Privacy Policy

This Privacy Policy explains what information the Tudomy mobile app (for iOS and Android) and the website tudomy.com collect, why, who we share it with, and the choices you have. We have tried to keep it short and plain.

1. Who we are

Tudomy is an app for practicing technical interviews out loud and reviewing programming concepts daily. It is developed and operated by Juan Camilo Giron, an individual based in Colombia ("Tudomy", "we", "us"). We are responsible for (the "controller" or, under Colombian law, the "responsable del tratamiento" of) the personal information described in this policy.

Questions and requests about privacy can be sent to support@tudomy.com.

2. Information we collect

Information you give us

• Sign-in details (only if you sign in). Tudomy offers Sign in with Apple and Sign in with Google. We receive your email address and a unique account identifier from the provider. If you use Apple's "Hide My Email", we receive a relay address instead of your real one. Depending on the provider, the sign-in token may also include basic profile details, such as your name, which our authentication service stores with your account record. We do not use them in the app. We never receive your Apple or Google password.
• Learning preferences. The technologies (your "stack") you choose, the one you are currently practicing, which concepts you want included or skipped, and your daily reminder time.
• Voice interviews. What you say during a voice interview. Your audio is streamed live to ElevenLabs to run the conversation. Afterwards we receive and store a text transcript of the conversation (your answers and the interviewer's questions), along with the interview's duration and the scores and feedback generated from it.
• Daily reviews. For each concept card you review, whether you marked it as known or shaky, and when. From this we calculate your streak and experience points (XP).
• Messages to us. If you email us, we keep your message and email address to reply.

Information collected automatically

• Guest account identifier. When you first open the app, we create a random, anonymous account identifier so your progress can be saved without you signing in.
• Device identifier, in hashed form. To manage the free-session allowance fairly and prevent abuse (for example, resetting it by reinstalling the app), the app reads a device identifier: the Android ID on Android, or a random identifier the app creates and keeps in the iOS Keychain. It is sent to our server once per account, where it is converted into a keyed, one-way hash. We store only that hash and your device platform (iOS or Android), not the original identifier. It is not an advertising identifier and is not used for advertising or tracking.
• Time zone. Your device's time zone (for example, "America/Bogota"), so streaks and daily limits roll over at your local midnight.
• Usage records. When interviews start and end, which concepts were planned, and similar records needed to run the features you use.
• App analytics. Through Firebase Analytics, the app records which screens you open and how you use its features. Examples include switching tabs, starting, finishing, or cancelling an interview, marking a review card as known or shaky, toggling captions or mute, changing your stack or reminder time, and the outcome of a sign-in, purchase, or account deletion. Some events include simple details such as a technology tag, an interview's length, its overall score, your streak length, or the XP earned. Analytics events never contain your interview audio, your transcripts, your name, or your email. Each event is linked to your random Tudomy account identifier and to whether you are a guest or signed in. Firebase also collects some information automatically: an app-instance identifier, your device model, operating system, language, app version, approximate location (country, region, or city, worked out from your IP address), app opens and time spent in the app, and the product and price of purchases made through the App Store or Google Play.
• Crash reports. If the app crashes or hits an unexpected error, Firebase Crashlytics receives a report with the error details, your device model, operating system and app version, a Crashlytics installation identifier, and your random Tudomy account identifier, so we can match a crash to the account it affected.
• Technical logs. Like most online services, our servers and hosting providers automatically process technical information such as your IP address, request times, and error details when the app connects to them, to operate and secure the service.

Information from third parties

• Apple and Google, when you sign in with them, as described above.
• ElevenLabs, which sends us the transcript and call duration of each voice interview after it ends.

Stored only on your device

The app keeps some information on your phone: your sign-in session, onboarding answers, a cached copy of today's review, and local reminder settings. On Android, the app opts out of system backups, so this data is removed when you uninstall the app.

What we do not collect

Tudomy does not access your device's location (GPS), contacts, photos, camera, or calendar. The app has no ads, has advertising-ID collection and ad personalization turned off in Firebase Analytics, and does not track you across other companies' apps or websites. Interview packs are paid for through the App Store or Google Play, so we never see your card or other payment details; the store, through our purchases provider RevenueCat, only confirms the purchase to us so we can add the sessions to your account. We do not use your voice to identify you (no voiceprints or other biometric identification).

