Privacy Policy

Last updated: July 18, 2026

This Privacy Policy describes how YappZilla, operated by Konstantin Pavlovskii, an individual entrepreneur residing in Spain ("we", "us", or "our"), collects, uses, and protects your information when you use the YappZilla mobile application and website located at yappzilla.com (the "Service"). By using the Service, you agree to the practices described below.

1. Information We Collect

1.1 Information you provide

• Account information: email address and password (stored as a secure hash). You may also sign in using Sign in with Apple, in which case we receive your Apple ID identifier, the email address associated with your Apple ID (or a private relay email if you chose to hide yours), and your name if you choose to share it. We do not receive or store your Apple ID password.
• Conversation content: the messages you send and receive during language practice sessions.
• Conversation metadata: selected proficiency level, topic, and automatically generated titles.
• Payment information: transaction records processed through Apple App Store, Google Play, and RevenueCat. We do not store full card numbers.

1.2 Information collected automatically

• Usage data: token balance, number of conversations, feature interactions, and session duration.
• Device and technical data: IP address, device type, operating system version, and app version.
• Audio data: text submitted for text-to-speech synthesis is sent to providers and cached as audio files. We do not store voice recordings of you.
• Product analytics events: when you opt in via the in-app consent screen, the mobile app collects anonymized usage events such as screen views, feature usage, session counts, and retention signals (for example, days since install). These events are processed by PostHog in the European Union and are not linked to the content of your conversations. No personal conversation content is sent to our analytics provider.
• Crash and performance reports: when you opt in via the in-app consent screen, the mobile app collects stack traces, device model, operating system version, app version, and timing data when the app crashes or freezes. These reports are processed by Sentry in the European Union and are used solely to diagnose and fix bugs.
• Consent state: your analytics and crash-reporting consent choices are stored on your device using secure storage. This state never leaves your device.

2. How We Use Your Information

• To provide AI-powered conversation practice, grammar correction, and vocabulary assistance.
• To generate audio pronunciation of responses using text-to-speech providers.
• To manage your account, authenticate sessions, and process token purchases.
• To maintain conversation history so you can resume and review past sessions.
• To improve the quality of responses, troubleshoot issues, and develop new features.
• To understand aggregate product usage patterns (such as which features are most used and where users drop off) and to diagnose crashes and performance problems, based on the consent you grant in the app.
• To comply with legal obligations and enforce our Terms of Service.

3. Legal Bases for Processing (GDPR Art. 6)

We process your personal data under the following legal bases:

• Account, conversations, and payments: processed on the basis of contract (Art. 6(1)(b)) — this data is required to deliver the Service you requested.
• Product analytics events: processed on the basis of consent (Art. 6(1)(a)) — you opt in via the first-run consent screen, and you may withdraw consent at any time in the Profile screen.
• Crash and performance reports: processed on the basis of legitimate interest (Art. 6(1)(f)) — to diagnose and fix bugs that affect service stability. For transparency, we gate these behind the same consent screen and allow you to opt out at any time.
• Legal compliance: where processing is necessary to comply with a legal obligation (Art. 6(1)(c)).

4. Third-Party Services and Sub-processors

We share data with the following third parties to operate the Service. Each provider processes data in accordance with its own privacy policy:

• OpenAI — processes your conversation messages and vocabulary queries to generate AI tutor responses via GPT models.
• AWS Polly, OpenAI TTS, and HuggingFace — receive text to synthesize audio pronunciation.
• Cloudflare R2 — stores cached audio files and serves them via CDN.
• RevenueCat — processes in-app purchases and subscription state on behalf of Apple App Store and Google Play.
• Stripe — processes payments and token purchase transactions.
• Apple App Store and Google Play — handle in-app purchase flows and receipts.
• Sign in with Apple — used to verify your identity when you choose this sign-in method. Apple provides us with a stable identifier (Apple ID) and your email. We do not receive your Apple ID password or access to your Apple account. See Apple's privacy policy at https://www.apple.com/legal/privacy/.
• PostHog (PostHog, Inc.) — processes anonymized product analytics events (screen views, feature usage, retention) when you opt in via the in-app consent screen. PostHog data is hosted in the European Union. See https://posthog.com/privacy for PostHog's privacy policy.
• Sentry (Functional Software, Inc.) — processes crash reports and performance data when you opt in via the in-app consent screen. Sentry data for our project is hosted in the European Union. See https://sentry.io/legal/privacy/ for Sentry's privacy policy.

