Privacy Policy

Who we are

Abidera is built and operated by Aleks Meshkov, an individual developer based in Portugal (“Abidera,” “we,” “us”). You can reach us at support@abidera.com.

This Privacy Policy covers the Abidera iOS app and the website at abidera.com. By using Abidera, you agree to the practices described here.

What we collect

Account data

When you sign in with Apple or create an account, we store your email address and a stable user identifier so we can keep your progress tied to you across devices. If you use Sign in with Apple's private email relay, we only see the relay address Apple provides.

Learning progress

We store the lessons you've completed, your spaced-repetition schedule, your streak, your daily goal, and which phrases you've starred. This is the data that makes the app personal — without it, Abidera can't remember where you left off.

Subscription & purchase records

Purchases are handled by Apple's App Store and processed via RevenueCat. We receive your subscription status (active, in trial, canceled) and the product you're on. We never see your payment card or Apple ID password.

Reminders & notifications

Reminders and practice questions in notifications are scheduled on your device as iOS local notifications. We do not send push notifications from a server and do not collect or store push tokens. You can change or turn off reminders any time in the app's Profile, or by turning notifications off in iOS Settings.

Documents and photos you submit

When you use the Document Decoder, the photo or PDF you provide is sent to OpenAI (the primary processor) so it can extract text and produce a structured summary. If OpenAI is temporarily unavailable, the same image is sent once as a fallback to Anthropic. When you use the Translator, the text you submit is sent to OpenAI. Neither provider uses your input for training (see “Third-party processors” below).

The original image you upload is not stored on our servers — only the structured decoded result (summary, action items, translated text) is retained, so you can revisit it in your own app history. See “Retention” below for how long results are kept and how deleting your account removes them.

Voice and audio you send for help

Some features need to hear audio to help you. In each case the audio is sent to our server only when you start it, is processed in memory, and is not stored; the text result is.

• Talk with anyone, when they speak (Listen): the recording of what someone said to you (up to about a minute) is transcribed by Microsoft Azure AI Speech. The transcript is then checked by OpenAI's moderation model and sent to OpenAI to explain it and suggest what to answer.
• Talk with anyone, your turn, and dictation: when you speak instead of typing (in Talk with anyone, Translate, or word lookup), your recording is transcribed by OpenAI. What you typed or said is sent to OpenAI to put it into Portuguese.
• Conversations you record and videos you explain: a recording of people talking around you, or the sound of a video playing in another app (captured with iOS screen broadcasting; only the other app's audio, never your microphone or the picture), is sent to OpenAI to transcribe it, tell the speakers apart, and explain it line by line.
• Questions about a mistake (“Still confused?”): the question you type is checked by OpenAI's moderation model and answered by OpenAI.
• Audio you hear in the app: Portuguese phrases are read aloud by Microsoft Azure text-to-speech. Only the text of the phrase is sent, never anything about you.

Voice recordings for pronunciation practice

When you practice speaking, your recording stays on your device so you can play it back and hear yourself. It is not uploaded to our servers, not sent to any AI provider, and not shared with any third party. Recordings are deleted when you discard them in the app or when you uninstall Abidera.

Here's what each iOS permission is for:

• Camera: Scan letters, menus, and documents so Abidera can translate and explain them.
• Photo Library: Upload photos of Portuguese documents so Abidera can translate and explain them.
• Microphone: Record yourself practicing phrases (stays on your device), and record what someone says to you, what you want to say, or a conversation around you, which is sent for processing as described under “Voice and audio you send for help”.

App analytics

The iOS app sends product analytics to PostHog. It records selected events such as onboarding steps, the screens you open, lesson, review and verb practice activity, the features you use, and subscription-screen views and purchases. Events can include lesson identifiers, counts and results, the dictionary word you opened, along with app version, device model and OS version. Automatic screen and touch capture and session replay are not enabled by this integration.

Before sign-in, activity uses an anonymous installation identifier. After sign-in, we associate it with your account ID to understand the learning journey. We do not pass your email, translation text, documents or voice recordings to PostHog through these analytics events. Signing out resets the analytics identity. This analytics integration is separate from the website cookie choice below.

Where you found Abidera

If you install Abidera after tapping one of our ads in the App Store (Apple Search Ads), Apple gives the app an attribution token. RevenueCat uses it to tell us which of our ad campaigns and keywords led to the install and to any subscription. This uses Apple's AdServices framework, not the advertising identifier (IDFA), so the app never asks for tracking permission and nothing is shared with other advertisers.

Website analytics

On abidera.com (this website, not the iOS app) we use a small set of analytics tools to understand which pages people visit and how the site performs. Nothing here is used for advertising, and none of these tools mount until you accept on the cookie banner — if you reject, the site loads with no analytics at all. You can change your choice any time from “Cookie settings” in the footer.

• Vercel Analytics — counts page views and referrers. Cookieless: it derives a daily per-visitor hash from your IP and User-Agent, processes it server-side, and does not store the raw IP.
• Vercel Speed Insights — measures Core Web Vitals (page load time, layout shift, etc.) so we can spot performance regressions. Same data class as Vercel Analytics.
• Google Tag Manager — a tag loader that lets us run additional measurement tools (currently this includes Google Analytics for aggregated traffic stats). GTM and any tags it loads use cookies on your browser.

