Privacy Policy

1.Who we are and what this policy covers#

Arbor (“Arbor”, “we”, “us”) is a language learning service operated by [legal entity name] of Los Angeles, California, United States. For people in the European Economic Area, the United Kingdom and Switzerland, we are the data controller for the personal data described here.

This policy covers:

• the Arbor iOS app;
• learnarbor.com and any other website we operate; and
• the backend services behind them, including our API, our database and our scheduled jobs.

This policy does not cover the App Store itself, or any site we link to. Apple’s handling of your purchase, your Apple ID and your App Store account is governed by Apple’s privacy policy, not this one.

If you sign up, use Arbor, or speak to Arbor, this policy applies to you. If anything in it is unclear, write to us at the address in section 16 and we will answer in plain language.

2.The information we collect#

a. What you tell us when you set up your account

• Your email address. Required, because it is how you sign in and how we reach you about your account.
• Your name and profile photo, if you choose to add them. If you sign in with Apple or Google, we receive whatever name that service passes to us.
• The identifier your sign-in provider gives us — an Apple user identifier or a Google user identifier. If you use Sign in with Apple’s Hide My Email, we only ever see the private relay address, and Arbor works exactly the same.
• Your consent record: the moment you accepted our Terms of Service, the moment you accepted this Privacy Policy, the moment you confirmed you are 16 or older, and — separately and only if you choose it — the moment you opted in to tips and updates by email.

b. Your life profile — the part that makes Arbor Arbor

During onboarding, and afterwards as you talk to Arbor, you tell us about your life so your lessons can be about your life. This includes:

• what you do for work and the industry you do it in;
• your hobbies and interests;
• places you have been and places you want to go;
• why you are learning this language;
• the specific situation you are learning for, and how formal it is;
• your target date, how many minutes a day you are committing to, and the goal you set for yourself;
• your self-assessed starting level, your answers to the onboarding questions, whether you already read the script, and whether you are a heritage speaker.

This is free text. Please share what helps Arbor teach you and no more. Arbor never asks for health information, political or religious views, information about your sex life or sexual orientation, racial or ethnic origin, or trade union membership, and we ask you not to put that kind of detail into your profile or into a conversation. If you do, you are choosing to share it, and section 12 explains what that means and how to remove it.

c. What you create as you learn

• Lessons: which lessons you opened, which sections you completed, the sentences you wrote, and the coaching Arbor wrote back to you.
• Your vocabulary deck: every card — the target word, its meaning, its dictionary form, the example sentence, where the word came from — and its review schedule: intervals, ease, repetitions, review history and response times.
• Conversations with Arbor: the full transcript of both sides, a written summary, the topics you covered, the new words you picked up, and notes on which structures are still building.
• Speaking measurements: seconds spoken, words spoken, number of turns, how often you reach back to your first language mid-sentence, and pronunciation scores — including per-sound scores from the pronunciation service.
• Stories generated for you, and whether you finished them.
• Capstone conversations: your score, the verdict on each can-do statement, and short quotations of your own words used as the evidence for each verdict.
• Memories: short statements Arbor forms about you from your conversations, each stored with where it came from and how confident Arbor is in it. You can read every one of them, correct one, or remove one at any time.
• Moments you save, including any you mark as shareable.
• Your learner model: when you tend to practise, how quickly things stick for you, how you respond to being stretched, and the priorities Arbor is planning to unlock next.
• Your progress: a daily snapshot of your ability estimate, your Consistency Score, daily counts against free-tier limits, personal bests, and any level confirmations you earn. A level confirmation may carry a verification code, so that if you choose to share the code someone can check the confirmation is real.

d. Technical and usage information

• Device and app information: device model, operating system version, app version and build number, and language settings.
• Diagnostic reports. If the app runs into a problem or stops unexpectedly, we receive a technical report. It is scrubbed on your device before it is sent: email addresses, tokens, transcripts, memories, story text and life-profile content are removed, and you appear in it only as an opaque account identifier. If the scrubbing step cannot complete for any reason, the report is dropped rather than sent.
• Product analytics: events describing which features you used and when, tied to a pseudonymous identifier rather than to your name or email.
• Your IP address, which we see transiently on each request and use to apply rate limits and prevent abuse. We do not store it in your learner record.
• On-device storage: your sign-in session is kept in the iOS Keychain via the system’s secure storage. Lesson bookmarks, your active language, activity dates and content caches live on your device.

e. Subscription information

If you subscribe to Arbor Pro, our subscription provider tells us whether your entitlement is active, which plan you are on, and when it renews or expires, and forwards us the purchase events Apple sends. We never see or hold your card number. Apple processes the payment; we only receive the result.

f. Information we receive from others

• Apple: your sign-in identifier, the name and email (or private relay address) you agree to share, and subscription events.
• Google: your sign-in identifier, name and email address if you sign in that way.
• Our subscription provider: entitlement status, as above.

g. What we do not collect

We do not collect your precise location, your contacts, your photo library, your health data, government identity documents, or your financial account details. We do not use the Advertising Identifier (IDFA), and Arbor does not present an App Tracking Transparency prompt, because we do not track you across other companies’ apps or websites.

