In short
- We keep your account, your answers and your scores. We do not sell your data and we do not use it for advertising.
- When you create an account (with email, Google or Facebook), we save the time you accepted the terms and the version you accepted.
- When you use AI features, we send your text to OpenAI, not your name or email. OpenAI’s own rules for keeping data then apply. We cannot delete the data there.
- Other learners can see your leaderboard name, XP, streak and country. You can hide yourself in Settings.
- You can download your data or delete your account in Settings.
- Backups are replaced step by step, so deleted data can stay in a backup for a limited time.
This is a short summary. The rest of this page applies, and it has more detail.
Who is responsible
NOVALA STUDIOS AS (organisation number 938261598), which runs Blabalot, is responsible for the personal data described here (the “data controller”). The privacy contact and the person who handles requests is Devon Williams, the owner of the company. You can reach the privacy contact at support@blabalot.com or through the support page. We answer requests within one month.
Our address is NOVALA STUDIOS AS, Oscars gate 54, 0258 Oslo, Norway.
No Data Protection Officer (DPO) has been appointed. The owner acts as the privacy contact.
This is a draft privacy policy for a pilot with invited testers. It is not legal advice, it has not been reviewed by a lawyer, and the Norwegian text is AI-drafted and awaiting review by a native speaker.
What we collect
We collect and use information needed to provide, secure, and improve Blabalot. We do not sell personal data.
- Account data: username, public ID, email or phone when provided, optional country and display name, and a password stored only as a salted hash.
- Google or Facebook sign-in (if you use it): the provider ID and email. The name is used to suggest a username and is saved as your display name if you have none. The picture is used only to show it to you.
- Terms acceptance (new accounts): the time you accepted the terms and the version you accepted (email, Google or Facebook sign-up). Accounts created before this was recorded have no such record.
- Google sign-in on an existing password account: if the email address already belongs to a password account, we connect Google to that account and switch off its old password. You can set a new password later with Forgot password.
- Learning data: language and level settings, saved words, answers, scores, XP, streaks, achievements, and practice history. We also keep a session copy of what you typed in the current session so you can continue.
- AI conversation data: messages, session settings, generated replies, feedback, corrections, and usage counters (tokens and cost) needed to provide and resume a conversation.
- Leaderboard and community data: your leaderboard choices, friend and group links, and subscription status where those features are used. Other learners can see your leaderboard name (a custom name or your username), XP, streak and country on leaderboards unless you switch this off in Settings.
- Support and sign-up messages: the name, email and message you send through the support form or the early-access form.
- Security and operations data: sign-in and session tokens, password-reset requests (with the IP address and browser details), consent events (type, version, whether it was given, and time) if an app or client records them through our API (the website itself records none yet), a staff audit log of actions on accounts, technical events with a username or IP address in the server logs, and anonymous game-usage events.
Authorised Blabalot staff may open a saved AI conversation to investigate a problem or a support request, and each time they do it is recorded.
Each time your browser contacts our site, that request gets a reference code (normally random). We store it with entries in the staff audit log and with AI usage records so that a fault can be traced, and we keep it for as long as those records are kept. It also appears in our server logs.
Why we use it
We need a reason the law accepts (a legal basis) for each use of your data. These are proposed for the pilot:
- Account, learning features and AI conversation: to provide the service you asked for (contract, GDPR Article 6(1)(b)).
- Security, abuse prevention, fixing faults, backups and uptime monitoring: to keep the service safe and reliable (a good reason of our own that does not override your rights: legitimate interests, Article 6(1)(f)).
- Leaderboards: to make learning more motivating (legitimate interests). You can hide yourself in Settings > “Privacy & data”.
- Answering your messages: to reply to your question (contract or legitimate interests).
- Early-access sign-up and optional notification choices: your consent (Article 6(1)(a)). You can withdraw it at any time.
- Legal requirements: for example bookkeeping rules if payments are used in future (legal obligation).
We do not use your data for advertising, and we do not make automated decisions with legal effect about you. The difficulty of exercises may adapt to your answers.
Pronunciation recordings
When pronunciation assessment is available and you choose to submit a recording, it is sent to Azure Speech for pronunciation assessment and then discarded. Blabalot keeps the audio in memory only for that request. Pronunciation assessment is not switched on in the pilot.
We store scores and minimal provider and usage metadata, not the audio or recognised transcript. Your browser also removes its local recording after a completed assessment.
AI features
- When you use AI conversation, feedback or voice features, the text of your messages (with the level and scenario) is sent to OpenAI, which creates the reply, feedback and speech. We do not include your username or email address in these requests.
- Voice input uses the speech recognition built into your browser. Your browser may send the sound of your voice to its maker (for example Google for Chrome or Microsoft for Edge) to turn it into text. Their own terms apply. The sound does not pass through Blabalot’s server. Blabalot gets only the text. In AI Conversation we save it as a message until you delete your account. In every case we send it to OpenAI to write the reply or check your answer.
- To make replies fit you, the request to OpenAI can also include short notes from your earlier conversations, words you are practising and mistakes you often make.
- Text you enter in Translate is sent to OpenAI to be translated.
- When Blabalot reads text aloud, the text is sent to OpenAI, which returns the audio. Clips of the words, sentences and passages the app reads aloud are saved on our server and reused for all learners. They are not linked to your account and are not removed when you delete it. Voice in AI conversations is not saved.
- If live voice mode is switched on, the sound from your microphone is sent directly from your browser to OpenAI. It is switched off in the pilot.
- Replies, corrections, translations and some learning content are created or drafted by AI and may contain mistakes, including in Norwegian. Some content is still waiting for review by a native speaker. Blabalot is a practice aid and does not replace a teacher.
