Privacy

Contact

Scope and accountable operator

This notice covers the Starlette website, learning app, and support interactions. The legal operator is accountable for personal information. It does not cover third-party services you visit under their own policies.

Information we collect

We process account and profile details; languages, goals, settings, and progress; practice transcripts, scores, feedback, saved items, past assistant messages and memory; personal-course documents, images, audio, and pasted text while creating a course; photos you upload during practice so a scene can be described; generated courses and source metadata; recordings you choose to save; subscription identifiers and status; the description you write when you report a safety concern, including reports about self-harm; device, security, usage, anonymous analytics and push-subscription data; and messages you send to support. Hosting and security infrastructure sees your IP address to deliver and protect the service; Starlette does not store it or derive a stored location from it.

How and why we use information

We use information to authenticate you, deliver and personalize learning, save progress, generate content and feedback, process subscriptions, communicate, provide support, measure service health, secure accounts, prevent abuse and fraud, review safety reports, enforce rules, and comply with law. Depending on location and context, the legal basis is performance of a contract, consent, legitimate operational and security interests, or a legal obligation.

AI, voice, and recordings

Prompts, learning context, and transcripts may be sent to contracted AI and model processors to generate the requested feature. Live audio is streamed to a voice processor; Starlette does not save it in app storage, but that processor may retain inputs and outputs for up to 30 days for safety and abuse monitoring. Personal-course documents, images, audio, and pasted text are not retained in Starlette app storage after processing, but voice-transcription processors may retain inputs and outputs for up to 30 days and course-generation processors may retain them for up to 55 days for safety monitoring. Photos you upload during practice so a scene can be described are processed to create the exercise, are not saved in Starlette app storage, and use a route configured so the processor retains nothing. These routes are configured to disallow prompt training. The generated course is retained. Pronunciation and shadowing recordings are saved only after you choose Analyze and remain until you delete them or your account; the oldest are automatically removed after the 50-record limit.

Payments, analytics, and notifications

For web purchases, Stripe processes payment and billing details as merchant of record and acts as an independent controller for payment, tax, and fraud prevention under its own privacy policy; for purchases in the Android app, Google Play does the same as seller under Google's privacy policy. Starlette sends Stripe your email address and your Starlette account identifier so a purchase can be matched to your account, and receives customer, subscription, price, status, and invoice-related identifiers but not your full card number. Cloudflare provides the bot-protection check shown when you create an account, sign in, request a new confirmation email, or change your password; it receives your IP address, browser signals, and the result of that check to separate people from automated traffic, and passing it is required to create an account. Contracted authentication, database, and storage providers operate those parts of the service, while hosting and analytics providers deliver the app and anonymous aggregate web analytics. If you opt into browser notifications, the browser push service receives an endpoint, encryption keys, and delivery metadata that identifies the practice language and date, and delivers reminder content. If you separately opt into weekly email, Starlette reads the current verified email address from your account at send time and sends Resend (Plus Five Five, Inc.) the recipient address, aggregate-only message content, and delivery metadata needed to deliver it. The summary contains only bounded seven-day practice totals and a rehearsal link—never audio, transcripts, prompts, or learner text. Starlette does not store the recipient address in the weekly-email preference record. You can turn either channel off in Settings or unsubscribe through any weekly email.

Campaign and referral attribution

If you arrive through a tagged campaign or referral, we keep normalized source, medium, campaign, content, term, and referral values with first- and last-touch times. We link them to your account only after verification and use them to measure onboarding, first and second completed practices, and purchase. These records are included in account export and deleted with the account.

Sharing and international processing

We disclose information to service providers only as needed to operate the service, and may disclose it to comply with law, protect users and the service, investigate abuse, or complete a business transaction with appropriate protections. We do not sell personal information. Data may be processed in Canada, the United States, and other locations where providers operate, under contractual and technical safeguards, and may be subject to local lawful access.

Retention and security

Account and learning data generally remain until you delete individual items or your account. Cached daily activity, learning content, and generated speech are trimmed by count rather than by age, so how long an entry survives depends on how often you practice rather than on a fixed number of days. Practice sessions are kept to the most recent 200, and older transcripts are removed as newer ones are added. Pronunciation and shadowing recordings remain until you delete them or your account, with the oldest automatically removed after 50. Generated speech clips are shared between accounts, so when an account is deleted they are separated from it rather than removed, and the text used to generate them can remain. Starlette does not retain original personal-course source content in app storage after processing; AI processor copies may remain for up to 30 or 55 days as described above. Operational, security, fraud-prevention, subscription, transaction, and legal records may be kept longer only as reasonably necessary or required by law; backups age out on their normal cycle. We use access controls, encryption in transit, provider safeguards, and monitoring, but no system can guarantee absolute security.

Your choices and privacy rights

Settings let you review or change profile choices, export account data, delete recordings and saved learning data, turn off browser notifications or weekly email, and request account deletion. You can also unsubscribe through any weekly email; Starlette applies the change immediately. Depending on law, you may request access, correction, deletion, portability, restriction or objection, withdraw consent, or complain to a regulator. We may verify identity and retain information where an exception applies. Contact the privacy address below.

Adults only and policy changes

Starlette is for people aged 18 or older and does not knowingly collect personal information from children. If you believe a child created an account, contact the privacy address. We will post updates with a new version date and provide additional notice or request renewed consent when the change or applicable law calls for it.