Privacy Policy for Heyparo

                                                                                               Last Updated: 25 December 2025

                                                                                               Effective Date: 25 December 2025

1. Introduction

Welcome to HeyParo ("we," "our," or "us"), operated by Corvexastudio. We are committed to protecting your privacy and ensuring you have a positive experience while using our mobile application and services (collectively, the "App").

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App. This policy complies with the Information Technology Act, 2000 (India), Digital Personal Data Protection Act, 2023 (India), General Data Protection Regulation (GDPR) for EU users, Google Play Developer Program Policies, and other applicable data protection laws.

By accessing or using the App, you agree to the terms of this Privacy Policy. If you do not agree, please do not use the App.

Contact: corvexastudio@gmail.com | Kolkata, India

2. Information We Collect

2.1 Information You Provide Directly

Data Type              | What We Collect                        | Purpose

-----------------------|----------------------------------------|----------------------------------

Account Information    | Name, email address, Google account ID | Account creation and authentication

Profile Data           | Native language, English level,        | Personalizing your learning

                       | learning goals                         | experience

Voice Recordings       | Speech audio during practice sessions  | Pronunciation analysis and feedback

Support Communications | Messages you send us                   | Providing customer support

2.2 Information Collected Automatically

Data Type           | What We Collect                              | Purpose

--------------------|----------------------------------------------|----------------------------------

Usage Data          | Features used, lessons completed,            | Improving app experience and

                    | time spent, streaks, progress                | tracking your learning journey

Device Information  | Device model, OS version, app version,       | App functionality, troubleshooting,

                    | unique device identifiers, language settings | and compatibility

Log Data            | Error logs, crash reports                    | Identifying and fixing bugs

                    | (via Firebase Crashlytics)                   |

Analytics Data      | App interactions, screen views, session      | Understanding user behavior

                    | duration (via Firebase Analytics)            | to improve the app

Advertising Data    | Ad interaction data, ad identifiers          | Serving and measuring

                    | (for free users viewing rewarded ads)        | rewarded video ads

2.3 Subscription and Payment Information

When you subscribe to HeyParo Premium:

- Subscription status (active, expired, cancelled)

- Subscription type (monthly or yearly)

- Purchase date and expiry date

- Google Play order ID

IMPORTANT: We do NOT collect or store your payment card details, bank account information, or UPI details. All payment processing is handled securely by Google Play Billing. Google processes your payment and only shares transaction confirmation with us.

2.4 Information We Do NOT Collect

- We do NOT collect precise GPS location

- We do NOT store your payment card details (handled entirely by Google Play)

- We do NOT access your contacts, photos, or files

- We do NOT sell your personal data to third parties

- We do NOT collect data from other apps on your device

3. How We Use Your Information

3.1 Legal Basis for Processing (GDPR)

Purpose                       | Legal Basis

------------------------------|------------------------------------------

Providing the service         | Performance of contract

Account management            | Performance of contract

Processing subscriptions      | Performance of contract

Improving the app             | Legitimate interest

Analytics                     | Legitimate interest (with opt-out available)

Serving rewarded ads          | Legitimate interest / Consent

Security and fraud prevention | Legitimate interest

Marketing communications      | Consent (opt-in required)

3.2 Specific Uses

To Provide Our Service:

- Authenticate and manage your account via Google Sign-In

- Analyze your pronunciation using on-device processing and AI services

- Track your progress, streaks, and achievements

- Personalize your learning path based on your level and goals

To Manage Subscriptions:

- Verify your Premium subscription status with Google Play

- Provide access to Premium features based on your subscription

- Send subscription expiry reminders (with your consent)

To Serve Advertisements (Free Users Only):

- Display rewarded video ads via Google AdMob

- Allow you to earn extra features by watching optional ads

- Measure ad performance (anonymized)

To Communicate:

- Send learning reminders (push notifications, with your consent)

- Respond to support requests

- Send important service updates and subscription reminders

For AI-Powered Features:

- Your speech is converted to text (transcription)

- Text is processed by AI services to generate responses and feedback

- We prioritize on-device processing whenever possible

For Analytics and Improvement:

- Understand how users interact with the app

- Identify popular features and areas for improvement

- Debug issues and improve stability

4. Voice Data Privacy (Special Category)

Given that our App's core functionality involves voice input, we want to be transparent about how we handle your voice data:

Aspect              | Our Practice

--------------------|----------------------------------------------------------

On-Device Processing| Speech-to-text conversion happens on your device when possible

What Gets Sent      | Text transcripts (not raw audio) are sent to AI services for feedback

Raw Audio Storage   | We do NOT permanently store raw voice recordings on our servers

Temporary Processing| Audio is processed in real-time and immediately discarded

User Control        | You can delete all your data at any time via Settings

Third-Party Speech Services:

- Google Speech-to-Text API (for transcription)

- Google Gemini AI (for conversational responses)

These services have their own privacy policies. We only share the minimum data necessary for functionality.

