juntosPrivacy Policy
Last updated 9 September 2026
This policy explains what Juntos collects, why, and your rights. We follow the Australian Privacy Principles and honour GDPR-style rights for everyone.
What we collect
- Account: username, display name, email address, a securely hashed password, and your invite code.
- Learning data: lesson scores, messages you send to the AI or to friends, transcripts of voice recordings, writing samples, grades and feedback, error patterns, level estimates, XP and streaks.
- Voice: recordings are transcribed to text to grade your speaking. Audio is processed in memory and not stored; the transcript is.
- Technical: device and browser type and error diagnostics when something fails, so we can fix it. No advertising trackers.
- Payments: handled by Stripe. We store your Stripe customer and subscription IDs, never card numbers.
How it's used
- To run the product — AI conversation, grading, feedback and your progress are generated from what you submit.
- AI processing runs on Cloudflare Workers AI; content is processed to produce a response and is not used to train models.
- To email you about your account: password resets, your trial ending, important service changes. No marketing spam.
Sharing
Friends you connect with see your display name, level, streak, XP and messages you send in your shared chat. We don't sell data. Service providers: Cloudflare (hosting, AI, database), Stripe (payments), and an email provider for transactional mail.
Retention
Data is kept while your account exists. Deleting your account removes your account, progress, messages and learning data within 30 days of backups cycling.
Your rights
Export your data or delete your account from Account settings in the app, or email us. You can also ask us to correct information. Contact: hello@hablajuntos.com.
Children
Juntos is for people aged 16 and over. We don't knowingly collect data from younger users; if we learn we have, we'll delete it.
Security
Passwords are hashed (PBKDF2), sessions expire, connections use HTTPS, and login is rate-limited. No system is perfect; if we ever discover a breach affecting you, we will tell you.