The short version: your practice data — progress, notes, saved phrases and voice recordings — is stored on your device. We never sell what you do, and we never profile you. Premium subscriptions and ads are both described below, before they are switched on: nothing is sold and no ad has been shown yet, and when ads do arrive they will be non-personalised, free-plan General English only, never during practice, and absent from Welding entirely (sections 5b and 7b). Some features do need the internet to work, and those send specific things off your device: your recordings go to a speech service to be transcribed and scored, and text you enter into Executive Polish goes to an AI service to be rewritten. Every one of them is listed in section 4. The camera, when you enable the Posture Coach, never leaves your device at all.
1. Data we store — on your device
The app stores the following locally in your browser/app storage (localStorage and IndexedDB) on your device:
- Your profile (first name, role, goal, practice slot) as entered by you
- Practice progress: completed sessions, scores, notes, saved phrases, vocabulary, clips
- Voice recordings you make, and the text transcripts generated from them
- Practice conversations: the text of what you and the practice character said, kept so you can pick a conversation up again
- Anything you type into the Résumé & LinkedIn coach in the Career Center
This is the only copy unless you turn on cloud sign-in (section 5) or the optional GitHub backup (section 6), or a feature in section 4 sends something out to do its job. Deleting the app or using Account → Reset everything permanently erases the local copy.
2. Microphone and your recordings
The microphone is used only when you tap record or start a speaking exercise. The recording itself is saved on your device — we never keep a copy.
However, to give you word-by-word feedback the app has to send the clip somewhere that can listen to it. When you are online, a recording is sent to our Cloudflare Worker, which passes it to OpenAI and returns the result:
- Transcription and word timings (OpenAI Whisper) — so the app knows which words you said and exactly when
- Pronunciation grading (an OpenAI audio model) — which listens to the clip to score how you said it
This happens automatically as part of speaking feedback and role-play; it is not a separate opt-in. Our Worker stores nothing: it holds no database and writes no logs of your audio or text — it forwards the request and returns the answer.
Workplace practice conversations work differently. There, the app uses the speech recognition built into your browser to turn what you say into text. On Chrome and on Android this is a Google service: your browser sends the audio to Google to be transcribed, under Google's privacy policy, not ours. In the iPhone app it is Apple's speech recognition in iOS: iOS handles the audio under Apple's privacy policy, and the app receives only the resulting text. We never receive that audio. The resulting text is then sent to our Worker and on to OpenAI so the character can reply. The same speech recognition also powers the app's quick word and pronunciation checks, and is what the app falls back to elsewhere when the Worker cannot be reached.
OpenAI does not use data sent through its API to train its models, and we have not opted in to any data-sharing programme. We also do not enable OpenAI's optional call logging, so your recordings and text are not kept in our OpenAI account. OpenAI retains API requests for up to 30 days for abuse monitoring and then deletes them.
3. Camera — Posture Coach (zero-capture)
The camera activates only when you enable the Posture Coach, and follows a strict zero-capture, local-loop design:
- Frames are analyzed on-device (Google MediaPipe running locally) and discarded immediately
- No video, image, or facial data is ever recorded, cached, stored, or transmitted
- Only ephemeral numeric posture coordinates exist while the coach runs; they are mathematically irreversible and cannot reconstruct your face
- Turning the coach off releases the camera completely
Unlike the microphone, the camera feed never leaves your device under any circumstances.
