Privacy Policy

Version: 1.3 · Last Updated: 8 August 2026

1. Introduction

OralCat ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our web application and services.

We are based in Singapore and comply with the Personal Data Protection Act (PDPA) of Singapore.

Contact: privacy@oralcat.com

2. What Data We Collect

Data You Provide

• Transcribed speech text: When you record your speech, the audio is transcribed to text. The resulting text is sent to our AI service for analysis and feedback. The transcribed text is processed in real-time and is not stored by us after the analysis is returned.
• Voice recordings (signed-in users only): When you complete a practice session while signed in, the audio recording is stored privately so you can replay it in your Activity history. Recordings are stored in a private bucket accessible only to your account, and are automatically deleted 90 days after the session. Recordings are never made publicly available.
• Practice session metadata: When you complete a practice session while signed in, we record the topic, category, duration, score, and assessment framework used. We do not store the transcript of your speech.
• Donation information: If you choose to make a voluntary donation, payment processing is handled by Stripe. OralCat does not store your payment card information. We may receive limited transaction details such as your name, email address, donation amount, and transaction reference for accounting and customer support purposes.

Data Collected via Google Sign-In

Signing in with Google is optional. You may use OralCat without signing in.

If you choose to sign in with Google, we receive:

• Google Account ID (a unique identifier)
• Email address
• Display name
• Profile picture URL

This information is used to associate your practice history with your account and to personalise your experience. We only receive what Google makes available at the time of sign-in as part of the OAuth flow. You can revoke access at any time via your Google Account permissions page.

Data Collected Automatically

• Page visits: When you load any page on OralCat, a beacon is sent recording the page name, the timestamp of your visit, and (if you are signed in) a reference to your account. This data is used for aggregate analytics only — we count visitors and see which pages are most popular.
• Referrer information: The URL you came from, if any, is included with page visit data.

Data We Do Not Collect

• Audio recordings for users who are not signed in (speech is transcribed in real-time and the audio is not saved)
• Recordings are never sold, shared, or made public; signed-in users' recordings are stored privately and automatically deleted after 90 days
• Transcribed speech text (processed in real-time and not stored)
• Device identifiers or advertising identifiers
• Location data (GPS or network-based)
• Payment card information (handled by Stripe)
• Browsing history or usage data outside the app
• Cookies or tracking identifiers

3. How We Use Your Data

4. Third-Party Data Processing

Your transcribed speech text is sent to our servers and forwarded to third-party service providers for processing.

AI Analysis Providers:

• OpenAI (Whisper) — audio transcription. Audio is sent to OpenAI for speech-to-text processing and is not retained by OpenAI after transcription.
• DeepSeek — speech analysis and feedback generation. Transcribed text is sent to DeepSeek for grammar analysis and coaching feedback.

What is sent to AI providers: The audio recording of your speech (for transcription) and the plain text transcript (for analysis). No names, no device identifiers, no location.

What is not sent: Your name, email, account ID, or any other personal information.

When your data is processed by third-party AI service providers, it is shared only as necessary to deliver the requested features. Their handling of data is governed by their respective privacy policies and applicable agreements.

We may change AI providers in the future to improve the quality, security, or performance of the Service. Any material changes will be reflected in this Privacy Policy.

Infrastructure Providers:

• Supabase — database, hosting, and storage. Supabase stores your user profile (name, email, account ID), practice session metadata (topic, category, duration, score, framework), page visit data, and (for signed-in users only) practice audio recordings in a private storage bucket.
• Stripe — payment processing for voluntary donations. Stripe handles all payment card data. OralCat does not receive or store your payment card details.

We select service providers that implement appropriate security measures and take reasonable steps to work with trusted providers. However, we are not responsible for the availability, security, or practices of these third-party services.

5. International Transfers

Your speech transcript (during processing), session metadata, and (for signed-in users) practice recordings may be processed or stored outside Singapore by our service providers. We take reasonable steps to ensure that such transfers are protected through appropriate contractual and technical safeguards.

6. Children's Privacy

This app may be used by children, including students preparing for the PSLE English Oral examination who may be under 13 years of age.

• We do not knowingly collect personal information from children without parental consent.
• Children may use the app without signing in — all practice features are available without an account. No personal information is collected in this mode.
• If a child signs in with Google, we collect their name and email address as provided by Google. Parents who do not consent to this may request deletion at any time.
• If a child signs in with Google, their practice recordings are stored privately for up to 90 days and accessible only to their account, matching the same retention as adult users. Parents may request immediate deletion at any time via the contact below.
• Under the Singapore Personal Data Protection Act, consent for minors under 13 must be given by a parent or guardian.
• Parents and guardians are encouraged to supervise children's use of the Service.
• Parents who have questions about their child's use of this app, or wish to request deletion of their child's data, may contact us at privacy@oralcat.com.

7. Data Storage and Security

• On your device: Your user profile and practice history (dates only) are stored in your browser's local storage. You can clear this at any time via your browser settings.
• On our servers (Supabase): Your user profile (name, email, account ID), practice session metadata (topic, category, duration, score, framework), and page visit data are stored in our database.
• Speech transcription is processed in real-time. Transcribed text is not stored after the analysis is returned. For signed-in users, the practice audio recording is stored in a private, access-controlled bucket for up to 90 days and then automatically deleted; it is never publicly readable.
• We use HTTPS/TLS encryption for all data transmitted between your browser and our servers.
• Access to backend systems is restricted, and we implement reasonable technical and organisational measures to protect the information we process.

8. Data Retention

• Transcribed text is processed in real-time and not retained after the analysis result is returned.
• Practice session metadata, user profile data, and page visit data in Supabase are retained until you request deletion. We do not automatically delete data based on account inactivity.
• Voice recordings (signed-in users only) are retained for up to 90 days from the session and are automatically deleted once expired. Expired recordings are removed automatically when your Activity history is loaded or played back; no manual request is needed.
• Data on your device (localStorage) is retained until you clear it or uninstall the app.
• You can delete all data associated with your account at any time by contacting us at privacy@oralcat.com.

9. Your Rights Under PDPA (Singapore)

Under the Singapore Personal Data Protection Act, you have the right to:

• Access — Request information about what data we hold about you
• Correction — Request correction of inaccurate data
• Withdrawal of consent — Withdraw consent for data processing at any time
• Deletion — Request that we delete your personal data. We will comply within a reasonable timeframe unless we are required by law to retain it.

To exercise any of these rights, contact us at privacy@oralcat.com.

10. AI Accuracy Disclaimer

Although OralCat uses AI to provide language feedback, AI-generated suggestions may occasionally be inaccurate. Users should exercise their own judgement when relying on the feedback. See our Terms of Service for further details.

11. Data Breach Notification

In the event of a data breach that affects your personal information, we will notify affected users within a reasonable timeframe and, where required, the relevant authorities in accordance with applicable law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page, and the "Last Updated" date at the top will be revised.

13. Contact Us

For any questions, concerns, or data requests:

Privacy matters: privacy@oralcat.com

General support: support@oralcat.com