3. How we use information

We use your information only for the purposes below. If you are in the European Economic Area (EEA), the United Kingdom, or a similar jurisdiction, the legal basis we rely on is shown in brackets.

• To provide Tudomy: run voice interviews, score them and show feedback, build your daily reviews, track streaks and XP, show your history, and save your preferences. [Performance of our contract with you]
• To keep your account in sync, including carrying your progress over when a guest signs in. [Contract]
• To manage the free-session allowance and prevent abuse, using the hashed device identifier. [Our legitimate interest in offering free sessions fairly and controlling costs]
• To operate, secure, and fix the service, using technical logs and crash reports. [Legitimate interests in keeping the app working and secure]
• To understand how Tudomy is used and improve it: for example, to see where people drop off during onboarding or an interview, and which features are used, using app analytics. [Our legitimate interest in improving the app]
• To test and improve the AI interviewer: we review recorded interview conversations kept by ElevenLabs and turn some of them into test cases, to check that the interviewer asks clear questions and behaves as intended when we change it. [Our legitimate interest in improving the quality of the service]
• To respond to your messages and requests. [Contract or legitimate interests]
• To comply with the law and enforce our Terms. [Legal obligation, legitimate interests]

AI scoring. Interview scores and feedback are generated automatically by an AI model. They are practice feedback only and do not produce legal or similarly significant effects for you. We do not use your information for advertising, and we do not use your interview transcripts to train AI models.

4. Device permissions

• Microphone. Used only while a voice interview is running, after you start it, so the AI interviewer can hear your answers. Audio is streamed live to ElevenLabs, which keeps a record of the conversation, including the audio, as described in section 5. Tudomy's own servers do not receive or store audio recordings, only the text transcript described above. You can turn off microphone access in your device settings at any time, but voice interviews will not work without it.
• Notifications. Used for an optional daily review reminder at the time you pick. The reminder is scheduled on your device; we do not use a push notification service. Your chosen reminder time is saved to your profile. You can turn reminders off in your device settings.

5. Who we share it with

We share information only with service providers that help us run Tudomy, and only what they need:

• Supabase (database, authentication, and server functions): stores your account and all app data described above, on servers in the US region.
• ElevenLabs (AI voice interviewer): receives your live microphone audio during an interview, the list of concepts planned for that interview, and a session reference, and produces the conversation transcript. ElevenLabs keeps a record of each conversation, including the audio and the transcript, in our ElevenLabs account, where we can review it to test and improve the AI interviewer (see section 3). See the ElevenLabs Privacy Policy.
• Anthropic (AI scoring): receives the interview transcript and the concept titles, and returns scores and feedback. See the Anthropic Privacy Policy.
• RevenueCat (in-app purchases): when a signed-in user buys or restores an interview pack, the app connects to RevenueCat under your random Tudomy account identifier. RevenueCat receives the purchase record from the App Store or Google Play (the product, transaction ID, store, price, and currency) along with basic device and app details, and tells us which sessions to add to your account. It does not receive your name, email, or card details. Your RevenueCat customer record is deleted when your account is deleted. See theRevenueCat Privacy Policy.
• Google Firebase (Firebase Analytics and Firebase Crashlytics): receives the app analytics and crash reports described in section 2, linked to your random Tudomy account identifier. We have turned off advertising-ID collection and ad personalization. SeePrivacy and Security in Firebase and theGoogle Privacy Policy.
• Apple and Google: provide sign-in when you choose to use them, and distribute the app through the App Store and Google Play under their own privacy policies.
• Vercel: hosts our website (see section 13).

We may also disclose information:

• if required by law, or to protect the rights, safety, or property of our users, us, or others;
• to a successor if Tudomy is transferred to another person or company, with notice to you; or
• with your consent.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

6. International transfers

Tudomy is operated from Colombia, but your information is stored on Supabase servers in the United States. ElevenLabs, Anthropic, RevenueCat, and Google (Firebase) may also process it in the United States and other countries. This means your information is transferred to, and stored in, countries whose data protection laws may differ from those of the country where you live.

