How QuackPath handles your data.

Overview

QuackPath is a language-learning app that turns content you provide — typed or pasted text, scanned or photographed pages, text and files shared from other apps, and spoken descriptions of real-life situations — into personalized study material: vocabulary, translations, example sentences, quizzes, and progress tracking. It also includes an AI voice tutor you can talk to. This Privacy Policy explains what we collect, why we collect it, how it is used, who it may be shared with, how long we keep it, and the choices and rights available to you.

This policy applies to the QuackPath mobile app, companion apps such as the HugeScreen big-screen mode, the public pages on this site, and the QuackPath backend services that support them (together, the "Service"). It does not apply to any third-party service you use alongside QuackPath, which is governed by its own privacy policy.

Who is responsible for your data

QuackPath is operated by the developer publishing the app. For privacy questions, contact us at support@quackpath.com. Where applicable law requires a controller, the developer listed on the App Store listing acts as the controller of personal data processed through the Service.

Data we collect

• Account data. When you sign in with Google, Apple, or email/password, we receive a user ID, email address, and display name. For email sign-in we also store a salted authentication record managed by Firebase Authentication.
• Profile and social data. Your username, display name, profile photo and color, a small picture of your duck in its outfit, achievements, XP, and streaks. If you use social features, your public profile and friend connections are visible to other users you interact with.
• Learning data. Items you save to your library, courses you create and complete, words you are learning and their mastery levels, study language and study preferences, placement results, and active subscription status.
• Content you provide. Text you type or paste, situation descriptions, text recognized from photos and scans, and text or files you share into QuackPath from other apps. We store this content and the study material generated from it so we can show your progress and let you resume later.
• Photos and document scans. When you scan a page with the camera or pick a photo, the app reads the text in it so you can choose what to study. On iPhone and iPad the text is read on your device by Apple's Vision framework, and the photo is not uploaded. On Android the text is read on your device by Google's ML Kit, except on pages in alphabets that ML Kit cannot read on the phone: Cyrillic, Greek, Arabic and Hebrew. Because the phone cannot read those letters, the Android app sends the photo to our server so its text can be read there. This happens when the language you are learning is Russian, Ukrainian, Belarusian, Bulgarian, Greek, Arabic or Hebrew, or when the phone's reading looks like Cyrillic letters mistaken for Latin ones. Before the photo leaves your phone, the app removes its location data. Our server then reduces the photo to at most 2048 pixels on its longest side, removes all remaining metadata, and sends only that copy to Google's Gemini model, which is asked only to copy out the printed text and returns that text to us. We do not store the photo: it is deleted once its text has been read. In every case, only the text you pick and confirm is used to build your course.
• Voice and audio. When you speak to the AI voice tutor, your recorded audio is sent to our server and forwarded to a speech-to-text provider to be transcribed, and in some cases heard directly by the AI model that generates the reply. We process this audio transiently in memory to produce the response; we do not store your voice recordings on our servers. The text transcript of the conversation and a short rolling summary of your progress are kept as part of your tutor session. Pronunciation exercises and voice dictation use your device's built-in speech recognition (provided by Apple under Apple's terms); that audio is not sent to QuackPath — only the resulting text is.
• Device and notification data. Push notification tokens, platform (iOS/Android), app version, language, your time zone, and your country code. Time zone and country are reported by the app and used to deliver notifications at a reasonable local time and to operate the Service.
• Advertising identifier (only if you allow it). On iOS, if you tap Allow on the App Tracking Transparency prompt, the app reads Apple's advertising identifier (IDFA) and shares it with TikTok so TikTok can tell whether one of our ads led to your install. If you tap Ask App Not to Track, or if you never see the prompt, no advertising identifier is read or shared. See “Advertising and measurement” below.
• Diagnostic and usage data. Crash reports, error logs, request identifiers, and basic usage events used to keep the Service reliable and secure. We do not use this for advertising profiling.
• Purchase data. When you subscribe to QuackPath Plus through the App Store or Google Play, the store shares the transaction and its renewal status with us (for example whether a free trial is running, when the current period ends, and whether it will renew). We keep a record of these store updates and use it to unlock Plus and to send you service messages about your subscription, such as an email and a notification before a free trial ends. We do not receive your payment card details.

AI processing

QuackPath uses artificial-intelligence services to build courses, translate, generate hints and quiz questions, transcribe speech, read the text in some photos, and synthesize the tutor's voice. To provide these features, the content involved — your imported text, situation descriptions, tutor messages, photos of pages the Android app cannot read on your device (see “Photos and document scans” above), and (for the voice tutor) your recorded speech — is processed by third-party AI providers acting on our behalf. Depending on the feature and configuration, these include Google (Gemini), Anthropic (Claude), OpenAI, Inworld, and ElevenLabs. Anthropic is used only for 1v1 challenges between two people who read QuackPath in different languages: it translates the challenge course's meanings and hints from the first player's language into the second player's. Some speech synthesis runs on QuackPath's own server instead of a third party. We send providers only what is needed to produce the result you asked for, and we do not use your content to show you ads.

