Privacy policy

Last updated: 28 October 2026 · Effective from: 28 October 2026

1. Controller

The Steve Academy is a service for practising English. The site is thesteveacademy.com. The controller is CleanXpress SG LLC, a company formed in Florida, USA, with its seat in Homestead, Florida. This policy explains what personal information the service handles, why, and for how long. It is part of the Terms of use.

2. Scope

This policy covers the account, the course, chat, rooms, reminders and, when payments are on, billing. It does not cover third-party sites you open from a link.

3. Data we collect

• Account. Username, name, email and the password as a one-way hash, not in plain text. Also the language, the level, placement and welcome answers, progress, streaks, points and badges.
• Learning and community. Lesson attempts, the review calendar, chat messages, friendships and communities you join.
• Birth. Only the month and year, never the day. If you are under 16, a parent or guardian’s email, only to ask for consent. That email does not appear on a public profile.
• Payments, when payments are on. Stripe processes the card. We do not store the number. We store the customer id, the subscription id and the invoice history. To prevent repeat free trials, we keep an anonymized record (a one-way code of the email and the card), even after the account is deleted.
• Email. Verification, password reset, an email change, security notices and, when needed, a parent or guardian’s consent. We do not sell your email.
• Reminders. If you turn on the daily reminder, the time, the time zone and, if you allow browser notices, the notification subscription.
• App push notices. Only if you turn them on in Profile: the device identifier, the platform (iOS or Android), the app version, your preferences (time, time zone and quiet hours), the date of the last notice and, separately, whether you accept Premium offer notices, with its date. Offer notices are sent only with that consent and only to people aged 18 or over. We send at most 2 notices a day and none during your quiet hours.
• Voice and text. In most exercises, pronunciation and speech recognition are done by your browser or your system (Apple or Google, depending on your device), under their own rules. In the speaking exercises of the unit reviews, the app records a short clip with the microphone and sends it to Google Gemini to be turned into text. We do not store the audio: we keep only the text and the result. In role-play, the text may be sent to Google Gemini. The character’s voice is generated by Google Gemini, not as a file on our server.
• iOS and Android app. The app may ask for permission to use the microphone (speaking exercises and voice rooms), the camera or photo gallery (only to choose your profile photo, if you are over 18) and push notifications (notices). Each permission is optional, is asked only when you use that feature, and you can remove it in your phone’s settings. If you turn on notifications, the system creates a device identifier to deliver them; only if you turn the notices on in Profile, that identifier is stored on our server and sent to Firebase Cloud Messaging (Google) to deliver them. We delete it when you turn the notices off, when you log out or when you delete your account. The data we collect is the same as on the website: email, name, username, month and year of birth, progress, your writing and, if you use it, the text of what you say aloud. You can delete your account and your data from the app itself, in Profile.
• Writing and the oral exam. Your unit writing is stored in your account together with its correction. In the oral exam your browser turns your voice into text and only that text reaches our server. We keep the transcript for 12 months; after that we delete it, with the detailed feedback, and keep only the mark. The audio recording is never sent or stored.
• Profile photos. Only users aged 18 or over can upload a profile photo from their phone’s gallery or camera, as a JPG, PNG or WebP file of up to 5 MB. Each photo is automatically reviewed by an artificial intelligence system (Google Gemini) to prevent inappropriate content, and is stored securely in our cloud storage (Cloudflare R2). The photo can be changed up to 3 times every 7 days and is deleted when the user replaces it or deletes their account. Minors use avatars.
• AI conversations and reports. The text you write in checkpoints and role-play, the character’s replies, the corrections and the evaluation are saved in your account to show your progress. If you tap “Report AI content”, we save the flagged reply, the reason, your optional note and your username so a person on the team can review it. All of this is deleted when you delete your account.

4. Why and the basis

5. Minors

• Minimum age: 13. We do not create an account for a person under 13 and we do not ask for a parent or guardian email for that age. If someone under 13 already had an account, or enters a month and year that make them under 13, we delete the account and its data.
• If you are under 16 (from 13 to 15), a parent or guardian must consent. Until they confirm, the account stays inactive and we collect no further data. If nobody confirms, we delete that signup after 7 days.
• If you are under 18, you do not appear in rooms or leaderboards with strangers, and we do not show chat with strangers. Buying Premium, when payments are on, asks for an adult’s confirmation checkbox.
• We ask only for the month and year of birth. Older accounts without those data are asked once, at the next sign-in.
• For a person under 16, role-play uses stricter safety filters and the characters are fictional, with no contact with other people.
• If you are under 18, you cannot upload a profile photo and you keep a drawn avatar.

6. Payments

When payments are on, Stripe handles the card in the United States. We do not store the card number. We store identifiers and invoices to show the plan and the receipts. Premium that an administrator turns on, and free days from a coupon, create no charge. There is no in-app purchase in the App Store or Google Play today.