3.Your voice, specifically#

Speaking is the point of Arbor, so this deserves its own section.

How it works. When you speak, iOS asks for microphone permission first, and you can withdraw that permission at any time in Settings. Your audio is sent to our backend over an encrypted connection, held in memory only, forwarded to the service that transcribes it — and, when you are being scored on a line, to the pronunciation service — and discarded as soon as the response comes back. It is never written to disk on our servers and never stored in our database.

What we keep is the text and the numbers: the transcript of what you said, the words you used, how long you spoke, and your pronunciation scores.

We do not use your voice to identify you. We never process your speech to work out who is speaking; we process it only to work out what was said and how clearly. For that reason we do not treat it as biometric data used for identification under Article 9 of the GDPR, and it is not “sensitive personal information” under California law.

Your lawful basis for this is your consent (GDPR Article 6(1)(a)), given when you grant microphone permission. You can withdraw it at any time by turning the permission off or by typing instead of speaking. Withdrawing does not undo processing that already happened, and it does not stop you from using the rest of Arbor.

Arbor’s own speech is synthesised. The audio you hear is generated from text, and we cache that generated audio by the text and voice — not by who asked for it — so the same line does not have to be generated twice.

4.Why we use your information, and our lawful basis#

If you are in the EEA, the UK or Switzerland, the GDPR requires us to name a lawful basis for every use. Here they are.

Where we rely on legitimate interests, we have weighed our interest against your rights and concluded it does not override them — and you can object at any time (section 12).

5.The companies that process information for us#

We keep this list short on purpose. Each of these is a processor acting on our documented instructions under a data processing agreement, not an independent recipient free to do as it likes with your data.

Practice reminders are scheduled on your device. Arbor does not operate a push notification server and does not hold a push token for you.

We may also disclose personal data:

• to comply with law — a subpoena, court order or lawful request, where we are satisfied it is valid, and we will tell you unless we are legally prevented from doing so;
• to protect people — where disclosure is necessary to protect the rights, safety or property of you, of us, or of the public;
• in a corporate transaction — if Arbor is ever acquired or merges, your data may transfer to the acquirer, who will remain bound by this policy or give you notice before anything changes.

6.What we do not do#

• We do not sell your personal information, as “sell” is defined by the California Consumer Privacy Act, and we never have.
• We do not share your personal information for cross-context behavioural advertising.
• We do not run advertising in Arbor, and there are no advertising, attribution or ad-network SDKs in the app.
• We do not allow our processors to use your content to train their own general-purpose models. Our agreements with them prohibit it.
• We do not put your name or email address into analytics. You appear there as a pseudonymous identifier.
• We do not publish anything you write. A moment is shared only when you choose to share it.
• We do not sell or transfer your data to data brokers.

7.International data transfers#

Arbor is operated from the United States. If you are in the EEA, the UK or Switzerland, using Arbor means your personal data is transferred to, and processed in, the United States and in any other country where the processors listed in section 5 operate. Those countries may not offer the same level of legal protection as your own.

Where we transfer personal data out of the EEA, the UK or Switzerland, we rely on:

• the European Commission’s Standard Contractual Clauses (Decision 2021/914), incorporated into our agreement with each processor;
• the UK International Data Transfer Addendum for UK transfers;
• the Swiss addendum for transfers from Switzerland; and
• where a processor is certified, the EU–US Data Privacy Framework and its UK Extension and Swiss–US framework.

Alongside those contracts, we apply practical protection: encryption in transit and at rest, minimising what we send in the first place, pseudonymous identifiers instead of names in analytics and diagnostics, and scrubbing on the device before diagnostic data leaves it.

You can ask us for a copy of the transfer mechanism that applies to you. Write to us at the address in section 16.

8.How long we keep things#

When you delete your account, we delete the personal data described in this policy from our systems, remove your sign-in credentials so every active session ends, and remove your subscriber record from our subscription provider. We keep a minimal record that an account with that identifier existed and when it was deleted, so we can evidence that the deletion happened. Deletion is permanent and cannot be undone — we would rather say that clearly now than have you find out afterwards.

