Privacy Policy

Last updated: 24.06.2026

1. Introduction

Welcome to ETQ-AI. Your privacy is important to us. This Privacy Policy explains how we collect, use, store, and protect your information when you use our mobile application available on the Google Play Store and the Apple App Store.

By using ETQ-AI, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Audio Data (Microphone Access)

ETQ-AI requires access to your device's microphone to record audio input initiated by you.

• Audio is collected only when you explicitly initiate a recording in the app.

• No background or passive audio recording occurs.

• Audio data is used exclusively for transcription and analysis purposes.

• Recordings continue to capture audio even when the screen is off or when switching between apps. This is solely to ensure complete session capture as initiated by the user.

2.2 Account and Authentication Data

ETQ-AI uses a role-based access system. Only pre-approved users may sign up and log in. We provide a secret code to pre-approved users to sign up. As part of this system, we may collect:

• Email address and credentials used during the authentication process

• Role and permission data associated with your account

• Account activity necessary to manage access control

2.3 Voice Profile Data (Biometric)

Before you can record, ETQ-AI asks you to set up a personal voice profile by reading a short passage aloud (30 seconds). From this sample, the app generates a voiceprint - a mathematical representation of your voice, not an audio recording - used to recognize your voice during lessons.

• The voiceprint is created and stored entirely on your device. It is never uploaded to our servers or shared with any third party.

• The short voice sample used to create it is processed on-device and deleted immediately afterwards; it is not stored or uploaded.

• It is used only to identify your voice so that other people's voices (such as students) can be filtered out before any audio leaves your device (see Section 3.2).

• It is deleted automatically when you withdraw study consent, delete your account, or sign in with a different account, and is removed entirely if you uninstall the app.

Since a voice print can uniquely identify users, it is treated as biometric data under the GDPR. We process it only for the voice-filtering purpose described above.

3. How We Use Your Data

3.1 Voice Transcription

Recorded audio is processed through an audio chunking pipeline that splits long recordings into segments before transmission to our transcription API. This segmented audio is securely transmitted to a third-party Voice AI service for speech-to-text processing:

• Voice AI API Provider: https://docs.hpc.gwdg.de/services/voice-ai/index.html

• This service processes audio data solely to generate text transcriptions and operates in a GDPR-compliant manner

• Transcription jobs are managed via a queue-based system with rate-limit controls to ensure stable and secure processing

• Returned transcription output is stored in the database, linked to the originating recording

3.2 Student Voice Filtering

To protect the privacy of third parties (such as students) present during recordings, ETQ-AI applies on-device audio filtering to remove non-target voices. The app distinguishes your voice from others by comparing the audio against the on-device voice profile described in Section 2.3. This processing:

• Occurs locally on the device without transmitting unfiltered audio to our or external servers.

• Deletes raw unfiltered audio once filtering succeeds. If filtering fails, the raw audio stays on your device (never uploaded), allowing the user to either retry filtering or delete it in the app.

3.3 Statistics and Feedback Generation

Following transcription, ETQ-AI automatically triggers statistical analysis of the transcript content using backend processing scripts. To generate the written summary and feedback, the transcript text is also processed by a third-party Large Language Model (LLM) service operated by GWDG. This analysis generates:

• Quantitative statistics derived from the transcript

• Automated feedback reports linked to the recording

  • LLM API Provider: https://docs.hpc.gwdg.de/services/ai-services/chat-ai/index.html 

• Timestamped transcript displays and playback-ready data

All generated data is stored securely and linked to your account and recording.

3.4 Push Notifications

ETQ-AI may send push notifications to your device to inform you when transcription and feedback generation are complete. These notifications do not contain personal data beyond status updates related to your recordings.

3.5 Data Storage

Audio recordings, transcriptions, identifiers, statistics, and feedback data are securely stored in Supabase, our cloud database and storage provider. Supabase:

• Operates on infrastructure compliant with the General Data Protection Regulation (GDPR)

• Applies industry-standard security and compliance controls

• Restricts access to authorized systems and personnel only

3.6 Research Participation

ETQ-AI is operated as part of a research project by the Hector Research Institute of Education Sciences and Psychology. Upon signing in, you are asked to consent to participate in the associated study which includes all relevant details. You can easily withdraw consent from the app sidebar. Since participation in the study is a necessary condition to use ETQ-AI, the user is automatically logged out upon consent withdrawal.

4. Infrastructure and Third-Party Services

ETQ-AI relies on the following third-party services to deliver its functionality:

4.1 Supabase (Database and Storage)

ETQ-AI uses Supabase as its primary backend infrastructure for user authentication, data storage, and file management. Supabase replaces previously used services (AWS S3 / Firebase Auth) as of the most recent platform update. Supabase is GDPR-compliant and applies appropriate technical and organizational security measures.