• Colombia. By accepting this policy you authorize the international transfer of your personal data to the United States for the purposes described here, as permitted by Law 1581 of 2012 and its regulations.
• EEA, UK, and Switzerland. Where the law requires it, we rely on appropriate safeguards recognized by applicable data protection law for these transfers, as provided in our service providers' data processing terms.

7. How long we keep it

• Account data, preferences, review history, and interview transcripts and scores: for as long as your account exists. They are deleted when your account is deleted.
• Guest interview results: an interview completed as a guest is kept only if you sign in within 7 days; otherwise it is deleted automatically after 7 days.
• Guest accounts: if you sign in to an account that already existed, the guest account on that device is deleted (its recent interview results move to your account). A guest account that is not used for 30 days is deleted automatically.
• Allowance records: the hashed device identifier, your free-session balance, and a record that a sign-up bonus was claimed are kept after account deletion so the allowance cannot be reset. They do not contain your name, email, or interview content. They are kept for up to 90 days.
• Technical logs: kept for 1 day, then deleted automatically.
• Emails with us, including privacy and deletion requests: kept for 6 months after the conversation ends, then deleted.
• Interview conversations held by ElevenLabs (audio and transcript): kept in our ElevenLabs account for 60 days, then deleted automatically. They are not removed automatically when your account is deleted.
• Data held by Anthropic is kept for up to 6 months, then deleted.
• App analytics (Firebase Analytics): individual events are kept for 2 months, and user-level data (your account identifier and whether you are a guest or signed in) for 14 months. Both are then deleted automatically. We may keep aggregated reports that do not identify you for longer.
• Crash reports (Firebase Crashlytics): kept for 90 days, then deleted automatically.

Analytics data and crash reports are not removed automatically when your account is deleted. They expire on the schedule above, or you can ask us to delete them sooner (see section 9).

8. Security

Information is encrypted in transit between the app and our servers. Access to your data is restricted so each account can read only its own records, and device identifiers are stored only in hashed form. No system is perfectly secure, so we cannot guarantee absolute security, but we work to protect your information and will notify you and the authorities of a breach where the law requires it.

9. Your choices and rights

In the app

• Change your stack, concept preferences, and reminder time on the Profile tab.
• Turn microphone or notification access on or off in your device settings.
• Sign out. Signing out does not delete your account; your account data stays saved until you delete your account.
• Delete your account if you are signed in: go to Profile, tap Delete account, and confirm by typing "delete" (or with Apple, if you signed in with Apple). Deletion is immediate and cannot be undone.

Analytics and crash reports

The app does not have a setting to turn off analytics or crash reporting. If you object to them, emailsupport@tudomy.com and we will delete the analytics data and crash reports linked to your account identifier.

Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you;
• correct inaccurate information;
• delete your information;
• ask for your information in a portable format, where the law gives you that right (the app has no self-service export, so make this request by email);
• object to or restrict certain processing, including processing based on legitimate interests;
• withdraw consent where we rely on consent, without affecting earlier processing.

To use any of these rights, email support@tudomy.com from the email address linked to your Tudomy account (or tell us which address it is). We may need to verify your identity before acting on a request. We will respond within the time the law requires.

EEA and UK residents

You also have the right to lodge a complaint with your local data protection authority.

California residents

In the last 12 months, we have collected the following categories of personal information:

• Identifiers: email address, account identifiers, hashed device identifier, IP address, and the app-instance and installation identifiers used by Firebase Analytics and Crashlytics.
• Audio and electronic information: your voice during interviews (streamed to our provider, not stored by us) and interview transcripts.
• Internet or other electronic network activity: app activity such as reviews, interview history, scores, streaks, and preferences; screens viewed and in-app interactions (app analytics); crash reports; technical logs.
• Approximate location: country, region, or city derived from your IP address by our analytics provider. We do not collect precise location.
• Inferences: interview scores and feedback about your knowledge of technical concepts.

We collect this information from you, your device, and the third parties listed in section 2, for the purposes in section 3, and disclose it only to the service providers in section 5. We do not sell or share personal information as those terms are defined under California law, and we do not use or disclose sensitive personal information for purposes that would give you a right to limit it. You have the right to know, delete, and correct your personal information, and we will not discriminate against you for using these rights. You may use an authorized agent to make a request on your behalf; we may ask for proof of the agent's authorization.