If you cancel a subscription but keep your account, nothing is deleted; you move back to the free tier and everything you have built stays where it is.

9.How we protect your information#

• Everything travels encrypted. All traffic between the app, our backend and our database uses TLS. Data at rest is encrypted by our database provider.
• Row-level security is switched on for every table. A signed-in request can reach only that account’s own rows, enforced by the database itself rather than by application code alone.
• The app never calls an AI or speech service directly and carries no third-party API keys. Every such call goes through our backend, where the keys live in environment variables and never reach a device.
• Teaching prompts and assessment rubrics stay on the server. They are never sent to the app.
• Our logs are scrubbed. Email addresses, tokens, API keys and personal content are removed before anything is written. Diagnostic reports are scrubbed on your device before they are sent, and dropped entirely if the scrubbing step cannot complete.
• Your session lives in the iOS Keychain, not in ordinary app storage.
• Every endpoint is rate limited, and abuse controls cut off clients that behave abnormally.
• Messages on your screen stay general when something goes awry. Detailed technical information stays server-side, so a message you see can never leak the shape of our systems to someone probing them.

No system is perfectly secure, and anyone who tells you otherwise is selling something. If a personal data breach affects you, we will notify you and the relevant supervisory authority as the law requires — within 72 hours of becoming aware, where the GDPR applies.

10.Age#

Arbor is for people aged 16 and over.

You confirm your age when you create your account, and we record the moment you did.

Arbor is not directed to children, has no child-directed features, and is not offered in the App Store’s Kids Category. We do not knowingly collect personal data from anyone under 16. If we learn that an account belongs to someone under 16, we will delete that account and its data.

We chose 16 as a single global floor because it is the highest age of digital consent used across the EU — Poland’s, for example — and applying it everywhere is simpler and safer than applying a different rule in each country.

If you are a parent or guardian and believe your child has created an account, write to us at the address in section 16 and we will act promptly.

11.Your choices inside the app#

You do not need to email anyone to do most of this.

• Delete your account. Profile → Delete account. Two confirmations, then everything described in section 8 is deleted. Deletion is permanent.
• Get a copy of your data. Ask us at the address in section 16 and we will send you a machine-readable export of your profile, your conversations, your vocabulary deck, your progress and your completed lessons.
• Review and correct what Arbor remembers about you. Every memory Arbor has formed is visible to you, and you can correct one or remove one at any time.
• Turn the microphone off. iOS Settings → Arbor → Microphone. Arbor keeps working; you type instead of speaking.
• Turn practice reminders off, in iOS Settings or in the app.
• Stop receiving tips and updates, using the unsubscribe link in any of those emails. Account email — receipts, security notices — continues, because it is part of running your account.
• Change your name, photo or learning language at any time in Profile.

12.If you are in the EEA, the UK or Switzerland#

Under the GDPR and the UK GDPR you have the following rights. They are free to use, and we will not treat you any differently for using them.

• Access. You can ask what personal data we hold about you and receive a copy.
• Rectification. If something we hold about you is inaccurate or out of date, you can ask us to fix it — and for the things Arbor has inferred about you, you can do it yourself in the app.
• Erasure. You can ask us to delete your personal data, and you can do it yourself from Profile → Delete account.
• Portability. You can ask for the personal data you gave us, and the data generated by your use of Arbor, in a structured, commonly used, machine-readable format, and you can ask us to send it to another provider where that is technically feasible.
• Restriction. You can ask us to pause processing while a dispute about accuracy or legitimate interests is resolved.
• Objection. You can object at any time to processing based on our legitimate interests — including analytics — and we will stop unless we can show compelling grounds that override your rights. Where we ever process for direct marketing, an objection is absolute and we stop immediately.
• Withdraw consent. Where we rely on your consent — your voice, and marketing email — you can withdraw it at any time, in Settings or by unsubscribing. Withdrawal does not affect processing that already took place.
• Automated decision-making. Arbor estimates your level and plans what to unlock next automatically. These are teaching decisions: they change what you are shown next, and they never produce a legal or similarly significant effect on you. We do not carry out automated decision-making of the kind described in Article 22. You can always disagree with an estimate and ask a human to look at it, using the address in section 16.

How to use these rights. Write to privacy@learnarbor.com from the email address on your account. We will respond within one month, and will tell you if we need to extend that by up to two further months because a request is complex. We may need to verify your identity before we act, and we will ask for the least information that lets us do so.

