Legal

Privacy policy

The short version: we never hear you, we store as little as we can, analytics run without cookies, and you can export or delete everything yourself.

Last updated 5 September 2026

1. Who we are

Parlessa is operated by its founder (the legal entity and its country of registration are being finalised and will be named here before public launch; until then the responsible person is reachable at hello@parlessa.com). This policy covers parlessa.com, app.parlessa.com and the Parlessa apps for iOS and Android.

2. No microphone, no audio capture

Parlessa has no speech recognition and does not request microphone permission on any platform. Nothing you say during a lab is recorded, transmitted, or processed. If a future version adds local self-recording, it will be off by default, stay on your device, and be described here first.

3. What we store

  • An install id. A random identifier in your browser's local storage or the app's secure store, so your progress can be saved before you have an account and so analytics can count you once. It is not linked to a person until you sign in.
  • Your email address, if you give it, to sign you in with a magic link and to send the transactional emails listed below.
  • Progress: which labs you ran, when, at what pace, your self-ratings and flags, and the scheduler state for each structure. Synced to our server when you are signed in so it follows you across devices.
  • Settings: pace, show-text-after-answer, no-timer mode, reminder time, and your analytics and ad-sharing switches.
  • Billing: handled by Lemon Squeezy (web) or Apple and Google (apps). We store the entitlement (plan, status, expiry) and the merchant's order reference, never your card.
  • Support messages you send us, for as long as the conversation is open plus one year.

4. Analytics without cookies

We use PostHog to count events such as "drill started", "lab completed", "signed up" and page views, through a proxy on e.parlessa.com so that requests go to our own domain. Analytics persist in local storage, not cookies, which is why there is no cookie banner. Events carry the install id, the page path, the referrer and, on first visit, campaign parameters from the URL (utm_*, fbclid, ttclid, gclid, rdt_cid). Session recording is off. Do Not Track is respected. You can switch analytics off in settings; the switch is honoured on every device you are signed in on.

5. Ad-platform conversion sharing

When you arrive from an advertisement, the ad platform's click id is stored with your install id. If you then sign up, complete a lab, or buy, we may send that click id and the event name to the platform that showed you the ad (Meta, TikTok, Google or Reddit) from our server, so the platform can measure the ad. No audio, no progress, no email address is sent; where a platform requires an email it is hashed first. You can opt out in settings ("share conversions with ad platforms"), and visitors in the EU and UK are asked before it is switched on. This sharing is the only thing we do that resembles selling or sharing personal information under US state privacy laws, and the switch honours "do not sell or share".

6. Emails

Transactional only: the sign-in link, a welcome message, receipts, an optional daily reminder you switch on yourself, an optional weekly summary, a notice if we must delete an inactive account, and replies to your support messages. Every non-essential email carries a one-click unsubscribe. We do not sell or rent addresses and do not send newsletters from this list.

7. Who processes data for us

  • Cloudflare (hosting, storage, the API and the analytics proxy; US and EU data centres)
  • PostHog (product analytics; US cloud)
  • Resend (transactional email)
  • Lemon Squeezy (merchant of record for web purchases)
  • Apple and Google (app-store purchases), RevenueCat (store receipt validation)
  • ElevenLabs (voice generation for the recorded French; no learner data is involved)

8. Retention

Progress and settings are kept while your account exists. Analytics events are kept for 24 months, then aggregated. Accounts with no activity for 24 months receive a notice and are deleted 30 days later. Server logs are kept 30 days.

9. Your rights: export and deletion

From the account page you can download everything we hold about you as JSON, and delete your account, sessions and progress in one step; events are anonymised, and a confirmation email is sent. The same rights (access, rectification, erasure, portability, objection) apply under the GDPR, the UK GDPR, and US state laws such as the CCPA; write to hello@parlessa.com and we act within 30 days. You may complain to your local data-protection authority.

10. Age

Parlessa is for people aged 16 and over. We do not knowingly collect data from anyone younger; if you believe we have, tell us and we will delete it.

11. Changes

We will post changes here with a new date and, for anything material, email signed-in users first. The changelog lists every revision.