← Back to Idiosync

Privacy Policy

Last updated: 23 October 2026

Who we are

Idiosync is run by Ronnie Lashley, a sole trader trading as Idiosync, based at 19 Friars Orchard, Fetcham, Surrey, KT22 9RL, United Kingdom. We are the “controller” of your personal data, which means we decide how it’s used. Contact us about anything in this policy at idiosync.help@gmail.com.

1. What we collect, why, and our legal basis

  • Your email address and name — to create and sign you in to your account, and send you sign-in codes and important emails about your account. Other users only ever see your display name (or your first name if you haven’t set one), never your full name or email. (Legal basis: contract.)
  • Language choices, level, learning goals, voice and app preferences — to set up and personalise your learning. (Legal basis: contract.)
  • Messages, voice notes, reactions, room names and your profile photo (if you add one) — to run Group Chat and Language Exchange and show your content to the people you share it with. Messages are translated by AI. (Legal basis: contract.)
  • Learning progress — such as XP, streaks, badges, practice history, words you find tricky and quiz results, to track your progress and personalise practice. (Legal basis: contract.)
  • Safety and moderation data — automatic checks on messages, display names and voice notes (voice notes are turned into text for the check; that text isn't kept), reports you make or that are made about your content, blocks, and any suspension or ban. Used to keep Idiosync safe and enforce our rules. (Legal basis: legitimate interests (keeping users safe), and legal obligation where the law requires it.)
  • Illegal-content evidence — if content is reported as illegal or flagged as sexualising children, a locked copy (the content, sender, time and chat) is kept so we can report it to the authorities. (Legal basis: legal obligation and legitimate interests (protecting children and other users).)
  • Age check result — before your first Language Exchange we may ask Didit to check your age from a selfie. Idiosync never receives the selfie, only whether you passed and when. (Legal basis: legitimate interests (keeping under-18s out of chats with strangers).)
  • Billing information — your plan, payment status and dates, and records of what you agreed to when you paid. Card details are handled by Stripe and never reach us. (Legal basis: contract, and legal obligation (tax and consumer law records).)
  • Records of what you agreed to — when you accepted our terms, which version, and your IP address at the time; your marketing email choice; and the tick-boxes you confirm when you buy a plan or pack. (Legal basis: legal obligation and legitimate interests (being able to show what was agreed).)
  • Technical and usage data — your IP address (to work out which country you're in, block sign-ups where we don't operate yet, and limit abuse), when you last used the app, your timezone (for Language Exchange matching), basic error logs, and your notification settings if you turn on push notifications. (Legal basis: legitimate interests (running a secure, reliable service).)
  • Free-trial check — a scrambled (hashed) version of your email and of a random ID stored on your device, so each person and device only gets one free trial. We can't turn these back into your email or device. (Legal basis: legitimate interests (preventing trial abuse).)
  • Support messages — what you send us through Help & Support, translated so we can reply in your language. (Legal basis: legitimate interests (helping you).)
  • Marketing emails — only if you opt in. You can turn them off any time in Account Settings or with the unsubscribe link. (Legal basis: consent.)

We don’t use your data for advertising, we don’t sell it, and we don’t make decisions about you that have legal or similarly significant effects using only automated processing. Automatic moderation can stop a message being sent; if you think it got it wrong, you can contact us.

2. Who we share it with

We use these service providers to run Idiosync. They only use your data to provide their service to us:

  • Supabase — database, file storage and sign-in.
  • Vercel — hosting the app and website.
  • OpenAI — translation, AI practice and feedback, moderation, and turning voice notes into text. OpenAI doesn’t use our data to train its models, and keeps it for up to 30 days for abuse monitoring unless the law requires longer.
  • Stripe — taking payments and managing subscriptions. Stripe also processes your payment details under its own privacy policy.
  • Resend — sending emails such as sign-in codes, receipts and notices.
  • Upstash — short-term usage counters that stop abuse (keyed by account or IP address).
  • Didit — the selfie age check, only if you’re asked to do one.
  • Apple, Google or Mozilla push services — delivering notifications to your device, only if you turn them on.

Other users see what you choose to share with them (your display name, photo, messages and progress where the app shows it). We may also share data with the police or other authorities where the law requires it, or to protect someone from serious harm.

3. Where your data goes

Some of these providers are based in, or use servers in, the United States or elsewhere outside the UK. When your data leaves the UK, we rely on the safeguards UK law allows, such as the UK’s adequacy regulations (including the UK–US “data bridge” for certified US companies) or the UK International Data Transfer Agreement or Addendum. Contact us if you’d like more detail.

4. How long we keep it

We delete data automatically once these periods are up:

  • Your account and content: while your account is open. When you delete your account, your profile, progress and private data are deleted straight away. Messages you sent in group chats stay visible to the other members, with your name removed.
  • Voice-note recordings: 1 year after you send them. The recording is then deleted; the message itself stays in the chat.
  • Unfinished sign-ups (if you start signing up but never finish): 30 days.
  • Error logs and daily usage counters: 90 days.
  • Support messages: 2 years after you send them.
  • Reports: 2 years after we’ve reviewed them. Suspensions and bans: 2 years after they end. A permanent ban is kept while it applies.
  • Our log of moderation actions: 6 years. It can’t be changed or deleted before then, so there’s a reliable record of how we’ve enforced our rules.
  • Billing and agreement records (payments, refunds, what you agreed to at checkout, price-change notices): 6 years, because UK tax and consumer law require us to keep business records. Your agreement to our terms and your marketing-email choice are kept while your account is open, then deleted once they’re 6 years old.
  • Illegal-content evidence: for as long as needed to report it to, and support, the authorities.
  • Abuse-prevention counters (with our provider Upstash): a few minutes, or up to 2 days for daily usage limits.

5. Your rights

Under UK data protection law you can ask to: see a copy of your data; correct it; delete it; get it in a portable format; restrict or object to how we use it; and withdraw consent where we rely on it. You can do some of this yourself in Account Settings: edit your details, Email me a copy of my data (we email you a file with everything we hold about you) and Delete Account. For anything else, email idiosync.help@gmail.com and we’ll reply within one month.

If you’re not happy with how we’ve handled your data, you can complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113). We’d appreciate the chance to sort it out first.

6. Cookies and storage on your device

We only use what’s needed for the app to work. We don’t use advertising or analytics cookies.

  • A sign-in cookie that keeps you logged in.
  • Storage on your device for app settings and conveniences, such as your app language, unsent message drafts and which tips you’ve already seen.
  • A random device ID used only to make sure each device gets one free trial.

7. Children

Idiosync is for adults only. You must be 18 or over to use it, and we don’t knowingly collect data from anyone under 18. If you think someone under 18 has an account, tell us at idiosync.help@gmail.com and we’ll close it.

8. Changes to this policy

If we make an important change, we’ll tell you in the app before it applies. The date at the top shows when this policy was last updated.

9. Contact

Ronnie Lashley, a sole trader trading as Idiosync. Address: 19 Friars Orchard, Fetcham, Surrey, KT22 9RL, United Kingdom. Email: idiosync.help@gmail.com.