Privacy Policy

This Privacy Policy explains how [LEGAL ENTITY NAME] (“Paseo,” “we,” “us”) collects, uses, shares and protects information when you use the Paseo web app, the Cuentos reader, the Paseo apps for iPhone (from Apple's App Store) and Android (from Google Play), and this website (together, the “Service”). We wrote it in plain English. If anything is unclear, email us at support@getpaseo.app.

1. Information we collect

Information you give us

• Account information. If you sign in with Google, Google shares your name, email address and a Google account identifier with us. We store your email, name, plan, subscription status and Stripe customer ID.
• Sign in with Apple (iPhone app). Apple shares a stable identifier for your Apple Account and, the first time, the name and email you choose to share. If you choose Hide My Email, we get a private relay address (ending in @privaterelay.appleid.com) that Apple forwards to your real inbox; we never see your real address, and you can stop the forwarding in your Apple Account settings. Apple also gives us a sign-in authorization that we keep with your account, only so we can disconnect Paseo from your Apple Account when you delete your account.
• Acceptance and consent records. When you confirm you're 18 or older, accept our Terms and this policy, agree to AI processing before your first conversation, or turn on recovery topics, the app saves the date and time. The 18+ and Terms times are also stored with your account when you sign in.
• Profile and preferences. During onboarding and in settings you may enter your first name, your Spanish level, why you're learning (for example, a trip or family), your city, how the coach should refer to you, and a few optional lines “about me” (“Sobre mí”). These are stored on your device and are included in the instructions sent to our AI provider so your coach can personalize the conversation. They go into your cloud copy only as described in “Cloud copy” below.
• Email sign-ups. If you request our free speaking plan, we store your email address, when you signed up, and the ad campaign or page that brought you (for example, UTM tags). We first send one email asking you to confirm; we send nothing else unless you click it, and we delete unconfirmed sign-ups after 7 days.
• Reports. If you report a reply from the AI coach, we receive that reply's text (up to 1,000 characters), the reason you chose, an optional note, the Spanish variety you use and the time. We don't attach your name, email or IP address.
• Messages to us. If you email us, we keep the message and our reply.
• Your own API key (optional). If you choose to use the Service with your own AI provider API key, it is stored only on your device and sent only to that provider.

Information created when you use the Service

• Voice audio and transcripts. See section 2.
• Learning data on your device. Lessons completed, recaps, transcripts of your sessions, saved words and phrases, mistakes for review, reading progress, quiz results, streaks and achievements are stored on your device, in your browser's local storage or, in the iPhone and Android apps, in the app's own storage. Deleting the app deletes them from that phone.
• Cloud copy (progress sync). If you sign in with Google, the app keeps a copy of your learning data on our servers (our database provider, Upstash) so a new phone or a cleared browser picks up where you left off. This is on by default for signed-in users and can be turned off in Ajustes › Tus datos (“Sincronizar entre dispositivos”). With an invite code, it's off until you turn it on, and it's tied to a secret sync key that only your phone knows (we store only a one-way hash of the key).
  • Included by default: your settings (name, city, level, learning reason, preferences and the consent times above), your progress and streaks, your session history with recaps (including short corrected phrases from what you said), saved phrases, verbs and achievements, and your reading progress.
  • Left out by default: full conversation transcripts and your “Sobre mí” text. You can include them with “Incluir mis conversaciones en la copia.”
  • Always left out unless you separately include them: recovery-topic conversations, phrases saved from them, and the recovery setting itself (“Incluir también los temas de recuperación”).
  • Never included: your own API key, your sign-in token, your invite code and your sync key.
  Our server removes anything that isn't allowed by your choices, even if an older version of the app sends it.
• Usage and billing records on our servers. For accounts: minutes of voice practice used, session counts, word counts, estimated processing costs and timestamps, used to run your plan's allowance and to operate the business.
• Product analytics and ad click data. Our own analytics use a random device identifier; if you sign in, we link it and your first-visit campaign data to your account. They count events such as page views, lessons started and finished, and which ad campaign first brought the device. We do not store IP addresses or free text in these counts, and recovery-topic activity is never included.
• Ad click data. When you arrive from one of our ads, the campaign tags in the link (UTM source, medium, campaign, content and term) and the ad click ID (fbclid from Meta, gclid from Google, ttclid from TikTok) are kept with your device record and, if you sign up, stored with your account for about 13 months so we can tell which ads work.
• Technical information. Like most websites, our hosting provider and security tools process your IP address, browser type, device type and request logs to deliver pages, prevent abuse (for example, rate limiting with short-lived, one-way network tags) and fix errors.

