Privacy Policy

Last updated: July 13, 2026

This policy explains how Yallah Speak — the mobile app and the website yallahspeak.com — handles personal data. The controller within the meaning of the GDPR is Fouad El Ajouaoui (Yallah Speak); the fastest way to reach us is by email at info@yallahspeak.com.

In short: we show no ads, we do not sell your data, and we collect only what the Service needs to work. Your learning data lives on servers in the EU (Frankfurt). Speech and AI features send the necessary input to specialised providers — that is what makes the app work, and it is described openly below.

1. The website

The website is hosted by Vercel Inc. (USA). When you visit, the server processes technical connection data (IP address, time, requested page, user agent) in server logs to deliver the site and keep it secure — legal basis: Art. 6 (1) f GDPR. The website sets no cookies and uses no tracking or analytics; fonts and audio samples are served from our own hosting, not from third-party CDNs. Your language choice is stored only locally in your browser (localStorage).

If you use the support form, we process the email address, category and message you enter, in order to answer your request (Art. 6 (1) b GDPR). Your request is stored in our database (Supabase, EU region) and forwarded to our mailbox via the email service Resend (EU region, eu-west-1).

2. Account and learning data in the app

To use the app you create an account. We process your email address and authentication data (managed through Supabase, hosted in eu-central-1, Frankfurt/Germany), your course progress, custom vocabulary decks and settings you choose during onboarding (such as your dialect, learning goal or form of address). This data is needed to provide the Service and to sync your progress across devices — legal basis: Art. 6 (1) b GDPR. Many preferences (for example the harakat display) are stored only locally on your device.

3. Speech recognition and AI conversations

The core of Yallah Speak is speaking. When you use pronunciation feedback, role-plays or debates, the necessary input is processed by specialised providers on our behalf:

These providers process data partly in the USA; transfers are safeguarded by EU standard contractual clauses and, where applicable, the EU–US Data Privacy Framework. Legal basis: Art. 6 (1) b GDPR. We do not use your conversations to train our own models.

4. Purchases and subscriptions

Payments run through Apple App Store or Google Play; we never see your payment details. To know which features to unlock, subscription status is managed through RevenueCat (USA) using pseudonymous identifiers — legal basis: Art. 6 (1) b GDPR.

5. Push notifications

If you allow notifications, learning reminders are delivered through OneSignal (USA), which processes a push token and basic app information for this purpose — legal basis: your consent, Art. 6 (1) a GDPR. You can revoke it any time in your device or app settings.

6. Emails

Transactional and support emails are sent through Resend (EU region). We use your email address to answer your requests and for essential service information.

7. Retention

Account and learning data are kept as long as your account exists. If you delete your account in the app (Settings → Account → Delete account), your account and synced data are permanently removed. Support requests are kept as long as needed to handle them and for statutory retention periods. Server logs are kept for a short period for security purposes.

8. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority. To exercise your rights, email info@yallahspeak.com.

9. Children

The Service is not directed at children under 13. Where a minor uses the Service, this requires the consent of a parent or guardian in accordance with local law.

10. Changes

We update this policy when the Service or the legal situation changes. The current version is always available at yallahspeak.com/privacy-policy.