Privacy Policy

1. Who we are

reem is an app operated by Alex Diyan, a sole trader based in the United Kingdom (“we”, “us”, “our”). We are the data controller for the personal data described in this policy.

For anything in this document, including any request about your data, write to alexdiyan@outlook.com.

2. What this policy covers

This policy covers the reem mobile app on iOS and Android, and the servers behind it. It does not cover the App Store or Google Play themselves, or any website you reach by following a link out of the app; those have their own policies.

3. What we collect, and why

Things you create

• The words and meanings you save, the sentences you write with them, and the optional note of where you found a word.
• Your review history: which words you were asked about, when, how you did, and the feedback you were given. This is kept in order to coach you, by tracking what is getting better and what is not.
• Your roleplay conversations: the transcript of what you and the AI character said, and the coaching debrief written from it. Both are kept so your progress can be measured against your own earlier attempts.
• When each live conversation started and ended, so your practice minutes can be counted. We also keep OpenAI's reference for the call, so we can end it on their side when you finish.
• Your voice, while you are speaking an answer or holding a roleplay conversation. This is covered separately in section 4, because it deserves to be.

Things about your account

• An account identifier. One is created the first time you open the app, so your words have somewhere to live. You do not have to give us an email address to start.
• Your email address and name, if and when you choose to create a full account.
• Your settings: reminder times, daily goal, streak.

A device identifier

We store an identifier for your device (on Android, the Android ID; on iOS, the Identifier for Vendor) alongside your account identifier. Its only purpose is to make sure one device gets one free allowance. It stops the free roleplay minutes from being claimed again and again by reinstalling the app. It is never used for advertising, never used to track you across other apps or websites, and never shared with anyone.

Purchases

If you subscribe, Apple or Google takes the payment, and we never see your card details. We receive confirmation of whether your subscription is active, through RevenueCat, which manages subscriptions for us.

Usage analytics

We collect usage data, such as which screens are opened and whether a review session was finished, to work out which parts of the app are worth improving. It is linked to your account number, so we can see how the app is used over time, but never to your name or email address. This goes to PostHog, on their EU servers. It never includes your words, your sentences, your transcripts or your recordings. It is on by default. You can turn it off at any time in Profile → Privacy, and turning it off changes nothing else about the app.

Crash and error reports

When the app fails, we receive the technical details of the failure so we can fix it. This is part of the analytics above and is switched off by the same control.

4. Your voice, in detail

reem asks you to speak aloud. That is the point of it, and it means we handle recordings of your voice. Those are personal data, and sensitive in a way a saved word is not. We treat them as something to pass through and discard, never to collect. Precisely:

Spoken reviews

When you speak an answer in a review, the audio is uploaded to our server and passed straight to OpenAI to be turned into text. We never write it to disk and never store it; it exists only for the seconds the transcription takes. OpenAI may keep it for a limited time to check for misuse (see below). The resulting text is then sent to Anthropic, which decides whether the answer was right and writes the one-line note you see. We keep that text because it is what your coaching is built on: holding on to what you actually said is the only way reem can compare this attempt with your earlier ones, tell you what is improving, and choose what you should practise next. Without it every session would start from nothing.

Roleplay conversations

Live roleplay is a two-way audio conversation, so it has to stream: audio passes through OpenAI’s Realtime API for the length of the session, which is what lets the character answer you and what turns the conversation into text. Our server sets the call up, and then the audio streams directly between your phone and OpenAI. It never passes through our servers, and we never record or store it. The debrief is written from the transcript, not the audio. The transcript and the debrief remain, for the same reason: they are the record your coaching is drawn from, and what lets reem show how your communication is changing across conversations rather than judging each one in isolation.

Consent, and taking it back

Before anything is sent to an AI provider for the first time, the app tells you what is about to be sent and to whom, and asks you to agree. You can withdraw that agreement at any time in Profile → Privacy. Be aware of the honest consequence: spoken reviews and roleplay stop working, because there is no way to do either on the device alone. The rest of the app, including saving words, reading them and typed review, continues to work.

What our providers keep: processed, stored, trained on

These three get run together, and they are not the same thing. Processed means a service reads something in order to do its job. Stored means a copy is kept afterwards. Trained on means it is used to build a future model. For reem:

• Audio is processed, and may be held briefly. OpenAI may keep the audio and text it receives for a limited time, normally up to 30 days, to check for misuse, and then deletes it, unless the law requires it to keep something for longer. We do not control that period; it is part of using their service. We never keep the audio ourselves.
• Text is processed, and may be held briefly. Anthropic may retain the text we send for a short period for safety and abuse monitoring before deleting it. We do not control that period; it is part of using their service.
• Nothing is trained on. Neither provider trains its models on anything submitted through the business APIs we use.

What is not sent at all

Neither provider is told who you are. We send no name, no email address and no account number with any request. A request carries only the word being tested, the situation, and what you said. Your account and your history stay in our database; the AI services see fragments without an owner attached.

Two things reach OpenAI during live roleplay, and only then:

• A scrambled code instead of your account number. OpenAI asks for one so it can deal with misuse by a single user rather than shutting off the whole app. The code is made from your account number with a secret only we hold, so OpenAI cannot turn it back into your account number or link it to anything else about you.
• Your device's network address (IP address). Live roleplay audio streams directly between your phone and OpenAI, on a call our server sets up, so OpenAI sees the address the audio comes from, as any server you connect to does. It can show your internet provider and roughly where you are, usually to the nearest town or region.

