Privacy Policy

Effective date: 29 May 2026 Last updated: 13 August 2026

This Privacy Policy explains how Well Made Apps Limited, a New Zealand company (NZBN 9429053777782) ("we", "us", "our"), the operator of the Well Versed app, collects, uses, stores, and shares your personal information when you use the Well Versed voice-based language-practice app and website ("the Service").

We treat personal information in accordance with the Privacy Act 2020 and its thirteen Information Privacy Principles. If you'd like to read the plain-English overview of those principles, the Office of the Privacy Commissioner has a useful summary at https://privacy.org.nz/.

1. Information we collect

We collect three groups of personal information.

a. Account and profile information

What it is:

Your email address (collected at sign-up).
A display name you choose for the tutor to use.
A securely hashed copy of your password if you signed up with email. Stored by our authentication provider; we never see your plaintext password.
If you sign in with Apple or Google instead of email, we receive a verified identity token from that provider containing your email address (Apple may substitute a private relay address if you choose) and, where available, your name. We do not receive your Apple or Google password. Using these buttons shares your sign-in with Apple or Google as the identity provider.
The language you're learning, your self-assessed CEFR level, your preferred tutor for that language, and any tutor directives you've added in Settings.

Where it's collected: directly from you when you sign up or change Settings.

Why we collect it: to identify you across devices, send you account emails (verification, password reset), send you the occasional email about the Service itself (section 2, and one click unsubscribes you), and tailor the conversation to the language and level you're practising.

b. Conversation data

What it is:

The audio of your voice during a practice session, while the session is live. Audio is streamed in real time to our processing partners (see below) and is not stored by us after the session ends.
The transcribed text of what you said during the session, produced by our transcription partner and the conversation model.
The text of what the tutor said during the session.
Derived analytics generated by an automated analysis after each session: vocabulary you've used, grammar patterns you find difficult ("weak areas"), broad topics you've discussed, and a short list of personal facts you've mentioned to the tutor (e.g. "likes cricket"). These are stored to make future sessions adapt to you.

Where it's collected: from your microphone via the in-app session, with your explicit permission to use the microphone.

Why we collect it: the live audio is the conversation itself. The transcripts let you re-read your past conversations and let the tutor remember context. The derived analytics shape future sessions so the tutor doesn't keep repeating things you already know.

We do not sell, rent, or share your conversation data with anyone outside the processing chain described below. We do not use your conversations to train AI models that we sell or share, and the AI providers in our processing chain (listed below) have committed not to use your conversations or transcripts to train their own models.

We process the audio of your voice only to run the conversation and transcribe what you said. We do not use your voice to identify you, and we do not create voiceprints or other biometric identifiers from it.

Running the conversation means sending this data to third-party AI services. Section 3a sets out exactly which companies, what each one receives, and the permission we ask you for in the app before any of it is sent.

c. Location information

If you use Travel Mode, the app can use your device location to suggest a trip and tie your daily challenges to the city you're in.

Location is read only in the foreground: when you tap to use it, or (if you've granted "Allow While Using App") when you open the app. It is never read in the background.
The coarse GPS reading is reverse-geocoded to a city and country on your device. Your precise coordinates never leave your phone; only the resolved city and country names are sent to and stored on our server, and only while a trip is active.
Location is optional. If you deny the permission, Travel Mode still works. You just type your destination instead.

d. Practice reminders and device tokens

If you leave practice reminders on (you can turn them off in Settings, or in your device's system notification settings), we store a push notification token for each device you use, along with the device platform (iOS/Android) and its time zone. We use these to send your daily practice reminder at a sensible local hour and to stop sending to devices that are no longer registered. These reminders are about your own practice. We do not use push notifications for third-party advertising. Tokens are deleted when you turn reminders off, delete your account, or the device deregisters.

e. Technical and diagnostic data

What it is:

Device and app information: device type, operating system version, app version, screen size, and similar non-identifying technical context.
IP address at the time of each request to our server.
Logs of requests to our server (timestamp, route, HTTP status, duration, and a learner identifier).
Crash reports and error events sent to our error-tracking service when something goes wrong in the app or server. These can include a stack trace and the surrounding context of the error.
Aggregate website statistics for visits to our marketing website (wellversedlearning.com), collected without cookies and without any identifier that can follow you between sites or sessions. We see counts, not individuals: how many people viewed a page, and which site or search referred them. This applies to the website only; the mobile app contains no analytics or usage-tracking software.