We do not load any of these on the iOS app, and we do not use any of them for retargeting or building advertising profiles.

Crash reports and feedback

The iOS app does not send crash reports of its own. If you allow “Share with App Developers” in iOS Settings, Apple shares crash logs with us through App Store Connect.

If you send feedback from the app, the message you write, any screenshot you attach, your name, email and Abidera user ID are sent to Sentry so we can read it and reply. If you report an AI answer as wrong, the report is stored with the answer so we can fix it.

Third-party processors

We use a small set of carefully chosen providers to run the app. Each one receives only the data needed for its specific job.

• Supabase — database and authentication. Stores your account and learning progress. EU-hosted. Privacy policy.
• RevenueCat — subscription management. Tracks your subscription state and purchase history. Privacy policy.
• OpenAI — powers the translator, the primary document decoder, Talk with anyone, conversation and video explanations, dictation, and answers to questions about a mistake. Receives the text, image or audio you submit for processing. OpenAI does not use API inputs to train their models. Privacy policy.
• Anthropic — used as a fallback processor for the document decoder only when OpenAI is unavailable. Receives the image you submit. Anthropic does not use API inputs to train their models. Privacy policy.
• Microsoft (Azure AI Speech) — transcribes what someone said to you in Talk with anyone, and reads Portuguese phrases aloud. Receives that recording, or the text of the phrase. Privacy statement.
• Apple — Sign in with Apple, App Store payments, and App Store ad attribution. Privacy policy.
• Sentry — receives the feedback you send from the app, as described under “Crash reports and feedback” above. EU-hosted (Frankfurt). Privacy policy.
• Vercel — hosts our website and API, and provides Vercel Analytics + Vercel Speed Insights for the website (loaded only after you accept the cookie banner). Processes standard server logs. Privacy policy.
• Google — Google Tag Manager and Google Analytics on the website (loaded only after you accept the cookie banner). Used for aggregated traffic measurement, not for advertising. Privacy policy.

PostHog processes the app analytics described above, on its EU servers. See the PostHog privacy policy.

What we don't do

How we use your data

• To run the app and keep your progress synced across devices.
• To process your subscription and give you access to paid features.
• To generate translations, document summaries, conversation and video explanations, and answers when you request them.
• To send you the notifications you've opted into (daily reminders and practice questions).
• To learn which of our App Store ads bring people who find Abidera useful, so we spend on the ones that do.
• To respond to support emails, read in-app feedback, and use crash reports to find and fix bugs.
• To prevent abuse of our free tier — for example, to stop the same person from creating throwaway accounts to reset usage limits (see “Retention” below for what this involves).
• To comply with legal obligations (tax reporting for subscription revenue, responding to lawful requests).

Retention

We keep your account data for as long as your account is active. If you delete your account, we erase your personal data within 30 days, except where we're required to keep records for legal reasons (e.g., transaction records for tax purposes, kept for 7 years under Portuguese law).

Decoded documents — specifically the structured result (summary, action items, translated text) — are retained in your account history until you delete the item or your account. If you remove an individual item from your history, it is permanently erased within 30 days. Deleting your account cascades all of these rows immediately. The original image you uploaded is not stored on our servers; it is sent to the AI provider for processing and discarded when the request completes. Translator history follows the same lifecycle.

Conversation and video explanations (the transcript, speakers and explanations, never the audio) and your questions about mistakes with their answers are kept in your account until you delete your account. Removing a video from your history hides it in the app. See “Your rights” below for how to request deletion of anything sooner.

One narrow exception for free-tier abuse prevention: when you delete your account, we retain a one-way pseudonymized identifier derived from your email — generated using a server-side secret you do not have access to — together with how many free Document Decoder uses and free translations you had consumed. This is the minimum we need to enforce our free-tier limits if the same email signs up again later. We do not retain your name, your learning progress, your decoded documents, your translations, your audio, or any other identifying information. The identifier cannot be linked back to your email by anyone who only sees this database.

Legal basis under the GDPR: Article 6(1)(f), our legitimate interest in preventing free-tier abuse (Recital 47), which is also recognized under Article 17(3)(e) as an exception to the right to erasure. You can object to this processing at any time by emailing us — see “Your rights” below.

Your rights

Under the GDPR and similar laws, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data (“right to be forgotten”).
• Export your data in a portable format.
• Object to specific processing activities.
• Lodge a complaint with your local data protection authority.

You can delete your account and its data yourself in the app: Profile → Delete account. Email support@abidera.com to exercise any of these rights. We'll respond within 30 days.

Children

Abidera is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please email us and we'll delete it.

International transfers

Some of our providers (OpenAI, Anthropic, Microsoft, RevenueCat, Vercel) may process data in the United States. When data leaves the EU/EEA, it is covered by Standard Contractual Clauses (SCCs) or equivalent safeguards.

Security

Data in transit is encrypted via TLS. Data at rest in Supabase is encrypted. We follow standard practices for access control, secret management, and vulnerability patching. No system is perfectly secure, but we take this seriously — if you find a vulnerability, please email us at support@abidera.com.

Changes to this policy

If we make material changes, we'll update the “Last updated” date above and, where appropriate, notify you in-app or by email. Continued use of Abidera after a change means you accept the revised policy.

Contact

Questions or requests? support@abidera.com.