Privacy Policy
This Privacy Policy explains what personal data Phrase Rush collects, why we collect it, who we share it with, and what control you have over it.
It covers every Phrase Rush service:
- The website and blog at phraserush.app
- The web app at app.phraserush.app
- The Phrase Rush Android app
- The Phrase Rush iOS app
Where this policy says “we”, “us” or “Phrase Rush”, it means the company named below. Where it says “you”, it means anyone who visits our site or uses our apps.
1. Who is responsible for your data
The data controller is:
RIHAKEY LLC 1704 Llano St, Ste-B 1148 Santa Fe, NM 87505 United States
Contact for privacy matters: support@phraserush.app
We are based in the United States, but Phrase Rush is available to users worldwide, including in the European Economic Area (EEA) and the United Kingdom. Where the GDPR or UK GDPR applies to you, we comply with it. Where United States state privacy laws apply to you, we comply with those.
2. What we do not do
We want to be clear about this first, because it shapes everything below.
- We do not run analytics. There is no Google Analytics, no Meta Pixel, no Mixpanel, no PostHog, no Sentry, no session recording and no heatmaps in the website, the web app or the mobile apps.
- We do not show ads, and we do not share your data with advertising networks or data brokers.
- We do not sell or rent your personal data, and we do not “share” it for cross-context behavioural advertising as those terms are defined under California law.
- We do not use advertising or tracking cookies. We do not set third-party cookies at all.
- We do not ask for access to your camera, microphone, photos, contacts, calendar, or precise location, on any platform.
- We do not build advertising profiles about you.
3. What data we collect
3.1 Account data
Phrase Rush has no password of its own. You sign in with Google (website, web app, Android) or with Sign in with Apple (iOS). Authentication is handled by Firebase Authentication.
From that sign-in we receive and store on our servers:
| Data | Where it comes from | Why we store it |
|---|---|---|
| A unique user ID | Firebase Authentication | To identify your account and attach your progress to it |
| Email address | Your Google or Apple account | To send you account emails and to identify you for support |
| Display name | Your Google or Apple account | To address you by name in the app and in emails |
Your profile picture is held by Firebase Authentication and may be shown to you inside the app, but it is not copied into our own database.
If you use Sign in with Apple and choose Hide My Email, we only ever receive Apple’s private relay address. That works fine — we never need your real address.
3.2 Learning data
This is the data that makes the product work. For each language pair you study, we store:
- Your current CEFR level and sub-level (A1-1 through C2-5)
- Your statistics per level, and your total attempts and correct answers
- Your current streak, the date you last played, and the dates you have played
- Your best runs in the timed game modes (score, level reached, time)
- Your review schedule, so we know which phrases to show you again and which ones you already know
3.3 Content you submit
When you answer a phrase, we store a history entry containing the phrase you were shown, the translation you typed, the reference translation, the feedback you received, whether it was correct, the level, the game mode and the timestamp.
We store this so you can review your own history and so the spaced-repetition system knows what to show you again. It is your learning record, and it is visible only to you.
Please do not type personal, confidential or sensitive information into the answer box. It is a translation field; there is no reason to put anything personal in it, and anything you type there is stored and sent to our AI provider for grading (see section 5).
3.4 Subscription data
If you subscribe to Phrase Rush Premium, we store your plan, your subscription status, the end of your current billing period, and the identifiers that Stripe uses for your customer and subscription records.
We never see or store your card number. Payment details are entered directly with Stripe and never touch our servers. Subscriptions are purchased on the web only.
3.5 Email preferences
We store whether you have opted in to marketing emails, and when we last sent you one, so we do not email you repeatedly. Transactional emails about your account and your subscription are separate and are always sent.
3.6 Technical data
Our backend runs on Google Cloud Run, which produces server logs. These contain the IP address of the request, the time, the endpoint called and the response, along with operational metrics such as how long an AI validation took. We use them to keep the service running, to debug failures and to detect abuse. We do not use them to profile you.
The mobile apps read your device language so the interface can start in a language you understand. This stays on your device except insofar as it determines which language we render your emails in.
3.7 Data stored on your own device
We store two things locally, on your device:
- Your chosen interface language, so the app remembers it next time.
- Your sign-in session, so you do not have to log in on every visit.
On the website and web app these live in the browser’s localStorage. On mobile they live in the app’s own storage. Neither is a tracking cookie, neither is readable by other websites, and neither is sent anywhere for advertising.
The blog at phraserush.app is a set of static pages. It sets no cookies at all.
4. Why we use your data, and our legal basis
If the GDPR or UK GDPR applies to you, these are our legal bases:
| What we do | Legal basis |
|---|---|
| Create and maintain your account; run the game; save your progress and history | Performance of a contract (Art. 6(1)(b)) — this is the service you asked for |
| Process your subscription and payments | Performance of a contract (Art. 6(1)(b)) |
| Send transactional emails about your account, subscription and invoices | Performance of a contract (Art. 6(1)(b)) |
| Keep the service secure, debug failures, prevent abuse | Legitimate interests (Art. 6(1)(f)) — running a reliable, non-fraudulent service |
| Send you emails about our own similar products and offers, where you have not objected | Legitimate interests (Art. 6(1)(f)), or consent (Art. 6(1)(a)) where local law requires it |
| Keep records we are legally required to keep | Legal obligation (Art. 6(1)(c)) |
You can object to marketing emails at any time, with no effect on your account (see section 8).
We do not carry out any automated decision-making that produces legal or similarly significant effects on you. Your CEFR level goes up and down automatically based on your answers, but that is a feature of a language game, not a decision about you in the legal sense.
5. How AI is used, and what it sees
When you submit a translation, we send the original phrase, the reference translation, your answer and the language pair to an external AI model, which decides whether your answer is correct and writes the feedback you see.
