Privacy Policy

Information we collect

• Account information: email address, display name, Firebase user ID, email-verification status, and account creation time.
• Learning information: problems-completed totals, optional leaderboard preference, roleplay scenarios, transcripts, AI feedback, scores, and timestamps.
• Audio you choose to submit: roleplay audio is processed to create a transcript and feedback. Deca Pal does not save the audio file to its database.
• Browser-only information: question practice statistics and theme preference are stored in local storage on your device.
• Technical information: hosting, authentication, security, and AI providers may process IP address, user agent, request timing, and similar service metadata.

Why we use information

We use information to authenticate users, provide and secure the service, save progress, serve original practice questions, generate and grade practice roleplays, honor privacy choices, troubleshoot failures, prevent abuse, and comply with law. We do not use personal information for targeted advertising.

AI processing and service providers

When you expressly agree and submit a recording, its audio and the related practice scenario are sent through OpenRouter to an AI model provider for transcription and grading. Requests are configured to deny provider data collection and require a zero-data-retention endpoint. OpenRouter may retain request metadata such as model, token count, latency, and cost. Provider practices and legally required security or abuse processing may still apply.

Practice-test questions are selected from a deterministic, first-party question bank built from authored anchors and scenario templates. Your selected test category and questions are not sent to OpenRouter or another AI model provider. Answer choices are shuffled on the server, and only the signed-in account identifier needed to issue and verify a short-lived answer token is processed.

We also use Google Firebase for authentication and database services and Vercel or a comparable hosting provider to deliver the website. These providers process information for us under their applicable service terms.

How we disclose information

We disclose information to service providers described above, when you direct us to do so, to protect users and the service, or when legally required. If you opt in to the leaderboard, your display name and problems-completed total are visible to other signed-in users. The leaderboard is off by default.

Deca Pal does not sell personal information or share it for cross-context behavioral advertising. We do not knowingly sell or share the personal information of users under 16.

Cookies and local storage

We use one strictly necessary, HTTP-only session cookie that expires after five days and local storage for theme and on-device practice statistics. We do not currently use advertising cookies or third-party behavioral analytics. If that changes, this policy and any required consent controls must be updated before deployment.

Retention

Account profiles, learning totals, transcripts, and AI feedback are kept while the account remains active and are deleted when the user completes the in-product account deletion process, subject to limited legal, fraud-prevention, backup, or security exceptions. The session cookie expires after five days. Browser-only information remains until you clear site data or delete your account from that browser. Service-provider logs and backups follow the providers’ retention schedules.

Your choices and privacy rights

From the Account page, you can correct your display name, choose whether to appear on the leaderboard, download server-stored data, and permanently delete your account and roleplay history. Depending on where you live, you may also have rights to know, access, correct, delete, restrict, object, or appeal, and to receive equal service when exercising a privacy right.

To exercise a right that is not available in the Account page, use an authorized agent, or ask a question, email [email protected]. We may need to verify your identity. We do not discriminate against users for exercising privacy rights.

Students, schools, and children

Deca Pal is intended for users age 13 and older. Users under the age of legal majority should use it only with permission from a parent or guardian. We do not knowingly collect personal information from a child under 13. If you believe a child under 13 has used the service, contact us so we can delete the information.

If a school uses Deca Pal for an educational purpose, the school and Deca Pal must separately determine and document their responsibilities under FERPA and applicable state student-privacy laws. A public website policy alone is not a school data-processing agreement.

Security and transfers

We use access controls, encrypted transport, restricted server-side database access, secure cookies, input limits, and dependency monitoring. No security measure is perfect. Firebase Authentication operates from the United States and other providers may process information in the United States or other locations where they operate.

Changes and contact

We will post material changes here with a new effective date and provide additional notice when required. Questions may be sent to [email protected].

See also our Terms of Use and Accessibility Statement.