4. When data leaves your device
These are every case, and what is sent:
- Speaking feedback and role-play: your voice recording, to our Worker and on to OpenAI (see section 2)
- Workplace practice conversations: the audio of your turn, to your browser's speech recognition service — Google, on Chrome and Android (see section 2). The resulting text, together with the recent turns of that conversation, then goes to our Worker and on to OpenAI so the character can answer you. Because you are describing your own working life, this text will often contain things like your name, your experience and where you have worked
- Executive Polish, and the Résumé & LinkedIn coach: the text you type or dictate, to our Worker and on to OpenAI, which returns the rewritten versions. In the Résumé coach that text is your professional summary
- Natural voices: the text to be spoken, to our Worker and on to OpenAI. Choosing the device voice in Settings keeps this on your device instead
- YouTube: videos in the Shadowing Studio play via YouTube's embedded player, subject to YouTube's privacy policy
- Transcripts of YouTube videos you add: when a video you add has no transcript we can use, our Worker may ask Google's Gemini API to transcribe part of it so the Shadowing Studio can show its lines. What is sent is the video's YouTube address and the part to transcribe — never your voice and nothing about you
- Dictionary definitions: individual words you tap, looked up anonymously via the free Dictionary API
- Fonts and the on-device vision model: fetched from public CDNs
- Analytics: anonymous page counts only — see section 7
- Daily reminders on the website and in the Android app, if you switch them on: your browser's push address and the time of day you chose — see section 8. In the iPhone app reminders stay inside the app
None of these requests carry your account, except where section 8 says so for push notifications. Analytics, dictionary look-ups and fonts carry nothing about you at all. The three AI features above are the exception, and only because they cannot work otherwise: they carry whatever you chose to say or type, which in a practice conversation or a résumé summary may include your name and your work history. We do not sell data, and there are no social-media trackers in the app. Advertising is covered on its own in section 7b: it is not switched on, it will be non-personalised when it is, and it is never part of the requests listed above.
5. Optional cloud sign-in
Sign-in is optional and off unless you choose it. If you create an account with an email address and password, we use Google Firebase to authenticate you and to store a copy of your progress so it follows you between devices.
Account emails: the password-reset email, and a one-time welcome email when you create an account, are sent through Brevo, our email provider, from noreply@lomonec.com. Brevo receives your email address and, for the welcome email, the first name you entered; it delivers the message under its own terms.
What syncs: completed sessions, scores, notes, saved phrases, vocabulary, streak and activity dates, competency and achievement records, and a record of each practice conversation — when it happened, which scenario it was, and the scores it produced.
What does not: your voice recordings, the text of what you said in a practice conversation, anything the app extracted from that text, and whatever you typed into the Résumé coach. Those stay on this device. The cloud copy is filtered before it is sent, so your spoken words are not in it even though the app keeps them locally for you.
You can clear the stored text of your conversations at any time without losing your progress: Account → Delete saved conversations. You can delete the whole account and its stored copy at any time; see Delete your account.
5b. Purchases
BE Mastery sells nothing at present. There are no subscriptions or in-app purchases in the iPhone app, in the Android app or on the website, and we collect no payment or purchase information. If that changes, this section will say what is collected before anything is sold.
6. Optional GitHub backup
If you choose to connect your own private GitHub repository for backup, your progress and recordings are transmitted directly from your device to your repository using your own access token. Unlike the cloud copy in section 5, this is a full backup: it includes the conversation text that sync leaves behind, because the destination is your own private repository rather than ours. We never see this data or your token; the token is stored only on your device and is never included in exports.
7. Analytics
We use Cloudflare Web Analytics to count page views and see which sites link to us. It is privacy-first by design: it sets no cookies, does not fingerprint your device, and cannot follow you to other websites. We receive aggregate counts only — never an individual profile, and never anything you type, say, record or save. There is nothing here to opt out of because nothing identifies you.
We also count anonymous app actions so we can tell which parts of the app are used and where people stop: for example the app being opened, onboarding being finished, a session or lesson being completed, a feature being opened or used (such as the Shadowing Studio, the Challenge, Practice Partner, the AI coach, reminders and certificates), and the share, invite and rate buttons being tapped. These go to our own server, not to an analytics company, and they set no cookies either.