In the iPhone and Android apps

• Microphone. The apps ask for microphone permission the first time you start a conversation, and use the microphone only while a conversation you started is running. So that a walk doesn't stop in your pocket, it keeps running when you lock the screen or switch apps, until the walk ends or you end it. While it runs, the phone shows it: on iPhone, Paseo's controls on the Lock Screen; on Android, an ongoing “Paseo” notification with Pause and End. What the microphone picks up is handled as described in section 2; we don't record or keep it. You can turn the permission off at any time in your phone's settings.
• Reminders. If you choose a walk time, the app schedules a reminder on your phone with your phone's own notifications. The time you pick stays on your device; we don't use a push-notification service and don't send reminders from our servers. You can turn them off in the app or in your phone's settings.
• Payments. If you subscribe from an app, the app opens our secure checkout page (Stripe) in your phone's browser; Apple and Google don't process that payment.
• The app stores. Apple and Google distribute the apps and process your download under their own terms and privacy policies. They give us statistics such as installs, crashes and ratings, generally in aggregated form and, for some statistics, only from people who agreed to share them with app developers. They don't give us your name or contact details for downloading the app.
• No ad pixels. The Meta Pixel and the TikTok Pixel don't run in the apps. The apps don't use your phone's advertising identifier.

Information from third parties

• Google (sign-in): basic profile information as described above.
• Apple (Sign in with Apple, iPhone app only): an identifier and the name and email you choose to share, as described above.
• Apple and Google (app stores): download, crash and usage statistics about the apps, as described in “In the iPhone and Android apps”.
• Stripe (payments): subscription status, plan, customer ID, billing country and the last four digits and brand of your card. Stripe processes your full payment details under its own privacy policy.
• Advertising and analytics partners (only if you accept them): aggregated reports about ad performance and how visitors use the site.

2. Voice, transcripts and AI processing

Paseo is a voice-first app, and your coach (for example “Camila” or “Andrés”) is an artificial intelligence, not a human. The characters are fictional. Before your first conversation the app shows what is sent to our AI provider and asks for your OK. When you start a session:

• Your microphone audio is streamed directly from your device to OpenAI, our AI provider, over an encrypted connection, so it can transcribe what you say and generate your coach's spoken reply in real time. Your coach's voice is AI-generated; no human is listening.
• The coach's instructions sent to OpenAI include the profile details you entered (such as your name, level, city and “Sobre mí”) and, for review sessions, phrases you saved.
• The text of the conversation (transcripts) is shown on your screen and saved on your device. At the end of a session, the transcript is sent to our AI provider (through our server, or directly when you use your own key) to create your recap, score your review drill, or translate a line when you ask.
• In the reader, if you choose a natural AI voice, the story text being read aloud is sent to our AI provider to generate audio. That audio contains only the story's text, not your data, and is cached on our hosting provider (Vercel Blob) and shared by every listener.
• We do not keep copies of your voice audio. Your conversation transcripts are stored on our servers only if you include them in your cloud copy (section 1).
• Reporting a reply. If the coach says something offensive, harmful or wrong, tap “⚑ Reportar” next to it in the recap. The report goes to us as described in section 1, and we review it.

OpenAI processes this data as our service provider. Under OpenAI's API terms as currently published, data sent through its API is not used to train its models by default and may be retained for a limited period (currently up to 30 days) to monitor for abuse, unless a longer period is legally required. [LAWYER/OPERATOR: confirm current OpenAI API data-usage and retention terms, and whether a data processing addendum or zero-data-retention option applies, before launch.]

Please don't share information in conversations that you don't want processed this way, such as government ID numbers, financial account numbers, passwords, or other people's private information.

3. Sensitive topics (recovery practice)

Paseo offers optional practice topics about addiction recovery and 12-step meetings (for example, practicing a share or a call with a sponsor in Spanish). These topics are off by default. Information you share in these conversations may reveal health information about you, so we treat it as sensitive (“consumer health data” under some state laws).

• Consent. Before the topics appear (and before a recovery conversation starts, if you used them before this consent step existed), the app explains what happens to this information and asks you to tap “Acepto.” The app records when you agreed. We never turn these topics on based on what you write elsewhere.
• Purpose. We and our AI provider process what you say in these conversations only to run those practice conversations and your recap.
• Where it's kept. Recovery conversations, phrases saved from them and the recovery setting stay on your device. They are left out of your cloud copy unless you turn on “Incluir también los temas de recuperación” in Ajustes › Tus datos.
• We do not use recovery-topic content for advertising, we do not send it to advertising or analytics partners (the app marks it private and our analytics drop it), and we do not sell it.
• You can turn the topics off at any time in settings, delete them from your device, or delete your account (section 8).
• These practice conversations are language practice only. They are not medical advice, therapy, counseling, a sponsor or a crisis service, and they are not affiliated with or endorsed by Narcotics Anonymous or any recovery fellowship. If you are in crisis in the U.S., call or text 988, or call 911 in an emergency.