Our keys for both providers live only on our servers and are never present in the app you install. Live roleplay audio is the one thing that goes from your phone to an AI company directly.

Training

We do not use your recordings, transcripts or written sentences to train AI models, and we have not permitted our AI providers to use them for that purpose either. We use both providers’ business APIs, which do not train on data submitted through them. No one at reem listens to your sessions.

5. Who else receives your data

We use a small number of companies to run the app. They process data on our instructions, under contract. This is the complete list.

We do not sell personal data, we do not share it with advertisers or data brokers, and we do not track you across other companies’ apps or websites.

We may disclose data if the law requires it, or to establish or defend a legal claim. If reem is ever sold or transferred, your data would move with it, and we would tell you before that happened.

6. Sending data outside the UK

OpenAI, Anthropic and RevenueCat are in the United States, so using reem means your data is transferred there. We rely on the UK’s International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, which each of those providers offers, to keep your data protected to a UK standard. Supabase hosts our database in the European Union, and PostHog holds our analytics on its EU servers.

7. Our lawful bases

Under UK GDPR we must have a lawful basis for each use of your data. Ours are:

• Performance of a contract: for everything needed to actually give you the app: storing your words, running your reviews, keeping your subscription active.
• Consent: for sending your voice and your text to AI providers. You may withdraw it at any time in Profile → Privacy, without affecting anything that happened before.
• Legitimate interests: for keeping the app secure, for the device identifier that stops the free allowance being farmed, and for usage analytics, which we need in order to understand how the app is used and make it better. We have weighed each against your privacy: the identifier is not used to profile you and is not shared, and analytics never include your name, your email, your words or your recordings. You can object to analytics at any time by turning them off in Profile → Privacy.
• Legal obligation: for records we are required to keep, such as those relating to tax.

8. How long we keep things

The reason the text is kept when the audio is not: coaching needs a history, transcription does not. Once your speech has become words, the recording has done its job and goes. The words stay because improvement can only be shown by comparison, and there is nothing to compare a session against if the last one was thrown away.

When you delete your account, everything above is removed from our live systems immediately. Copies may persist in encrypted backups for up to 30 days before they age out.

One thing is deliberately not personal to you: the dictionary itself. Definitions, etymologies and example sentences are written once and shared by everyone who looks up that word. They contain nothing about you, and they are not deleted when your account is.

9. Your rights, and how to use them

Under UK GDPR you have the right to access your data, to correct it, to have it erased, to take it elsewhere, to restrict or object to how we use it, and to withdraw consent. In practice:

• Access. The app is your access, and everything we hold that you created is visible in it. For anything else, ask us.
• Export. Profile → Export Lexicon gives you your saved words as a spreadsheet file. For a full export including your review history and coaching sessions, email us and we will send it within one month.
• Erasure. Profile → Delete Account. It is immediate and it cannot be undone.
• Correction. Most of what we hold you can edit in the app directly. For the rest, email us.
• Withdrawing consent, and objecting. Profile → Privacy holds a switch for AI features, which withdraws your consent, and a switch for analytics, which is how you object to them.

We will respond to any request within one month. We will not charge you, and we will not ask why.

10. Accounts without an email, and what you can lose

reem deliberately lets you start with no sign-up. An account is created for you quietly on first open, and your words save to it. It is a real account with real protections: the recordings and sentences it holds are personal data whether or not we know your name, and everything in this policy applies to it.

You should understand the trade you are making, though, because it is not reversible:

• If you delete the app, your words go with it. Without an email address there is nothing to sign back in with, and we cannot restore the account for you, because we would have no way to know it was yours.
• Signing out is final for an account with no email address, for the same reason. This is why the app only offers sign-out once you have added one.

Adding an email address at any point turns that same account into one you can recover, without losing anything. We recommend it.

11. AI, and what it is not

When you hold a roleplay conversation, you are talking to a machine, not a person. The coaching debrief, the character’s dialogue, and the etymologies and consolidated definitions in the dictionary are all generated by AI.

AI gets things wrong. Etymologies in particular are flagged in the app as AI-written and may be inaccurate, so please do not cite them. The coaching feedback is a practice aid: it is not professional, medical, psychological, legal or career advice. Treat it as a training partner, not an authority.

12. Children

reem is made for adults at work and is not intended for anyone under 13. We do not knowingly collect data from under-13s. If you believe a child has used the app and given us their data, write to alexdiyan@outlook.com and we will delete it. If you are between 13 and 18, please read this policy with a parent or guardian before using the app.

13. Security

Data is encrypted in transit and at rest. Access to your rows in our database is enforced at the database itself, so one account cannot read another’s. Keys for our AI providers live only on our servers and are never present in the app you install. No system is perfect; if a breach ever put your rights at risk, we would tell you and the Information Commissioner’s Office, as the law requires.

14. Changes to this policy

If we change this policy we will update the date at the top. For any change that materially affects your privacy, such as a new recipient of your data or a new use of your voice, we will tell you in the app before it takes effect, and ask again for consent where consent is the basis.

15. Contact and complaints

Privacy questions, requests and anything else: alexdiyan@outlook.com.

If you are unhappy with how we have handled your data, please tell us first, because we would rather fix it. You also have the right to complain to the UK’s Information Commissioner’s Office at ico.org.uk/make-a-complaint, or to your local supervisory authority if you are elsewhere in Europe.