What is recorded is the name of the action, a few fixed details about it where they apply (such as the week or day number, or how it ended), and the country our network already sees from your connection. There is no device ID and no account link, so these counts cannot be joined together into a picture of one person — which also means we genuinely cannot tell you how many individual people are behind them. Nothing you type, say, record or save is ever included, and the server refuses any event that is not on that fixed list.
7b. Ads
Ads are not switched on. At the time of writing no advertisement has ever been shown in BE Mastery and no advertising partner has received anything from the app. The rest of this section describes what will happen when we do switch them on, so that it is written down before it affects you rather than after.
Where they will appear. On the free plan, in General English and in the game hubs of both programmes (English Mastery and Welding Mastery): at the foot of each hub page, between items on the longer pages, on a game’s results screen and, at most every four minutes, full screen after a game you have finished. Every other Welding page shows no ads. Premium removes ads completely. Ads never appear while you are recording, on a call, or in the middle of an activity.
What they will never interrupt. An ad is never shown while you are practising. It cannot appear while the microphone is live, while you are recording, while the app is speaking, during a practice-partner call, a simulation, a conversation or an Executive Polish analysis, while the app is waiting for AI feedback, or on top of feedback you have just been given. Ads wait for a natural break — you finishing something and moving on — and there is no banner pinned to the screen. There are no rewarded or sponsored ads.
Non-personalised only. Every ad request this app makes is marked non-personalised. We do not use your device’s advertising identifier (IDFA), we do not ask for permission to track you, and we do not build or buy an advertising profile of you. You will not see an “Allow this app to track you” prompt, because the app does not track you across other companies’ apps or websites.
Who serves them, and what they get. Ads will be served by Google AdMob (Google Ireland Limited). To fill an ad slot and to count it once, Google receives technical information from your device — for example a coarse location derived from your network address, your device type and operating-system version, and the fact that an ad was requested, shown or closed. It does not receive your name, your email address, your recordings, your transcripts, your saved phrases, your progress or anything you have typed. Google’s own handling of that data is described in its privacy terms and its partner list.
Your choice. Where the law requires one — the UK, the EEA and Switzerland — you will be shown Google’s own consent form before the first ad request, and you can change your answer later. If you refuse, or if the form cannot be shown, no ad is requested at all. You can also remove ads by subscribing to Premium (section 5b).
What we count ourselves. The anonymous counts in section 7 include whether an ad was eligible, shown, skipped or refused and why — fixed labels only, with no device ID and no link to your account. On the Welding programme they are recorded only inside the Welding Mastery game hub.
8. Daily reminders
Reminders are off unless you turn them on in Settings. In the iPhone app they appear inside the app only — at the time you chose if the app is open, otherwise the next time you open it — and nothing is sent to our server for them.
On the website and in the Android app, if you also allow notifications, your browser creates a push address for this app and we store it, together with the time of day you picked and a random device ID we generate. The same push address carries the Practice Partner alerts you switch on (learners online, invitations). The notification itself is sent empty — the wording you see is composed on your own device, which is also why it appears in your own language.
Link to your account: the push address is stored without your name, email or practice history. If you are signed in, however, the random device ID is part of your synced progress (section 5), and Practice Partner keeps it with your partner profile so that an invitation can wake this device. It is used for nothing else.
The one thing your device does tell us is that you have finished a session today, so that the evening reminder is not sent at all. We store the date and nothing else about what you did. Switching reminders off in Settings, signing out or deleting your account deletes the push address and the stored time; so does revoking notification permission or uninstalling the app, the next time a notification is attempted.
8b. Practice Partner (optional)
Practice Partner (General English only) pairs you with one other learner for a short practice session — four voice turns, two each — so you can practise speaking. It is optional and needs the free account. If you use it:
- What your partner sees: your first name, your level band and your interface language. Nothing else — no photo, no e-mail, no country.
- What leaves your device: each voice turn you choose to send, and its transcript. They are sent over an encrypted connection to a Cloudflare Worker operated by Lomonec LLC, stored in Cloudflare R2 and D1, and made available to that one partner only. Audio is never given a public address.
