Privacy Policy
Who is responsible
Aedo is operated by José Luis Ponciano Bomfim, a natural person, in Talavera de la Reina, Toledo (45600), Spain. You can reach the person responsible for data protection at [email protected].
Scope
This policy covers the Aedo mobile app (Android on Google Play; iOS when available) and this website, aedo.club. Aedo has no advertising and no third-party advertising analytics in this version.
You can use much of the app offline without an account. If you sign in, create an account, subscribe, or use voice evaluation, the additional processing described below applies.
What data we handle
Account and identity (optional)
- Email address, used to sign in with a one-time code or magic link (no password).
- Profile display name and eu poético / heteronym name you choose.
- Session tokens stored on your device.
Processor: Supabase Auth and database (Supabase, Inc.).
Your poetry library and practice (when you sync or sign in)
- Poems you create or import that are marked as yours (title, author, language, text/verses).
- Decor practice progress (for example percent mastered, streak, score, cursor).
- Plan / Pro flag linked to your account when applicable.
Stored: on your device (AsyncStorage) and, after sign-in, synced to our Supabase database under your user id, protected by row-level security so other users cannot read your private rows.
Microphone and voice evaluation (Decor)
- Permission:
RECORD_AUDIO, only while you practice recitation. - Audio is captured on your device. When you use voice evaluation, the audio (and the expected verse text needed to score) is sent for speech-to-text and scoring.
- Processing: Groq (United States) — Whisper transcription and LLM or equivalent scoring. In production Play builds we prefer sending this through our Supabase Edge Function (
practice-evaluate) so the Groq API key is not shipped inside the app. Dev builds may call Groq more directly. - We do not use your recitation audio to train advertising profiles. We process it to return Pass / try again (and related feedback) and do not keep it for unrelated profiling.
- Text-only evaluation can stay on-device (local fuzzy compare) when no cloud scoring path is used.
Purchases and subscriptions (Musa / Laurels)
- If you buy a subscription or Laurel packs, purchase and entitlement data are handled by Google Play Billing and RevenueCat.
- We link RevenueCat to your Supabase user id after you sign in, so entitlements follow your account. On sign-out we log out of RevenueCat on the device where possible.
- We do not receive your full payment card number; the store processes payment.
Local reminders (optional)
- If you enable the daily practice reminder (habit / “pacto”), we schedule a local notification on your device. This does not require sending a push token to our servers in this version.
Website
- Server logs on Hostinger may include IP address and user agent, kept only as needed for security and operation. No third-party web analytics in this version.
What we do not do (this version)
- No ads, and no sale of your content as an advertising inventory.
- No third-party marketing analytics SDKs beyond the Auth, sync, billing, and voice-evaluation processors named here.
- Public Sarau audio hosting and social feeds are not part of the live product covered here; if they ship later, this policy will be updated first.
Why we use the data (purposes)
- Provide and secure the app and website.
- Create and restore your account; sync your library and progress across devices.
- Let you practice memorization, including optional voice evaluation.
- Process subscriptions and Laurel entitlements you purchase or earn.
- Send optional local practice reminders you enable.
- Comply with law and respond to abuse or security issues.
Legal bases (GDPR / similar)
Where the GDPR or LGPD applies, we rely on: contract / steps to provide the service you request; consent where required (for example microphone, optional notifications, and certain transfers); and legitimate interests for security, fraud prevention, and keeping the service reliable — balanced against your rights.
Processors and third parties
| Processor | Role |
|---|---|
| Supabase, Inc. | Authentication, database, and (when enabled) Edge Functions / storage |
| Groq | Speech transcription and recitation scoring when you use voice evaluation |
| RevenueCat | Subscription and entitlement management |
| Google Play / Google | App distribution and in-app billing on Android |
| Hostinger | Website hosting and server logs |
Each acts under its own terms and privacy policy for the processing they perform for us.
Retention
- Device data: until you clear app data or uninstall.
- Account and synced library/progress: until you ask us to delete your account or we close the service; we then delete or anonymize within a reasonable period unless law requires longer retention.
- Purchase records: as required by the stores and for accounting/tax.
- Voice evaluation payloads: processed to return a result; not retained by us for profiling.
- Website logs: only as long as needed for security and operation.
International transfers
Some processors (notably Groq in the United States, and depending on configuration RevenueCat and Supabase) may process data outside your country, including outside the EEA/UK. Where GDPR applies, transfers rely on appropriate safeguards (such as standard contractual clauses) or another lawful mechanism provided by the processor.
Your rights
Under the GDPR (EU/EEA) and the LGPD (Brazil) you may request access, correction, deletion, portability, restriction, or object to certain processing. You can delete most on-device data by clearing app storage or uninstalling. For account deletion or other requests: [email protected]. You may lodge a complaint with your supervisory authority (in Spain, the AEPD).
Children
Aedo is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will delete it.
Security
We use HTTPS, Supabase row-level security for synced rows, and store session material on your device using the platform’s storage. No method of transmission or storage is perfectly secure.
Your content
Poems and related content you add remain yours. We process them only to operate Aedo (host, sync, evaluate practice, show according to the privacy settings of the product). We do not sell your library as advertising inventory. Separate Terms of Use will cover copyright responsibility for imported texts.
Changes
We may update this policy. The date above reflects the latest version. Material changes will be noted in the app or on this website before or when they take effect for new processing.
Contact
Questions about privacy: [email protected].
This document explains how the Aedo app handles data. It is provided for transparency and is not legal advice.