LegalReactor
Privacy Policy
Effective date · June 10, 2026
This Privacy Policy explains how Reactor — the mobile application and the website reactorlang.com (“Reactor”, “we”, “us”) — collects, uses, shares and protects your personal data, and the rights you have. Reactor is a global service: this Policy applies wherever in the world you use the App, and we explain below the additional rights you may have under your local law.
1. Who we are (data controller)
The data controller for your personal data is the operator of Reactor (reactorlang.com). For any privacy question or request, contact support@reactorlang.com. We have not appointed a statutory Data Protection Officer; privacy requests go to the contact above.
2. Scope
This Policy covers the Reactor app and website. It does not cover third-party platforms you bring content from (for example, podcast hosts or YouTube) — those are governed by their own terms and privacy policies.
3. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | E-mail address, password (stored hashed by our authentication provider), sign-in identifiers when you use Google or Apple sign-in, account ID | You, at sign-up / sign-in |
| User content | Audio you import or upload, links you submit, content titles, and the AI-generated transcripts, translations and explanations derived from them | You, when using the App |
| Practice recordings | Microphone recordings you make in Echo (shadowing) practice. These are processed and stored only on your device and never leave it — we do not upload them to our servers | Your device (with your microphone permission) |
| Usage & quota data | Transcription minutes used against your monthly quota, playback position, streak/usage dates, subscription tier | Generated as you use the App |
| Purchase data | Subscription status and entitlements. Payment itself is handled by Apple or Google — we never receive your card or bank details | App stores / our subscription provider |
| Device & diagnostics | Push notification token (if you enable notifications), app and OS version, language settings, crash and error reports | Your device |
| Support data | Information you send us by e-mail | You |
We do not intentionally collect special-category (sensitive) data, and we do not track you across other companies’ apps or websites for advertising.
4. How we use your data & legal bases
| Purpose | Legal basis (GDPR Art. 6 and equivalent laws) |
|---|---|
| Provide accounts, transcription, translation, explanations and playback | Performance of a contract |
| Enforce usage quotas and operate the free plan and Pro subscriptions | Performance of a contract |
| Send re-engagement / streak notifications (if you allow them) | Consent (you can disable them at any time) |
| Diagnose crashes, secure the Service, prevent abuse, comply with law | Legitimate interests / legal obligation |
5. Service providers (sub-processors)
We share the minimum data necessary with the following providers, who process it on our instructions to run the Service:
| Provider | Purpose | Data shared |
|---|---|---|
| Supabase | Cloud infrastructure: database, authentication, storage | Account data, user content, usage data |
| Groq | AI speech recognition and language models that generate transcripts, translations and explanations | Audio segments and text to be processed |
| RevenueCat | Subscription status management and receipt validation | Account ID, purchase/entitlement state |
| Apple App Store / Google Play | Payment processing for subscriptions, under their own terms | Handled by the store; we receive entitlement state only |
| Sentry | Crash and error reporting | Device and app diagnostics tied to crashes |
| Expo | Push notification delivery (only if you opt in) | Push token |
| YouTube / Google APIs | Fetching public videos and captions you ask to import | Video IDs, caption requests, optional Google token you provide |
| SponsorBlock | Detecting sponsor/ad segments in videos you import | Video ID only (anonymous lookup) |
We do not sell your personal data, and we do not “share” it for cross-context behavioural advertising as defined by the California CCPA/CPRA.
6. International data transfers
Reactor is a global service and our providers operate cloud infrastructure in several countries: your data may be processed in the United States and other countries whose data protection laws differ from those of your country. Where required, transfers rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) or equivalent mechanisms entered into by our providers.
7. Retention
We keep account and content data while your account is active. When you delete your account, associated data is deleted from our primary systems promptly (typically within 30 days), except where we must retain limited records to meet legal obligations or resolve disputes. Backups expire on a rolling basis. Echo practice recordings live only on your device and are removed when you delete them or uninstall the App.
8. Your privacy rights
Everyone, everywhere. Regardless of where you live, you can ask us to access, correct, delete or export your personal data, and you can withdraw any consent you gave (for example, by turning off notifications). E-mail support@reactorlang.com and we will respond within the timelines of applicable law. We never treat you differently for exercising your rights.
European Economic Area & United Kingdom (GDPR / UK GDPR)
You additionally have the rights to restrict or object to processing and to data portability, and the right to lodge a complaint with your local supervisory authority (your national Data Protection Authority, or the ICO in the UK).
Brazil (LGPD)
You have the rights set out in Article 18 of the LGPD, including confirmation of processing, access, correction, anonymisation, deletion, portability and information about sharing. You may also lodge a complaint with the ANPD (Autoridade Nacional de Proteção de Dados).
California (CCPA/CPRA)
You have the rights to know, delete, correct and port your personal information, and to opt out of its “sale” or “sharing” — we do not sell or share personal information as defined by the CCPA/CPRA, and we do not use sensitive personal information beyond what is necessary to provide the Service.
9. Deleting your account and data
You can delete your account and all associated data directly in the App: Account → Delete account. This permanently erases your profile, imported content, transcripts, translations and progress from our systems. You can also request deletion by e-mail at support@reactorlang.com.
10. Security
We use industry-standard measures, including encryption in transit, access controls and database row-level security. No method of transmission or storage is 100% secure; we cannot guarantee absolute security, but we work to protect your data and will notify you and the relevant authorities of breaches where the law requires it.
11. Children
The Service is not directed at children under 13. Where your country sets a higher age of digital consent (for example, up to 16 in parts of the EEA), that higher age applies. We do not knowingly collect data from children below the applicable age; if you believe a child provided us data, contact us and we will delete it.
12. Changes to this Policy & contact
We may update this Policy as the Service or the law evolves. Material changes will be indicated by the effective date above and, where appropriate, by in-app notice. Questions or requests: support@reactorlang.com.