Privacy policy

Oulpan is published by Israel Baubot ("we"). For questions about your personal data, contact contact@oulpan.fr.

We collect the following data:

• Identity: first name, last name and email address.
• Authentication: password (stored in hashed form), Google or Apple identifier, depending on your sign-in method.
• Learning: progress, scores, exercise answers, conversation history with the AI tutor and flashcards.
• AI reports: reported content and the status of its handling by our team.
• Audio: voice streams transmitted during a spoken answer for real-time transcription; voice messages sent in Moreh are stored privately with their transcripts so you can listen again.
• Preferences: theme, interface language and learning settings.
• Technical data: time zone, device type, request identifiers, timestamps and duration of voice service use, without raw audio content.
• Subscription: transaction and product identifiers, status and dates of your App Store or Google Play subscription; Oulpan does not receive card details.

Before signing up, you can use the discovery journey and placement test without an account. Your first and last names are kept in the local draft and may prefill email sign-up; they are not used for an Apple account. The draft and test answers are available on your device for 48 hours. The draft is deleted the next time you open the app after this period, or after it is linked to an account. With your consent, the three answers are sent to OpenAI to determine your level; using the microphone requires separate consent for Soniox transcription.

The server temporarily stores a random identifier, a protected fingerprint of your IP address to limit abuse, your consents and the test result. Preferences are also stored when you sign up by email so your journey can be recovered after verifying your address on another device. These temporary data expire after 48 hours and are deleted by regular service maintenance. After sign-in, your level and preferences are linked to your account; they do not replace an existing learning journey. Later exchanges with Moreh follow their own consent rules.

• Provide the Hebrew learning service.
• Personalize your learning journey and adapt difficulty.
• Manage your account and authentication.
• Improve service quality.

Processing needed to provide the service is based on performance of the contract. Where consent is required, including before sending written exchanges to OpenAI or voice to Soniox and relevant AI providers, it is collected separately and can be withdrawn in Settings > Conversation.

• Fly.io — application hosting (EU/US servers).
• OpenAI — AI generation, correction and safeguarding of learning content.
• Google and Apple — authentication, depending on your chosen sign-in method.
• Apple and Google Play — subscription purchases, renewals, restorations and refunds, depending on the store.
• RevenueCat — verification and synchronization of subscription status between the store and Oulpan.
• Soniox — real-time speech transcription and synthesis.
• Microsoft Azure — speech synthesis when this provider is used.
• SMTP email provider — account verification and security emails.

No data is sold or shared for advertising. No third-party analytics tool is used.

Before you first use the microphone, the app explains that audio is sent to Soniox for transcription and that the transcript may then be sent to AI providers. Soniox states that its real-time API retains neither audio nor its transcript and does not use them to train its models. When you send a voice message in Moreh, Oulpan keeps the file and transcript in your private space. Soniox and Oulpan may log technical and usage metadata without voice content, including request time, duration, model, status and cost. Conversation text may be retained in your learning history.

Your data is kept while your account is active. If you delete your account, all your data is permanently deleted within 30 days.

Voice messages sent in Moreh and their transcripts follow the retention period of your learning history. They are deleted when you reset your Moreh data or delete your account. Cancelled or unsent voice captures are not added to your history.

We use only a session cookie (hb_session) strictly necessary for authentication. This cookie is exempt from consent under the ePrivacy directive. No advertising or tracking cookies are set.

Under the General Data Protection Regulation, you have the following rights:

• Access: obtain a copy of your data.
• Rectification: change your information in settings.
• Erasure: delete your account in settings or request deletion on the web.
• Portability: export your data as JSON in settings.
• Objection: object to processing by contacting us.
• Restriction: request a restriction of processing.

To exercise these rights, go to Settings > Account or contact us at the address above. You may also lodge a complaint with the CNIL (cnil.fr).

Passwords are hashed using a secure algorithm. Communications are encrypted using HTTPS/TLS. Access to data is restricted to services needed to operate the application.

We may change this policy. If a significant change is made, you will be informed by email or an in-app notification.