[LAWYER: review for state consumer health data laws (e.g., Washington's My Health My Data Act, Nevada SB 370, Connecticut) and whether a separate Consumer Health Data Privacy Policy (linked from the home page) is required in addition to the in-app consent described above.]

4. How we use information

• To provide the Service: run voice conversations, write recaps, schedule reviews, show your progress, keep your cloud copy, and remember your settings.
• To manage accounts, free trials, subscriptions, voice-minute allowances and payments.
• To send the emails you ask for (such as the 7-day speaking plan, after you confirm your address) and service messages (such as receipts or important changes). You can unsubscribe from marketing emails at any time.
• To understand and improve the Service: which lessons people finish, where they get stuck, and which features are used, mostly through aggregated, anonymous counts.
• To review reports about AI replies and improve how the coach behaves.
• To measure and improve our advertising, only if you accept the pixels described in section 6.
• To keep the Service safe: prevent fraud and abuse, enforce our Terms, and comply with law.

We do not use your voice recordings or transcripts to train AI models, and we do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

5. How we share information

We share information only with these service providers, for these purposes:

We may also share information: (a) if required by law, subpoena or other legal process; (b) to protect the rights, safety and property of our users, the public or us; (c) with a buyer or successor if we are involved in a merger, acquisition or sale of assets, subject to this policy; and (d) with your consent or at your direction.

We do not sell personal information for money. In the past 12 months we shared (which may be considered “selling” or “sharing” under some U.S. state laws) identifiers and activity with Meta, Google and TikTok for targeted advertising, for visitors who accepted. We never share sensitive or recovery-topic data this way. We have no actual knowledge that we sell or share the personal information of anyone under 16. You can opt out at any time with “Your Privacy Choices” (Do not sell or share my personal information), through Global Privacy Control, or as described in section 8.

[LAWYER/OPERATOR: accept each provider's data processing addendum (OpenAI, Upstash, Vercel, Stripe, Resend) and record it; confirm each provider's data region.]

6. Cookies, pixels and analytics

We and our partners use cookies, local storage and similar technologies:

• Essential: local storage that keeps your progress, settings and consent choices, and your sign-in session. The app won't work properly without these.
• First-party analytics: a random device identifier and event counts (no name, IP address or free text; if you sign in, the identifier and your first-visit campaign data are linked to your account). They start when you open the site or app and stop if you choose “Turn off all analytics” in the consent notice.
• Google Analytics, the Meta Pixel and the TikTok Pixel: on the website and web app, load only after you choose “Yes” in the consent notice, and never when your browser sends the Global Privacy Control (GPC) signal. They tell us whether our ads lead to visits and sign-ups, and help those platforms show our ads to people likely to be interested. You can manage ad preferences in your Facebook, Instagram, TikTok and Google settings, and opt out of Google Analytics at tools.google.com/dlpage/gaoptout. The Meta Pixel and the TikTok Pixel never run in the iPhone and Android apps.

We never place recovery-topic content, transcripts or voice data in analytics or advertising tools. [LAWYER: if you advertise in the EU/UK, first-party analytics may need opt-in consent too, and the consent notice needs a way to change your choice later.]

Server-side conversions (Meta Conversions API and Google Ads)

Draft — pending legal review.

• When: only if you chose “Accept” in the consent notice, your browser does not send Global Privacy Control, the event is not recovery content, and not from the phone apps. When you sign up, start your free trial or subscribe, our server sends that one event. Your choice, including Global Privacy Control, is saved on your account as soon as you change it, and server-side conversions follow that saved choice.
• Meta Conversions API receives: the event name (CompleteRegistration, StartTrial or Subscribe), the time, a one-way event ID, a SHA-256 hash of your email, the value and currency (for a subscription), the Meta cookie IDs (fbp, fbc, from your browser or an ad click), your browser's user agent (Meta requires it for website events) and our site address (the home page, without any query). We do not send your IP address, name, account ID, language or dialect, or anything about what you practiced.
• Google Ads receives the same events as offline conversions that we upload: your ad click ID (gclid), the event name, time, value and currency, and an order ID. It does not receive your email. On our website, the Google Ads tag (gtag) sets cookies after you accept; in the web app it sends only a conversion ping at sign-up, trial start and purchase; that ping sets Google cookies and Google receives your IP address.
• A hash is not anonymous: the platforms can match it to people who have the same email. Hashing protects the address in transit, nothing more.
• Recovery-topic data, transcripts, voice and your profile are never sent. Opening a recovery topic or story marks your device and account so nothing further is sent for it.
• Opt out: use Your Privacy Choices (choose “Do not sell or share my personal information”), turn on Global Privacy Control, delete your account, or use your ad settings at facebook.com/adpreferences and adssettings.google.com. Your choice is saved on your account within a moment of changing it.