What we do not collect

• We do not collect precise location.
• We do not access your contacts, photos, microphone, or camera unless you give the app explicit permission for a feature that needs it.
• We do not sell or rent your personal data.
• The QuackPath app shows no ads — not ours and not anyone else's. We do not use the content you study, your learning progress, or your account data to build advertising profiles.
• We do advertise QuackPath itself on TikTok, and we measure whether those ads work. That uses one measurement tool on the quackpath.com website and one in the iOS app — see “Advertising and measurement” below. In the app it is off unless you allow it.

Advertising and measurement

We advertise QuackPath on TikTok. We do not sell ad space and we never show you someone else's ads — the only advertising involved is our own, and the only reason we measure it is to know whether it is worth paying for. This happens in two places.

On the quackpath.com website

To let TikTok report whether those ads actually bring people to the site, the pages on quackpath.com load the TikTok Pixel, a small tracking script provided by TikTok.

When the pixel runs, TikTok receives technical information about your visit that TikTok requires in order to measure its ads. This typically includes your IP address, browser and device details, the page you are viewing and the address that referred you, and identifiers stored in cookies or in your browser's local storage. TikTok may match that information to a TikTok account and use it to measure ad performance and to show you or people like you QuackPath ads. We do not send TikTok your name, your email address, your account details, or anything you study in the app.

TikTok acts as an independent controller for the data it collects through the pixel, so its own privacy policy governs what it does with it. You can read it at tiktok.com/legal/privacy-policy. You can stop the pixel by blocking third-party scripts or trackers in your browser, or by using a content blocker; the website works normally without it. You can also limit ad personalisation in your TikTok account settings.

Inside the iOS app

The iOS app includes the TikTok Events SDK. Its only job is attribution: telling TikTok that an install or an app launch happened, so TikTok can match it to an ad you may have seen and report whether our campaigns work. It does not show ads, it does not read what you study, and it does not receive your name, your email address, or your account contents.

It is off until you allow it. On first launch the app shows Apple's App Tracking Transparency prompt. If you choose Ask App Not to Track, no advertising identifier is read and TikTok receives no identifier that could link you across other companies' apps and websites. If you choose Allow, the SDK may send TikTok your device's advertising identifier (IDFA) along with technical details such as your device model, operating system version, app version, and country, plus the fact that the app was installed or opened. You can change your answer at any time in iOS Settings → Privacy & Security → Tracking, and QuackPath works exactly the same either way.

Because this data can be linked to you across other companies' apps and websites, Apple classes it as tracking, and our App Store privacy label declares it as such.

For both the pixel and the app SDK, TikTok acts as an independent controller of the data it receives, under its own privacy policy.

Weekly Challenge posts on social media

The Weekly Challenge is a short game in the app with a new leaderboard every week. On QuackPath's own social media accounts, such as Instagram, we may post pictures of a week's leaderboard and of its winners. These posts are public. If you are near the top of the leaderboard when we make a post, it can show:

• Your 2D duck. A picture of the duck you dress up in the app, in its outfit and on its background color. If we do not have one for you, we show the QuackPath duck instead. The player in first place is shown with a bigger duck.
• Your public name. The name other players see on your QuackPath profile, which for most players is their username. Long names are shortened, and a name we cannot show properly is replaced with a phrase like “A Spanish learner”. Never the private name you gave when you set up your profile.
• Your result. Your place, your points for that week, any prize you won, and the language you are learning.

A post never shows your profile photo, your email address, or anything else from your account.

Who is never named

• Private profiles. If your profile is set to Private (Settings → Privacy), a post never shows your name or your duck. You appear only as an anonymous entry, such as “A Spanish learner”, with your place and points.
• Players hidden from leaderboards. If you turn off Show me on leaderboards (Settings → Privacy), you are left out of these posts completely, just as you are hidden from the leaderboards other people see in the app and on the web.
• We may also show a player anonymously for other reasons, for example while a report about their name is being reviewed.

Opting out and removing a past post

A change to either setting applies to every post we make after it. It does not change posts that were already published, and neither does deleting your account. To have a past post that shows you taken down, email support@quackpath.com and tell us which week it was. We will delete it from our accounts. We cannot remove copies that other people have saved or shared.