Complaints. If you think we have handled your data poorly, please tell us first — we would like the chance to put it right. You also have the right to complain to your local supervisory authority. In Poland that is the Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl. In the UK it is the Information Commissioner’s Office, ico.org.uk.

Our EU and UK representatives. Our representative under Article 27 of the GDPR is [EU representative name and address]. Our UK representative is [UK representative name and address].

13.If you are in California#

This section is for California residents and is provided under the California Consumer Privacy Act as amended by the California Privacy Rights Act.

Categories of personal information we collect

We use each category for the purposes set out in section 4, and we retain each for the periods set out in section 8.

Sale and sharing

We do not sell personal information and we have not sold personal information in the preceding twelve months. We do not share personal information for cross-context behavioural advertising. We do not sell or share the personal information of consumers we know to be under 16 — Arbor is not available to them at all.

Sensitive personal information

The only sensitive personal information we handle is your account log-in credentials, and we use it solely to sign you in and keep your account secure. We do not use or disclose sensitive personal information for any purpose other than those permitted by CCPA §1798.121(a). Because of that, the “Limit the Use of My Sensitive Personal Information” right does not apply to us, and we do not display that link.

Your life profile and your conversations are free text, so it is possible to type something sensitive into them. Please do not — and if you have, you can remove it in the app or ask us to.

Your California rights

• Right to know what personal information we collect, the sources, our purposes, the categories of third parties we disclose it to, and the specific pieces we hold.
• Right to delete the personal information we hold about you.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing — we do not sell or share, so there is nothing to opt out of, and we do not display a “Do Not Sell or Share My Personal Information” link.
• Right to non-discrimination. We will never charge you a different price, give you a lesser service, or slow you down because you used a privacy right.

How to use them. Delete your account in the app at Profile → Delete account, or write to privacy@learnarbor.com. We will confirm receipt within 10 business days and respond within 45 days, extending by a further 45 days where a request is complex, and telling you if we do.

Verification. We will verify your request by matching it to the email address on your account, and for a request for specific pieces of personal information we may ask for additional confirmation. Authorized agents may submit a request with written permission signed by you, and we may still contact you to confirm.

Shine the Light (Cal. Civ. Code §1798.83): we do not disclose personal information to third parties for their own direct marketing purposes.

14.Cookies, SDKs and device identifiers#

The Arbor iOS app does not use cookies. Apps do not work that way. What it uses instead:

• Your sign-in session, stored in the iOS Keychain by our authentication provider, so you stay signed in. Strictly necessary.
• A pseudonymous analytics identifier, generated on your device by our analytics SDK, so we can tell one person’s sequence of actions from another’s without knowing who either of you is.
• A diagnostics session identifier, generated by our crash reporting SDK.
• A subscription identifier, which is deliberately the same as your Arbor account identifier, so that a purchase made on your device unlocks Pro for your account and not for a stranger’s.
• Local caches on your device: lesson bookmarks, your active language, activity dates and generated content. These stay on the device and are cleared when you delete your account or delete the app.

We do not use the Advertising Identifier (IDFA), and Arbor does not show an App Tracking Transparency prompt, because we do not track you across other companies’ apps or websites.

learnarbor.com sets no cookies. The website measures how it is used — which pages are opened, how far down a page people read, and whether the waitlist form is completed — through PostHog and Vercel. Neither stores anything on your device that outlives the browser tab you are in: the analytics identifier is kept in your tab’s session storage, so closing the tab ends it.

If you arrive from a campaign or a shared link, the source of that link is kept in your tab’s session storage so a signup can be credited to it, and it is passed to our email provider with your address if you join the waitlist. It is discarded when you close the tab. We do not build a profile of you across visits, we do not record your screen, and we do not track you across other companies’ websites.

15.Changes to this policy#

We will update this policy as Arbor grows — new languages, new ways to practise, and in time human tutors, which we are still building toward and which will bring their own disclosures.

When we change it, we will change the “Last updated” date at the top and post the new version at learnarbor.com/privacy. If the change is material — a new category of data, a new purpose, or a new processor that meaningfully changes where your data goes — we will tell you in the app or by email before it takes effect, and where the law requires it we will ask for your consent again rather than assume it.

We keep previous versions and will send you one on request.

16.How to reach us#

We would rather hear from you than have you wonder.

Privacy questions, and any request under section 12 or 13:
privacy@learnarbor.com

Postal address:
[legal entity name]
[street address]
Los Angeles, California [ZIP]
United States

Data Protection Officer: [name — or remove this line]

EU representative (GDPR Article 27): [name and EEA address]

UK representative: [name and UK address]

You can also complain to your supervisory authority — details in section 12 — but we hope you will give us the first chance to put it right.