7. How long we keep information

We delete information automatically when it's no longer needed, on these schedules (each clock restarts when you use the thing again):

• On your device: until you delete it (Ajustes › Tus datos › “Borrar mis datos de este teléfono,” “Borrar mi cuenta,” clearing the site's data in your browser, or deleting the app).
• Account (email, name, plan, acceptance records): deleted 24 months after you last opened the app while signed in, or right away when you delete your account.
• Voice-usage records (minutes per session): 24 months after your last session.
• Cloud copy: 24 months after it was last saved or read.
• Email sign-ups: unconfirmed ones after 7 days; confirmed ones 24 months after you last signed up, or when you ask us to delete them. Email send history: 24 months after the last email. If you unsubscribe, we keep your address on a “do not email” list so we never email you again.
• Reports about AI replies: we keep the 500 most recent.
• Billing records: at Stripe, as long as needed for tax, accounting and legal purposes (typically up to 7 years).
• Analytics counts and the random device record: about 400 days. Ad click data stored with your account: about 13 months. Google conversion rows (the offline-upload queue): about 90 days.
• When you delete your account we keep a one-way hash of your account ID and how many free-trial minutes it used, for up to 24 months, so the free trial can't be reset; it can't be used to identify you.
• Rate-limit counters: minutes to two days.
• AI provider: as described in section 2.

We also review stored data monthly and remove anything that has outlived these periods.

8. Your choices and rights

Wherever you live, you can:

• Delete your account in the app: Ajustes › Tus datos › Borrar mi cuenta. It cancels an active subscription, deletes your account and everything stored with it on our servers (including your cloud copy, email sign-up and send history), and clears the app on that device. If you used Sign in with Apple, it also revokes Paseo's access to your Apple Account, so Paseo no longer appears under Sign in with Apple in your Apple Account settings. Deleting the app from your phone does not delete your account; use “Borrar mi cuenta” for that. You can also email us; see how to delete your account. We'll confirm when it's done, normally within 30 days (and no later than 45 days).
• Access and take a copy of your data: Ajustes › Tus datos › “Descargar copia” saves everything the app keeps; email us for what's on our servers.
• Correct information that is wrong (most of it you can edit in Ajustes).
• Choose what your cloud copy includes, or turn it off, in Ajustes › Tus datos.
• Opt out of marketing emails using the unsubscribe link, and opt out of targeted advertising by choosing “No” in the consent notice, turning on Global Privacy Control in your browser, or emailing us.
• Turn off sensitive practice topics at any time.

To protect your privacy, we may need to verify your identity before acting on a request made by email, usually by confirming control of the email address on your account. You may use an authorized agent where the law allows. We won't discriminate against you for exercising your rights. If we deny your request, you can appeal by replying to our decision; we'll respond within the time the law requires.

9. Notice for U.S. state residents

Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with consumer privacy laws have the rights described in section 8, as provided by their state's law. In the past 12 months we have collected the categories of personal information described in section 1: identifiers (such as name, email, device identifiers), commercial information (subscription and purchase records), internet or network activity, audio information (voice), inferences about your learning level and preferences, and, only if you enable recovery topics, sensitive (health) information you choose to share. We collect them for the purposes in section 4 and disclose them to the categories of recipients in section 5. We use sensitive personal information only to provide the Service you requested.

California's “Shine the Light” law: we do not share personal information with third parties for their own direct marketing purposes.

[LAWYER: confirm whether thresholds for each state law apply at launch, and adjust this section accordingly.]

10. Age requirement

Paseo is for adults 18 and over. The app asks you to confirm your age before you start, and it is not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18; if you believe someone under 18 has given us personal information, email support@getpaseo.app and we will delete it. [LAWYER: review state app-store age-signal laws before an app-store launch.]

11. Security

We use encryption in transit (HTTPS), short-lived keys for voice sessions so our AI provider key never reaches your device, access controls on our database, one-way hashes instead of raw sync keys and IP addresses, and we limit what we store in the first place (for example, transcripts stay out of the cloud copy unless you include them). Our staff can see stored data only to run the Service and help you. No method of transmission or storage is completely secure, so we can't guarantee absolute security. Data stored on your device is protected by your device's own security; please use a screen lock.

12. International users

We are based in the United States, and our service providers process data in the United States and other countries. If you use the Service from outside the U.S., your information will be transferred to and processed in the U.S., where privacy laws may differ from those in your country. [LAWYER: if marketing to the EU/UK, add GDPR/UK GDPR details: legal bases, controller details, transfer mechanisms and a right to complain to a supervisory authority.]

13. Changes to this policy

We may update this policy as the Service changes. If we make material changes, we'll update the date above and notify you in the app or by email before the changes take effect.

14. Contact us

[LEGAL ENTITY NAME]
[MAILING ADDRESS]
Email: support@getpaseo.app

← Back to Paseo · Terms of Service · Delete your account