Privacy policy

Version — September 2026.

Data controller. PracticeAloud is operated by an individual entrepreneur (a sole proprietorship), not an incorporated company. The operator is the data controller for the personal data described in this policy; for any privacy question or request, write to privacy@practicealoud.com.

In short

• This site sets no cookies of its own and uses no advertising trackers. Visits are counted by Cloudflare Web Analytics, a cookieless script that runs on this site and in the web app — see Cloudflare below.
• The one third party involved on public pages is Cloudflare, which delivers and protects the site and counts its visits.
• The AI teacher runs on Anthropic’s AI model, so what you say reaches Anthropic as text: live, as you speak, in a lesson, in Speaking practice or the Whole interview, and in live practice in the iOS app; afterwards, with recognisable personal details removed, as the transcript of every session you speak through our servers; and, from the Drill and the practice tests where your browser recognises your speech or you type, only the answers that need a second look. Anthropic and every other company that processes data for us are listed in Who processes your data.
• We collect only what lessons require, and we sell nothing.
• You can export all of your data or delete your account entirely, at any time.
• The iOS app is a separate product with its own purchases and no account at all — see The iOS app below.

What we collect

• Account: email, name, and your intake answers (goals, background, interests) — your study plan is built from them.
• Lessons: lesson audio is turned into a transcript. Before storage, we automatically strip the personal details we can recognise — card and document numbers, phone numbers, street addresses, email addresses. The matching is best-effort, not a guarantee. Audio is not kept longer than transcription requires.
• Progress: exercise results, report cards, study plans, and the exam you are preparing for with its date, if you set one.
• Citizenship practice: your answers to the civics questions in the Drill and the practice tests — as you typed them, or as the text your browser’s speech recognition returned — and whether each one counted. Personal details we can recognise are removed before storage, as for lessons. From the reading and writing tests, only whether each sentence passed. Speaking practice and the Whole interview are kept like a lesson: as a transcript, not audio.
• Feedback: the messages you send us through Help & feedback, with the page you sent each one from.
• Emails: a record of each email we send you about your account and your study — which kind it was, the day or event it was about (for an interview countdown, your interview date and the days left) and whether it went out — and the kinds of email you have turned off.
• Usage: in the web app we record events such as a lesson starting or ending, an exercise answered or a checkout started, filed under your account. We use them to run the service and to see which parts of it work.
• Payments: handled by Stripe. We never see or store your card details.

Cloudflare

Cloudflare delivers and protects this site and the web app, and carries the app’s traffic to our servers. In that role it processes request metadata such as your IP address.

Bot protection. This site has no forms. In the app, the registration and password-reset forms use Cloudflare Turnstile, a privacy-first alternative to CAPTCHAs: to tell real people from bots, Turnstile receives your IP address and basic browser signals there. It sets no advertising cookies and does not profile you across other sites.

Analytics. Cloudflare adds its Cloudflare Web Analytics script to the pages of this site and of the web app, and your browser runs it. The script reports to Cloudflare the address of the page you are on, with anything after a “?” or “#” removed; the page you came from, trimmed the same way; your browser and operating system; and how quickly the page loaded. In the web app it also reports each move from one screen to the next. Cloudflare states that Web Analytics uses no cookies or local storage, does not fingerprint visitors by their IP address or browser to produce its analytics, and does not track individual visitors across the sites it serves (Cloudflare Web Analytics; how it collects data). It measures traffic; it is not an advertising tracker.

See Cloudflare’s privacy policy for how Cloudflare handles this data.

Speech recognition in your browser

Two tests in the web app, the Practice test (spoken mock) and the Reading test, listen through your browser’s own speech recognition. That means your audio may be sent to the company that makes your browser — Google for Chrome, Apple for Safari, Microsoft for Edge — and handled there under its terms, not ours. We receive only the text it comes back as. From the practice test, only answers that need a second look go on to Anthropic; the reading test’s text is checked on our own servers, not by an AI model. The typed practice test asks the same questions and sends no audio at all.

The iOS app

PracticeAloud: Citizenship, our iOS app, is a separate product from this website. Separate practice, separate purchases, and no account at all: a pass bought in one does not work in the other, and there is nothing to sign in to. Everything above describes the website and the web tutor; this section describes the app, which has its own terms of use.

