Privacy policy

1. Who we are

The Dilo app is made by 1572612 B.C. Ltd., doing business as The Kode, a company in British Columbia, Canada. In this policy “we” and “us” mean that company, and “the app” means the Dilo app for iPhone and the server it talks to.

This version is dated 20 October 2026.

2. The short version

  • Your audio is not saved, and the app sends no audio to us or to our AI partner.
  • In a roleplay, the text of what you say, and a few facts you give us (first name, city, work, plans), go to our server and to our AI partner, Anthropic.
  • A record of your progress (which lines were right, how fast you answered, how long you spoke; never the words you said in a drill) goes to our server.
  • While Dilo is in beta, roleplay transcripts are kept. Erasing your data from Settings while keeping your account is coming before the public beta; until then, deleting your account is the way to remove it. Deleting your account deletes everything about you from our server, except the two items under “Kept after you delete your account” in section 6. When Dilo leaves beta we expect to keep roleplay turns for a shorter, fixed time, and this policy will say so before that changes.
  • No ads, no tracking, no analytics or session replay software.
  • No person hears your roleplay. A tutor reads a sample only if you agree.
  • You can have your account and what we hold for it deleted (section 9).

3. What we collect and why

What you tell us at the start. Your first name, city, work, plans and why you are learning, and your own words from the Why step, if you gave them; whether you start from zero, your goal date, how many minutes a day you want, whether you declined the microphone, and when to remind you. All of it is kept on your phone. Your own words from the Why step never leave your phone. Your first name, city, work and plans, and your reason (one of five fixed answers), also go to our server each time you start a roleplay, so your partner can talk about your own life. Your city is the text you type; the app does not use your location.

What you say in a roleplay. For each turn: the text the recogniser heard, its other readings, how sure it was, how long you spoke, whether it heard Spanish or English, and whether you tapped for help. Our server stores these with your partner’s reply, which goals of the task you met and how the task is going. At the end, our server asks our AI partner to write your corrections report: what went well, up to five corrections (each one quotes what you said), what to work on next and a short summary. We also keep the session’s scenario, start and end times, how it ended and some counts (turns, help taps, English turns).

Your partner’s memory. From each report our server keeps up to ten lines about errors you make often and the summaries of your last five sessions, so the partner remembers earlier sessions.

Your progress. Your cards, reviews and lessons are kept on your phone. The app also sends our server a record of your progress: which lessons, drills and reviews you did, whether each line was right, how fast you answered and how long you spoke, with the time of each (POST /v1/progress-events, stored in progress_events). It never sends the words you said in a drill, or your audio. We use it to see whether the course works and to fix it. It is deleted with your account (section 9).

The identifiers that keep you signed in. The first time the app talks to our server it makes a random device id and gets a sign-in token, which lasts 24 hours and is renewed with the device id. You do not need an account with an email or password. The device id is a pseudonymous identifier: it does not carry your name, but it links your sessions together. Both are kept in your phone’s Keychain. Our server keeps the device id and an account id, and keeps no copy of the token.

Sign in with Apple, if you use it. Apple gives our server a signed token. From it our server keeps Apple’s stable user id for you, so you can sign in on another phone, and, for about ten minutes, a hash that stops the same sign-in token being used twice; it names no one. The app does not ask Apple for your name or email, and our server keeps neither. If you sign in with Apple on a phone you have already practised on, that practice moves into your Apple-linked account.

What the app does not collect. No contacts, no location, no advertising identifier, no cross-app tracking. To limit sign-in attempts our server holds your IP address in memory for about an hour: it is dropped at the next sign-in attempt after that hour, or when our server restarts. It is not written to the database or to our logs.

4. Your voice and speech recognition

The app listens through the microphone in drills and roleplays, and turns what you say into text with Apple’s speech recogniser (SpeechTranscriber). It listens for Mexican Spanish (es-MX), and in a roleplay also for US English (en-US), to notice when you switch to English. Apple describes this recogniser as running on your phone, and the app installs its language model on the phone (it is downloaded from Apple); the older “on device only” switch belongs to an Apple API the app does not use. Whether Apple’s framework sends any audio to Apple is governed by Apple’s own terms and by the permission sheet your phone shows when the app first asks to recognise speech; Dilo’s own code sends no audio anywhere.

The app keeps your audio in memory only while you speak one line. It does not save it to a file and does not send it to our server or to Anthropic.

