Short Summary: We only collect what is needed for you to practice English speaking and sync your progress. We do not sell your data, do not permanently store audio on our servers, do not use tracking cookies, and you can request data deletion through admin.
1. Scope of Application
This privacy policy applies to the phanxa.com website (Reflex Speaking AI).
When you create an account or continue using the service, you confirm that you have read and agree to how we collect, use, and protect data as described in this document.
2. Data We Collect
Account data: email, display name, user ID, role — received when you log in via Google OAuth.
Practice data: questions, answers, audio recordings, transcripts, AI evaluation results, scores, skill analysis (pronunciation, vocabulary, grammar, fluency, confidence), session metadata.
Gamification data: XP, streak, level (A1–C2), achievements, daily points.
Technical data: login token, basic device and browser information, request timestamps, error logs, anti-abuse signals.
LLM data: token usage, request/response content (truncated, stored for 14 days), audio metadata (size, audio content not stored), latency.
Payment data: order ID, transaction status, amount, transfer description. We do NOT store full bank card information.
3. Google Login
When logging in via Google OAuth, we only receive the email, display name, and ID from your Google account.
We NEVER see or store your Google password.
Google's Privacy Policy: https://policies.google.com/privacy
4. Purpose of Data Usage
Provide and personalize the English speaking practice experience.
Sync learning progress across devices.
AI evaluation of your spoken answers (sending audio and text to the AI provider).
Generate question audio via TTS.
Account authentication, login session protection, spam prevention, and anomaly detection.
Premium plan management, manual payment processing, customer support.
LLM performance monitoring (14-day logs, automatically deleted).
Improve the product based on aggregated usage metrics.
We do NOT use your data for cross-application targeted advertising.
5. Third-Party Data Sharing
We only share data to the necessary extent with:
• Google (OAuth): email, name — for login only
• OpenCode AI: audio (base64), text, conversation history — for AI evaluation and translation
We do NOT sell personal data to any party.
Data may be provided to authorities in response to valid legal requests.
6. Storage and Security
Data is stored on a SQLite server with access controls, authentication tokens, role-based permissions, rate limiting, and security event logging.
Audio is temporarily stored in IndexedDB on the browser (client-side) and is NOT permanently stored on the server.
LLM logs: automatically deleted after 14 days (TTL) with a 5,000-line limit.
Daily points: auto-cleaned after 7 days.
Data is retained for as long as necessary to provide the service, resolve disputes, and comply with legal obligations.
No online system is completely secure — protect your devices and log out on shared computers.
7. Data Retention Period
Account information: until account deletion (via admin).
Practice sessions: unlimited (your learning history).
Recorded audio: temporary (IndexedDB on browser, session only).
LLM logs: 14 days, then automatically deleted.
Daily points: 7 days, then automatically deleted.
Transaction records: 10 years in accordance with Vietnamese accounting document storage regulations.
8. Your Rights
View and edit profile information (display name) directly in the application.
View complete practice history, scores, skill analysis, and achievements.
Request data export or deletion of personal data by contacting admin.
There is currently no self-service account deletion feature — please contact admin for assistance.
Some anonymized transaction records are retained for 10 years in accordance with Vietnamese accounting document storage regulations.
9. Children and Minors
The service is intended for users aged 13 and above due to AI and audio recording features.
If you are a parent and believe your child has provided personal data inappropriately, please contact us for assistance with deletion.
Users under 18 should have parental or teacher supervision when using the service.
10. Cookies and Browser Data
Cookies/localStorage are used for: login sessions, UI preferences, temporary data, return paths after login.
No tracking cookies, no advertising cookies, no third-party analytics tools.
Disabling cookies or blocking browser storage may prevent login, session sync, and some features from working correctly.
11. Compliance with Vietnamese Law
We comply with the Cybersecurity Law and personal data protection regulations of Vietnamese law.
Data is stored on servers within the appropriate legal jurisdiction.
Transaction records are retained for 10 years in accordance with accounting document storage regulations.
12. Policy Changes
We may update this policy from time to time. Significant changes will be notified on the website or in the application, along with the update date at the top of the page.
New versions take effect immediately upon publication on the website.