Privacy Policy
Effective 14 August 2026
SpeakUp Gym is a live speaking-practice service. You are paired with another member for a timed voice session, you get feedback, and your progress is tracked over time. Doing that means holding some information about you. This policy sets out exactly what, why, for how long, and what you can make us do about it.
We have written it to be read rather than skimmed past. Where a practice might surprise you, we say so plainly instead of burying it.
1. Who we are
SpeakUp Gym is operated from the Philippines and is the Personal Information Controller for the data described here, under the Data Privacy Act of 2012 (Republic Act 10173) and the rules of the National Privacy Commission. If you are in the EU, UK or California, the rights described in section 12 are extended to you as well.
Our Data Protection Officer can be reached at hello@speakupgym.com.
2. What we collect
Account information
Your name, email address and a member code. Sign-in is handled by our authentication provider, so we never see or store your password. If you sign in with Google, we receive your Google account email and identifier.
Profile and progress
Your interests, placement-quiz result, level, streak, gems balance and transactions, achievements, league standing, session count and banked speaking time. If you upload a profile photo it is stored in a bucket that is publicly readable, so treat it as a public picture.
Practice and safety data
Which rooms you enter, when your sessions ran and how long they lasted, the prompts you have already seen, and the ratings, trait tags and written feedback exchanged after a session. Feedback runs both ways: what you write about a partner is stored and attributed to you, and what they write about you is stored too. We also keep reports and blocks, and a safety score derived from them.
Messages you send in a practice room
The text chat inside a room is stored with the session it belongs to, so that reloading the page does not lose the conversation and so that we can look at what was said if someone reports it. Voice is never recorded by us: the only recording is the one you switch on yourself, which captures your own microphone and never your partner's, and which is kept for you for 30 days. Room conversations are deleted after 90 days. If you delete your account, the messages you sent are emptied straight away.
Learning progress
For members with Learning Hub access: which lessons and ebooks you have opened, how far through each one you are, your last video position and last page, and your bookmarks.
Device and technical data
Standard server logs, and your IP address at the time of a security-relevant action. In the mobile app we also record a device fingerprint. That fingerprint is one-way hashed on your device with a random local salt, so it identifies the handset without describing it, along with the platform, a coarse OS and app version, and a device model. This exists to detect account takeover and abuse.
Support communications
If you email us, we keep the message and our reply so we can deal with it and refer back to it later.
3. Why we collect it, and our legal basis
| What we do | Why | Basis |
|---|---|---|
| Create and secure your account | You cannot use the service without one | Performance of a contract |
| Match you with a partner and run the session | This is the service itself | Performance of a contract |
| Track progress, streaks, gems and leagues | Features you signed up for | Performance of a contract |
| Take payment and manage your subscription | To sell you a plan | Performance of a contract |
| Ratings, reports, blocks, safety score, device signals | Keeping members safe from each other in live voice rooms | Legitimate interest, and legal obligation where abuse is reported |
| Optional analytics | To learn which parts of the product are used | Consent, which you can withdraw |
| Send service email such as password resets | You asked for it, or it is required to run the account | Performance of a contract |
4. Live audio and recordings
Your live conversation is not recorded. Session audio is relayed in real time between you and your partner and is not captured or stored by us. In-session text chat is held in memory for the length of the session and then discarded.
You can record yourself, and only yourself. There is an opt-in switch in the practice room that records your own microphone. It is deliberately wired to your microphone rather than to the call, so a partner's voice is never captured. They have not agreed to be recorded by a stranger, and the product does not let you do it.
Recordings you make are saved to your account so that they follow you to any device you sign in on. They are held in private storage that is not publicly readable, and playing one back uses a link that expires after a short time, so a copied link does not give anyone lasting access. Only you can reach your own recordings. You can play one back or delete it at any time from My Session Recordings, and deleting one removes both the entry and the audio.
Recordings are kept for 30 days and then deleted automatically. Download any you want to keep for good. If an upload does not go through, the recording stays in your browser on that device instead, and My Session Recordings shows it separately so you can download or delete it.
This changed in August 2026. Recordings used to be stored only in the browser that made them, which meant a member who cleared their browsing data, or whose phone reclaimed the space, lost the only copy. They are now held for you instead, under the retention above.
Speaking Timeline clips are a separate, deliberate exception. These are short recordings you choose to save to chart how your speaking changes over months, so they are kept until you remove them rather than being swept. See section 11 for what that means today.
5. Identity verification
Verification today is a manual review request. When you submit it we record that you asked, and an administrator approves or rejects it. We do not currently collect, upload or store an ID document or a selfie, and there is no facial recognition or liveness check anywhere in the service. If that changes, this policy will be updated before the collection starts, and we will ask for your explicit consent at the point of upload.