In a drill, the text the recogniser heard is used to score your attempt and then dropped; only the result is kept on your phone. In a roleplay, the text of each turn is sent to our server and to our AI partner (section 5).

If you decline the microphone, you can tap through drills instead of speaking.

5. The AI partner

Your roleplay partner and your corrections are written by Anthropic’s Claude models. Our server calls Anthropic; your phone never does.

For each roleplay turn and for the corrections report, Anthropic receives:

  • the task, the scenario and the Spanish your lesson allows;
  • your first name, city, work, plans and reason for learning, when given;
  • your partner’s memory: the lines about errors you make often, and your last five session summaries;
  • the partner’s opening line;
  • every earlier turn: the text of what you said, whether you tapped for help, and the partner’s reply;
  • the turn you just spoke, and every turn in the report request: also the recogniser’s other readings, how sure it was and the language it heard; and in each turn’s request, which goals you have met so far;
  • for the report, also our session id and how the session ended.

Anthropic does not receive your audio, your Apple user id, your device id, your account id or your IP address.

Anthropic processes what it receives under its terms for API customers, which set how long it keeps it; we hold no copy of your data at Anthropic beyond what those terms allow.

No person hears or reads your roleplay as part of how the app works, unless you give the rating consent (section 7). The person who builds Dilo can read the server database, and may read a transcript to fix a fault you report.

6. How long we keep it

Roleplay turns. Our server runs a clean-up every hour while it is running. While Dilo is in beta the clean-up deletes no roleplay turns: the setting that sets its age (RETENTION_DAYS) is 0, which means never.

Kept while Dilo is in beta, until you erase your data or delete your account:

  • your roleplay turns: what you said, the other readings and the partner’s replies, and the partner’s opening line;
  • your corrections report, whose corrections quote what you said;
  • your partner’s memory: the lines about errors you make often and your last five session summaries;
  • your first name, city, work, plans and reason;
  • each roleplay’s scenario, times and counts;
  • your progress events (section 3, “Your progress”);
  • rated samples, if you gave the rating consent (section 7).

Erase my data in Settings deletes all of the above and keeps your account; it is built before the public beta.

If you delete the app, or erase this phone in Settings, and start again without signing in with Apple, the app starts a new anonymous account; the earlier one and what it holds stay on our server until you ask us to delete them (section 15).

Kept after you delete your account:

  • an account id and the times when the account was made, when it was deleted and, if you linked Apple, when that link happened. Old sign-in tokens stop working because the account is marked deleted, and the same phone or Apple ID would start a new, empty account;
  • counts of our calls to the AI models (which model, how many tokens, how long, when), linked to that account id, with no text of what you said, so we can track cost.

Rated samples are deleted with your account.

On your phone. What the app keeps on your phone stays until you erase it or delete the app. Deleting the app deletes its database. The sign-in item in the Keychain may stay on the phone after you delete the app. Deleting your account in the app (Settings, Your data, Delete account, then Delete everything) also clears it; a deletion we do for you on request does not reach your phone (section 9).

Server logs and backups. Our server’s error lines name the error, never the text of what you said. Our hosting provider keeps our server’s logs for a limited time set by the provider. Deleted data may remain for a limited time in our database provider’s backups, as its service provides.

This is optional and off unless you give it. You give it for one corrections report at a time. When you do, our server copies, within about an hour while it is running, else at its next start, each correction in that report together with the text of the turn it corrects. In the copy your first name and city are replaced with placeholders. Your work, your plans and anything else you said in that line are not replaced. A Spanish tutor working with us will read these samples and rate whether the corrections were right, once we have a way to send them; today the app and our server have none.

While Dilo is in beta, the copies and your roleplay turns both stay until you erase your data or delete your account (section 6).

Switching it off: the Share rated samples switch in Settings stops consent being given for your next corrections reports. It does not withdraw a consent you have already given, in the app or on our server: samples already copied stay until you delete your account; to have them removed sooner, write to us (section 15) and we will agree a way to identify your account (section 9).

The oral check. At the end of a level the app runs a short speaking check. For each goal of that check our server keeps the text of what you said, with your first name and city replaced by placeholders, and the app’s verdict, so a tutor can check the app’s scoring. This does not need the rating consent and holds no recording. These rows are deleted with your account.

