Speech is recognised on your phone and the audio is never uploaded. An account stores your progress so it survives a reinstall. The exception worth knowing about is the free AI tutor, which runs on a shared provider tier that may use what you send it — section 5 explains how to avoid that.
Effective 12 September 2026Your voice never leaves your phone. We keep an account so your progress survives a reinstall, and almost nothing else. We do not sell personal data, we do not run advertising, and there is no ad tracking in the app.
The one thing worth reading properly is section 5 — the free AI tutor runs on someone else's infrastructure, and they may use what you send it.
Jisung Moon is the controller of the personal data described here, for the Nabi app (com.koreanlearning.nabi).
Questions, requests or complaints: tjmoon020@gmail.com.
Account identity. When you use Sign in with Apple or Sign in with Google, we receive a stable user identifier and an email address. We never receive your password. If you choose Apple's "Hide My Email", we only ever see the relay address, which is what we store.
Your display name, if Apple or Google provides one, or one you set yourself.
Learning progress. Lessons completed, stars, streak, daily-goal setting, review schedule, and the words you explicitly saved to review. This is the data the account exists to carry.
Pronunciation scores, if you leave that switched on in Settings → Privacy & data. These are numbers derived on your device from recognised text — not audio.
A profile picture, only if you choose one. Selecting it uses your photo library; the app reads the single image you pick and nothing else.
Basic technical data needed to run the service: app version, platform, and an App Check attestation token that tells our backend the request came from a genuine copy of the app rather than a script.
Recordings of your voice — we never receive them. Speech recognition runs on the device through the operating system, and the audio stays on the device: each attempt is written to the app's private cache so you can play it back and compare it with a native speaker, then overwritten by your next attempt and cleared when the app's cache is cleared. It is never uploaded, and only the recognised text is used by any feature.
Your contacts, calendar, precise location, or the rest of your photo library.
Advertising identifiers. There is no ad SDK and no cross-app tracking, so the app does not ask for tracking permission.
Product analytics are switched off by default. If you turn on "Anonymous usage analytics" in Settings, it covers aggregate feature usage only, and you can turn it back off at any time.
When you use a tutor conversation, the recognised text of what you said or typed is sent to Google (Gemini on Vertex AI), reached through our own server in order to generate a reply.
We do not store those conversations ourselves. Only words you deliberately save for review are written to your account.
The free tutor runs on a shared provider tier, and under that tier the provider may use the traffic to improve their models. We cannot switch that off on your behalf.
If you would rather it did not, open Settings → Use my own AI key and add your own provider key. The key stays on your device, requests go directly from your phone under your own provider account, and our servers never see the key or the traffic. Your agreement with that provider then applies.
Do not type anything into the tutor that you would not want processed by a third party — no identity documents, health details, passwords or payment information.
To perform our agreement with you: your account, your progress, and the features you actively use.
With your consent: optional pronunciation-score storage, optional analytics, and access to your photo library or microphone. Each is a separate choice and each can be withdrawn — in the app for the first two, in system Settings for the permissions.
For our legitimate interests: keeping the service secure and abuse-free, which is what App Check is for.
Google, as our infrastructure provider, through Firebase Authentication, Cloud Firestore, Cloud Storage and App Check. They process this data on our instructions in order to run the service.
Google (Gemini on Vertex AI), reached through our own server, for tutor replies, as described in section 5.
Apple or Google, as the identity provider you chose at sign-in. What they log about that sign-in is covered by their own privacy policies, not this one.
We do not sell personal data and we do not share it with advertisers or data brokers.
On Google's infrastructure, which may mean servers outside your country, including in the United States.
Where personal data leaves the UK or EEA, the transfer relies on the safeguards Google provides for its cloud services, such as Standard Contractual Clauses.
Account and progress data is kept for as long as your account exists.
Delete the account and the profile, progress, streak and review schedule go with it. This is deliberate and cannot be undone — there is no export afterwards, so use "Download my data" first if you want a copy.
Backups may retain copies for a short period after deletion before they are overwritten in the ordinary cycle.
Depending on where you live, you can ask for a copy of your data, correction of anything wrong, deletion, restriction of processing, or portability, and you can object to processing based on legitimate interests.
Access and deletion are available directly in the app under Settings → Privacy & data. For anything else, write to us at the address in section 2 and we will respond within the period the law allows.
If you are in the UK or EEA and you think we have handled your data badly, you can complain to your national data protection authority.
The app is not directed at children under 13, and we do not knowingly collect their personal data.
If you believe a child has created an account, contact us and we will delete it.
Traffic is encrypted in transit. Access to stored data is restricted by server-side security rules so that an account can only read and write its own records, and App Check rejects requests that do not come from a genuine build of the app.
No service is perfectly secure. If a breach affects your personal data and the law requires it, we will notify you and the relevant regulator.
If this policy changes materially, the effective date at the top changes and we will tell you in the app before the new version takes effect.