Rosie AI Privacy Policy

Last updated: 6 October 2026

This policy explains what personal information Rosie AI ("Rosie", "we", "us") collects when you use our language-learning app at https://rosie-ai.co.uk (the "Service"), why we collect it, who we share it with, and the choices you have.

Who we are (data controller): Catherine Alani, trading as Rosie AI. Contact: privacy@rosie-ai.co.uk.

1. Information we collect

Account information. When you sign in with Google, we receive your name, email address and profile picture from Google. We use these to create and identify your account. We request only this basic profile information, and no other Google data (we do not access your Gmail, Drive, contacts, calendar or any other Google service).

Profile information. Your display name and avatar, and the languages you choose to learn.

Learning activity. Lessons and units you complete, vocabulary you have seen or answered, your saved phrasebook, learning sessions, practice results, answers you submit, and interaction logs we use to schedule reviews and improve lessons.

Voice recordings and transcripts. If you use pronunciation or speaking exercises, the app records audio from your microphone only after you grant browser permission and start a recording. We send the audio to a speech-to-text provider and store the resulting transcript and the outcome (for example passed or not) so we can grade you and fix transcription problems. We do not keep the raw audio after it has been transcribed.

Images. If you use a camera or photo feature, the image you submit is sent to an AI provider to produce the result you asked for. We do not store the image.

Conversation text. Messages you type or speak in Converse and Duo Converse, and text you submit for translation.

Friends and sharing (optional). If you use friends features you may add a phone number. We store it so friends can find you, and a hashed (one-way scrambled) version is used for matching. Your display name and avatar are visible to other signed-in users. If you share a phrase with the community, it is visible to those users. Messages in Duo Converse are visible to the friend you are talking to.

Notifications (optional). If you enable push notifications, we store the device subscription needed to send them.

Reports. If you report a problem with an exercise, a message or a shared phrase, we store your report and related context.

Technical data. Our hosting providers process your IP address, browser and device type, and standard server logs. We use cookies and similar storage only to keep you signed in and remember app settings. We do not use advertising cookies or sell data.

2. How we use it

• Provide and personalise the Service: sign you in, track progress, schedule reviews, grade speaking, and power AI conversation and translation.
• Keep the Service safe: prevent abuse, handle reports, enforce our Terms.
• Improve content and quality, including fixing lesson errors and pronunciation problems.
• Send notifications you asked for, and respond to your messages.
• Meet legal obligations.

Legal bases (UK/EU GDPR): contract (providing the Service you signed up for), legitimate interests (security, improving the Service), consent (microphone, camera, push notifications, phone number for friend matching, which you can withdraw at any time), and legal obligation.

3. Google user data (Limited Use)

Rosie AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we use Google account data (name, email, profile picture) only to sign you in and operate your account. We do not sell it, use it for advertising, transfer it to others except as needed to provide the Service (Section 4), or allow humans to read it except with your consent, for security or abuse investigation, to comply with law, or where it is aggregated and anonymised.

4. Who we share information with

We do not sell your personal information. We use these service providers (processors) who handle data only to provide their service to us:

We may also disclose information if required by law, to protect rights and safety, or in a business transfer (with notice to you). Some providers are in the United States; where we transfer UK/EU data internationally we rely on appropriate safeguards such as standard contractual clauses or the UK/EU–US data bridge.

5. Retention

We keep your information while your account is active. If you delete your account we delete or anonymise your personal data within 30 days, except where we must keep limited records for legal or security reasons. Server logs are kept for a short period set by our hosting providers.

6. Your rights

Depending on where you live, you can ask to access, correct, delete, restrict or export your data, object to processing, and withdraw consent. To exercise these, email privacy@rosie-ai.co.uk. You can also revoke Rosie's access to your Google account at https://myaccount.google.com/permissions, and disable microphone, camera or notifications in your browser settings. If you are in the UK you may complain to the Information Commissioner's Office (ico.org.uk); EU residents may contact their local data protection authority.

7. Children

Rosie AI is not directed at children under 13, and we do not knowingly collect their information. If you believe a child under 13 has given us information, contact us and we will delete it.

8. Security

We use access controls, encryption in transit, and row-level security on our database. No system is perfectly secure; if a breach affects you we will notify you and regulators as the law requires.

9. Changes

We may update this policy. We will post the new date here and, for material changes, tell you in the app or by email.

10. Contact

Catherine Alani, trading as Rosie AI — privacy@rosie-ai.co.uk