1. Introduction

Xylo Software LLC ("we," "us," or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Tagalog language learning platform, Tahanan ("the Service"), available on iOS, Android, and web.

By using the Service, you consent to the data practices described in this policy. If you do not agree with this policy, please do not use the Service.

2. Information We Collect

2.1 Account and Profile Information

When you create an account, we collect:

• Basic account information: Email address and password
• Profile information: Name, username, country, and timezone
• Date of birth: Asked during sign-up or before you use voice messages, to check that you meet the minimum age for voice messaging. Coaches and other users cannot see it
• Language background: Filipino heritage status, current Tagalog ability level, and learning motivations
• Payment information: Processed securely through third-party payment processors (we do not store your full payment card details)

2.2 Learning and Usage Data

As you use the Service, we collect:

• Progress data: Lessons completed, flashcard performance, study streaks, and learning statistics
• Flashcard content: Custom flashcards you create
• Usage patterns: Features used, time spent, and interaction patterns

2.3 Audio and Voice Data

We collect audio recordings when you use our voice-enabled features:

• AI Conversation Practice: Voice recordings during AI-powered conversation sessions are processed for speech-to-text transcription and stored to provide session history and improve the Service
• Coaching Submissions: Audio recordings you submit for coach review, along with any text responses you provide
• Voice Messages: Voice messages you send to friends and family through the Service (see Section 5)

2.4 Device and Technical Information

We automatically collect:

• Device information: Device type, operating system, browser type, and unique device identifiers
• Push notification tokens: Device tokens for sending notifications (if you enable notifications)
• Log data: IP address, access times, error logs, and system activity
• Location data: General geographic location based on IP address

3. How We Use Your Information

We use the collected information for the following purposes:

• Provide, maintain, and improve the Service
• Process your subscription and payments
• Personalize your learning experience based on your profile and progress
• Track your progress and maintain your learning history
• Power our AI conversation practice features and provide feedback
• Enable coaches to review your submissions and provide personalized feedback
• Check that you meet the minimum age before you can use voice messages
• Deliver voice messages and friend requests between you and the people you connect with
• Review reports, remove harmful content, and restrict accounts that break our Terms of Service
• Send push notifications about your learning (daily reminders, coach feedback, streak alerts) and about voice messages and friend requests
• Send important updates, security alerts, and administrative messages via email
• Respond to your comments, questions, and customer support requests
• Analyze usage patterns to improve our features and user experience
• Detect, prevent, and address technical issues and fraud
• Comply with legal obligations and enforce our Terms of Service

4. Coaching Feature and Data Sharing with Coaches

Our coaching feature connects you with independent contractor coaches who provide personalized feedback on your Tagalog speaking practice.

4.1 What Coaches Can See

When you submit recordings for coaching, coaches have access to:

• Your audio recordings and text responses
• Your profile information (name, username, country, Filipino heritage, Tagalog ability level, and learning motivations)
• Your lesson progress to provide contextual feedback

4.2 Coach Obligations

Coaches are independent contractors who are contractually required to keep your information confidential and use it only for providing coaching services. They may not share, sell, or use your data for any other purpose.

5. Voice Messages with Friends and Family

Voice messages let people who know each other send private voice messages in the app, for example a learner and a family member who already speaks Tagalog. Voice messages are free. Who can use them, including the minimum age, is set in the app; voice messages are currently available only to people aged 18 or older. If we change who can use voice messages, we will update this policy.

5.1 What We Collect

• Your date of birth, to check that you meet the minimum age
• A record of when you accepted our Terms of Service and this Privacy Policy for voice messages
• The display name and preset avatar you choose for voice messages
• Your friend code, any invite links you create, your friend requests, your friends list, and the people you block
• The voice messages you send, and details about each one: who sent it, who it was sent to, its length, when it was sent, and whether it has been played
• Reports you submit, including the reason and any details

5.2 Who Can See It

• Only you and the friend you send a voice message to can play it. Voice messages are never public.
• Nobody can search for you. Today, people can only connect with you through a friend code or invite link that you share, and you choose whether to accept each friend request.
• We may also connect members of the same family plan or another trusted group as friends. We will update this policy to describe how that works before it starts.
• Your display name and avatar are shown to your friends, to people you send a friend request to, and to anyone who opens an invite link you share.
• Coaches cannot see your voice messages or friends.
• Authorized Tahanan support staff can access voice messaging information, including audio, to review reports, investigate safety concerns, enforce our Terms of Service, or comply with the law.
• We do not transcribe voice messages, send them to AI providers, or use them to train AI models.

