1Who we are
Flyt (“we”, “us”) is a mobile application that helps you practise spoken Norwegian (Bokmål) through real-time conversation with an AI tutor, and gives you corrections on what you say. This policy explains what personal data we collect, why, how we protect it, and the rights you have over it.
We are the data controller for the personal data described here, under the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act (personopplysningsloven).
We have not appointed a Data Protection Officer, as we are not legally required to. You can reach us about any privacy matter at akilsherif@yahoo.com.
2What data we collect
Account data
- Email address and password (password is stored only in encrypted/hashed form).
- If you sign in with Google: your name and email address as provided by Google.
Profile data (from onboarding)
- The name you want the tutor to use.
- Why you are learning Norwegian, your self-reported level, your occupation, your interests, and (optionally) your native language.
Conversation data — this is the sensitive part
- Your voice. When you have a conversation, your microphone audio is streamed in real time to our AI voice provider (Microsoft Azure AI Services) to power the spoken conversation.
- Transcripts. Your spoken words are transcribed to text. We store these transcripts so we can generate corrections and track your progress.
- Corrections. The specific errors and suggested improvements our system produces from your transcripts.
- Session summaries. A short, automatically generated one-line summary of each conversation’s topic, so the tutor can remember what you discussed previously.
Your transcripts may contain whatever you choose to say. If you talk about topics such as your health, beliefs, or background, that information will be present in the transcript. Please keep this in mind during conversations.
Technical data
- Basic error and performance diagnostics (via Sentry) to keep the app working. We have configured this specifically so that your conversation content is not included in error reports.
We do not collect: your contacts, your location, advertising identifiers, or any data unrelated to language learning.
3How your voice is handled
- Your audio is streamed from your device directly to our AI voice provider (Microsoft Azure AI Services) over an encrypted connection. Our own servers are not in the audio path — our backend only issues the short-lived access token that lets your device open that connection; it does not receive, relay, or store the raw audio.
- The provider transcribes your speech to text and generates the tutor’s spoken replies. We receive the text transcript, which we store to produce corrections and progress.
- We do not use your voice to identify or authenticate you, and we do not create voiceprints. Your audio is processed only to enable real-time conversation, transcription, corrections, and progress tracking.
- We do not sell your voice or transcripts, and we do not use them for advertising.
4Why we process your data (legal basis)
We only process your data where we have a lawful basis under GDPR Art. 6:
| What we process | Purpose | Legal basis |
|---|---|---|
| Account creation, login, core app use | Give you an account and let you use Flyt | Contract — Art. 6(1)(b) |
| Voice streaming for a live lesson | Power the real-time conversation | Contract — Art. 6(1)(b) |
| Transcripts, corrections, summaries | Produce corrections and track your progress | Contract — Art. 6(1)(b) |
| Account security, fraud prevention, diagnostics | Keep the service secure and working | Legitimate interests — Art. 6(1)(f) |
| Meeting legal obligations | Comply with laws that apply to us | Legal obligation — Art. 6(1)(c) |
On special-category data. Recorded speech is only treated as special-category biometric data under GDPR Art. 9 where it is processed for the purpose of uniquely identifying a person. Flyt does not do this — we do not create voiceprints or identify you by voice (see §3). Separately, if you choose to disclose sensitive information (for example about health or beliefs) during a conversation, that content may appear in your transcript; we do not seek it out or use it for any purpose beyond providing the service.
Where any processing ever relies on your consent, you have the right to withdraw that consent at any time, without affecting processing already carried out.
5Who we share data with (sub-processors)
We share data only with the service providers that make Flyt work. Each acts as our processor, on our instructions, under a data-processing agreement:
| Processor | What it handles | Where |
|---|---|---|
| Microsoft Azure AI Services | Voice and text processing that powers the conversation and corrections | West Europe (EU) |
| Railway | Hosts our database and backend | European Union |
| Sentry | Error diagnostics (configured to exclude conversation content) | European Union |
We do not sell your data to anyone, and we do not share it for advertising.
International transfers. All of our processors store and process your data within the EU/EEA. In particular, Microsoft Azure AI Services processes and stores your voice and transcript data within the EU Data Boundary — meaning this data is processed and stored exclusively within the European Union. Because your data is handled within the EU/EEA, it is not routinely transferred outside the region. Microsoft is part of a US-headquartered group; to the extent any limited processing could ever occur outside the EEA (for example, technical support), Microsoft’s Standard Contractual Clauses and EU–US Data Privacy Framework commitments apply.
6Where your data is stored
Our database and backend are hosted with Railway in the European Union. Voice and text processing by our AI provider takes place in Microsoft Azure’s West Europe region, under Microsoft’s EU Data Boundary, so your voice data is processed and stored exclusively within the European Union.
7How long we keep it
- Account and profile data: kept for as long as you have an account.
- Conversations, transcripts, corrections, and summaries: kept while your account is active, so we can provide progress tracking and personalised learning. If your account is inactive for 24 months, we may delete or anonymise this data.
- When you delete your account: we erase your account, profile, transcripts, corrections, and summaries from our active systems. Any residual copies in encrypted backups are overwritten in the ordinary course of our backup rotation, after which they are gone.
We do not keep personal data in identifiable form for longer than we need it for the purposes above.
8How we protect your data
- Encrypted connections (HTTPS/TLS) for all data in transit.
- Your login tokens are stored in your device’s secure storage (iOS Keychain / Android Keystore).
- Passwords are hashed, never stored in readable form.
- Access to production data is restricted to those who need it to operate the service.
9Your rights
Under GDPR you have the right to:
- Access / export your data — in the app: Settings → “Last ned dataene mine”, which gives you a complete copy of your data in a readable file.
- Delete your data (“right to be forgotten”) — in the app: Settings → “Slett kontoen min og alle data”. This erases your account and associated data from our active systems immediately; backup copies are overwritten on our ordinary backup rotation.
- Rectify inaccurate data — you can edit your profile in the app, or contact us.
- Object to or restrict certain processing.
- Data portability — receive the data you provided in a machine-readable format.
- Withdraw consent where processing is based on consent, at any time.
- Lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) if you believe we have mishandled your data.
To exercise any right not available in the app, contact us at akilsherif@yahoo.com.
10Is providing your data required?
To use Flyt’s core features you must provide account data (email, password) and, for lessons, your voice and the resulting transcripts — without these we cannot hold a conversation, produce corrections, or track progress, so the service will not function. Profile fields such as your native language are optional and only make the tutor more relevant; leaving them out does not stop you using the app.
11Automated processing and profiling
Flyt analyses your speech to generate corrections and to build a picture of your recurring mistakes and progress. In GDPR terms this can be a form of profiling, but it is used solely to teach you Norwegian. It does not produce any legal effect or similarly significant effect on you, and we do not make solely automated decisions about you under GDPR Art. 22.
12Children
Flyt is intended for users aged 13 and over. We do not knowingly collect personal data from children under 13. If we learn that a child under 13 has used Flyt without parental consent, we will delete the account and associated data. Because voice conversations may include sensitive information, Flyt is not intended for children under 18 without appropriate parental or guardian involvement.
13Changes to this policy
We may update this policy. We will notify you of material changes in the app or by email, and update the “Last updated” date above.
14Contact
Questions about your data or this policy: akilsherif@yahoo.com