Privacy Policy

1. Introduction

NERRA is an AI-powered English language learning platform available as a web application (nerra.online) and mobile applications (iOS and Android). This Privacy Policy explains what data we collect, how we use it, and your rights regarding your personal information. This policy applies to all users of the platform across all platforms (web, iOS, Android), including those in the European Union (GDPR), Thailand (PDPA), and Russia (152-FZ).

2. Data Controller

The data controller is Elena Malgina, individual developer based in Thailand.
Contact email: privacy@nerra.online

3. Data We Collect

3.1 Registration Data

When you sign in via Google or LINE OAuth, we receive and store:

• Email address
• Display name
• Profile picture URL
• OAuth provider ID (Google ID or LINE ID)
• Timestamp of account creation and last login
• Timestamp of privacy policy acceptance

3.2 Assessment Data

When you take the CEFR assessment, we collect:

• Written text responses (Writing module)
• Transcribed text from voice responses (Speaking module)
• Multiple-choice answers (Usage, Reading, Listening modules)
• AI-generated scores and feedback for each module
• Test session metadata (start time, completion status, CEFR result)

3.3 Voice Recordings

This is important: during the Speaking module, your voice is recorded and sent to OpenAI Whisper for transcription. The audio file is stored temporarily on our server and deleted immediately after successful transcription. We do not store your voice recordings permanently. Only the text transcript is saved.

3.4 User-Generated Content

• Personal vocabulary (words saved via the dictionary feature)
• Flashcard sets
• Messages in the curator chat

3.5 Technical Data

• IP address (used for rate limiting only, not stored in the database)
• JWT authentication token (stored in browser localStorage on web; in encrypted Keychain/Keystore on mobile)

3.6 Mobile App Data

When you use the NERRA mobile app (iOS/Android), we additionally collect:

• Game results and vocabulary learning progress
• Device push notification tokens (for lesson reminders, if enabled)
• Locally cached word sets (stored on-device for offline play, not transmitted)

The mobile app does not access your contacts, camera, microphone, or location. Advertising (Google AdMob) runs in the Android app only and uses the device advertising identifier with your consent. The iOS app currently shows no ads and requests no tracking permission.

4. How We Use Your Data

We use your data for the following purposes:

• To provide the CEFR language assessment service
• To generate AI-powered evaluation and feedback
• To store your test history and learning progress
• To enable communication with a human curator (if you opt in)
• To send service-related emails (via Resend)
• To monitor errors and improve service quality (via Sentry)
• To understand user behavior and improve the product (web only, via PostHog)

5. Third-Party Data Processing

We share your data with the following third-party services:

Cross-border transfer: your text responses and voice audio are processed by OpenAI, whose servers are located in the United States. OpenAI may retain API inputs for a limited period for abuse monitoring in accordance with its own policies. By using the Speaking and Writing modules, you consent to this transfer.

5a. Sharing Between Teachers and Students

NERRA lets teachers create lessons and assign them to their students. When a student is connected to a teacher (by accepting the teacher's invitation) and completes an assigned lesson or homework, the following becomes visible to that teacher only:

• The student's name and email
• The student's answers to lesson and homework exercises, and their correctness
• Text transcripts of any spoken answers within a lesson
• Progress and completion status for assigned lessons

A teacher can only see students who have accepted their invitation and only the lessons connected to them. A student can see which teacher they are connected to. This sharing is essential to the teaching service; you can end it by deleting your account or asking us to remove the connection.

6. Cookies and Analytics

On the web, we use PostHog for product analytics; tracking is disabled by default and activated only after you provide consent (opt-in model). The mobile app contains no product-analytics SDK and sends no analytics events.

On the web, we use JWT tokens stored in your browser's localStorage for authentication. On mobile apps (iOS/Android), tokens are stored in the platform's encrypted secure storage (Keychain on iOS, Keystore on Android). We do not use Google Analytics or Yandex.Metrica.

7. Data Retention

• Account data: stored until you request account deletion
• Test results and transcripts: stored until account deletion
• Voice recordings: deleted immediately after transcription (not stored)
• Vocabulary and flashcards: stored until account deletion
• Authentication tokens: user tokens expire after 4 hours; curator tokens after 8 hours

8. Your Rights

Depending on your jurisdiction, you have the following rights:

Under GDPR (EU)

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure (right to be forgotten)
• Right to data portability
• Right to object to processing

Under PDPA (Thailand)

• Right to access and obtain a copy of your data
• Right to request deletion
• Right to withdraw consent
• Right to data portability

Under 152-FZ (Russia)

• Right to access your personal data
• Right to request correction or deletion
• Right to withdraw consent for data processing

Under CCPA (California, USA)

• Right to know what personal data is collected and how it is used
• Right to delete personal data
• Right to opt-out of the sale of personal data
• Right to non-discrimination for exercising your privacy rights

We do not sell your personal data. We do not share personal data for cross-context behavioral advertising.

To exercise any of these rights, contact us at privacy@nerra.online or use the account deletion page.

9. Data Security

We implement the following security measures:

• Access controls enforced at the application layer — every request is authenticated and authorized so a user can only read or modify their own data (and, for teachers, only the students and lessons connected to them)
• Database-level Row Level Security policies as a defence-in-depth layer
• All account passwords (students, teachers, and curators) are hashed with bcrypt; we never store passwords in plain text
• Content Security Policy (CSP) with nonce-based script validation
• Rate limiting on API endpoints to prevent abuse
• HTTPS encryption in transit (via Vercel and Render)

No method of transmission or storage is 100% secure. While we work to protect your data, we cannot guarantee absolute security.

Web: JWT tokens are stored in browser localStorage. Mobile: tokens are stored in encrypted platform secure storage (iOS Keychain / Android Keystore), which is not accessible to other apps.

10. Children's Privacy

NERRA is designed for language learners and may be used by minors, including school-age students whom a teacher connects to their class. Because privacy rules for minors differ by country, the following applies:

• A child may use NERRA only with the involvement and consent of a parent or legal guardian. Where the law requires it (for example, under 16 in parts of the EU, or under 13 in the United States), a parent or guardian must provide consent before the child creates an account or submits personal data.
• A teacher who invites or adds a student confirms that they have the authority to do so and that any required parental or guardian consent has been obtained for that student.
• We do not knowingly collect personal data from a child without the consent described above, and we do not serve behavioural advertising to children.

If you are a parent or guardian and believe a child has provided personal data without your consent, contact us at privacy@nerra.online and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted at nerra.online/privacy with a revised date.

12. Contact

If you have questions about this Privacy Policy or want to exercise your rights:

• Email: privacy@nerra.online
• Data Controller: Elena Malgina