5.3 How Long We Keep Voice Messages

• The audio of each voice message is deleted automatically 30 days after it is sent.
• You can delete a voice message you sent before then. We keep a record that a message was sent, but not its audio.
• If a voice message is reported, we keep its audio until our review is finished. Audio that a moderator removes is deleted.
• We keep records of reports and moderation decisions to keep the Service safe and to enforce our Terms of Service.

6. Third-Party Service Providers

We share information with third-party service providers who perform services on our behalf:

• Supabase: Database hosting, authentication, and file storage
• Stripe: Payment processing and subscription management
• OpenAI: AI conversation features and speech-to-text transcription
• ElevenLabs: Text-to-speech for audio content generation
• Resend: Transactional and notification emails
• Expo: Push notification delivery for mobile apps
• RevenueCat: In-app purchase and subscription management for mobile apps
• PostHog: Product analytics about how the Service is used

These service providers are contractually obligated to protect your information and use it only for the purposes we specify. All data is stored and processed in the United States.

7. Other Information Sharing

7.1 Legal Requirements

We may disclose your information if required by law or in response to valid legal requests, such as:

• Complying with subpoenas, court orders, or other legal processes
• Responding to government or law enforcement requests
• Protecting our rights, property, or safety, or that of our users or the public
• Enforcing our Terms of Service

7.2 Business Transfers

If we are involved in a merger, acquisition, sale of assets, or bankruptcy, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have.

7.3 No Sale of Personal Information

We do not sell your personal information to third parties.

8. Data Security

We implement appropriate technical and organizational security measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication requirements
• Secure payment processing through PCI-compliant providers
• Regular backups and disaster recovery procedures

However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

9. Data Retention and Deletion

We retain your information for as long as your account is active. When you delete your account:

• Immediate deletion: Your personal information, profile data, learning progress, audio recordings, and coaching submissions are deleted immediately
• Voice messages: Your date of birth, voice messaging profile, friends, and the voice messages you sent or received are deleted. Their audio files are removed by automatic cleanup shortly afterward
• Safety records: Records of reports about your account and of moderation decisions may be kept, no longer linked to your account, to keep the Service safe
• Payment records: We may retain transaction records as required by law and accounting practices
• Anonymized data: We may retain anonymized, aggregated data that cannot identify you for analytics purposes

10. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information:

10.1 Access and Portability

You have the right to access and receive a copy of your personal information in a portable format.

10.2 Correction

You can update or correct your account and profile information at any time through your account settings.

10.3 Deletion

You can delete your account through the app settings. Your data will be deleted immediately. You can also request deletion by contacting us at support@tagalogapp.com.

10.4 Notification Preferences

You can manage your push notification and email preferences through your account settings at any time.

10.5 California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what information we collect, the right to request deletion, and the right to opt out of the sale of personal information (we do not sell your information).

10.6 European Privacy Rights

If you are in the European Economic Area, you have rights under the General Data Protection Regulation (GDPR), including the right to access, rectification, erasure, restriction of processing, data portability, and the right to object to processing.

To exercise any of these rights, please contact us at support@tagalogapp.com. We will respond to your request within the timeframe required by applicable law.

11. Push Notifications

If you enable push notifications on our mobile apps, we collect your device push token to send you notifications about:

• Daily study reminders
• Coach feedback on your submissions
• Streak warnings
• New voice messages, friend requests, and accepted friend requests, including the sender's display name
• Important service updates

You can disable push notifications at any time through your device settings or the app's notification preferences.

12. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect information and improve the Service. You can control cookies through your browser settings, but disabling cookies may affect your ability to use certain features of the Service.

13. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

14. Children's Privacy

We do not knowingly collect personal information from children under 13. If we become aware that we have collected information from a child under 13 without parental consent, we will take steps to delete that information promptly. If you believe we have collected information from a child under 13, please contact us at support@tagalogapp.com.

Voice messages have a minimum age, which is set in the app and is currently 18, based on the date of birth you give us. If we learn that someone using voice messages does not meet it, we will turn off their access to voice messages. Before we open voice messages to anyone younger, for example with a parent or guardian's consent, we will update this policy.

15. International Data Transfers

Your information is stored and processed in the United States. If you are accessing the Service from outside the United States, your information will be transferred to the United States. By using the Service, you consent to the transfer of your information to the United States. We take appropriate measures to ensure your information receives adequate protection.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by posting the updated policy on the Service and updating the "Last Updated" date. We encourage you to review this Privacy Policy periodically. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

17. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: support@tagalogapp.com
Website: tagalogapp.com