4.2 Voice AI Transcription Service

Audio segments are submitted to the Voice AI transcription API at https://docs.hpc.gwdg.de/services/voice-ai/index.html for speech-to-text conversion. This service processes audio solely for transcription and does not retain audio beyond what is necessary to fulfill the request.

4.3 Railway (Backend Processing and Job Orchestration)

ETQ-AI uses Railway (Railway Corp.) to host the backend worker that coordinates audio processing. This includes retrieving recordings from Supabase, segmenting them, sending segments to the Voice AI service, and generating the statistics and feedback as described in Section 3. The worker processes data only in memory during each job and stores nothing. All data remains in Supabase. Railway is GDPR-compliant and applies appropriate security measures.

4.4 AI Feedback Generation (GWDG Academic Cloud)

To produce feedback reports, ETQ-AI sends the generated transcript text to an AI language model hosted by GWDG Academic Cloud (Chat AI / SAIA, https://docs.hpc.gwdg.de/services/ai-services/chat-ai/index.html). Operated by the same provider as the Voice AI transcription service, it is self-hosted on GWDG infrastructure and processes the transcript solely to generate the report, retaining nothing beyond what the request requires. No audio is sent to this service.

4.5 Firebase Cloud Messaging (Push Notifications)

ETQ-AI uses Firebase Cloud Messaging (FCM), a service provided by Google LLC, to deliver push notifications to your device. When you log in, a device-specific FCM token is generated and stored in our database solely for the purpose of sending you status updates about your recordings. This token does not identify you personally on its own. Firebase operates under Google's privacy policy and is GDPR-compliant. No personal content from your recordings is included in push notifications.

5. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), ETQ-AI processes your personal data based on:

• Consent: You grant microphone access and decide when to start, stop, and submit each recording.

• Consent (Research Participation): ETQ-AI is conducted as a research study by the University of Tübingen. Before using the app, you provide explicit consent for your recordings and resulting transcripts to be processed and made available to the University for scientific research purposes only, never for performance assessment. This consent is required to use the app.

• Biometric Data (Voice Profile): Your on-device voice profile is created and used based on your consent and participation in the research study. It never leaves your device and you can delete it anytime.

• Legitimate Interest: Operating, securing, and maintaining the app's core functionality and access control.

Your consent is voluntary and may be withdrawn at any time by turning off AI data-sharing consent, through the app sidebar (which also logs you out), disabling microphone permissions, or uninstalling the app. Because participation is integral to the study, the app cannot be used without study consent. Withdrawal does not affect processing already performed.

6. Data Sharing and Third Parties

ETQ-AI does not sell, rent, or trade personal data. Your data is shared only with:

• The Voice AI transcription service (for transcription purposes)

• The GWDG Academic Cloud AI service (for feedback report generation)

• Supabase, a GDPR-compliant cloud service provider, for secure storage and authentication

• Railway (for backend processing of recordings and transcripts)

• Firebase Cloud Messaging (Google LLC), solely for push notification delivery

7. Data Retention and Deletion

We retain your data only for as long as necessary to provide ETQ-AI’s functionality or as required by law. Recordings and transcripts contributed to the study are kept, pseudonymized, for the period required by the University of Tübingen's research rules.

7.1 Data Deletion Requests

Users may request deletion of their stored data at any time by permanently deleting their account through the option provided in the app's sidebar, or by emailing etqai.tu@gmail.com. ETQ-AI will remove all the associated data within a reasonable timeframe, except for pseudonymized data we must keep for research or legal reasons. This cannot be undone.

8. Data Security

ETQ-AI implements appropriate technical and organizational safeguards, including:

• Encrypted data transmission

• Secure, GDPR-compliant cloud infrastructure

• Access restricted to your own account and the authorized research team

• On-device audio filtering to prevent storage of raw unfiltered audio

While we take reasonable steps to protect your data, no system can guarantee absolute security.

9. Your Rights (GDPR)

You have the right to:

• Access your personal data

• Request correction or deletion

• Restrict or object to processing

• Request data portability

• Withdraw consent at any time

To exercise these rights, please contact etqai.tu@gmail.com

10. Children’s Privacy

ETQ-AI may be used in educational or classroom environments where children under the age of 13 are present. Any collection of personal data from children occurs only under the supervision of a school, teacher, or authorized educational institution and with appropriate consent obtained by the institution, in accordance with applicable data protection laws, including the GDPR and relevant child data protection regulations.

Parents or legal guardians may request access to, or deletion of, a child’s data by contacting etqai.tu@gmail.com.

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically. Updates will be reflected by revising the “Last updated” date and made available within the app or its Google Play listing.

12. Contact Information

If you have any questions or requests regarding this Privacy Policy or your data, please contact us:

• Email: etqai.tu@gmail.com

• Company Name: Hector Research Institute of Education Sciences and Psychology