5. Advertising (Google AdMob)

5.1 Rewarded Video Ads

Free users can optionally watch rewarded video ads to unlock additional features. These ads are served by Google AdMob.

5.2 Data Collected for Advertising

When you watch rewarded ads, Google AdMob may collect:

- Advertising ID (can be reset in device settings)

- Device information (model, OS version)

- IP address (for geographic ad targeting)

- Ad interaction data (views, clicks)

5.3 Personalized vs. Non-Personalized Ads

- By default, we serve non-personalized ads

- Google may use limited data for ad serving

- You can control ad personalization in your Google account settings

5.4 Your Control Over Ads

- Rewarded ads are optional - you choose when to watch

- Reset your Advertising ID: Settings → Google → Ads → Reset advertising ID

- Opt out of ad personalization: Settings → Google → Ads → Opt out of Ads Personalization

- Premium subscribers do not see any ads

5.5 Children and Advertising

- Our app is not directed at children under 13

- We do not knowingly serve personalized ads to children

For more information: https://policies.google.com/privacy

6. Data Sharing and Disclosure

6.1 Third-Party Service Providers

We use the following trusted third-party services:

Service               | Purpose                                    | Data Shared                | Privacy Policy

----------------------|--------------------------------------------|----------------------------|---------------------------

Firebase (Google)     | Authentication, database,                  | Account data, usage data,  | https://firebase.google.com/

                      | analytics, crash reporting                 | device info                | support/privacy

Google Play Billing   | Subscription payment processing            | Subscription status,       | https://policies.google.com/

                      |                                            | order IDs                  | privacy

Google AdMob          | Rewarded video ads (free users)            | Advertising ID, device     | https://policies.google.com/

                      |                                            | info, ad interactions      | technologies/ads

Google Speech-to-Text | Voice transcription                        | Audio data (temporary)     | https://cloud.google.com/

                      |                                            |                            | speech-to-text/docs/data-usage

Google Gemini AI      | AI conversation and feedback               | Text transcripts           | https://policies.google.com/

                      |                                            |                            | privacy

6.2 We Do NOT:

- Sell your personal information to anyone

- Share your data for purposes unrelated to the App

- Share your voice recordings with third parties (except for transcription)

- Allow third parties to use your data for their own marketing

6.3 Legal Disclosure

We may disclose your information if required by:

- Law, court order, or government request

- To protect our rights, safety, or property

- To prevent fraud or illegal activities

7. Data Retention

Data Type           | Retention Period

--------------------|--------------------------------------------------

Account data        | Until you delete your account

Learning progress   | Until you delete your account

Voice recordings    | Not stored (processed in real-time and discarded)

Subscription data   | Duration of subscription + 3 years (for disputes)

Analytics data      | 14 months (Firebase default)

Crash logs          | 90 days

Ad interaction data | As per Google AdMob policies

After Account Deletion:

- Your personal data is deleted within 30 days

- Anonymized analytics may be retained for statistical purposes

- Subscription records are retained as required by law and Google Play policies

8. International Data Transfers

Your data may be transferred to and processed in countries outside India, including the United States (where Google's servers are located).

Safeguards we use:

- Standard Contractual Clauses (SCCs) with service providers

- Data Processing Agreements with all third parties

- Encryption in transit (TLS/SSL) and at rest

- Google's compliance with international data transfer frameworks

9. Data Security

We implement industry-standard security measures:

Measure          | Implementation

-----------------|----------------------------------------------------------

Encryption       | TLS 1.3 for data in transit, AES-256 for data at rest

Authentication   | Secure OAuth 2.0 via Google Sign-In

Access Control   | Role-based access, principle of least privilege

Monitoring       | Firebase Crashlytics for error detection

Secure Payments  | Google Play Billing (PCI-DSS compliant)

Data Minimization| We collect only what's necessary for the service

Important: No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

10. Your Rights

10.1 Rights for All Users

Right                    | How to Exercise

-------------------------|--------------------------------------------------

Access                   | Request a copy of your data via Settings or email

Correction               | Update your profile in the App

Deletion                 | Use "Delete Account" in Settings

Opt-Out of Analytics     | Disable in App Settings

Opt-Out of Notifications | Disable in device settings or App Settings

Manage Ad Preferences    | Device Settings → Google → Ads

10.2 Additional Rights for EU Users (GDPR)

- Data Portability: Request your data in a machine-readable format

- Restrict Processing: Request limitation of processing

- Withdraw Consent: Withdraw consent at any time (without affecting prior processing)