10. Colombia: Habeas Data (Law 1581 of 2012)

This section, together with the rest of this policy, is our personal data processing policy under Law 1581 of 2012 and Decree 1377 of 2013 (incorporated into Decree 1074 of 2015). It applies to everyone whose data we process, and in particular to users in Colombia.

• Data controller (responsable del tratamiento): Juan Camilo Giron, Colombia. Email:support@tudomy.com. The same person handles all requests, inquiries, and claims about personal data.
• Processing and purposes: we collect, store, use, and transfer your data only for the purposes in section 3, using the providers in section 5, which act on our behalf (encargados del tratamiento).
• Authorization: we process your personal data with your prior, express, and informed authorization, which you give by accepting this policy when you use the app. You may refuse or revoke it, but we will then be unable to provide the parts of Tudomy that depend on that data.
• Sensitive data: we do not ask for sensitive data (such as health, political, religious, or biometric data), and we do not use your voice for biometric identification. You are not required to share sensitive data, so please avoid mentioning it in your interview answers.

Your rights as a data subject (titular)

You have the right to:

• know, update, and correct your personal data (conocer, actualizar y rectificar);
• request proof of the authorization you gave us;
• be informed, on request, of how your data has been used;
• revoke your authorization and request deletion of your data (revocar la autorización y suprimir los datos), when there is no legal or contractual duty for us to keep it;
• access your personal data free of charge;
• file a complaint with the Superintendencia de Industria y Comercio (SIC)(www.sic.gov.co), after first completing an inquiry or claim with us, as the law requires.

How to make an inquiry or a claim

Send an email to support@tudomy.com with your name, the email address linked to your Tudomy account (if you have one), a description of your request, and how we should reply.

• Inquiries (consultas), such as asking what data we hold about you, are answered within 10 business days of receipt. If we cannot answer in that time, we will tell you why and answer within 5 more business days.
• Claims (reclamos), such as requests to correct, update, or delete data, or to revoke your authorization, are answered within 15 business days of receipt. If we cannot answer in that time, we will tell you why and answer within 8 more business days. If a claim is incomplete, we will ask you for the missing information within 5 business days; if you do not provide it within 2 months, the claim will be considered withdrawn.

This policy takes effect on September 28, 2026.

11. Deleting your account and data

If you are signed in, you can delete your Tudomy account and its data yourself in the app: go to Profile, tap Delete account, and confirm by typing "delete" (Apple users confirm with Apple). Deletion takes effect immediately and cannot be undone. If you can't open the app, email support@tudomy.com from the email address of the Apple or Google account you use to sign in, with the subject "Delete my Tudomy account"; we complete deletion within 30 days of verifying your request. Step-by-step instructions, what is deleted and what is kept, and processing times are on our Delete your account page.

When your account is deleted, we delete your sign-in record, profile and preferences, review history, streaks, XP, interview transcripts, scores, and feedback, terms acceptances, device link, session credits and purchased session records (unused purchased sessions are lost), and your customer record with our purchases provider, RevenueCat. If you signed in with Apple, we also revoke the Sign in with Apple tokens for your account. We do not offer a data export before deletion. What we keep afterwards, such as the allowance records, analytics data, and crash reports until they expire, is described in section 7 and on the Delete your account page.

12. Age requirement and children

You must be at least 16 years old to use Tudomy. Tudomy is not directed to children, and we do not knowingly collect personal information from anyone under 16, including children under 13. If you believe someone under 16 has given us personal information, contact us and we will delete it.

13. Our website

tudomy.com is hosted by Vercel. We use Vercel Web Analytics to count page views and see which pages are visited; it does not use cookies. The site loads fonts from Google Fonts, which means your browser connects to Google's servers and Google receives your IP address. The website does not use advertising or tracking cookies.

14. Changes to this policy

We may update this policy as Tudomy changes. We will post the new version here and update the "Last updated" date. If a change materially affects how we use your information, we will let you know in the app or by email before it takes effect and, where the law requires it, ask for your authorization again.

15. Contact us

Juan Camilo Giron
Colombia
Email: support@tudomy.com