Privacy at Loquala

Last updated: 3 September 2026

This page says plainly what Loquala collects — on this website and inside the app — what we do with it, who else sees it, and how to make us stop. It is written to be read, not to be survived.

Who we are

Loquala is the data controller for everything described here, and you can reach us at hello@loquala.com about any of it. We are a small independent operation, not a company with a privacy department, so that address reaches the person who actually builds the thing. We have not yet appointed a representative in the EU or the UK under Article 27; until we do, write to the same address and we will answer.

What we collect

On this website: nothing, unless you ask us to tell you when a new city opens — then we store your email address, the language of the page you signed up from, and the fact that you ticked the consent box. We send one email asking you to confirm the address is yours, and nothing else is ever sent to it until you do. In the app, you have an account: an email address if you signed in with a link, or the name and address your Google or Apple sign-in gives us; guests get an account with no details attached at all. Alongside it we keep what your practice produces — the words you saved to your notebook, your session scores, the sounds you find hard to pronounce, your estimated level, your streak and the minutes you have used, and a short note each character keeps about you so they remember your name and your usual order. If you send us feedback we keep what you wrote, and the address you sent it from. If you turn on notifications we keep a token identifying your device.

What happens when you speak

A conversation is live audio, not a recording. Your microphone streams through LiveKit to Google Gemini, which listens and answers in real time; we have deliberately turned off the setting that would let Google hold that session for later, so nothing is retained there after you finish. When you practise a sound, that short clip goes to Microsoft Azure to be scored, and comes back as numbers. We keep the numbers, never the clip. The written transcript of a conversation is stored only on your own device, and is deleted after seven days; it passes through OpenAI while your session runs so we can grade the conversation and write your feedback, and neither we nor they keep it afterwards. We never record your voice, and there is no audio of you anywhere in our systems.

Why we are allowed to

Running the app is what you asked us for, so your account and everything your practice produces is processed to deliver the service you signed up to. Analytics runs only on your consent — the banner is a real choice, nothing is measured until you allow it, and you can take it back at any time in Settings. Crash reports and the checks that stop spam and abuse run on our legitimate interest in keeping the app working and available; the crash reports are stripped of your words, your address and your identifiers before they are sent. Waitlist email runs on the consent you gave by ticking the box. We do not sell, rent, or share anything with anyone for their marketing, we do not profile you for advertising, and nothing here makes automated decisions about you.

How long we keep it

Your account and practice data stay until you delete your account, which you can do yourself in Settings — it removes everything tied to you, immediately. A guest account with no activity is deleted automatically after thirty days. Conversation transcripts on your device expire after seven days. Waitlist addresses stay until you unsubscribe. Analytics events expire after a year. Feedback you send us is kept after account deletion, address included, because it is a conversation with us rather than part of your account — ask us and we will delete that too. For signed-out visitors we keep an IP address against usage records for a short period, to stop abuse of the free tier; this is the one thing account deletion does not remove, and it is why it exists.

Who else sees it

All of these are companies in the United States that process data on our instructions, under contract, and under the European Commission’s standard contractual clauses or their Data Privacy Framework certification. Google, for the live conversation, and for delivering notifications to Android devices. Microsoft Azure, for pronunciation scoring. OpenAI, for grading a conversation and writing your feedback. LiveKit, which carries the audio. Supabase, which is our database, and Vercel, which serves the site and the app. Cloudflare Turnstile, which checks you are a person when you sign in or join the waitlist, and may set a cookie remembering that your browser passed; it is not used to follow you between sites. Sentry, which receives crash reports. Resend, which sends our email. Apple, for delivering notifications to iPhones. GitHub, where a support message you send us is copied into a private ticket so we can answer it. And, only if you allow it, PostHog for analytics. Our fonts, images and audio are served from our own site, so nobody else sees you loading a page.

Analytics, and the choice you get

If you allow it, we use PostHog to see which pages and screens people open, what they press, and where they give up — and, in the app, to record a replay of your screen with every piece of text hidden, so we can watch the shape of somebody getting stuck without reading a word they wrote or said. It is tied to a random identifier for your account, not to your name, and the same identifier links your visit to loquala.com with your use of the app so we can tell whether the two connect. Say no, or simply ignore the banner, and none of it loads: no script, no cookie, no event. We also use Vercel Web Analytics, which counts visits without storing anything on your device or identifying anyone.

Your rights

You can ask us for a copy of what we hold about you, correct it, delete it, take it elsewhere, restrict what we do with it, or object to it — and we will answer within a month. Deleting your account in Settings does most of that instantly; for anything else, write to hello@loquala.com. Every email we send has an unsubscribe link. To withdraw consent for analytics, turn it off in Settings, or choose No thanks the next time the banner appears; withdrawing is exactly as easy as agreeing, and costs you nothing in the app. If you think we have got this wrong, you are entitled to complain to your national data protection authority — in the EU that is the regulator where you live, and in the UK it is the Information Commissioner’s Office. We would rather you told us first.

Children

Loquala is not directed at children under 16, and we do not knowingly collect anything from them. If you believe a child has an account, write to hello@loquala.com and we will delete it.