We use the following AI providers for this:
- Fireworks AI (United States)
- Google Vertex AI (Google Cloud)
We send no account identifier with these requests — the provider receives the text to grade, not your name, email or user ID. We do not use your translations to train any model of our own. Our providers process this text under their own terms of service in order to return a result to us; we ask you to review their policies if that matters to you.
Because these providers process data in the United States, submitting a translation involves an international transfer of that text. See section 7.
6. Who we share data with
We do not sell your data. We share it only with the service providers that make Phrase Rush work, and only to the extent each one needs. These are our processors:
| Provider | What it does | Where it processes data |
|---|---|---|
| Google Cloud / Firebase (Google LLC) | Authentication, database (Firestore), backend hosting (Cloud Run), website hosting | Our database and backend run in the European Union; Google is a US company |
| Fireworks AI | Grades your translations | United States |
| Google Vertex AI | Grades your translations | Google Cloud |
| Stripe | Subscription payments and billing records | United States and EU |
| Resend | Sends our transactional and marketing emails | United States |
| Apple | Sign in with Apple; distribution of the iOS app | United States |
| Expo (EAS) | Builds and delivers our mobile apps | United States |
This list reflects the providers we use today. We may add or replace a provider as the service evolves; if we do, we will update this page, and we will tell you in advance if the change is significant. You can always ask us for the current list.
We may also disclose data where we are legally required to — for example in response to a valid legal request — or where it is necessary to establish, exercise or defend legal claims.
If Phrase Rush is ever acquired or merged, your data may transfer to the new owner. If that happens, we will tell you before it takes effect, and this policy will continue to apply until you are given notice of a new one.
7. International transfers
Your account, progress and history are stored on servers located in the European Union.
However, Phrase Rush is operated by a United States company, and several of our processors are based in the United States. That means your personal data is transferred to and accessed from the United States.
Where we transfer personal data out of the EEA or the UK, we rely on the safeguards available under Chapter V of the GDPR — principally the European Commission’s Standard Contractual Clauses, and where the recipient is certified, the EU-US Data Privacy Framework and its UK extension. You may request more detail about the safeguards that apply by writing to us.
8. Your rights
Wherever you live, you can ask us to give you a copy of your data, correct it, or delete it. Depending on where you live, you may have additional rights.
If you are in the EEA or the UK
You have the right to: access your data; have it rectified; have it erased; restrict how we process it; object to processing based on legitimate interests, including profiling; receive your data in a portable format; and withdraw consent at any time where processing is based on consent, without affecting processing carried out before you withdrew it.
You also have the right to lodge a complaint with a supervisory authority in the country where you live, work, or where you believe the infringement occurred. In Spain that is the Agencia Española de Protección de Datos; in the UK, the Information Commissioner’s Office.
If you are in California or another US state with a privacy law
You have the right to know what personal information we collect and how we use it, to access and obtain a copy of it, to correct it, to delete it, and not to be discriminated against for exercising any of these rights.
We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing for you to opt out of on that front. We do not use or disclose sensitive personal information beyond the purposes described in this policy.
How to exercise your rights
Deleting your account is built into the product: open your profile in the app and delete it there. This is immediate and permanent — see section 9.
For anything else, write to support@phraserush.app from the email address on your account. We respond within one month. If a request is unusually complex we may extend that by a further two months, and we will tell you if we do. We do not charge for this unless a request is manifestly unfounded or excessive.
To stop marketing emails, either use the unsubscribe link at the bottom of any marketing email, or turn them off in your profile settings. Unsubscribing takes effect immediately and does not require you to be logged in. You will still receive transactional emails about your account and any subscription, because those are part of the service.
9. How long we keep your data
We keep your data for as long as your account exists, and we delete it when you delete your account.
When you delete your account from within the app, we recursively delete your user record and everything under it — your progress, your full answer history, your spaced-repetition state, your game runs and your subscription record — and then we delete your authentication account. This happens immediately. There is no grace period and no recovery: once deleted, your data is gone and we cannot restore it.
Two things survive that deletion, and neither is under our control:
- Stripe keeps its own record of payments and invoices, because it is legally required to retain financial records. Deleting your Phrase Rush account does not erase Stripe’s billing records.
- Server logs roll off on Google Cloud Logging’s own retention schedule rather than being deleted on request. They contain IP addresses and request metadata, not your learning history.
If you stop using Phrase Rush without deleting your account, we keep your data so that your progress is still there if you come back.
10. Children
Phrase Rush is not directed to young children, and we do not knowingly collect personal data from them.
You must be at least 13 years old to use Phrase Rush. If you are in the EEA or the UK, you must be at least 16 years old, unless your country has set a lower age for consent to online services, in which case that lower age applies (but never below 13).
If you believe a child under these ages has given us personal data, write to support@phraserush.app and we will delete the account and its data.
11. Security
Traffic between our apps and our servers is encrypted in transit with HTTPS. Data at rest in Google Cloud is encrypted. Every request to our API must carry a valid, signed authentication token, and each user’s data is scoped to their own account, so one user cannot read another’s history or progress. We never store card details. Access to production systems is restricted to those who need it.
No system is perfectly secure, and we cannot guarantee absolute security. If we ever suffer a breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where the risk is high, notify you directly.
12. Changes to this policy
If we change this policy, we will update the date at the top of this page. If the change is significant — a new category of data, a new purpose, a new class of recipient — we will tell you by email or in the app before it takes effect, so you have the chance to object or to delete your account.
13. Contact us
Questions, requests or complaints about privacy:
RIHAKEY LLC · 1704 Llano St, Ste-B 1148 · Santa Fe, NM 87505 · United States
We read and answer every message.