4.1 Sub-processor list

The following sub-processors process personal data on our behalf. We will notify you in-app at least 30 days before adding a new sub-processor that processes personal data. You may object to a new sub-processor by emailing privacy@yappzilla.com.

We do not sell your personal data to third parties. Data shared with the providers above is limited to what is necessary to deliver the corresponding feature.

5. Data Retention and Deletion

5.1 Retention periods

• Account data: retained for as long as your account is active, or until you delete your account.
• Conversations: kept until account deletion, unless you delete individual conversations from within the app.
• Payment records: anonymized on account deletion (your user ID is removed); non-identifying purchase facts are retained in aggregate for legal and accounting requirements.
• Product analytics events: retained by PostHog for up to 25 months unless deleted earlier via the "Delete my data" feature. Anonymous events (not linked to a user ID) are retained the same way.
• Crash and performance reports: retained by Sentry for up to 90 days unless deleted earlier via the "Delete my data" feature.
• Residual data in backups may persist for up to 90 days after deletion before being permanently purged.

5.2 How to delete your data

You have two ways to delete your data, depending on what you want to remove:

• Analytics and crash data only: In the mobile app, go to Profile → Privacy & data → Delete my data. This erases your anonymized usage history and crash reports from PostHog and Sentry, and turns off future collection. Your account, conversations, and progress are not affected. Deletion on PostHog and Sentry may take up to 30 days to fully process.
• Full account data: In the mobile app, go to Profile → Delete Account. This permanently deletes your YappZilla account, conversations, messages, token balance, and auth tokens. It also automatically triggers analytics data deletion on PostHog and Sentry (the same as "Delete my data" above).
• Email request: You can also email privacy@yappzilla.com with the subject "Data deletion request". We will respond within 30 days (GDPR Art. 12(3)).

You can revoke your analytics and crash-reporting consent at any time in the app's Profile screen. Revoking consent stops future collection but does not delete data that has already been collected — use "Delete my data" for that.

6. Your Privacy Rights

Depending on your location, you may have the following rights under GDPR (EU/UK), CCPA (California), or similar laws:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your personal data ("right to be forgotten").
• Restriction — request that we limit processing of your data.
• Data portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — revoke consent you previously granted at any time.
• Right to lodge a complaint — you have the right to lodge a complaint with your local data protection authority (for example, the CNIL in France at https://www.cnil.fr, or the AEPD in Spain at https://www.aepd.es).

To exercise any of these rights, email privacy@yappzilla.com or support@yappzilla.com. We respond to verified requests within 30 days. You can also manage your product analytics and crash-reporting consent directly in the mobile app's Profile screen at any time, without contacting us.

7. Cookies and Similar Technologies

Our website (yappzilla.com) uses cookies and similar technologies to operate the site and understand how it is used. The mobile app does not use cookies.

• Essential cookies: required for the website to function and are not optional.
• We do not use cookies for targeted advertising.

8. Children's Privacy

The Service is not directed to children under 13 (or the equivalent minimum age in the applicable jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact privacy@yappzilla.com and we will delete it promptly.

9. Data Security

We implement appropriate technical and organizational measures to protect your data, including encrypted password hashing (for email/password accounts), HTTPS for all network traffic, and access controls. Accounts created via Sign in with Apple do not store a password with us; authentication is delegated to Apple. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. International Data Transfers

The data controller is Konstantin Pavlovskii, based in Spain. Your data may be processed in countries other than your own, including the United States and other European Union member states, by us and the third-party providers listed above. We rely on standard contractual clauses and provider-specific safeguards as required by the GDPR for transfers outside the European Economic Area.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy in the app and updating the "Last updated" date above. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

12. Changelog

• July 18, 2026: Added "Delete my data" feature for analytics and crash data erasure. Added PostHog and Sentry as sub-processors with DPA links. Added legal bases for processing (GDPR Art. 6). Added sub-processor notification clause. Added right to lodge a complaint with a supervisory authority. Added dedicated privacy contact email (privacy@yappzilla.com). Updated retention periods for analytics and crash data.

13. Contact Us

If you have questions about this Privacy Policy or your data, contact us at:

support@yappzilla.com

For privacy and data protection requests: privacy@yappzilla.com

YappZilla is operated by Konstantin Pavlovskii, individual entrepreneur, Spain.