- Screening: transcripts are checked automatically for phone numbers, e-mail addresses, links and social-media handles before a turn is delivered. This is automatic screening, not human moderation.
- Retention: turns are deleted 14 days after a session ends (a session expires after 7 days at most). Your matching preferences (goals, mode, availability, time zone) and a record of who you practised with, chose to continue with, or declined are kept so that matching respects your choices; a log of safety actions is kept for 90 days. Reports and blocks are kept so that they keep protecting people.
- Optional gender: if you choose a same-gender partner we store the gender you tell us. It is used only for matching and is never shown to anyone.
- Matching: we suggest up to three learners at a time by level, lesson, goals, availability and time zone, and show you a plain reason. No score, no photo, no profile. Neither person is told why the other chose to continue or stop.
- Reports and blocks: you can report or block a partner at any time. Two reports from different people suspend an account from Practice Partner for 30 days. A block can be lifted only by the person who placed it (Change preferences → Blocked learners); lifting it is a fresh start, the other person is not told either way, and their own block, if they placed one, stands.
- Your history: the app keeps a record on your device of what you did in Practice Partner — your own turns with their transcript and score, how a session ended, your live calls (who, how long, how it ended), your AI-coach practice and the safety actions you took. Your partner's words are never kept. Scores and outcomes are included in the optional cloud copy (section 5); your transcripts are not. Clear my history on the History tab removes that record from the device and the backup, and deletes your own recordings of finished sessions from our server at once instead of after 14 days. Reports and blocks are kept.
- AI coach practice: when no partner is available, or a partner is silent, or you choose it, you can do the same four-turn practice with the AI coach. Your recordings go to our server for transcription and scoring exactly as above; the transcript is sent to the AI service to produce the coach's reply and is not kept by us beyond your device. The AI coach is always labelled as AI and is never presented as your partner.
- Live practice: two learners practising together — including in a first trial — can talk in real time. It is audio only. The call uses WebRTC: its audio travels directly between your two devices (peer to peer) where the networks allow it, and otherwise through Cloudflare's relay (TURN) service, encrypted either way. A direct connection means each device can learn the other's network (IP) address, as in any internet call. Our server only relays the connection set-up data and keeps the session's state (who, when, how long, how it ended) and the same report/block records. A live call runs in four timed rounds. During each round your device records your own microphone only — never your partner's voice — and sends that recording to our AI service to be transcribed. The recording is not stored on our servers. Your device then sends the transcripts of your own rounds to the Practice Partner server, which builds your private report from them and keeps that report for you alone; your partner never sees it. Your partner's device does the same for their voice. If you ask for "phrase help" during a call, only the task text is sent to the AI service.
- Age: Practice Partner is for learners aged 18 and over. You confirm this before using it.
To delete your Practice Partner data, delete your account in the app (Account → Delete account): that erases your partner profile, preferences, waiting-list entry, every voice turn you sent, your sessions, connections and live-call records at once. Reports and blocks that other learners placed about you are kept so that they keep protecting people; once your account is deleted they no longer lead to your name, email or profile. The safety log is dropped after 90 days. If you cannot open the app, see Delete your account or e-mail contact@lomonec.com from the address of your account.
9. Children
The app is intended for professionals and learners aged 13 and over.
10. Your rights & data deletion
Your local data is always yours to take or destroy: export it (Account → Export JSON), or erase it entirely (Account → Reset everything, or uninstall the app). If you want to remove only the text of your practice conversations and keep your progress, use Account → Delete saved conversations. The app also clears a practice conversation by itself once it is a week old. If you signed in, deleting your account also removes the synced copy — see Delete your account. If you never signed in, we hold nothing about you to begin with. For anything else, write to us at the address below.
11. Changes & contact
If this policy changes, the "Last updated" date above will change. Questions: contact@lomonec.com