Privacy Policy

EngoNow Listen & Speak (“the Service”) is an English and Chinese listening and pronunciation practice platform operated by EngoNow. This policy explains what personal data we collect, why, who it is shared with, and what rights you have.

For any privacy question or request, email maximumz160@gmail.com.

1. Who this is for

The Service is used by students, teachers and teaching assistants at centres that work with EngoNow. Many of our users are school-age students. If you are under 16, please read this with a parent or guardian — see section 9.

2. What we collect

2.1 Account information

• Email address — from you, or from your Google account
• Display name — shown on your profile and leaderboards
• Profile photo — uploaded by you, or from your Google account
• Password — only if you register with email. We store a bcrypt hash and never see your actual password.

2.2 Learning data

This is the majority of what we hold:

• Exercises you open and how far through them you get
• Your typed answers to dictation and fill-in-the-blank questions
• Scores, accuracy, and which individual words were right or wrong
• Hints used and the resulting score adjustment
• Streaks, XP, achievements, league placement and leaderboard position
• Bookmarks, saved vocabulary and review schedules
• Comments you post on exercises

2.3 Class and role information

If you belong to a class we store your membership, your role, and which centre you belong to. Teachers and teaching assistants can see the learning data of students in their own classes, including answers and scores. This is the purpose of the Service and cannot be disabled while you are in a class.

2.4 Technical data

• IP address, used transiently for rate limiting. We do not keep browsing logs.
• Browser and device information, through Google Analytics
• Push notification details, only if you enable notifications
• Error reports, if the app fails while you are using it

2.5 Microphone and voice — please read this carefully

The pronunciation practice feature uses your microphone, and only while you actively start a recording.

We do not store your audio. In almost every recording the Service receives only the text transcript of what you said, never the sound itself, and keeps only that text.

However, the Service uses your browser’s built-in speech recognition. In Google Chrome and other Chromium-based browsers, this sends your audio to Google’s servers for processing. That transmission is between your browser and Google, governed by Google’s Privacy Policy, and we have no access to or control over it.

In one case your recording does leave your browser through EngoNow. When the browser’s speech recognition returns nothing — roughly one recording in forty, usually a technical glitch — the Service sends that single recording to Cloudflare’s Workers AI to transcribe it, so a broken recording does not cost you the exercise. The recording is used only to produce the transcript and is not stored by EngoNow or, per Cloudflare’s terms, retained by Cloudflare after processing. This only ever happens for a pronunciation recording that would otherwise have failed.

If you do not want your voice processed by Google or Cloudflare, do not use the pronunciation feature. Every other part of the Service works without it.

2.6 What we do not collect

• Payment or financial information — the Service does not take payments
• Your date of birth or age (see section 9)
• Precise location
• Audio or video recordings stored on our servers

3. Why we use it

• To provide the Service: show exercises, grade answers, track progress
• To let your teacher see your work, if you are in a class
• To operate leaderboards, streaks, leagues and achievements
• To send reminders you have asked for, and service messages
• To answer your questions through the in-app AI tutor
• To prevent abuse, through rate limiting

We do not sell your personal data, and we do not use it for advertising.

4. Who we share it with

• Google — sign-in, if you use Google. Provides us your email, name and photo.
• YouTube — exercise video is embedded from YouTube, which may set cookies and collect viewing data.
• Google Analytics — aggregate usage measurement.
• DeepSeek — when you ask the AI tutor a question, your question and the relevant exercise text are sent to DeepSeek to generate an answer. Do not put personal or sensitive information into tutor questions.
• Translation services (MyMemory, Lingva) — individual words or short phrases only. Never your identity or your answers.
• Upstash — rate limiting. Stores a short-lived key derived from your IP.
• Email delivery — reminder emails go through Gmail’s SMTP service.
• Google Fonts — receives your IP address when fonts load.
• Your teachers and administrators — see section 2.3.

We do not share your data with anyone else, except where required by law.

5. Where your data is stored

Your data is stored in Vietnam, on servers we operate ourselves. As of 2 August 2026 we no longer use overseas cloud database hosting for this Service. Some processors listed above are outside Vietnam and process the specific data described there on their own infrastructure.

6. How long we keep it

• Account and learning data — while your account is open
• Deleted accounts — 30-day grace period, then permanently purged
• Reminder emails in the send queue — 30 days
• Backups — 30 days, encrypted
• Rate-limiting keys — minutes

When you request deletion your account is deactivated immediately and permanently erased after 30 days. You can cancel during that window by contacting us.

7. Security

• All traffic uses HTTPS
• Passwords are stored as bcrypt hashes, never in plain text
• Database access is restricted per-user by row-level security
• Backups are encrypted before leaving the server, with the key held separately
• The database is not reachable from the public internet

No system is perfectly secure, and we cannot guarantee absolute security.

8. Your rights

• Access your data — Settings includes a data export
• Correct your profile information in Settings
• Delete your account in Settings, subject to the 30-day grace
• Object to notifications by turning them off in Settings
• Ask or complain — maximumz160@gmail.com

We aim to respond within 30 days.

9. Children’s data

The Service is used by school-age students, and we know some are under 16.

We currently do not ask for your age, and we do not have a parental consent process. In practice, accounts are usually created by, or at the direction of, a teacher or centre that already has a relationship with the student’s family.

We are aware this may not be sufficient under Vietnam’s Decree 13/2023, which requires verifiable parental consent for processing the personal data of children under 16. We are reviewing this and will update this policy and the Service accordingly.

If you are a parent or guardian and want to see, correct or delete your child’s data, email maximumz160@gmail.com and we will act on it.

10. Cookies

• Authentication — keeping you signed in. Required.
• Analytics — Google Analytics.
• YouTube — set by the embedded player when a video loads.

Blocking authentication cookies will prevent sign-in.

11. Changes

If we make a significant change we will notify you in the app. The date at the top always reflects the current version.

12. Contact

maximumz160@gmail.com