Where it's collected: automatically when you use the app, and when you visit our marketing website.

Why we collect it: to keep the Service running, diagnose problems, understand how many people find our website, and defend against abuse.

2. How we use your information

We use the information described above to:

Provide the Service: let you sign in, run conversations, store your learner profile, and show you your session history.
Personalise the conversation: the tutor uses your profile, language, level, and recent topics to shape what it says next, so it doesn't repeat itself or pitch at the wrong level.
Improve the Service: diagnose bugs and crashes, understand which features are used, plan changes. This is done at an aggregate level using technical and diagnostic data; we don't single out individual conversations for analysis except where you've asked us to help with a problem.
Communicate with you about your account: for example, email verification at sign-up, password reset, or important changes to the Service or to this Privacy Policy.
Tell you about the Service: occasional emails about something worth knowing, such as a new feature, an improvement, or an offer on a subscription. Every one carries a one-click unsubscribe that we act on immediately, and unsubscribing never affects the account emails above.
Send practice reminders: a gentle daily nudge to come back and practise, which you can turn off at any time.
Power Travel Mode: use the city/country you're in (see 1c) to suggest a trip and shape your daily real-world challenges.
Protect the Service against fraud, abuse, and security incidents, for example by rate-limiting suspicious traffic.
Comply with NZ law, including legitimate requests from law-enforcement, where we're legally required to respond.

We do not use your information for advertising. We do not run ads, and we don't share data with advertising networks. Emailing you about Well Versed is not that: your address stays with us and our email provider (section 3), and no third party targets you because of it. We may use what we know about your use of the Service to judge whether an email is relevant to you. For instance, we might write to people who haven't started practising yet and not to people who already practise most days.

3. Who processes your information (sub-processors)

To run the Service we use a small set of external service providers. Each one only sees the information needed to do its job. None of them are authorised to use your information for their own purposes outside the agreement they have with us.

Provider	Role	Data they see	Where they process
Supabase, Inc.	Authentication, primary database, storage	Email, password hash, display name, profile, transcripts, derived analytics	Multi-region; we use a US-hosted project
Resend (Plus Five Five, Inc.)	Sending our email: both the account emails and the Service emails described in section 2	Your email address, and the contents of the message we send you	US
Apple Inc. / Google LLC (Sign in with Apple / Google)	Identity verification when you use those sign-in buttons	The identity token described in section 1a (email, and name where available)	US
Google LLC (Gemini Live API and Gemini Flash text models)	Live conversation processing and post-session analysis	Live audio of your voice during the session; conversation text; learner profile context	US
ElevenLabs Inc. (Scribe v2)	User-side transcription of your spoken turns	Per-turn audio of your voice during the session	US
Daily.co	Real-time WebRTC media transport between your device and our bot	Live audio of your voice during the session (in transit)	US-hosted media servers
Fly.io, Inc.	Server hosting	The server-side processing of any of the above	Sydney region
Expo (650 Industries, Inc.)	Push-notification delivery	Your device push token and the reminder title/body	US
Vercel, Inc.	Hosting for our marketing website (wellversedlearning.com), and cookieless visit counting for that site	Standard web-server request logs (including IP address) for visits to the marketing site, plus aggregate page-view counts	Global edge / US
Sentry	Crash and error reporting	Stack traces, error context, device info, IP address	EU or US, depending on routing
RevenueCat, Inc.	Subscription management	A pseudonymous account identifier and your purchase/subscription status	US

If you buy a subscription, payment is processed by Apple (App Store), and we never see or store your card details. Your purchase and subscription status are managed through our subscription provider (RevenueCat, Inc.). To keep your subscription in sync across your devices, we share a pseudonymous account identifier with RevenueCat when you sign in, whether or not you go on to purchase.

