Legal
Privacy Policy
Effective 27 August 2026
Ondas turns podcasts into Spanish lessons. To do that we store your account, your learning profile, and the lessons and conversations you create. We do not run analytics, we do not use advertising or tracking cookies, and we do not sell your data to anyone.
What we collect
Account
- Your email address.
- Your password, stored only as a bcrypt hash — we cannot read your actual password.
- Your name, if you give one. It is optional.
Learning profile (from onboarding)
- Your Spanish level, preferred dialect, interests, native language, daily goal in minutes, and the podcast shows you follow.
- Why you are learning Spanish, including the free-text note if you write one.
What you create in the app
- Lessons: the source episode’s URL, title, author and artwork, plus the transcript, summary, vocabulary and grammar notes generated from it.
- Vocabulary you save, including any personal notes you attach to a word.
- Your conversations with Sofía — the full text of both sides is stored so you can return to a conversation.
- Progress data: streak, XP, lessons completed, and when you last studied.
Voice
When you speak to Sofía, the recording is sent to our transcription provider, converted to text, and the text is kept as part of that conversation. The audio recording itself is never written to our database. Your device may ask for microphone permission the first time; you can refuse and keep using the app by typing instead.
What we do not do
- No analytics or product-tracking tools of any kind.
- No advertising, ad networks, or advertising identifiers.
- No third-party tracking cookies.
- We do not sell or rent your personal data.
- We do not build advertising profiles or share data with data brokers.
On the web, the only cookie we set is the httpOnly session cookie that keeps you logged in. The mobile app uses no cookies at all — it stores a login token in your device’s secure keychain.
Who else processes your data
We use these services to make the app work. Each processes data under its own terms; we send them only what the feature needs.
| Service | What it receives |
|---|---|
| Groq | Lesson text and transcripts for generating lessons; your messages to Sofía; podcast audio and your voice recordings for speech-to-text. |
| Google Cloud Text-to-Speech | The Spanish text of Sofía's replies, to synthesise her voice. |
| Supadata | YouTube video links, to fetch their transcripts. |
| Apple iTunes Search API | Your podcast search terms, to find shows. |
| Podcast hosts (Acast, Libsyn, SoundCloud, Omny, Spreaker and others) | Requests for episode audio and RSS feeds, which reach them with your IP address like any other download. |
| Neon | Hosts the database where everything above is stored. |
| Vercel | Hosts and serves the app; keeps standard server logs. |
| Our email provider | Your email address, to send confirmation and password-reset messages. |
How long we keep it
Your account and everything attached to it stay until you ask us to delete them. Deleting your account removes your profile, lessons, saved vocabulary and conversations — they are linked to your account and go with it.
Your rights
You can ask us to show you the data we hold about you, correct it, export it, or delete it entirely. If you are in the EU or UK, the GDPR gives you these rights explicitly, along with the right to object to processing and to complain to your national data protection authority.
To exercise any of them, email privacy@ondas.space from the address on your account. We will action deletion requests within 30 days.
Children
Ondas is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, email us and we will remove it.
Changes to this policy
If we change how we handle your data, we will update this page and move the effective date at the top. Material changes will also be emailed to you.
Contact
Questions about anything above: privacy@ondas.space.