The app never asks for an email address, a name or a password. On first launch it silently creates a device account — an identifier that belongs to that installation of the app, not to a person. Everything the app stores is filed under that identifier, which is why we treat it as data linked to you even though it does not tell us who you are.

• What you say and write: your answers to the civics questions, the sentence you type in the writing exercise, the sentence you read aloud, and the transcript of a live practice interview. Personal details we can recognise are stripped from the stored text automatically, as they are for lessons on the web. The matching is best-effort, not a guarantee, so do not say anything you would not want kept.
• Your voice: only in live practice — see Speech recognition in the iOS app below.
• The device: the app asks Apple to vouch that it is our genuine app running on a real device, and sends the resulting App Attest and DeviceCheck values with the requests that hand out a free test or spend money. They exist so that one phone cannot claim an endless run of free tests, and they identify the device, never the person holding it.
• Purchases: the app sells through Apple, not Stripe. Apple takes the payment and we never see a card; we keep the signed receipt Apple returns so the app knows what you bought.
• How you use the app: which practice tests you began and finished, how they scored, and when you reached a daily limit. They produce your readiness estimate and our own usage records, and they go to no one else.

The app carries no advertising, no advertising identifier, and no analytics or crash-reporting SDK. Its one third-party component is Google’s WebRTC code, which carries your audio to our own server during live practice — through Cloudflare’s relay when a direct connection is not possible — and reports nothing to anyone else.

Deleting everything. The app can erase what it holds, from its own settings: Delete all my data. Everything on that account goes — the questions you have practised, your spoken practice history, and your results — and it cannot be undone. Your purchase is not lost: it stays with your Apple Account, and the app picks it up again from the App Store by itself.

The Your rights section below describes export and deletion from a web account, which the app does not have. For anything the in-app delete does not cover, write to the same address, privacy@practicealoud.com; tell us enough to identify the records you mean, because we hold no email address for you.

Speech recognition in the iOS app

• The civics practice test recognises your speech on the device. The audio stays on the phone and only the text reaches us. Where a device cannot recognise speech on its own, iOS sends the audio to Apple instead, under Apple’s terms rather than ours; the app says so before your first spoken test.
• Live practice — the speaking practice and the full mock interview — is a conversation, so your microphone audio does reach our server, which turns it into text as you speak. The audio is not stored; the transcript is. The text of the conversation goes to Anthropic’s AI model, which runs the practice, and after the session the stored transcript goes to it again to be analysed — see Who processes your data.

Who processes your data

We run PracticeAloud on our own servers. In every session you speak through them — lessons, Speaking practice and the Whole interview on the web, live practice in the iOS app — that is where your speech is turned into text and where the voice you hear is generated. These companies process personal data for us, on the web and in the iOS app, each for the purpose listed.

