counters, the notification address, the last-contact mark) — until you tap “Delete my data” in your profile, and otherwise for 12 months after the app last contacted the server; while a subscription is active they are not deleted. Payment records are kept by the store under its own rules.
• Anonymised server statistics (daily counters of events and errors and an approximate number of different users per day, from which identifiers cannot be recovered) — 90 days.
• Analytics and crash reports at Google Firebase — the period is determined by the settings of those services in the Firebase console and by Google’s rules.
• Server technical logs — without request content, limited in size and pushed out by newer entries.
• Server backups — daily, the 14 latest are kept; they may still hold data you have already deleted — for up to 14 days, until older copies are replaced by newer ones.
• The email address left earlier in the website form — until you unsubscribe or the closed test ends, whichever comes first.

7. Closed test request

The home page of the site used to have a form where you could leave an email address to get on the tester list. There is no such form on the site now. If you left an address earlier, we handle it as described below. There is no such form in the app itself either: it still works without any sign-up.

The address had to be confirmed. After you submitted the form we sent one email with a confirmation link. Until you follow it, the address goes nowhere and there will be no more emails. That is how we make sure the address was left by its owner and not by someone else.

• What was collected: the email address, the date of the request and the language of the page.
• Why: to confirm the address, add it to the Google Play tester list and write to you once when access opens.
• Legal basis: your consent, confirmed by following the link in the email.
• Where it is stored: on our server. This is an exception to the general “everything on the device” rule, and we say so plainly.
• Who we share it with: the email delivery service Resend, so the email arrives, and Google, when we add the confirmed address to the tester list in the Play Console. Nobody else.
• There is no newsletter. We don’t send regular emails.

Unsubscribing deletes the address. The link is in every email, and in Gmail the built-in button works too. We don’t move you to an “unsubscribed list” — we erase the address; all that stays with us is an irreversible hash from which neither the address nor the list of recipients can be reconstructed, and which exists for one purpose only: so that we don’t accidentally write to you again.

Separately, a service delivery log is kept: when an email went out and with what result. There are no addresses in it, only the domain and the same irreversible hash, and it is kept to a limited number of the most recent entries.

8. Analytics on the kiralang.app website

Everything above concerns the app. The website works differently.

On your first visit the site asks for consent to analytics and advertising pixels. Until you press “Accept”, no third-party script is loaded and no cookie is set. If you press “Decline”, nothing is loaded at all; the site keeps working in full.

If you consent, we load:

• Google Analytics 4 — how many people visit, from which pages and countries. The IP address is anonymised.
• Meta Pixel and TikTok Pixel — to understand which ads bring people in, and to avoid showing ads to those who already installed the app.

These services set their own cookies and receive your IP address, device type and page address. They are independent controllers, and their processing is governed by their own policies — Google, Meta, TikTok.

You can change your mind at any time: reopen the choice. Your choice is kept in the browser’s local storage under the key kira:consent — it is not a cookie and is never transmitted.

Apart from that, the site sets no cookies and runs no counters of its own.

9. Your rights

You have the right to know what data about you is processed, to get a copy, to correct it, to delete it, to restrict or object to processing, to withdraw consent and to data portability, as well as to lodge a complaint with a supervisory authority.

How: write to hello@kiralang.app and attach the “Support ID” from the app (Profile → “How it all works”): we have no accounts, and it is the only way for us to find your data. We reply within 30 days.

Supervisory authorities: in Ukraine — the Ukrainian Parliament Commissioner for Human Rights; in the EEA — the data protection authority of your country; in the UK — the ICO.

10. Data deletion

In the app: Profile → “Delete my data”. Details — on the kiralang.app/en/delete page.

What is erased. On the server — the PRO entitlement and the receipt token, subscription details and the payment history, daily counters, the notification token, the last-contact mark, and the feedback and reports about AI replies that carry your identifier. On the phone — progress, words, settings and the consent and age marks. The anonymous Firebase account is deleted; if it could not be deleted, the app only signs out of it.

What remains.

• Backups of our server — for up to 14 days (section 6).
• A cloud backup of your phone (Google or iCloud), if there was one: the system made it and the button does not delete it; if you restore the app from such a backup, this data comes back to the device. You can delete the backup in the phone settings (2.2).
• Data that Google (Firebase Analytics, Crashlytics) and OpenAI have already received — under those companies’ periods and rules (sections 5 and 6).
• Anonymised server statistics without your identifier (section 6).

The button does not cancel the subscription in the store. Cancel it in the store (Google Play or the App Store) — that is a separate operation, and we can’t do it for you; until the subscription is cancelled, the charges continue. Payment records are kept by the store under its own rules.

11. Age

The service is for people aged 18 and over — that is how the app is listed in the stores. On first launch the app asks for your age once and doesn’t store the answer itself. We don’t knowingly collect minors’ data. We do not use other ways to determine age — voice, the content of conversations or store data. If you say in the conversation that you are under 18, Kira’s rules have her stop the lesson and suggest talking about learning with a parent, a teacher or another adult you trust. If we learn that someone under 18 is using the service, we may end their access and will delete the data we can find by their “Support ID” (terms of use, section 4). If a minor has given us data, write to hello@kiralang.app — we will delete it.

12. Security

Data travels only over an encrypted connection (HTTPS). The server is in the EU and access to it is restricted. There is no absolute security on the internet; if a breach occurs that may affect your rights, we will notify the supervisory authority and you within the time limits set by law (in the EEA — within 72 hours).

13. Changes to this policy

We may update this policy. Each version has a date (at the top). We will announce material changes — new data, recipients or purposes — in the app before they take effect.