7. Artificial intelligence

In role-play, the text you type, or the text the browser recognised, may be sent to Google’s paid Gemini API to draft a character’s reply. Under Google’s paid-service terms, that text is not used to train models. Safety filters apply. If you are under 16, the filters are stricter. The characters are fictional, with no contact with other people. Google Gemini also generates the character’s voice.

We use artificial intelligence to correct unit writing and for the oral exam. The text of your writing is sent to Google’s paid Gemini API to be corrected. In the oral exam, the text of the conversation (what your browser recognised) is sent to Gemini so the examiner can reply and to grade it. In the oral exam we do not send your audio, only the text your browser recognised. In the speaking exercises of the unit reviews we do send a short audio clip to Gemini to turn it into text, and we do not store it. The correction and the mark come from the AI, with no review by a person, and it can make mistakes. Under Google’s paid-service terms, that text is not used to train models.

Before a profile photo is shown, we send a copy to Google Gemini to check for nudity, graphic violence and hate symbols. If the check refuses the picture, we do not show it and we tell you the reason. Under Google’s paid-service terms, that picture is not used to train models.

8. Voice rooms, video and notices

• Voice rooms. If you join a voice room, the microphone is for a live call with other people. The audio goes from person to person. We do not store a recording. Google STUN only helps find the path of the call.
• Video. If a lesson includes a video, it is shown through youtube-nocookie.com. No published lesson includes a real video today. When one does, YouTube may handle data under its own rules.
• Browser notices. The in-app reminder and the calendar work without them. A browser notice is used only if you allow it and that feature is on. In the app, push notices work only if you give permission on your phone and turn them on in Profile. You can turn them off there at any time. Premium offer notices need a separate consent and are offered only to people aged 18 or over.

9. Cookies

In the browser we only use session cookies: the browser removes them when it closes and we do not set an expiry date on them. In the iOS and Android app, the sign-in cookie (ea_session) is persistent and lasts up to 30 days, so you do not have to sign in every time you open the app; it is removed when you sign out, when you delete the account or after 30 days. We do not use advertising or tracking cookies.

This device may also keep local settings, such as the language, the sound, whether you hid today’s reminder and whether you closed the cookie notice. That is not a cookie. The app uses your IP address for a moment, in memory, to limit repeated requests. We do not sell it or build a profile with it.

10. Processors

We share data only with those who are needed to provide the service. We do not sell your information.

11. Your rights and a copy

You can ask for access, correction, restriction or objection, and for a copy of your data. The copy is downloaded on My account. Profile does not have the download button; from there you can open account deletion. You can also email support@thesteveacademy.com if you prefer to ask by email.

12. Retention

• The account and the progress are kept while the account exists.
• If we keep a report about an account, including a report of a profile photo, we keep it for 12 months. The profile photo leaves storage when you delete it or when the account is deleted.
• Invoices are kept for 7 years. Technical logs, 30 days. Support, 24 months. Backups, 30 days.
• If an account is unused for 24 months, we may email you and, if you do not reply, delete it. There is no automatic job today that sends that notice.
• These figures are the retention rule. There is not yet a scheduled job that deletes invoices at 7 years, logs at 30 days or support messages at 24 months.

13. Transfers

The providers in section 10 handle data mainly in the United States, and Cloudflare and Google also in other countries. If you use the service from China, you accept that your data is handled outside China, as this policy describes. If your country requires a specific safeguard for that transfer, we apply the one that fits when payments and use from that country are underway.

14. Deleting the account

On Profile and on My account you can delete the account. It is not one tap: first you see what is lost (progress, XP, streak, certificates and Premium) and you can cancel. Then we ask for the current password. If payments are on and a Stripe subscription is active, we cancel it at that moment, before the account is deleted. If Stripe does not cancel, we do not delete the account. Chat, progress, friendships, notice device identifiers and preferences, and the other personal rows are removed. Payment rows are kept without your user id. We email you a confirmation. You can also write to support@thesteveacademy.com. If you delete the account, we also remove the profile photo from storage. The steps, without signing in, are on How to delete your account.

15. Security

We protect the account with a hashed password, signed session cookies and limited access. No internet service is impossible to break. If you think someone signed in without permission, email support@thesteveacademy.com and put Security in the subject.

16. Changes

We may update this policy. The date at the top is the date of the current version. If the change is important, we will email you at least 30 days in advance. It does not affect a period you already paid.

17. Brazil and other countries

If your local law gives you more rights, they apply. In Brazil you can write to Steven Galvez at support@thesteveacademy.com.

18. Contact

Write to support@thesteveacademy.com or use the Contact page. Include your username. Controller: CleanXpress SG LLC, Homestead, Florida, USA.