Privacy Policy
Last updated: 11 July 2026
This Privacy Policy explains how Otonna (“we”, “us”) collects, uses, shares, and protects personal information when you use the Otonna website and application (the “Service”). By using the Service, you agree to the practices described here. If you do not agree, please do not use the Service.
We collect: (a) account information from your sign-in provider (Google) via Supabase Auth, such as your email address, name, and profile image; (b) practice content you enter, including the English sentences and rewrites you submit; (c) usage data, such as practice sessions, saved library patterns, credit balances, and interface-language preference; (d) limited technical data, such as IP address and request metadata used for security and rate limiting; and (e) billing data handled by Stripe. We do not collect or store payment card numbers ourselves.
We use your information to create and maintain your account; provide the five-level practice experience and generate AI feedback; store your saved patterns and credit balances; process purchases and manage subscriptions; enforce rate limits and prevent abuse or fraud; provide support; comply with legal obligations; and review and improve evaluation quality. We do not sell your personal information, and we do not use it for third-party advertising.
Where the GDPR or UK GDPR applies, we rely on: performance of our contract with you (to provide the Service and process payments); our legitimate interests (to secure the Service, prevent abuse, and improve quality); your consent (for example, when you actively rate an evaluation so we may store that snapshot); and compliance with legal obligations.
To generate feedback, evaluations, and sentence patterns, the text you submit is sent through the Vercel AI Gateway to a large-language-model provider, which processes it to return a result. We select providers that we understand do not use API submissions to train their public models by default, but their handling is governed by their own terms. Please do not submit sensitive personal information in practice text.
We rely on service providers that process data on our behalf: Supabase (database hosting and authentication), Vercel and its AI Gateway together with the underlying model provider (application hosting and AI processing), Google (sign-in), and Stripe (payments). Stripe collects and processes your payment details directly under its own privacy policy; we receive only limited billing metadata such as subscription status and a transaction identifier, not full card numbers.
We keep account data for as long as your account exists. Practice submissions are not stored as long-term history; however, when you actively rate an AI evaluation as fair or unfair, we retain a snapshot of that submission and the related feedback to review and improve quality. Billing records may be retained as required by law, such as for tax and accounting. When you delete your account, we delete or anonymize associated data except where retention is legally required.
We use measures such as encrypted HTTPS connections, database row-level security, and access controls to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please keep your sign-in credentials protected.
Depending on where you live, you may have rights to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. You can permanently delete your account and associated data at any time from the Account page. To exercise other rights, contact us at chyoufeng@gmail.com. If you are in Canada you may also contact the Office of the Privacy Commissioner; if you are in the EEA or UK, your local supervisory authority.
We and our providers may process and store your information in countries other than your own, including the United States. Where required, we rely on appropriate safeguards for such transfers. By using the Service, you understand that your information may be processed in these locations.
We use strictly necessary cookies and similar technologies to keep you signed in and to operate the Service, such as session and authentication cookies. We do not use advertising or cross-site tracking cookies.
The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us so we can delete it.
We may update this Privacy Policy from time to time. Material changes will be reflected by an updated “last updated” date and, where appropriate, additional notice. For any privacy question or request, contact chyoufeng@gmail.com.
Translations of this document are provided for convenience only. In case of any discrepancy between language versions, the English version prevails.