• Anthropic — its AI model is the teacher in lessons and the examiner in Speaking practice, the Whole interview and live practice in the iOS app; it also checks borderline answers from the Drill and the practice tests, and writes report cards and the weekly teacher note. We never attach your name or email address to what we send it. Anthropic’s privacy policy.
  • While you talk — in a web lesson, in Speaking practice or the Whole interview on the web, or in live practice in the iOS app — the conversation goes to Anthropic as text as it happens. What you say is sent as you said it: the automatic removal of personal details applies to what we store and to the requests below, not to the live conversation. In web lessons the lesson’s context goes with it: your level, goals, interests and recurring mistakes, your language pair and your support and voice settings, the lesson plan, the scenario you picked for the lesson (if you picked one) and the review items that are due, and summaries of your last lesson and your homework results. In Speaking practice, the Whole interview and live practice, only your language pair and support setting, your Officer pace setting and the exam you are practising go with it.
  • After every session you speak through our servers — lessons, Speaking practice and the Whole interview on the web, live practice in the iOS app — the transcript, with the personal details we can recognise removed, goes to Anthropic with your learning profile and study plan to produce a report card, homework and plan updates.
  • When a civics answer is borderline, in the web app’s Drill or in any practice test or interview, on the web or in the iOS app, the answer, with recognisable personal details removed, goes to Anthropic for a yes-or-no check of whether it counts.
  • Once a week, for web learners who practised, a summary goes to Anthropic to write your teacher’s note: your language pair; your goals, daily target, interests and intake answers; your level, study-plan objectives and recurring mistakes; your exam and its date, if you set one; the week’s activity; highlights and corrections from recent report cards; and your previous note. Text that came from you has recognisable personal details removed, and no transcripts are sent.
• Stripe — takes payments for the web tutor. It receives your email address and our account number for you, and collects your card details and billing address itself; we never see or store your card. Stripe’s privacy policy.
• Cloudflare — delivers and protects this site and the web app, carries the app’s traffic to our servers, and runs Turnstile and Web Analytics (above). When your network does not allow a direct connection, it also relays the audio of a session you speak through our servers via its TURN service, on the web and in the iOS app; the call audio is encrypted and stays encrypted while relayed. Cloudflare’s privacy policy.
• Resend — sends our emails: account emails (address confirmation and password reset) and study emails (welcome, study plan ready, practice reminders, interview countdown, civics answer updates), unless you have turned those off. It receives your email address and the message, which can include your first name, your daily goal, a civics question and its answer and, in an interview countdown, your interview date. It also carries the notice we send ourselves when someone signs up, which includes the new account’s name and email address. Resend’s privacy policy.
• Google — only if you choose to sign in with Google: Google confirms who you are and shares your name and email address with us. In Chrome, the speech recognition of the web app’s spoken practice test and reading test is Google’s too — see Speech recognition in your browser. Google’s privacy policy.
• Apple — in Safari, the speech recognition of the web app’s spoken practice test and reading test. In the iOS app, Apple sells and refunds purchases, vouches for the device the app runs on, and may recognise speech for the civics test — see The iOS app. Apple’s privacy policy.
• Microsoft — only if you use Edge: the speech recognition of the web app’s spoken practice test and reading test is Microsoft’s — see Speech recognition in your browser. Microsoft’s privacy statement.

What we do not do

• No third-party ad trackers or advertising pixels.
• No selling or sharing your data with advertisers.
• No use of your lesson content for advertising.

Your rights

• Export: a complete machine-readable copy of your data, on request from your account: your profile and settings, your lessons with their transcripts and report cards, exercises, practice tests and interviews, study plans, review deck, mistake log, teacher notes, the feedback you sent, any usage-policy warnings on your account, your daily usage counts, and your subscription and credit history.
• Deletion: deleting your account erases everything listed under Export, the feedback you sent included. At Stripe, a live subscription is cancelled and your customer record, which holds your email and billing address, is deleted. What we still keep afterwards is listed under How long we keep data.
• We answer data requests at privacy@practicealoud.com.

How long we keep data

• Your account data is kept for as long as you have the account. We do not delete it on a timer; deleting the account erases it from our database straight away.
• Audio is not stored; the transcript is.
• Backups: our database is backed up every night, encrypted, and each backup is deleted after about 30 days. Data you delete is gone from the backups within about 30 days.
• Sign-in records: the time, IP address and email address of each sign-up, sign-in and password reset are kept for 90 days to protect accounts, then deleted automatically, including after the account itself is deleted.
• After you delete your account, besides the backups and sign-in records above, we keep your Stripe customer number and the date of deletion, so that a late notice from Stripe can be matched to a closed account. Stripe keeps its own records of the payments you made, as tax and accounting law requires; see Stripe’s privacy policy. We also keep our log of what our staff did on your account — for example reviewing or deleting it — which names the account only by its number, not by your name or email address; and the notice our own mailbox received when you signed up, with your name and email address, which we delete when you ask at privacy@practicealoud.com.
• In the iOS app, the record of a purchase — which product, when, Apple’s identifiers for the transaction, and how much of its daily practice allowance has been used — stays after Delete all my data, because it belongs to your Apple Account: that is what lets the app pick it up again from the App Store.
• The companies listed under Who processes your data keep what they receive under their own policies, linked there.

Children

PracticeAloud is for adults. You must be 18 or older to create an account, and neither the website, the web app nor the iOS app is directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a child has an account or has used the service, write to privacy@practicealoud.com with what you know — the email address of a web account, or for the iOS app, roughly when and on which device — and once we have confirmed it, we delete the account and its data. In the iOS app, Delete all my data in the app’s settings erases it straight away.

Changes

If this policy changes, we will update this page with a new version date and notify you by email about material changes.