Privacy Policy

Toey ("we", "our", "us") operates the website www.toey.app, an AI-powered English test-prep platform for TOEIC, IELTS & Speaking. This Privacy Policy explains how we collect, use, store, and share your personal information — including any Google user data we receive when you sign in with Google — when you use our service.

1. Information We Collect

Account Information

• Email address (required for account creation)
• Full name (optional, for profile personalization)
• Authentication data via Google Sign-In or email/password

Google Sign-In Data

When you choose "Sign in with Google", Google's Identity Services share the following data with us, scoped to the standard openid, email, and profile scopes:

• Your Google account email address
• Your full name and (optionally) profile picture URL
• Your Google account ID (the OpenID Connect sub claim)

We use this Google user data only to:

• Authenticate you and create or sign you into your Toey account
• Display your name and avatar inside the app
• Send you transactional emails you have requested (e.g., study reminders, receipts)

We do notsell or transfer Google user data to third parties, use it for advertising, use it to train AI/ML models, or allow humans to read it except (a) with your explicit consent, (b) for security purposes (e.g., investigating abuse), or (c) to comply with applicable law. See section 11 ("Limited Use") below for our compliance statement under Google's API Services User Data Policy.

Usage Data

• Exercise answers, scores, and completion status
• Study streaks, XP points, and daily progress
• Mock test results and performance analytics
• AI coach conversation history
• Writing submissions and voice recordings you make for speaking practice, pronunciation feedback, or the AI voice tutor (stored to show you your history and processed by our AI providers for transcription and grading — see section 9)

Payment Information

• Payment details are processed directly by Stripe. We do not store credit card numbers, CVVs, or full card details on our servers.
• We store your Stripe customer ID and subscription status.

Technical Data

• Browser type, device type, operating system
• IP address (anonymized for analytics)
• Pages visited and time spent

2. How We Use Your Information

• Provide and improve the learning experience (TOEIC, IELTS & Speaking)
• Track your study progress, streaks, and goals
• Generate AI-powered explanations tailored to your answers
• Process subscription payments and manage your account
• Send optional study reminders and weekly progress summaries (you can opt out)
• Analyze aggregate usage patterns to improve the platform

3. Data Sharing

We do not sell your personal data. We share data only with:

• Google — Google Identity Services for Sign-In; Google Generative Language API (Gemini) for AI explanations, coaching, and grading (see section 9)
• Supabase — database hosting and authentication
• Stripe — payment processing
• OpenAI — AI text generation (as an alternative provider to Gemini), speech transcription, and the realtime AI voice tutor (see section 9)
• Vercel — website hosting
• Cloudflare R2 — file storage (e.g., audio files)
• AWS Simple Email Service (us-east-1) — transactional emails (reminders, receipts, payment confirmations)
• Meta (Facebook) — advertising measurement via the Meta Pixel and Conversions API (see section 6). When measuring a sign-up conversion we send Meta a SHA-256 hash of your email (never the raw address), plus standard event data (IP address, user agent, page URL). We do not share your study data with Meta.

4. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days. Anonymized, aggregated analytics data may be retained indefinitely.

5. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your account and associated data
• Export your study data
• Opt out of marketing emails

To exercise these rights, contact us at privacy@toey.app.

6. Cookies and Advertising Measurement

We use essential cookies for authentication, session management, and preferences (e.g., language). We use analytics cookies (anonymized) to understand usage patterns.

We also use the Meta Pixel to measure the effectiveness of our advertising. The pixel sets Meta cookies (_fbp, _fbc) and reports page views and sign-up conversions to Meta. You can limit this tracking via your browser's cookie settings, browser extensions that block trackers, or your Meta ad preferences. We do not use any other third-party advertising cookies.

7. Children's Privacy

Toey is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us.

8. Security

We use industry-standard security measures including HTTPS encryption, secure authentication via Supabase Auth, Row Level Security (RLS) on all database tables, and encrypted payment processing via Stripe.

9. AI Processing (Gemini / OpenAI)

Our AI features — exercise explanations, the Toey chat coach, the AI voice tutor, and AI grading of your writing and speaking practice — are powered by Google's Gemini API (currently the Gemini 2.5 family) and OpenAI's APIs (text models, speech transcription, and the realtime voice API for the voice tutor). Which provider is used depends on the feature and a server-side setting; all are treated identically for privacy purposes.

• What is sent to the AI provider: the learning content needed for the feature — e.g., the exercise question and your answer for explanations, your chat messages for the coach, your essay text for writing feedback, and your voice recordings for speaking grading and the voice tutor. No account identifiers (no email, name, user ID, or Google account ID) are included in prompts.
• Model training: we use the paid Gemini and OpenAI APIs whose terms state that content sent via the API is not used to train the underlying AI models.
• Caching:generated explanations are stored in our database keyed by question and answer choice so we don't re-call the AI provider for the same scenario. This reduces cost and latency.
• Quotas: AI usage is subject to daily and monthly allowances that vary by plan and program (daily allowances reset at midnight, Asia/Ho Chi Minh time). Current allowances are shown in the app.
• Opt-out: AI features are opt-in per use — they only run when you tap an AI button, send a chat message, or submit a recording for grading. Static explanations remain available for exercises without involving any AI provider.

10. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the service after changes constitutes acceptance of the updated policy.

11. Google API Services User Data Policy (Limited Use)

Toey's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we affirm that Google user data received via Google Sign-In or any Google API is:

• Used only to provide and improve user-facing features of Toey that are prominent in the application's user interface
• Not transferred to third parties except as necessary to provide or improve those user-facing features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with prior user notice
• Not used or transferred for serving advertisements, including retargeted, personalized, or interest-based advertising
• Not used to train, fine-tune, or otherwise improve generalized or non-personalized AI/ML models
• Not read by humans unless we have obtained your affirmative consent for specific messages, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or for internal operations where the data has been de-identified or aggregated

12. Contact

For privacy-related questions or requests, contact:

• Email: privacy@toey.app
• Phone: 080-2566-2538