Privacy Policy

Last updated: September 20, 2026. This page describes exactly what Speak & Fix stores and why.

Speak & Fix is an independent, individually-run project (not a registered company), operating the website at english-practice.site. This policy explains what information the app collects, how it's stored, and the choices you have.

Account information

To use Speak & Fix you create a username and a PIN/password. The username is stored as you typed it and in a normalized form used to look up your account; the PIN/password is never stored in plain text — only a one-way cryptographic hash (Argon2id, where supported by the server) is kept, which cannot be reversed back into your original PIN.

Conversations and flashcards

Your chat messages, corrections, and any flashcards generated from them are stored so that your practice history and progress persist between sessions and devices. This content is tied to your account and is not visible to other users.

Your AI provider API key

Speak & Fix uses a "bring your own key" (BYOK) model: to chat, you supply your own API key from a supported AI provider (or a custom OpenAI-compatible endpoint). That key is:

• encrypted with AES-256-GCM before it is stored, using a server-side encryption key that is never sent to any browser;
• decrypted only momentarily, on the server, to be returned to your own logged-in session so your browser can use it to talk to your chosen AI provider directly;
• never shared with any other user's account, and never used by Speak & Fix itself to make calls on your behalf outside your own sessions.

Because BYOK means your browser talks directly to the AI provider you chose, that provider (for example Google, Groq, or another OpenAI-compatible service) receives the messages you send during a chat and processes them under its own privacy policy and terms — Speak & Fix does not control how a third-party AI provider handles data once it reaches them.

Cookies and sessions

Speak & Fix uses a single session cookie to keep you signed in. It is required for the app to function (there is no way to use the account features without it), is marked HTTP-only and Secure, and is not used by Speak & Fix for advertising or cross-site tracking. (Advertising cookies set by Google are described in the Advertising section below.)

Rate-limiting and security records

To block repeated failed sign-in attempts and automated abuse, the server temporarily records the number of recent attempts against an IP address or username and, if that record shows a genuine account deletion carried out by an administrator, a small log entry (the action, the affected username, the IP address, and the time). This log never contains passwords, PINs, or API keys.

Advertising and third-party cookies

Speak & Fix shows advertising served by Google AdSense on its public pages (the home page, About, Contact, legal pages, and the Learn English guides). Ads are not shown inside the signed-in practice app. The following applies to that advertising:

• Third-party vendors, including Google, use cookies to serve ads based on a user's previous visits to this website and other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet.
• You can opt out of personalized advertising by visiting Google's Ads Settings. You can also opt out of some third-party vendors' use of cookies for personalized advertising at aboutads.info.
• To learn how Google uses data from sites that use its services, see policies.google.com/technologies/partner-sites, and for more on Google's advertising technologies see policies.google.com/technologies/ads.

Speak & Fix does not control the cookies set by Google or its advertising partners. Where the law requires it (for example for visitors in the European Economic Area, the United Kingdom, and Switzerland), a consent message is shown so you can choose whether personalized advertising cookies are used.

Analytics

Speak & Fix does not currently run any separate analytics or tracking service beyond what is described above under Advertising. If that changes, this policy will be updated to reflect it before it happens.

Your control over your data

Inside the app, you can clear all of your stored conversation history and clear all of your flashcards yourself at any time from the History and Flashcards screens — this removes that content immediately. To delete your account entirely, contact support@english-practice.site with the username to be removed; account deletion permanently removes your stored conversations, flashcards, and encrypted API keys and cannot be undone.

Security measures

Passwords/PINs are hashed, never stored in plain text. Provider API keys are encrypted at rest with AES-256-GCM. All traffic is served over HTTPS. Requests that change your data require a matching CSRF token in addition to a valid session, and repeated failed sign-in attempts are automatically throttled.

Changes to this policy

If this policy changes in a way that materially affects how your data is handled, the "last updated" date at the top of this page will change and, where practical, the update will be noted in the app.

Contact

Questions about this policy or your data can be sent to support@english-practice.site.