Privacy policy

This policy covers the Plainly app and this website. Plainly is run by Stillkite Labs, a sole proprietorship in India ("we"). Contact: mayank@stillkitelabs.com.

The short version

• Recordings are deleted as soon as they are analysed. We keep the transcript and the scores so you can see your progress.
• We don't sell your data and we don't use it for advertising.
• You can delete your account and everything in it from your account page, at any time.

What we collect on the web

• Session: a random account ID. If you take the test without signing in, that ID is anonymous. If you sign in, your email address or Google account email.
• Recordings: the audio of each answer, sent to our server, transcribed, then discarded. The web app never writes audio to storage or logs.
• Results: the transcript with word timings, your scores, and the coaching text.
• Billing: your plan, trial end date, renewal date and Dodo customer ID. Card details are handled by Dodo Payments; we never see them.
• Email preferences: whether you asked for the daily drill, and the hour you chose. If you join the email list without an account, your address, the date you consented and a hashed IP.
• Usage and errors: neutral product events (for example "test completed" and the score) and error reports. Never audio, never transcripts.

Why we use it

• To score your speaking and give feedback — the service you asked for.
• To show your history and progress, and to send the emails you turned on.
• To run subscriptions, enforce plan limits, and stop abuse.
• To fix bugs and improve the product, using neutral usage and error data.

Who processes it for us

These providers process data only to run Plainly, under their own terms and security controls:

• Supabase — database, sign-in, storage and server functions.
• Deepgram or AssemblyAI — turn your recording into text. We ask them not to retain it or train on it.
• Google (Gemini API) or Anthropic (Claude API) — read the transcript text (never the audio) to write your feedback.
• Microsoft Azure Speech — pronunciation scoring for the sentences you read aloud.
• Dodo Payments — merchant of record for web subscriptions: payment, tax and invoices.
• RevenueCat — subscription status for the mobile app.
• Resend — delivery of sign-in codes and the emails you opted into.
• Cloudflare Turnstile — bot check on sign-in and email forms.
• Upstash — anonymous rate limiting. It stores counts, not content.
• Vercel — hosting and logs. Audio is never logged.
• PostHog — product analytics, only after you accept. Google Play / Apple — mobile payments.

These providers may process data outside your country, including in the United States and the EU.

How long we keep it

• Recordings: deleted immediately after analysis. There is no copy to remove later.
• Results, notes and preferences: until you delete them or your account.
• Purchase invoices: kept by Dodo Payments as merchant of record, as tax law requires.
• API cost logs: kept without a link to your account once the account is deleted.

Your choices and rights

• Delete your whole account on your account page, which also cancels a web subscription. See how deletion works.
• Unsubscribe from any email with the link at its foot. One click; no questions.
• Ask us for a copy of your data, or to correct it, by email.
• Decline analytics in the cookie banner. The product works without it.

Children

Plainly is for adults at work. It is not meant for anyone under 16, and we don't knowingly collect their data.

Changes

If we change this policy in a way that matters, we'll say so here before it applies.