Because these providers operate in countries other than New Zealand, using the Service involves your personal information being processed outside New Zealand. We rely on each provider's published commitments (including, where applicable, the EU Standard Contractual Clauses, SOC 2, ISO 27001, and similar frameworks) as the safeguard for the overseas processing required by Information Privacy Principle 12.

If we add, change, or remove a sub-processor we'll update this list and note the change in the "Last updated" date.

3a. AI processing, and the permission we ask for

Some of the providers above are AI services, and the conversation itself cannot happen without them. Because that's a meaningful thing to agree to, we ask you directly rather than burying it here.

We ask for your permission in the app, before any of it happens. When you first set up your account, Well Versed shows you a screen naming each AI company, what it does, and exactly what it receives. Nothing is sent to any of them until you tap to agree. You can re-read that disclosure at any time in Settings → Your data → How your data is used, and a short reminder sits on the home screen where sessions start.

What is sent, and to whom

Who	What they do	What they receive
Google LLC (Gemini Live and Gemini Flash)	Runs the live conversation with your tutor, and reads the transcript afterwards to work out what to practise next	The audio of your voice while a session is live; the text of what you and your tutor said; your name, language, level, recent topics, and the patterns you find difficult
ElevenLabs Inc. (Scribe v2)	Transcribes your spoken turns so you can read your own side of the conversation	The audio of your voice while a session is live
Daily.co	Carries the audio between your device and our server. It is the connection, not a listener	The audio of your voice while a session is live, in transit

How it's collected

From your device's microphone, during a practice session you started, with your explicit microphone permission. Audio is streamed while the session is live and is not recorded by us outside a session.

What these providers may not do

Each of these providers is engaged as our processor under a written agreement that limits them to processing your data on our instructions and for the sole purpose of delivering the Service. Specifically:

They may not use your conversations, audio, or transcripts to train their own models.
They may not use your data for their own purposes, or for advertising.
They are bound to confidentiality and security obligations that provide the same or equal protection for your personal information as this Privacy Policy provides, and are subject to recognised security frameworks (SOC 2 / ISO 27001) and, where applicable, the EU Standard Contractual Clauses for overseas transfers.

We keep these commitments under review, and we won't add an AI provider that can't meet them.

If you'd rather not

Practising out loud is the whole of what Well Versed does, so there isn't a version of the app that works without this processing. If you'd prefer not to agree, don't tap to agree. And if you've already agreed and change your mind, deleting your account (Settings → Delete account) stops all of it and removes your conversations, transcripts, and profile from our systems.

4. How long we keep your information

Account and profile information is kept for as long as your account exists.
Conversation transcripts and derived analytics are kept for as long as your account exists, unless you delete individual sessions or your account. (We intend to introduce a configurable retention window for transcripts; until then "for as long as your account exists" is the operating default.)
Live audio is processed in real time and is not retained by us after the session ends. Our processing partners may retain audio briefly for their own operational reasons in line with their own privacy commitments.
Your trip city and country are kept only while a trip is active and are cleared when the trip ends.
Device push tokens are kept while reminders are on, and deleted when you turn reminders off, delete your account, or the device deregisters.
Technical logs and crash reports are kept for up to 90 days at the hosting and error-tracking layers, after which they are automatically rotated out.
Backups may persist for up to 30 days after deletion before being overwritten in the normal course of operation.

When you delete your account, we remove your account and profile information, your transcripts, your derived analytics, and your tutor directives from our active systems. We may keep limited records of the fact that an account was deleted for a short period for audit and security purposes.

