Privacy Policy

Version: 1.2 · Last Updated: 29 June 2026

1. Introduction

OralCat ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our web application and services.

We are based in Singapore and comply with the Personal Data Protection Act (PDPA) of Singapore.

Contact: [email protected]

2. What Data We Collect

Data You Provide

• Transcribed speech text: When you record your speech, the audio is transcribed to text. The resulting text is sent to our AI service for analysis and feedback. The transcribed text is processed in real-time and is not stored by us after the analysis is returned.
• Practice session metadata: When you complete a practice session while signed in, we record the topic, category, duration, score, and assessment framework used. We do not store the transcript of your speech.
• Donation information: If you choose to make a voluntary donation, payment processing is handled by Stripe. OralCat does not store your payment card information. We may receive limited transaction details such as your name, email address, donation amount, and transaction reference for accounting and customer support purposes.

Data Collected via Google Sign-In

Signing in with Google is optional. You may use OralCat without signing in.

If you choose to sign in with Google, we receive:

• Google Account ID (a unique identifier)
• Email address
• Display name
• Profile picture URL

This information is used to associate your practice history with your account and to personalise your experience. We only receive what Google makes available at the time of sign-in as part of the OAuth flow. You can revoke access at any time via your Google Account permissions page.

Data Collected Automatically

• Page visits: When you load any page on OralCat, a beacon is sent recording the page name, the timestamp of your visit, and (if you are signed in) a reference to your account. This data is used for aggregate analytics only — we count visitors and see which pages are most popular.
• Referrer information: The URL you came from, if any, is included with page visit data.

Data We Do Not Collect

• Audio recordings (speech is transcribed in real-time and the audio is never saved or transmitted after transcription)
• Transcribed speech text (processed in real-time and not stored)
• Device identifiers or advertising identifiers
• Location data (GPS or network-based)
• Payment card information (handled by Stripe)
• Browsing history or usage data outside the app
• Cookies or tracking identifiers

3. How We Use Your Data

4. Third-Party Data Processing

Your transcribed speech text is sent to our servers and forwarded to third-party service providers for processing.

AI Analysis Providers:

• OpenAI (Whisper) — audio transcription. Audio is sent to OpenAI for speech-to-text processing and is not retained by OpenAI after transcription.
• DeepSeek — speech analysis and feedback generation. Transcribed text is sent to DeepSeek for grammar analysis and coaching feedback.

What is sent to AI providers: Only the plain text transcript of your speech. No names, no device identifiers, no location, no audio.

What is not sent: Your name, email, account ID, or any other personal information.

When your data is processed by third-party AI service providers, it is shared only as necessary to deliver the requested features. Their handling of data is governed by their respective privacy policies and applicable agreements.

We may change AI providers in the future to improve the quality, security, or performance of the Service. Any material changes will be reflected in this Privacy Policy.

Infrastructure Providers:

• Supabase — database and hosting. Supabase stores your user profile (name, email, account ID), practice session metadata (topic, category, duration, score, framework), and page visit data.
• Stripe — payment processing for voluntary donations. Stripe handles all payment card data. OralCat does not receive or store your payment card details.

We select service providers that implement appropriate security measures and take reasonable steps to work with trusted providers. However, we are not responsible for the availability, security, or practices of these third-party services.

5. International Transfers

Your speech transcript (during processing) and session metadata may be processed or stored outside Singapore by our service providers. We take reasonable steps to ensure that such transfers are protected through appropriate contractual and technical safeguards.

6. Children's Privacy

This app may be used by children, including students preparing for the PSLE English Oral examination who may be under 13 years of age.

• We do not knowingly collect personal information from children without parental consent.
• Children may use the app without signing in — all practice features are available without an account. No personal information is collected in this mode.
• If a child signs in with Google, we collect their name and email address as provided by Google. Parents who do not consent to this may request deletion at any time.
• Under the Singapore Personal Data Protection Act, consent for minors under 13 must be given by a parent or guardian.
• Parents and guardians are encouraged to supervise children's use of the Service.
• Parents who have questions about their child's use of this app, or wish to request deletion of their child's data, may contact us at [email protected].

7. Data Storage and Security

• On your device: Your user profile and practice history (dates only) are stored in your browser's local storage. You can clear this at any time via your browser settings.
• On our servers (Supabase): Your user profile (name, email, account ID), practice session metadata (topic, category, duration, score, framework), and page visit data are stored in our database.
• Speech transcription is processed in real-time. Audio is not stored after transcription. Transcribed text is not stored after the analysis is returned.
• We use HTTPS/TLS encryption for all data transmitted between your browser and our servers.
• Access to backend systems is restricted, and we implement reasonable technical and organisational measures to protect the information we process.

8. Data Retention

• Transcribed text is processed in real-time and not retained after the analysis result is returned.
• Practice session metadata, user profile data, and page visit data in Supabase are retained until you request deletion. We do not automatically delete data based on account inactivity.
• Data on your device (localStorage) is retained until you clear it or uninstall the app.
• You can delete all data associated with your account at any time by contacting us at [email protected].

9. Your Rights Under PDPA (Singapore)

Under the Singapore Personal Data Protection Act, you have the right to:

• Access — Request information about what data we hold about you
• Correction — Request correction of inaccurate data
• Withdrawal of consent — Withdraw consent for data processing at any time
• Deletion — Request that we delete your personal data. We will comply within a reasonable timeframe unless we are required by law to retain it.

To exercise any of these rights, contact us at [email protected].

10. AI Accuracy Disclaimer

Although OralCat uses AI to provide language feedback, AI-generated suggestions may occasionally be inaccurate. Users should exercise their own judgement when relying on the feedback. See our Terms of Service for further details.

11. Data Breach Notification

In the event of a data breach that affects your personal information, we will notify affected users within a reasonable timeframe and, where required, the relevant authorities in accordance with applicable law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page, and the "Last Updated" date at the top will be revised.

13. Contact Us

For any questions, concerns, or data requests:

Privacy matters: [email protected]

General support: [email protected]