- Lodge Complaint: File a complaint with your local Data Protection Authority

10.3 Rights for Indian Users (DPDP Act 2023)

As a Data Principal under India's Digital Personal Data Protection Act, 2023, you have the right to:

- Access information about your personal data

- Correct and update inaccurate data

- Erase your data (right to be forgotten)

- Nominate another person to exercise your rights

- Grievance redressal

Grievance Officer:

Email: corvexastudio@gmail.com

Response Time: Within 30 days

11. Children's Privacy

- Our App is NOT intended for children under 13 years of age

- We do not knowingly collect data from children under 13

- We do not serve personalized ads to users identified as children

- If you believe a child has provided us with personal information, please contact us immediately

- We will promptly delete such information

For users aged 13-18, we recommend parental guidance when using the App.

12. Push Notifications

We may send you push notifications for:

- Daily practice reminders

- Streak alerts

- Subscription expiry reminders

- New content announcements

- Important account updates

Your Control:

- You can enable/disable notifications in App Settings

- You can also control notifications via your device settings

- We will not send marketing notifications without your consent

13. Analytics and Opt-Out

Firebase Analytics:

We use Firebase Analytics to understand app usage. This data is aggregated and does not personally identify you.

To Opt-Out of Analytics:

- Go to Settings in the App

- Toggle off "Analytics" (if available)

- Or contact us to request opt-out

Firebase Crashlytics:

We use Firebase Crashlytics to collect crash reports. This helps us fix bugs and improve stability. Crash reports may include:

- Device information

- App state at time of crash

- Stack traces (technical error information)

Google AdMob:

To control ad-related data collection:

- Device Settings → Google → Ads

- Reset Advertising ID or opt out of personalization

14. Subscription Management

14.1 Subscription Data

When you subscribe, we receive from Google Play:

- Confirmation of successful purchase

- Subscription type and duration

- Renewal and cancellation status

- Order ID for support purposes

14.2 What We Don't Receive

Google Play does NOT share with us:

- Your credit/debit card number

- Your bank account details

- Your UPI ID

- Your billing address

14.3 Managing Your Subscription

To view, cancel, or manage your subscription:

- Google Play Store → Profile → Payments & subscriptions → Subscriptions

- Or visit: https://play.google.com/store/account/subscriptions

14.4 Data After Subscription Ends

- Your learning progress is preserved

- Subscription status is updated to "expired"

- You can resubscribe at any time

15. Changes to This Privacy Policy

We may update this Privacy Policy periodically. When we do:

- We will update the "Last Updated" date at the top

- For significant changes, we will notify you via the App or email

- Continued use of the App after changes constitutes acceptance

We encourage you to review this policy periodically.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: corvexastudio@gmail.com

Address: Kolkata, West Bengal, India

Response Time: We aim to respond within 7 business days, and resolve requests within 30 days.

For subscription or billing issues:

- Manage subscriptions: Google Play Store → Subscriptions

- Payment issues: Contact Google Play Support

- App issues: corvexastudio@gmail.com

17. Consent

By using HeyParo, you consent to:

- Collection and processing of your data as described in this policy

- Transfer of data to third-party service providers listed above

- International data transfers with appropriate safeguards

- Use of cookies and similar technologies

You may withdraw consent at any time by:

- Deleting your account in App Settings

- Contacting us at corvexastudio@gmail.com

- Managing permissions in your device settings

This Privacy Policy is available at: https://sites.google.com/view/heyparo-privacy-policy

© 2025 Corvexastudio. All rights reserved.

================================================================================

DATA COLLECTION SUMMARY (Google Play Data Safety)

================================================================================

Data Type                | Collected | Shared | Purpose

-------------------------|-----------|--------|----------------------------------

Name                     | Yes       | No     | Account management

Email                    | Yes       | No     | Account management, communications

User IDs                 | Yes       | No     | Account identification

Voice/Audio              | Yes       | No*    | Pronunciation analysis

App Activity             | Yes       | No     | Analytics, progress tracking

Device ID                | Yes       | No     | App functionality

Advertising ID           | Yes       | Yes**  | Advertising (free users only)

Purchase History         | Yes       | No     | Subscription management

Crash Logs               | Yes       | Yes*** | App stability

* Voice data sent temporarily to Google Speech-to-Text for transcription

** Shared with Google AdMob for rewarded ads (free users only)

*** Shared with Firebase Crashlytics for bug fixing

Data Security: All data is encrypted in transit

Data Deletion: Users can request deletion via Settings → Delete Account

================================================================================