You record a short take. We upload it to provide your journal and analyse the audio with specialist cloud services. You control whether to record, and you can export your entries or delete your account. We don’t run advertising or analytics trackers on this website.
1. Who we are
LevelYap is operated by Savvas Theocharous, an individual based in Cyprus, who is the controller of your personal data. Contact address: Ariadnis 26, 2416 Egkomi, Nicosia, Cyprus. Privacy and support email: team@levelyap.com.
This notice is effective 2026-09-05, Version 1.0.
2. What this notice covers
This notice covers the LevelYap speaking practice app, levelyap.com, and communications with us. It describes information you provide, information received from your sign-in and purchase providers, and technical information generated when you use the service. External services linked from the app or website have their own privacy notices.
3. Personal data we collect
- Account information: your display name, email address, account identifier, authentication information, account creation date, and settings. Email/password authentication is handled by Firebase Authentication.
- Recordings and practice: audio, video if you choose video mode, recording dates and duration, selected topics, and your journal entries. Video recordings are uploaded to cloud storage; they do not remain exclusively on your phone.
- Analysis: transcripts, word timings, delivery measurements such as pace and pauses, scores, wording suggestions, and any corrections you submit about your intended meaning.
- Payment information: subscription status, product and transaction identifiers, purchase and expiry dates, and purchase restoration information.
- Technical information: IP addresses, device and app information, authentication and integrity checks, upload status, service errors, and operational logs.
- Messages: your email address and the contents of messages you send to support. If you choose to use the app’s external feedback board, that provider also receives information you submit there.
The website does not have an account form, advertising pixels, or a newsletter signup. Its hosting provider processes ordinary network requests, including IP address, requested page, browser information, and security signals.
4. How we use your information
We use account information to sign you in and keep your journal associated with you. We use recordings and transcripts to provide playback, transcription, AI feedback, and your practice history. We use purchase information to unlock paid features and restore purchases. Technical information helps operate the service, prevent abuse, diagnose failures, and keep accounts secure. We use support messages to answer your request.
Providing an account and a recording is necessary to use cloud analysis and your personal journal. You can browse the website without creating an account. You can decline microphone or camera permission; the corresponding recording feature will then be unavailable. Camera permission is only needed for video mode.
5. Lawful bases
- Contract, Article 6(1)(b): providing the account, recording analysis, journal, exports, and subscriptions you request, and responding to pre-contract enquiries.
- Legitimate interests, Article 6(1)(f): securing the service, preventing fraud and abuse, diagnosing technical problems, and handling support. We balance those interests against your rights, with particular care for younger users.
- Legal obligation, Article 6(1)(c): keeping records or responding to requests where applicable law requires it.
- Consent, Article 6(1)(a): optional processing for which we specifically request consent. You may withdraw it through the relevant setting or by contacting us; withdrawal does not affect earlier lawful processing.
Accepting a device permission does not mean consenting to unrelated uses of your data. We do not treat agreement to these policies as blanket consent.
6. Who we share information with
- Google / Firebase and Google Cloud: authentication, database, recording storage, server processing, security checks, and Gemini analysis through Vertex AI. Gemini receives transcript text, the topic and delivery context needed to generate feedback. See Firebase privacy information and Google Cloud’s privacy notice.
- ElevenLabs: the Scribe speech-to-text service receives access to your recorded audio to generate a transcript and word timings. See ElevenLabs’ privacy policy.
- RevenueCat: processes your app user identifier, purchase records, subscription state, and relevant device information to manage access to paid features. See RevenueCat’s privacy policy.
- Apple and Google: provide sign-in, app distribution, purchase processing where applicable, and device integrity services. Their own notices govern their independent account, store, and security processing.
- Cloudflare: hosts and delivers this website and processes request and security information. See Cloudflare’s privacy policy.
- UserJot: receives information you choose to submit if you follow the app’s external feedback-board link. Please avoid posting private recordings or other sensitive information on a feedback board.
Service providers receive information needed for their role. We may also disclose information to professional advisers or authorities where necessary for a legal obligation or a legal claim, or in a business transfer with appropriate safeguards. We do not sell personal data or share it for cross-service advertising.
7. AI processing and sensitive content
AI-generated scores and suggestions can be incomplete or wrong. They are intended for personal practice and do not make decisions about employment, education, credit, or other matters with legal or similarly significant effects. Contact us if you want to question how your information has been used.
We do not use voice or video to identify you by biometric matching. Please record yourself and avoid including other people or disclosing health details, political or religious beliefs, intimate information, or other sensitive personal data. These are not needed for speaking practice.
