Privacy Policy

Last updated: 15 September 2026

This Privacy Policy explains how the language-learning app Monolo (the “App”) handles information and why. In this policy, “we” and “us” mean the operator identified in section 14. Everything below reflects how the App is actually built.

1. About this policy

This policy applies to the Monolo app and its related support services. The operator’s legal details and privacy contact are provided in section 14.

2. What we collect

2-1. Account information

You sign in with Apple or Google only. We never receive or store a password. From your identity provider we receive:

your email address (if you use Apple’s Hide My Email, this is the relay address);
which provider you used (Apple or Google) and the user ID that provider assigns to you.
the version of the Terms you accepted and the time of acceptance.

2-2. Profile

Nickname
Contact email address (initially set to the email received from your identity provider, kept separately from your sign-in account, and changeable in Settings)
Learning language and native language
The time zone obtained from your device’s operating-system settings (used to apply daily limits according to the calendar day in that setting; GPS location and IP address are not used to obtain it)
Level (CEFR-equivalent; both the estimate produced by each round of feedback and any level you set yourself)
Playback speed for spoken audio
Whether reminders are on, and the reminder time
Practice streak and the date you last practiced

2-3. Learning data

Transcripts of what you say
AI feedback: suggested rewrites, explanations, difficulty tags, and the verbatim part of your speech used as a review prompt
Level assessments (scores for vocabulary diversity, sentence complexity, and grammatical accuracy, plus the estimated level)
Words per minute (word count ÷ recording seconds × 60), recording length, and topic
Suggested rewrites saved to My List, the verbatim review prompt, explanations, spoken audio, review counts, recall counts, and the time you last reviewed them
Practice session records (counts and durations used for your reports)

2-4. Usage counts

To enforce the daily limits (3 rounds of feedback and 20 generated audio clips), we record a count per user, per day, per feature.

2-5. Subscription information

Subscription state, plan type, expiry date, and last update time, as reported to us by RevenueCat.

We never receive your card number or any other payment details. Payment is handled by Apple’s App Store.

2-6. Push notification token

Only if notifications are enabled on your device, we store the token used to deliver push notifications (an Expo push token). We do not request it on devices where notifications are off.

2-7. Information used to prevent abuse

To prevent abuse of the initial assessment that can be used anonymously, we generate a value that is difficult to reverse from the IP address used for the request and store it with the usage count for a short period. We do not store the IP address itself in the App’s database, and we do not use this information to determine your location, for advertising, or to analyse your behaviour.

2-8. Usage analytics

We use PostHog to understand how people move through onboarding and to improve the App’s usability. We limit the information sent to PostHog to:

your in-app user ID;
onboarding screens viewed, buttons pressed, completion path, authentication provider type, and error type;
technical device, operating-system, and app information added by the SDK.

We do not send your name, nickname, email address, audio recordings, transcripts, or AI feedback to PostHog. Automatic interaction capture, session replay, and location inference are disabled. We do not use this information for advertising or to track you across apps or websites owned by other companies.

2-9. What we do not collect

The App does not collect:

device location such as GPS data, contacts, camera, or photos;
advertising identifiers (such as the IDFA), or any tracking for advertising purposes;
crash reports — the App contains no crash-reporting SDK.

The only permissions the App requests are the microphone, for recording, and notifications, which are optional.

We do not place cookies or analytics tools on this website.

3. How recordings are handled

We do not store your audio recordings on our servers.

Recordings are written to temporary storage on your device. They are never uploaded to our storage.
To produce a transcript, the recording is sent to OpenAI’s speech recognition API (Whisper) at the moment transcription runs. What comes back is text and the length of the audio.

4. What we store and when we delete it

Data	Storage and deletion
Audio recordings	Not stored (temporary files on your device only)
Transcripts, AI feedback, level assessments, words per minute	Stored temporarily for as long as operationally necessary for service backup purposes. They are not a user-visible history and cannot be viewed in the App. Information that is no longer needed is deleted automatically.
Suggested rewrites saved to My List, with verbatim review prompts and explanations	Kept until you delete them or close your account. A saved phrase remains even if the session it came from is deleted.
Generated audio files	Stored for as long as needed to provide text-to-speech. Files that are no longer used by any user are deleted automatically.
Profile, subscription state, usage counts	Kept until you close your account
Identifier derived from an IP address for abuse prevention	Stored for a short period to prevent abuse
Usage data sent to PostHog	Stored under the PostHog project’s configured retention period for as long as needed to improve the App, then deleted
Deletion log	Kept in a form that does not identify you for as long as operationally necessary for matters such as billing and refund verification (see section 7).

4-1. Exceptions to these storage and deletion rules

Despite the rules above, we may keep information for longer where the law requires us to retain it, or where retention is necessary to deal with a billing or refund dispute or to establish, exercise, or defend a legal claim. Any such retention is limited to what is necessary and to how long it is necessary, and we delete the information once that purpose has been met.

Deleted data may also remain in routine backups until those backups are overwritten in the normal course of operation.

5. Third parties we send data to

We send information to the following providers in order to run the App. All of them are based in the United States, so this involves transferring data outside Japan.

Recipient	What we send	Purpose
OpenAI, L.L.C.	Audio recordings, transcripts, your learning language, native language and current level, and the sentence to be spoken	Transcription, feedback and level assessment, text-to-speech
Supabase, Inc.	Everything this policy describes as stored	Database, authentication, file storage, and server-side processing
RevenueCat, Inc.	Your in-app user ID and App Store purchase information	Determining and managing subscription status
Apple Inc. / Google LLC	Sign-in credentials (ID tokens)	Authentication
Apple Inc.	Information needed to complete a purchase (collected by Apple directly)	App Store payment processing
Expo (650 Industries, Inc.)	Push notification token and notification text	Delivering level-up notifications (only to devices where notifications are enabled)
PostHog, Inc.	Your in-app user ID; onboarding screen, action, completion-path and error information; and technical device, operating-system and app information	Understanding onboarding usage and improving usability

Where we engage an external provider to process personal information, we limit the information and purpose to what is necessary, select the provider appropriately, confirm necessary security measures by contract or another appropriate method, and supervise the provider appropriately.