- Do not enter sensitive information, such as health details, in AI conversations.
- Text already sent to OpenAI follows OpenAI’s own rules for how long data is kept. We cannot delete it at OpenAI, and deleting your Blabalot account does not remove it there.
Who receives data
We use these providers and recipients:
- Render: hosting and storage of our database and backups. Blabalot runs on servers operated by Render in Oregon, USA (US West). Render delivers the site through the Cloudflare network, which sees requests including your IP address.
- OpenAI: the AI features, as described above.
- Google and Facebook: only if you choose to sign in with them.
- Email provider (SMTP): sends password-reset emails and support-form emails.
- UptimeRobot: checks that the site is up. It checks only public health addresses and receives no learner data.
- PayPal and Azure Speech: only if payments or pronunciation assessment are switched on. Neither is active in the pilot.
Our staff can access data when needed for support and security. We may disclose information if the law requires it.
Our main database is stored in the United States, outside the EEA, so your data is transferred there. Some other providers may also process data outside the EEA. We have not yet confirmed which transfer safeguards each provider uses. Ask us through support if you want details.
How long we keep data
- Account, learning and AI conversation data: kept until you delete your account. Our rule is to delete accounts that have been inactive for 24 months, and to warn you first by email where we have an address. By inactive we mean that you have not signed in. We have not built the tool for this yet, so it does not happen automatically; until it does, your account stays until you delete it or ask us to.
- Session copies: deleted 7 days after last use, and when you log out or delete your account.
- Sign-in: access tokens are valid for 30 minutes and refresh tokens for up to 30 days unless you log out.
- Password reset: the link is valid for 30 minutes. The request details, including the IP address, are removed automatically after the link has expired.
- Backups: taken nightly. The three latest nightly copies and copies the owner may keep for up to about six months are stored. Older nightly copies are overwritten and the owner’s own copies are then deleted.
- Terms acceptance (new account): the time and version are stored with the account and deleted when the account is deleted.
- Data already sent to OpenAI: kept under OpenAI’s own rules. We cannot delete it there.
- Saved speech clips (read-aloud): kept on our server until the storage for clips is full and older clips are replaced. They are not linked to your account.
- Abuse-protection counters (IP address): held only in server memory for up to one hour.
- Staff audit log: no fixed period; it is kept until we remove it, and we may delete old entries to save space.
- Early-access sign-ups: deleted after launch.
- Support messages and anonymous usage events: no automatic period; we keep them until we delete them. You can ask us to delete them.
- Server logs at our hosting provider: Render keeps server logs for a period that depends on our Render plan. We have not set our own period and have not yet confirmed how long it is.
Cookies and storage
We use one essential cookie (“session”) to keep you signed in and to protect forms against forgery. It is set as HttpOnly and SameSite=Lax, and as Secure on the live site.
Your browser’s storage on your device holds small items for features such as sound cues and the microphone setting. They do not leave your device.
We do not set advertising or analytics cookies ourselves, so we show no cookie consent banner. Our hosting and network providers may set their own cookies; we set one essential cookie called session. Scripts from Google, Facebook or PayPal may also set their own cookies. The scripts from Google, Facebook and PayPal load only when you choose their sign-in or payment.
Security
- Encrypted connections (HTTPS) and secure cookies on the live site.
- Passwords are stored only as a salted hash, never as readable text.
- Form protection against forgery, limits on sign-in and reset attempts, and a temporary lockout after repeated failures.
- Staff sign-in needs a one-time code by email, and access to saved conversations is recorded.
- No secret keys in the source code.
No service is completely risk-free. If a breach that could affect you occurs, we follow the notification rules in data protection law.
Your choices and rights
You can update profile and leaderboard choices, request a full account export, or permanently delete your account and user-linked learning data from your settings. Public deletion instructions are also available on the data deletion page.
- Access and portability (see and take your data): download a copy as JSON under Settings > “Privacy & data” > “Download my data”.
- Correction: change your username, country and leaderboard name yourself in Profile and Settings. Ask support to correct anything you cannot change yourself.
- Deletion (erasure): delete your account yourself, see “After you delete your account” below.
- Limit or object (restriction and objection): contact support. You can also hide yourself from leaderboards in Settings.
- Withdraw consent: change your notification choices in Settings, or contact support for the early-access sign-up.
We reply without undue delay and at the latest within one month. We may ask you to confirm who you are.
Complaints: You have the right to complain to Datatilsynet, the Norwegian Data Protection Authority: datatilsynet.no. You do not have to contact us first, but we would appreciate the chance to put things right.
For a privacy question or account request, contact support or write to support@blabalot.com.
After you delete your account
When you delete your account, your account, learning data, AI conversations, support messages linked to the account, sign-in tokens and saved sessions on every device are removed from the live service. Some things stay:
- Backups are overwritten on a rolling basis (the three latest nightly copies and copies the owner may keep for up to about six months are kept), so your data may remain in a backup for a limited time. A copy of your data that you downloaded from Settings is yours to delete.
- Staff audit-log entries about actions on your account may contain a username, email or IP address, and are kept until we remove them.
- Text already sent to OpenAI for AI features follows OpenAI’s own rules for how long data is kept. We cannot delete it there.
- Saved speech clips for read-aloud are shared by all learners and not linked to your account, so they are not removed.
- Operational logs at our hosting provider may contain a username and IP address for a limited time.
- Sign-ups and support messages sent while you were signed out are not linked to your account. Ask support to delete them.
- Payment records, if payments are used in future. There are no payments in the pilot.
- Emails you sent to support stay in the support mailbox until we delete them.