Google’s Vertex AI terms restrict training on customer data without permission. Other provider retention and data-use settings can differ. In particular, this app does not promise zero retention by ElevenLabs; its retention options depend on the service and account configuration. Deleting a recording in LevelYap does not by itself certify immediate deletion from every provider’s operational systems.
8. International transfers
Our Google Cloud backend is configured to use United States infrastructure, including the us-central1 region and a US database region. Vertex AI may use global processing. Other providers can also process data outside Cyprus and the European Economic Area, including in the United States.
For transfers that require safeguards, the applicable mechanism may be an adequacy decision, an eligible recipient’s Data Privacy Framework certification, or contractual protections such as the European Commission’s Standard Contractual Clauses and, where UK law applies, the UK transfer addendum or equivalent. The applicable provider agreements and destination determine the mechanism; a US location alone is not a safeguard. Contact us to request information about the safeguards applicable to your data and a copy where available.
9. Security
We use encrypted network connections, authenticated access to personal records, access rules for storage and the database, and app integrity checks. Recordings used by processing services are accessed with time-limited links. Please keep your device and sign-in account secure. No system can guarantee absolute security.
10. How long we keep information
| Information | Retention period or criteria |
|---|---|
| Account and settings | While your account remains open. Account deletion removes the active account record and authentication user. |
| Cloud recordings, transcripts, scores and analysis artifacts | Kept for your journal until you delete the relevant entries or account. They do not have an automatic 30-day cloud expiry. |
| Local recording copies | Video copies are removed after successful upload. Local recording cleanup normally removes known audio copies older than 30 days and confirmed orphaned files older than 7 days. Pending uploads are protected until they can be resolved. Cleanup runs when the app runs. |
| Export files | Download links expire after one hour. The export storage lifecycle is configured for deletion after one day; deletion is asynchronous. Copies you download remain under your control. |
| Subscription records | For managing access while the account exists. Account deletion attempts removal of the RevenueCat customer record. Stores and providers may retain transaction records for their legal, accounting, fraud-prevention, and dispute requirements. |
| Support messages and operational logs | For as long as necessary to resolve the request, investigate faults or abuse, and meet applicable legal obligations. The appropriate period depends on the issue, its sensitivity, and whether a dispute remains unresolved. |
| Provider logs and backups | Subject to provider service terms and retention configurations. Removed data can remain temporarily in restricted backups or operational records; we do not promise instant deletion from all provider systems. |
We may preserve narrowly relevant records where a legal obligation or legal claim requires it. You can request more information about a particular record by email.
11. Your rights
Where applicable, you may request access, correction, deletion, restriction, and a portable copy of your data. You may object to processing based on legitimate interests and withdraw consent where we rely on it. These rights have legal limits.
You can export your entries, delete entries, or delete your account from your profile in the app. If you cannot sign in or need another right, email team@levelyap.com. We may request proportionate verification. We normally respond within one month; if a lawful extension is necessary, we will explain it. Deleting your account does not cancel an App Store or Google Play subscription.
12. Children and younger users
LevelYap is intended for users aged 16 and over. If you are 16 or 17, ask a parent or guardian to review the Terms with you and give permission to use the service. Do not share information about other people or sensitive personal matters in practice recordings.
We do not knowingly offer the app to children under 16. If you believe a younger child has provided information, contact us so we can investigate and arrange deletion where appropriate. Parents and younger users can ask questions about this notice at the same contact address.
13. Cookies, tracking and device identifiers
This website does not use advertising cookies, behavioural analytics, third-party font requests, or embedded social-media players. Cloudflare processes technical requests and may use security measures necessary to deliver and protect the site. The app stores sign-in state, settings, and upload queues on your device and uses identifiers needed for authentication, app integrity, and purchases. We have not integrated an advertising tracking SDK.
14. Apple, Google sign-in and payment information
Sign in with Apple can provide your name and email address, including an Apple private relay address if you choose Hide My Email. Google sign-in provides basic account identity and profile information, including your name and email; LevelYap does not request access to your Gmail messages, contacts, or calendar.
The Apple App Store or Google Play processes purchases on supported platforms. We do not receive or store full payment-card numbers. Purchase metadata is used by RevenueCat and our backend to verify your access. You can manage subscriptions through the store where you bought them.
15. Complaints
You can contact us about any privacy concern. You also have the right to complain to the Cypriot Commissioner for Personal Data Protection or your local EEA supervisory authority. If UK data protection law applies, you can complain to the UK Information Commissioner’s Office. You do not have to contact us first.
16. Changes to this notice
We will update this page and its effective date when our processing changes. Where required, we will bring material changes to your attention before new processing begins and request any necessary consent.
17. Contact
Savvas TheocharousAriadnis 26, 2416 Egkomi
Nicosia, Cyprus
team@levelyap.com