OpenAI states that data submitted through its API is not used to train its models. For details of how each provider handles data, please see their own privacy policies. We take the security measures required by applicable law for providers outside Japan. Where required by law and requested through the contact in section 14, we will provide information about those measures and the privacy regime that applies to the provider.

We do not send your information to any other third party. We share nothing with advertising networks.

6. Why we use your information

To provide the App’s features: transcription, feedback, level assessment, text-to-speech, and review
To show reports based on practice counts and related data, and to determine your level automatically
To keep operational backups of transcripts and AI feedback
To authenticate you and manage your account
To provide paid plans and determine subscription status
To enforce daily usage limits using the time zone set in your device’s operating system
To record your acceptance of the Terms
To prevent abuse of the anonymous assessment
To send reminders and level-up notifications
To analyse onboarding usage and improve usability
To respond to your enquiries

7. Closing your account and deleting your data

You can delete your account at any time from Settings › Account in the App. Deletion happens immediately; there is no grace period.

7-1. What is deleted

Your authentication account and profile, including nickname, contact email, learning settings, and push token
Transcripts, AI feedback, level assessments, and practice records
Every phrase saved to My List
Usage counts
Generated audio files that no other user references
Personally identifying attributes held by RevenueCat — email address, display name, phone number, and IP address. These are cleared as part of deletion.

7-2. What remains

To record that a deletion took place, we retain an anonymised deletion log containing:

a user identifier anonymised in a form that cannot be reversed (the original user ID is not retained);
the time of deletion;
your plan at that moment (trialing, active, cancelled, or none);
whether auto-renewal was on at that moment;
the version of the warning text shown to you and what you consented to.

Usage data already sent to PostHog may also remain until the retention period configured for that project expires. It does not include your name, nickname, email address, audio recordings, transcripts, or AI feedback.

This log contains nothing that identifies you — no email address, no nickname, no provider user ID. We keep it so that, if a billing or refund question arises later, we can establish what a user agreed to before deletion.

Your subscriber record at RevenueCat itself is retained for revenue reporting, with the attributes above cleared.

7-3. Deletion and billing

Deleting your account does not cancel your subscription. There is no way for an app to cancel an App Store subscription on your behalf, so you must turn off auto-renewal yourself, from Settings › your Apple ID › Subscriptions on your device.

8. Security

All communication is encrypted (HTTPS).
The database enforces row-level security, so you can only read and write your own data.
Subscription fields can only be written by the server process that receives notifications from our payment provider; the App cannot change them.
Usage limits are enforced on the server.

9. Where the service is offered

Monolo is not offered in the member states of the European Economic Area, in the United Kingdom, or in Switzerland, and it is not intended for use from those regions.

10. Age restriction

Monolo is not directed to children under 13. We do not knowingly collect personal information from anyone under 13. If we learn that we have collected such information, we will delete it promptly.

If the law of the country or region where you live sets a higher age below which a parent or guardian must consent to your use of a service like this one, or to the handling of your personal information, please use Monolo only with that consent.

11. Your rights

Under applicable law, you may have the right to request notice of purpose, access, correction, addition or deletion, restriction or cessation of use, erasure, cessation of third-party disclosure, and access to records of third-party disclosure concerning personal information we hold about you. To make a request, please contact us using the details in section 14. We will respond without undue delay as required by law.

You can also delete your account and all of your learning data yourself, immediately and at any time, from within the App, as described in section 7.

We may need to verify your identity before acting on a request. Because we store no passwords and sign-in works only through Apple or Google, we may ask you to write to us from the account you registered with.

11-1. Providing information is voluntary

You may choose whether to provide information to us. However, if you do not provide information needed to create or verify your account, transcribe audio, provide feedback, or provide another feature, some or all of the App may not be available to you.

12. If you live in California

This section applies in addition to the rest of this policy where the California Consumer Privacy Act, as amended by the CPRA, applies to you.

12-1. Categories of personal information we collect

Identifiers (email address, the user ID assigned by your identity provider, and your in-app user ID)
Commercial information (subscription state, plan, and expiry date)
Audio and similar sensory information (transcripts of what you say; the recordings themselves are sent for transcription only and are not stored)
Inferences (the level we estimate from your speech)

We collect this from you directly and from the providers listed in section 5. Our purposes are set out in section 6, the parties we disclose to in section 5, and our storage and deletion rules in section 4.

12-2. Sale and sharing

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done either in the preceding 12 months. The same is true of the personal information of anyone under 16.

12-3. Sensitive personal information

We do not use voice data to identify anyone biometrically. We do not use or disclose sensitive personal information for any purpose that would give rise to a right to limit its use.

12-4. Exercising your rights

California residents have the right to know, to delete, to correct, and not to be treated differently for exercising those rights. To exercise them, contact us using the details in section 14. You may also submit a request through an authorised agent. We may need to verify that you are who you say you are, or that an agent is genuinely authorised, before we act.

13. Changes to this policy

We may change this policy. If we make a significant change, we will post it on this page and, where appropriate, notify you in the App.

14. Contact and operator details

Monolo is operated by Yuzuka KIKUCHI. For questions about this policy, personal information, or data deletion, please contact us at [email protected].

The operator’s address will be disclosed without delay upon request. To request disclosure, please contact the email address above.