8. Who we share it with

  • Our hosting provider, Fly.io, which runs our server in its US East region (Virginia, United States) and keeps its logs.
  • Our database provider, Neon, a managed Postgres service, which stores the server data in sections 3 to 7.
  • Anthropic, our AI partner, as in section 5.
  • Apple, which provides the speech recogniser (section 4) and Sign in with Apple. When you sign in with Apple, our server fetches Apple’s public keys to check the token; it sends Apple nothing about you.

The partner’s voice is your phone’s own voice; no speech service receives the text it speaks.

We do not sell your data, we show no ads, and we give nothing to data brokers or advertisers.

9. Your choices and rights

Delete your account. Deleting your account removes from our server your device and Apple links, your profile facts, your partner’s memory, every roleplay with its turns and corrections report, your progress events, and any rated samples, in one step. What stays is listed in section 6. In the app: Settings, Your data, Delete account, then Delete everything. It deletes your account on our server first, then clears the sign-in item on your phone and erases everything the app keeps there. If you no longer have the app, write to us at the contact in section 15 and we will agree with you a way to identify your account, since our server holds no email and the app shows no account id. A deletion we do for you on request does not reach your phone, so delete the app as well to erase what it keeps there; if you keep using the app, the next time it talks to our server it starts a new, empty account. Deleting your account does not change your Apple ID. You can also stop Dilo using your Apple ID from your iPhone’s Settings (your Apple account, Sign in with Apple).

The rating consent. Optional; see section 7 for what it does and the current limits on switching it off.

The microphone. You can decline the microphone when the phone asks, or turn it off later in the iPhone’s Settings. You can tap through drills instead of speaking.

Access and correction. To ask what we hold about you, or to correct it, write to us (section 15); we will first agree a way to identify your account, as for deletion. The app has no export button yet.

Your rights where you live. We use your data to provide the app you asked for; for the rating samples and for messages to your phone we rely on your consent. Depending on where you live you may have the right to ask what we hold about you, to have it corrected or deleted, to object to or restrict some uses, to receive a copy, and to complain to your privacy regulator. Write to us (section 15) to use any of them; we answer within the time the law where you live allows.

10. Children

You must be at least 13 years old to use Dilo. If you live in the European Economic Area or the United Kingdom, you must be at least 16. The app does not ask your age. If you think a child under these ages has used Dilo, contact us (section 15); we will agree a way to identify the account (section 9) and delete it.

11. International transfers

Our server runs in the United States (Fly.io, US East). Our database provider and our AI provider also process data in the United States or in other countries where their services run. If you live elsewhere, your data is transferred there, where privacy law may differ from where you live; by using Dilo you accept that.

12. Security

  • Your device id and sign-in token are kept in your phone’s Keychain, readable only after the phone has been unlocked once since it started, on this phone only, and not synced to iCloud.
  • Sign-in tokens are signed by our server and expire after 24 hours.
  • The app allows only encrypted (HTTPS) connections to our server.
  • Our server accepts only encrypted (HTTPS) connections, for the app and for the website’s waitlist form.

No system is free of risk. If something goes wrong with your data, contact us (section 15).

13. The website

The Dilo website has a waitlist form. When you send it, our server stores your name, your email, your phone number, the goal you picked and which headline you saw, once per email address; our logs record only that a signup happened, never who. We keep them to send you a beta invitation and the Dilo notes by email, and, only if you tick the box in the form, to message you about the beta by text or WhatsApp; with that tick we store when you gave it and the words you agreed to. We keep these until the beta’s invitations are sent and the notes end, or until you ask us to delete them (section 15). To stop messages, say stop in any message or write to us; to stop the notes, unsubscribe from any email. Only the person who builds Dilo sees them. Today no other service receives them; if we start using an email or messaging service to send the notes or the invites, this section will say which. To limit posts, our server holds your IP address in memory for about an hour, as in section 3, and never writes it down. The site sets no cookies and runs no analytics; it remembers in your browser’s local storage which headline you saw and, once you have joined the waitlist, that you joined, so the form does not show again on that browser. Neither holds your name or email, and clearing the site’s data in your browser removes both.

14. Changes to this policy

When this policy changes we update the date in section 1. If a change matters to what we collect or share, we tell you in the app, or by email where we have your address.

15. Contact

1572612 B.C. Ltd., doing business as The Kode. Write to [email protected].