Privacy Policy

Who is responsible

OnceEver is made and run by one person — Tian Nie, an individual developer based in the European Economic Area — who is the data controller for everything described here. For any question about your data, or to exercise any of the rights below, write to support@onceever.app.

What is collected

• Your email address. Either the one you signed up with, or — if you used Sign in with Apple and chose to hide your address — the relay address Apple gives the app instead. If you hid it, your real address is never seen here.
• An account identifier, which is what every row below hangs off.
• Your password, if you set one. It is stored as a hash by the authentication service described below and is never visible to the developer.
• Your settings: the language you are learning, your own language, the language you want explanations in, the interface language, your time zone, whether you prefer light or dark, if you answer it, whether the sentences written for you speak as a man or as a woman, and your answer on the AI services described below, with when you gave it.
• Your material. The phrases you save and everything the app builds around them — meanings, example situations, model answers, the parts you chose to review, your own attempts, the questions you ask and the answers you get, your decks and tags, and the texts in your Library — the ones Ideas wrote for you that you kept, and the ones you pasted, with their translations.
• Your practice history: which points you rated, how you rated them, and when each is next due. This is what the scheduler runs on.
• A notification token for each device, and only if you turn reminders on. It identifies the device to Apple’s push service so a reminder can be delivered; turning reminders off removes it.
• A Sign in with Apple handle, if you signed in that way. It is kept for one purpose — so that deleting your account can also end the app’s authorisation with Apple — and for nothing else.
• Operating records. Each time the app asks a language model for something, the size and cost of that request, and its text, are written to a ledger so that the running costs can be watched. It is described further down, because deletion treats it differently.

On the website only, two Vercel measurement scripts run: Analytics and Speed Insights. They record page views and loading performance in aggregate. No phrase, answer or any other text you write is ever put into either. Neither runs in the iPhone or iPad app.

What is not collected

• Photos never leave your device. When you read a phrase off a menu or a poster, the picture is scanned by Apple’s text recognition on the device itself. Only the phrases you then pick are saved, as text.
• Recordings are never kept. What you say into a box’s Speak button in the app is handed to Apple’s speech recognition, which the app asks to run on the device whenever the language’s model is installed there. Where it is not, iOS transcribes the audio through Apple’s own speech service instead — so in that case the recording does leave your device, to Apple, under their privacy policy. A recording made to fill a text (Record, on Add a text) is sent to OnceEver’s server, which passes it to one of the AI services below to be written out and keeps only the text. If you have not allowed the AI services (below), it goes to Apple’s speech recognition alone. If the server cannot be reached, the app hands it to Apple’s speech recognition instead, as above. Either way the recording is deleted from your device straight after. On the website there is no speech framework in the browser, so audio recorded there goes the same way, to one of those services, and is not stored afterwards.
• No advertising identifier, no advertising, no tracking. The app contains no ad network, no attribution service and no analytics SDK. Nothing about you is combined with data from other companies’ apps or websites, which is what tracking means — so the app never has cause to show you the tracking permission prompt.
• No location, no contacts, no health data, no payment details. The app is free and asks for none of them.
• Nothing is sold or shared for anyone else’s marketing.

Who else handles it

Running the app means using a small number of other companies. Each acts as a processor: they handle the data to provide their service and for nothing of their own, under their data processing terms, which include the European Commission’s standard contractual clauses where data reaches outside the EEA.

• Supabase — accounts, sign-in and the database. Hosted in Ireland (AWS eu-west-1).
• Vercel — the website and the app’s server. Hosted in Ireland (Dublin).
• AI services — Anthropic, ElevenLabs, Google, OpenAI, TypeSafe and xAI. Between them they recognise which language you wrote in, translate it, write model answers, example situations and practice dialogues, mark your attempts, answer the questions you ask about a phrase, explain the words you pick, write out how a phrase is pronounced, read phrases aloud, transcribe recordings — the app’s recordings to pick phrases from, and dictation on the website — and weigh which of the four ways to start a card fits what you entered. OnceEver chooses which of them handles each task and may change it, so any of them may receive what a task needs: your phrases and the context you give them, your attempts, your questions, the words you pick and your languages with your levels — with a model answer, and whether it should speak as a man or a woman, where you have said and the language shows it — or only the audio to be transcribed or the text to be spoken. Your email address and account identifier are never sent. All six are in the United States.
• Apple — delivering reminders to your device, Sign in with Apple if you use it, and the App Store if you subscribe: Apple takes the payment and holds your payment details; what reaches us is the subscription’s identifier, its product, its dates and your account identifier, never a card number or a billing address.

Each AI service is used through its paid commercial API, whose terms state that content sent this way is not used to train its models.

Nothing reaches them until you allow it. After you sign in, the app and the website show a page that names the six and what they receive, and ask before anything you write is sent; the server refuses every request to them from an account that has not allowed it. OnceEver’s core learning features — translation, marking, dialogues, answers to your questions — depend on these services and wait until you allow it; in the meantime nothing you write is sent to them, phrases are read aloud in your device’s own voice and, in the app, recordings are written out by Apple’s speech recognition. You can change your answer at any time in Settings, under AI services. If who receives what changes, you are asked again before anything is sent.

How long it is kept

Your account and everything under it are kept until you delete them. There is no other expiry: a phrase you saved two years ago is still yours to review.

Two things are kept differently, and both are worth stating plainly. The operating ledger described above outlives a deleted account, because it is the record of what running the service cost — but on deletion the account identifier and the text of the requests are erased from it, leaving sizes, costs and timestamps that belong to nobody. And spoken audio is cached by phrase, so that the same sentence is not paid for twice: that cache is keyed by the words and the voice, carries no account identifier, and cannot be traced back to who asked for it.

Deleting your account

In the app, open Settings, choose Delete account, type the six-digit code the page shows, and choose Delete my account. On the website, the same page opens from the settings page. It is immediate and it cannot be undone.

It removes your sign-in, your profile, every card and point and rating, your decks and tags, your questions, and your device tokens. If you signed in with Apple, the app’s authorisation is revoked with Apple at the same time, so it disappears from the list in iOS Settings rather than lingering there. What remains afterwards is a single line recording that an account was deleted, with the date and how many items went — no email address, no content, nothing that names you.

Your rights

Under the GDPR you may ask for a copy of your data, have it corrected, have it erased, take it elsewhere in a portable form, restrict or object to how it is used, and withdraw consent where consent is what allowed it. Deletion is built into the app so you never have to ask for it; for anything else, write to support@onceever.app and you will have an answer within 30 days.

If you think your data has been mishandled, you may complain to the data protection authority of the EEA country you live or work in — or to the CNIL, the French authority OnceEver itself answers to.

Children

OnceEver is not directed at children and is not intended for anyone under 15. No age is asked for, and nothing about the app is designed to appeal to children. If you believe a child has created an account, write to support@onceever.app and it will be deleted.

Security

Everything travels over HTTPS. Sign-in is handled by Supabase Auth rather than by hand, so passwords are hashed and never stored or seen in the clear. Every request the app makes carries your own session and is answered only with your own rows. No system is perfect, and none of this is a guarantee — but there is no analytics pipeline, no data warehouse and no third party holding a copy for their own purposes, which is the part that matters most.

Changes

If this policy changes, the date at the top changes with it, and a change that affects what is collected or who handles it will be told to you in the app before it takes effect.

Contact

support@onceever.app — questions, requests, or anything that looks wrong on this page. The support page answers the things that come up most.