Thailo — Privacy Policy

Effective date: [DATE] Last updated: [DATE]

1. Who we are

Thailo ("Thailo," "we," "us," or "our") is a Thai-language learning app for iOS, published by [Developer/Company Legal Name], [Address or "an individual developer based in [Country]"]. This policy explains what information Thailo collects, how it's used, and the choices you have.

Contact: [support email address]

2. Information we collect

2.1 Information you provide directly

• Onboarding answers — why you're learning (travel / living in Thailand / culture / fun), your track choice (speak-first vs. read-too), your starting level, and your daily goal. Used only to personalize your lesson sequence and pacing; not shared or sold.
• Account/purchase information — if you subscribe or buy the lifetime tier, Apple processes your payment via the App Store; we do not receive or store your payment card details. We receive a purchase/subscription status token via StoreKit to unlock content.
• Support communications — anything you send us directly (email, App Store review replies, etc.).

2.2 Information collected automatically

• Learning progress — lessons completed, quiz scores, streak history, SRS review state, mastery per category. Stored to power your progress, streaks, and the passport/achievements screen. This stays on-device unless you enable an optional cloud-sync/backup feature (if/when offered), in which case it syncs to [iCloud / your backend — specify].
• Basic diagnostic/crash data — standard iOS crash and performance data, collected via Apple's built-in mechanisms (or [Sentry/Firebase/etc. if added later]), used only to fix bugs, never to identify you personally beyond what's needed to debug a crash.
• Product analytics (PostHog) — anonymized usage events such as "lesson started," "quiz question answered (right/wrong)," "paywall viewed," and screen views, tied to a random per-install identifier (not your name, email, or Apple ID — we never collect those). We use this to see where learners get stuck or drop off and to improve the app. Events include coarse context (your track choice, daily goal, streak length, premium status) but never the text you type — Practice attempts and Live Challenge reflections are excluded from analytics. Data is processed by PostHog ([EU/US — specify hosting region]) under their data processing terms.
• We do not use third-party advertising SDKs or ad trackers. Thailo does not show ads and does not sell your data. (Per the locked GTM decision: organic/ASO-driven, no paid ads — see aso-strategy.md.)

2.3 Practice (AI-graded production attempts)

This is the one feature where your input leaves the device and goes to a third party, so it gets its own section. (Live Challenges, by contrast, are entirely self-reported and never leave the device — no third party is involved there at all.)

• When your Practice attempt doesn't match a pre-authored accepted answer, the attempt text is transmitted to Anthropic's Claude API for grading — a single-shot request, not a stored conversation.
• We send only what's needed to grade the attempt: the target phrase, your attempt, and your track/level (so feedback is calibrated appropriately). We do not send your name, onboarding answers, or purchase status to the AI provider.
• Anthropic processes this data under its own API terms and privacy commitments; API inputs/outputs are not used by Anthropic to train their models by default under standard API terms — see [Anthropic's privacy policy] for their current commitments, since this can change and should be verified before publishing.
• Grading results may be stored locally on your device (so you can review past practice attempts) and, if you report a bug or send feedback, that record may be included in the report.
• This feature is opt-in by use — you choose when to attempt a Practice prompt. Declining to use it doesn't affect access to any other part of the app.

3. How we use information

We use the information above solely to:

• Run the app's core features (lessons, SRS review, streaks, phrasebook, Practice grading)
• Personalize onboarding and pacing
• Process subscriptions/purchases via Apple
• Diagnose crashes and bugs
• Respond to support requests

We do not: sell your data, share it with data brokers, or use it for third-party advertising.

4. Third parties we share data with

We do not otherwise sell, rent, or trade your personal information to third parties.

5. Data retention

• On-device learning progress persists until you delete the app or reset progress in Settings.
• Practice attempt text sent to Anthropic is governed by Anthropic's own retention policy for API data — see their current terms.
• If we add server-side account storage in the future, this section will be updated with specific retention periods before that feature ships.

6. Your rights and choices

• Access/delete your data: since most data lives on-device, uninstalling the app deletes it. [Add an in-app "reset progress" / "delete my data" control if not already planned, and reference it here.]
• EU/UK users (GDPR): you have the right to access, correct, delete, or export your personal data, and to object to or restrict processing. Contact us at [support email] to exercise these rights.
• California users (CCPA/CPRA): you have the right to know what personal information is collected, to delete it, and to opt out of its "sale" — we do not sell personal information, so there is nothing to opt out of.
• Notifications: streak reminders and re-engagement notifications are opt-in during onboarding and can be turned off anytime in iOS Settings or in-app.

7. Children's privacy

Thailo is not directed at children under 13 (or the relevant minimum age in your country, e.g. 16 in parts of the EU), and we do not knowingly collect personal information from children under that age. The App Store 4+ age rating reflects that the app contains no objectionable content, not that it targets children. If you believe a child has provided us personal information, contact us at [support email] and we will delete it.

8. International data transfers

If you are located outside the country where our servers/providers operate, your information may be transferred to and processed in other countries, including the United States (where Apple and Anthropic process data). We rely on [Apple's and Anthropic's respective safeguards, e.g. Standard Contractual Clauses — verify current mechanism] for any such transfers.

9. Security

We rely on Apple's platform security (Keychain, sandboxing) for on-device data, and standard TLS encryption for any network calls (StoreKit, our backend, and our backend's call to the Claude API). No method of transmission or storage is 100% secure, but we take reasonable steps appropriate to the sensitivity of the data involved (which, for this app, is limited — no payment details, no government ID, no health data).

10. Changes to this policy

We may update this policy as the app evolves (e.g. if cloud sync, social features, or new integrations are added). Material changes will be reflected in the "Last updated" date above, and significant changes will be surfaced in-app.

11. Contact

Questions about this policy or your data: [support email address]

Open items before publishing (see roadmap.md item 16)

• Fill in legal entity name/address, support email, effective date.
• Confirm Anthropic's current API data-usage/training policy at time of publishing and link directly to it.
• If any analytics/crash SDK is added during development, name it explicitly here before submission.
• Have this reviewed by counsel, especially the GDPR/CCPA sections, before it goes live — this draft is a strong starting point, not a substitute for legal sign-off.