6. Payments
Subscriptions are processed by PayMongo. You are sent to their hosted checkout to pay, so your card number, e-wallet credentials and billing details are handled by them under their own security and never reach our servers. What comes back to us is the payment identifier, the amount, the currency, the plan and whether it succeeded.
When a payment fails to process correctly we store the message the provider sent us so the payment can be recovered rather than lost. That message can contain the billing name and email you gave the provider.
7. Cookies and analytics
We use a small number of cookies, and we run our own analytics rather than embedding anyone else's. There are no advertising pixels, no remarketing tags and no third-party trackers on this service. Analytics only run if you allow them, and you can change your mind at any time.
The full list, what each cookie does and how long it lasts is on the Cookie Policy page.
8. The referral programme
If you arrive through someone's invite link, we store a cookie recording who invited you so they can be credited when you subscribe. We keep your referral code, who referred you, and the commissions owed on subscriptions from people you referred.
To stop people paying themselves by signing up twice, we check whether a new account shares a device fingerprint or IP address with the account that referred it, and withhold the reward if it does.
9. Who we share it with
We do not sell your personal data, and we never have. We share it only with the providers that run the service:
| Provider | What they handle |
|---|---|
| Supabase | Sign-in, the database, and file storage |
| Vercel | Website hosting |
| Railway | The realtime server that runs sessions |
| Agora | Live voice audio between you and your partner |
| PayMongo | Payments |
| Upstash | Rate limiting that protects the service from abuse |
We also disclose data where the law requires it, or where it is necessary to investigate abuse or protect someone's safety.
10. Where your data is held
Our database and file storage are hosted in the Asia Pacific region, and our website functions run in the same region to keep them close to it. Some providers listed above operate globally and may process data outside the Philippines. Where they do, the transfer is covered by that provider's contractual terms, and we remain accountable for your data under the Data Privacy Act regardless of where it is processed.
11. How long we keep it
| Data | Kept for |
|---|---|
| Account, profile and progress | As long as your account exists |
| Session history, ratings and feedback | Kept after account deletion, because it is also your partner's record |
| Your own recordings | Private storage, reachable only by you through short-lived links. Deleted after 30 days |
| Speaking Timeline clips | Until removed. See the note below |
| Payment and subscription records | Retained for accounting and tax purposes |
| Security and admin logs | Retained for investigation |
| Analytics events | Not linked to your account after deletion, but the event itself is retained |
Two things we want to be straight about, because we would rather tell you than have you find out.
- Speaking Timeline clips are not yet covered by an automatic deletion schedule, and are not yet removed when an account is deleted. Building that is on our list. Until it ships, email us and we will remove them by hand.
- When you delete your account we anonymise your record rather than erasing the row, because your sessions and the ratings you gave are also part of your partners' history. Your name, email and photo link are removed, your sign-in is destroyed so the account can never be used again, and what remains cannot be traced back to you through the service.
12. Your rights
Under the Data Privacy Act you have the right to:
- be told what we hold about you and why
- get a copy of it
- have it corrected if it is wrong
- object to how we are using it
- have it erased or blocked
- have it moved to another service
- claim damages if you are harmed by a breach of the law
- complain to the National Privacy Commission
If you are in the EU or UK, the equivalent rights under the GDPR apply, including withdrawing consent at any time. If you are in California, you may request disclosure or deletion, and you have the right not to be discriminated against for exercising it. We do not sell personal information, so there is nothing to opt out of.
You can delete your account yourself in Settings. For anything else, email us and we will respond within the period the law allows. A machine-readable export is not yet self-service, so ask us and we will produce it for you.
13. Age and minors
SpeakUp Gym pairs members with strangers for live voice conversation, and it is built for adults. We ask that you do not use it if you are under 18.
We should be honest about the limit here: there is currently no age check at sign-up, so this is a rule we state and enforce on report rather than one the product verifies. If we learn that an account belongs to a minor we close it and delete the associated data. Building a real age gate is a priority.
14. How we protect it
- Everything travels over an encrypted connection, and the database and file storage are encrypted at rest.
- Your own recordings, Timeline clips and Learning Hub media all sit in private storage reachable only through short-lived links.
- Administrative access is restricted, and every administrative action is written to an audit log.
- Requests are rate limited to blunt automated abuse.
- Payment credentials never reach our servers.
No service can promise perfect security. If a breach occurs that puts your rights at real risk, we will notify the National Privacy Commission and the members affected within the period the law requires.
15. Changes to this policy
We may update this policy. When we do, the effective date at the top changes. If a change materially affects what we collect or why, we will tell you in the app rather than relying on you to re-read this page.
16. Contact
Questions, requests, or a complaint: hello@speakupgym.com, marked for the attention of the Data Protection Officer. If you are not satisfied with our answer you may complain to the National Privacy Commission at privacy.gov.ph.