Privacy Policy

Introduction

Snappy Idioms ("we", "us", "our") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our Service.

We are the data controller responsible for your personal data. Our registered address is in the United Kingdom, and we comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Information We Collect

1.1 Information You Provide

When you create an account or use our Service, you provide:

• Account Information: Full name, email address, password (encrypted)
• Profile Information: Age group, profession, mother tongue, country of residence, telephone number
• Learning Preferences: Thinking style, preferred difficulty level, learning pace
• Payment Information: Processed securely through third-party payment providers (we do not store full credit card details)

1.2 Information Automatically Collected

When you use our Service, we automatically collect:

• Usage Data: Which idioms you study, practice scores, time spent, features used
• Device Information: Device type, operating system, browser type, IP address
• Analytics Data: Pages visited, navigation paths, session duration
• Cookies: See our Cookie Policy below

1.3 User-Generated Content

Content you create within the app:

• Custom mnemonics and memory tricks
• Practice sentences and notes
• Community contributions (if you choose to share)
• Messages to AI tutors (Barnaby, Molly, Arnold, Albert)

2. How We Use Your Information

We use your personal data for the following purposes:

2.1 Service Provision (Contractual Necessity)

• Creating and managing your account
• Delivering personalised learning content based on your thinking style
• Tracking your progress and achievements
• Processing payments for premium subscriptions
• Providing customer support

2.2 Service Improvement (Legitimate Interest)

• Analysing usage patterns to improve the Picture This™ methodology
• Testing new features and A/B testing
• Fixing bugs and improving performance
• Conducting educational research (using anonymised, aggregated data only)

2.3 Communication (Legitimate Interest & Consent)

• Sending you essential service updates and notifications
• Sending learning reminders and motivational messages (you can opt out)
• Marketing communications about new features (with your consent - you can unsubscribe anytime)

2.4 Legal Compliance

• Complying with legal obligations
• Preventing fraud and abuse
• Enforcing our Terms of Service

3. Data Sharing and Third Parties

We may share your data with:

3.1 Essential Service Providers

• Hosting Provider (Base44): Secure cloud hosting for the application
• Payment Processor (Stripe): Secure payment processing for premium subscriptions
• Email Service (Base44 Email): Transactional emails and notifications
• AI Services (OpenAI): Powering our AI tutors and feedback systems

All third-party providers are GDPR-compliant and bound by data processing agreements.

3.2 Analytics (Anonymised Only)

• Mixpanel: Usage analytics (anonymised and aggregated data only)
• We do NOT share identifiable personal information with analytics providers

3.3 Legal Requirements

We may disclose your information if required by law, court order, or to protect our legal rights.

4. Data Security

We implement robust security measures to protect your data:

• Encryption: All data is encrypted in transit (TLS/SSL) and at rest (AES-256)
• Password Security: Passwords are hashed using industry-standard algorithms
• Access Controls: Strict access controls limit who can view your data
• Regular Audits: Security audits and vulnerability assessments
• Secure Infrastructure: Hosted on secure, GDPR-compliant cloud servers

While we implement strong security measures, no system is 100% secure. We cannot guarantee absolute security.

5. Your Rights Under GDPR

You have the following rights regarding your personal data:

6. Data Retention

We retain your personal data for as long as necessary:

• Active Accounts: Data retained while your account is active
• Inactive Accounts: After 2 years of inactivity, we may delete your account and data
• After Account Deletion: Most data deleted within 90 days (some anonymised data may be retained for research)
• Legal Obligations: Some data retained for tax, legal, or regulatory requirements (up to 7 years)

7. Children's Privacy

8. Cookies and Tracking

We use cookies and similar technologies to:

• Essential Cookies: Required for the Service to function (e.g., authentication, security)
• Functionality Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand how you use the Service (anonymised)

You can control cookies through your browser settings, but disabling essential cookies may affect functionality.

9. International Data Transfers

Your data is primarily stored in the UK/EU. If we transfer data outside the UK/EU, we ensure:

• Transfers to countries with adequate data protection laws
• Use of Standard Contractual Clauses approved by the UK/EU
• Our third-party providers comply with GDPR requirements

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. For significant changes, we will notify you by email or prominent notice within the Service.

11. Contact Us & Complaints