How we use data

• To create and maintain your account and authenticate you across devices.
• To generate the personalized study material you ask for from the content you provide, and to power the AI voice tutor.
• To sync your learning progress, library, and preferences between your devices.
• To send notifications you have opted in to (for example when a course you requested is ready or a review is due), timed to your local time zone.
• To operate social features you choose to use, such as friends, public profiles, and achievements.
• To prepare Weekly Challenge leaderboard and winners posts for QuackPath's own social media accounts, as described in “Weekly Challenge posts on social media” above.
• To process subscriptions and entitlements through the App Store and Google Play, and to tell you about your subscription (for example before a free trial turns into a paid period).
• To investigate and fix bugs, prevent abuse, secure the Service, and meet legal obligations.

Legal bases (EEA / UK)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Contract — to provide the core Service you signed up for, including account creation, course generation, the AI tutor, sync, and subscription delivery.
• Legitimate interests — to keep the Service secure, prevent abuse, debug errors, improve features, and show the top Weekly Challenge players in posts on our social media accounts. We balance these interests against your rights, and you can object to those posts at any time (see “Weekly Challenge posts on social media”).
• Consent — for optional features such as push notifications, microphone and camera access, and social features. You can withdraw consent at any time.
• Legal obligation — when we must retain or disclose data to comply with applicable law.

Sharing and processors

We share personal data only with service providers that help us run the Service, and only to the extent necessary:

• Google Firebase — authentication, push notification delivery, app integrity checks, and cloud infrastructure.
• Apple — sign-in with Apple, App Store subscription processing, and on-device text recognition and speech recognition.
• Google Play — subscription processing on Android.
• Google ML Kit — text recognition in the Android app, which runs on your device.
• AI providers — Google (Gemini), Anthropic (Claude), OpenAI, Inworld, and ElevenLabs, as described in "AI processing" above, to transcribe speech, read the text in some photos, generate study material and tutor replies, translate challenge courses between two players' languages, and synthesize voice audio.
• Cloudflare — to front and protect our backend, host the public site, deliver content, and store encrypted backups of our database.
• TikTok — advertising measurement only, as described in "Advertising and measurement" above: the pixel on quackpath.com, and, in the iOS app, install and launch events with your advertising identifier if you allowed tracking. TikTok acts as an independent controller for this data, not as our processor.

We may also disclose data when required by law, to protect the rights, property, or safety of users or the public, or in connection with a corporate transaction (such as a merger or acquisition), in which case we will continue to protect your data under terms at least as protective as this policy.

International transfers

QuackPath uses providers that may process data in the United States and other countries. Where required, we rely on lawful transfer mechanisms such as the European Commission's Standard Contractual Clauses or equivalent safeguards offered by our processors.

Retention

We keep account, profile, content, and learning data for as long as your account is active. Voice recordings sent to the AI tutor are processed transiently and are not retained on our servers after the response is produced, and photos sent to our server to have their text read are deleted once the text has been read; tutor transcripts and progress summaries are kept with your account. If you delete your account, we delete or irreversibly anonymize the personal data associated with it within a reasonable period, except where retention is required by law (for example tax records related to purchases). Deleted data may persist in our rotating encrypted backups for a limited window before it ages out. Crash and security logs are kept for a limited window for diagnostics and abuse prevention.

Security

We use industry-standard safeguards including TLS in transit, access-controlled storage, salted authentication credentials, and least-privilege server access. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security, but we work to protect your data and to respond promptly to any incident.

Your choices and rights

• Sign out of the app at any time from Settings.
• Deny or revoke microphone, camera, and speech-recognition permissions in your device's system settings; the related features simply will not run without them.
• Reset your study data from inside the app.
• Delete your account from Settings -> My Data. This removes your account and associated learning data from our active systems.
• Turn notifications on or off from your device's system settings or from the app.
• Keep your name and duck out of Weekly Challenge social media posts by turning off Settings → Privacy → Show me on leaderboards, or by setting your profile to Private in the same place.

Depending on where you live, you may also have rights to access, correct, port, restrict, or object to the processing of your personal data, and to lodge a complaint with your local data protection authority. To exercise these rights, contact support@quackpath.com. We will respond within the timeframe required by applicable law.

If you are a California resident, the CCPA/CPRA grants additional rights including the right to know, the right to delete, the right to correct, and the right to opt out of "sale" or "sharing" of personal information. We never sell personal information. The advertising measurement described above can amount to "sharing" for cross-context behavioural advertising: on the website through the TikTok Pixel, and in the iOS app only if you allowed tracking. To opt out, decline the app's tracking prompt (or turn QuackPath off under iOS Settings → Privacy & Security → Tracking), and block trackers or use a content blocker on the website. Nothing else you give us is ever sold or shared for advertising.

Children

QuackPath is not directed to children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal data from children under that age. If you believe a child has provided us with personal data, contact us so we can delete it.

Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision. Material changes will be highlighted in the app or on this page before they take effect.

Contact

Questions, requests, or complaints about this policy can be sent to support@quackpath.com.