5. Your rights

Under the Privacy Act 2020 you have the right to:

Access the personal information we hold about you.
Correct information you think is wrong.
Delete your account and the personal information attached to it, using the "Delete account" option in the in-app Settings screen.
Withdraw consent to non-essential processing, where we're relying on your consent, typically by deleting your account.
Unsubscribe from the Service emails described in section 2, using the link in any of them. Account emails (verification, password reset, changes to this policy) continue, because they're part of running your account.
Withdraw your agreement to AI processing (section 3a). Because that processing is what the Service is, withdrawing it means deleting your account; doing so stops the processing and removes your conversations, transcripts, and derived analytics.

If you can't do something via the in-app controls, or want a copy of the information we hold in a portable format, get in touch using the contact details below.

If you believe we've mishandled your personal information and we can't resolve the issue with you directly, you can complain to the Office of the Privacy Commissioner at https://privacy.org.nz/contact-us/.

6. Security

We protect your information using:

HTTPS / TLS for all traffic between the app and our server, and between our server and our sub-processors.
Encrypted storage at rest at the database and storage layers, managed by our hosting providers.
Authentication using industry-standard mechanisms (Supabase Auth), including password hashing with bcrypt-style algorithms; we never see or store your plaintext password.
Server-side authorisation using verified JSON Web Tokens. Every authenticated request is checked against your user identity before the server returns data, so one user can't access another user's records.
Operational controls on who can access production systems, limited to a very small number of people.

No system is perfectly secure. We can't guarantee that information transmitted to or stored by us is safe from all unauthorised access, but we work to apply industry-standard practices appropriate to the sensitivity of the data we hold.

If we discover a privacy breach that is likely to cause serious harm, we will notify you and the Office of the Privacy Commissioner as required under the Privacy Act 2020.

7. Children and younger users

Well Versed is not for users under 13. We don't knowingly collect personal information from anyone under 13, and we don't permit them to create accounts. If you become aware that a child under 13 has provided us with personal information, please contact us and we'll delete it.

The app is rated 13+ on the App Store. If you're between 13 and 18, we'd encourage you to talk to a parent or guardian before signing up, and certainly before subscribing. Two things worth them knowing: your spoken conversations are sent to the AI providers listed in section 3a in order to run the lesson, and the tutor is an AI that can occasionally get things wrong (section 9).

We don't build advertising profiles of anyone, and we don't treat users under 18 any differently in that respect. We don't do it at all.

8. Cookies and local storage

The mobile app doesn't use cookies. Your authentication token is held in the device's secure local storage and never leaves the device except to authenticate you to our server.

Our marketing website (wellversedlearning.com) is a static informational site. It doesn't sign you in, it doesn't set advertising or cross-site tracking cookies, and it doesn't load third-party scripts that profile you across the web.

The website does use a privacy-preserving analytics tool (Vercel Web Analytics, provided by the same company that hosts the site) to count visits. It sets no cookies and creates no identifier that can recognise you on a later visit or on any other site, so there is nothing to consent to and no banner to dismiss. It tells us how many people viewed a page and which site referred them, and nothing about who you are.

9. AI-generated content

Conversations with the tutor are generated by an AI system. AI can be wrong, can hallucinate facts, and can occasionally produce inappropriate output despite our safeguards. The Terms of Service explain this in more detail under "Important limits of the AI tutor". Don't rely on AI-generated content for anything that matters (health, legal, financial, immigration, or safety-critical decisions) without independently verifying it.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of the document shows when the policy was last changed. For material changes (for example, adding a new sub-processor, or changing what we collect), we'll notify you by email and/or an in-app notice with at least seven days' notice where reasonably possible.

11. Contact

If you have questions about this Privacy Policy, want to exercise any of the rights described above, or want to raise a privacy concern:

Privacy Officer, Well Made Apps Limited (Well Versed): contact@wellversedlearning.com