KlamPrivacy Policy

Privacy Policy

Effective date: July 7, 2026  · Last updated: July 7, 2026

1. Who We Are

Klam is operated by Mohamed Adnane Al Khiati, based in Morocco. Mohamed Adnane Al Khiati is the data controller responsible for processing the personal information described in this policy. If you have questions about this policy or your data, contact us at adnanealk@gmail.com.

2. Information We Collect

2.1 Account information

When you sign in with Google Sign-In or Sign in with Apple, we receive and store:

  • Your email address
  • Your first and last name (Apple only shares your name the first time you sign in; if you decline to share it, we won't have it)
  • A profile picture URL (Google only — Apple does not provide one)
  • A stable account identifier from Google and/or Apple, used to recognise your account on future sign-ins
  • If you sign in with a second provider using the same email as an existing account, we link the two so you can use either to log in

We never receive or store your Google or Apple password. Klam has no password of its own — authentication is handled entirely by Google and Apple.

2.2 Device and session information

Each time you sign in, we record the IP address and user-agent (device/browser type) associated with that session, along with session timestamps, so we can detect suspicious activity and let you manage your active sessions. Refresh tokens are stored in hashed form only — never in plain text.

We also store your device's time zone, which we use to calculate your daily practice streak and calendar-day statistics — not for location tracking.

2.3 Voice recordings, transcripts, and AI feedback

This is the core of what Klam does, so we're explicit about it:

  • Audio recordings you make during practice exercises are uploaded to our private cloud storage. They are never publicly accessible — every playback or processing request uses a short-lived, single-use signed link.
  • Your recording is sent to a speech-to-text provider (AssemblyAI or Deepgram) to produce a text transcript of what you said.
  • That transcript — along with some automatically derived statistics (like filler-word counts) and a short summary of patterns from your past sessions — is sent to an AI feedback provider (DeepSeek) to generate scores, coaching feedback, example rewrites, and practice suggestions. Your raw audio is not sent to the AI feedback provider — only text.
  • We store the resulting transcript, AI-generated feedback/scores, and (if you choose to answer them) your own self-assessment ratings and notes, all attached to that practice attempt.

We do not use your recordings or transcripts to train our own AI models.

2.4 Progress and gamification data

We store your practice history and in-app progress: XP earned, streaks, unlocked badges, how often you use each exercise type, and a personal "vocabulary" list of words our AI flags as worth improving. This data powers in-app features only — it is not shared with anyone outside Klam.

2.5 Push notification token

If you enable notifications, we store an Expo push token and your device platform (iOS/Android) so we can notify you when your transcript or feedback is ready. We do not collect any other device identifier (no advertising ID, no device model/OS fingerprinting).

2.6 What we do not collect

Klam does not use any third-party analytics, advertising, or crash-reporting SDK. We don't track you across other apps or websites, and we don't sell your data. Our own server logs are kept for a short rolling period (about 7 days) for debugging and security purposes, and may incidentally contain identifiers like your user ID from requests made during that window.

3. How We Use Your Information

We use your information to:

  • Create and secure your account, and let you sign in via Google or Apple
  • Record and play back your practice sessions
  • Generate transcripts and AI-driven feedback on your speaking
  • Track your progress, streaks, and achievements
  • Send you notifications you've opted into
  • Investigate abuse, fraud, or security incidents
  • Improve the App's exercises and AI feedback quality

We do not use your recordings, transcripts, or feedback for advertising, and we do not sell personal information to third parties.

Legal basis for processing (GDPR)

We process your information because:

  • Contract performance — processing is necessary to provide the service you have requested (creating your account, generating feedback, tracking progress);
  • Consent — for certain processing you opt into, such as push notifications;
  • Legitimate interests — securing the service, detecting abuse, and improving the App's exercises and feedback quality, in ways that do not override your rights;
  • Legal obligation — where we are required to retain or disclose data by applicable law.

4. Who We Share Information With

We share information with the following service providers, solely to operate the App on our behalf. They are not permitted to use your data for their own purposes.

Google

Receives: Sign-in credentials exchange (email, name, profile picture, Google account ID)

Purpose: Authentication

Apple

Receives: Sign-in credentials exchange (email, name if first sign-in, Apple account ID)

Purpose: Authentication

AWS S3

Receives: Your audio recordings

Purpose: Private cloud storage, EU (Stockholm)

DigitalOcean

Receives: Your account and practice data (database)

Purpose: Database hosting

AssemblyAI / Deepgram

Receives: A short-lived link to your audio recording

Purpose: Speech-to-text transcription

DeepSeek

Receives: Your transcript text and derived statistics (no audio, no name/email)

Purpose: AI-generated speaking feedback

Expo

Receives: Your push notification token

Purpose: Delivering push notifications

AI providers and advertising. The speech-to-text providers (AssemblyAI, Deepgram) and AI feedback provider (DeepSeek) process your data solely to generate the transcript and feedback you see in the App. They are not authorized to use your recordings, transcripts, or any derived data to advertise to you or for their own commercial purposes beyond delivering the service to us.

International transfers. Some of these providers process data outside your home country, including in the United States and, in the case of DeepSeek (our AI feedback provider), a company operating under Chinese jurisdiction. Where we transfer personal data internationally, we rely on the relevant provider's own safeguards and contractual commitments. If you have concerns about a specific provider's data handling, contact us at the address above.

We may also disclose information if required by law, to protect the rights and safety of Klam or our users, or in connection with a merger, acquisition, or sale of assets (in which case we'll notify you).

5. Data Retention

  • Your account data, recordings, transcripts, and feedback are retained for as long as your account is active.
  • When you delete your account (see Section 7), we delete your audio recordings from storage and permanently delete your account record, sessions, practice history, gamification data, and vocabulary list. We begin deletion immediately on request and complete it as soon as reasonably practicable, except where temporary backups or logs must be retained for security or legal reasons (see below).
  • A small amount of temporary technical data may outlive account deletion by a short window: cached API responses used to prevent duplicate requests (kept up to 24 hours) and rolling server logs (kept up to about 7 days).
  • If you joined a pre-launch waiting list with your email before creating an account, that entry is stored separately and is not automatically deleted when you delete your app account — contact us if you'd like it removed too.

6. Data Security

We use OAuth-only authentication (no Klam password to be stolen or leaked), store refresh tokens in hashed form, and keep your audio recordings in a private storage bucket that is never publicly readable — access is only granted through short-lived signed links generated on demand. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Your Choices and Rights

  • Access & correction: You can view your profile information in the App. To request a copy of your data or a correction, contact us.
  • Deletion: You can permanently delete your account and associated data at any time from within the App (Settings → Delete Account), or by contacting us.
  • Notifications: You can disable push notifications at any time in your device settings or in-app.
  • EU/UK/other residents: Depending on where you live, you may have additional rights over your personal data (such as rights to access, rectify, erase, restrict, or object to processing, and to lodge a complaint with a data protection authority). Contact us to exercise these rights.
  • California residents: You may have rights under California law to know what personal information we collect and to request its deletion. We do not sell personal information.

8. Children's Privacy

Klam is not directed at, and is not intended for use by, anyone under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we'll notify you through the App or by other reasonable means before the change takes effect. The "Last updated" date at the top reflects the most recent revision.

Governing Law

This Privacy Policy is governed by the laws applicable in Morocco, except where mandatory consumer or data protection laws in your jurisdiction provide otherwise.

10. Contact Us

If you have questions about this Privacy Policy or how we handle your data, contact us at adnanealk@gmail.com.

© 2026 Klam. All rights reserved.

← Back to home