Privacy Policy

1. Introduction

This Privacy Policy explains how Off the Cuff ("Off the Cuff," "we," "us," or "our") collects, uses, discloses, and safeguards information when you use our website, services, and products (collectively, the "Service"). By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy.

If you do not agree with this Policy, please do not use the Service. Capitalized terms not defined here have the meanings given in our Terms of Service.

2. Information we collect

a. Account information

When you create an account, we collect your email address. If you sign in with Google, we receive your email address and basic profile information that Google makes available through OAuth. Authentication is handled by Supabase; passwords for email sign-in are stored in hashed form by our authentication provider.

b. Payment information

Payments for paid speaking challenges are processed by Dodo Payments ("Dodo"). We do not receive or store your full payment card number, CVC, or expiration date. Dodo provides us with payment identifiers, checkout session metadata, charge status, currency, and limited payment details needed to run enrollments and refunds. Your use of payment features is also governed by Dodo's privacy policy and terms.

c. Audio recordings and transcripts

When you complete a speech take, the Service records audio from your device microphone and uploads the audio file to our storage provider (Supabase Storage). We generate a text transcript of that audio and store metadata such as duration, practice date, the topic or prompt you responded to, and which practice surface you used (random topics, interview prep, or vocab).

d. AI-generated analysis

We submit your transcripts to third-party AI services to generate feedback, including numeric scores (clarity, structure, and presence), filler-word and pause highlights, coaching tips, and related annotations. We store this generated output alongside the recording it relates to.

e. Challenge and usage data

If you enroll in a paid challenge, we collect information about your enrollment, including challenge type, start date, payment and refund status, daily completion progress, per-day refund credits earned, time zone used for challenge deadlines (Asia/Kolkata by default for program rules, plus browser-reported time zone where relevant), and webhook or checkout events from our payment provider.

f. Device and technical data

Our servers and service providers may automatically log technical information when you use the Service, such as IP address, browser type and version, operating system, referring URLs, access times, and diagnostic data. This information is used to operate, secure, and improve the Service.

g. Cookies and similar technologies

We use strictly necessary cookies and local storage to keep you signed in and to maintain session state. When configured, we may use Google Analytics to understand aggregate site usage; that service may set its own cookies under Google's privacy policy. Our authentication and payment providers may set their own cookies under their own privacy policies. We do not use third-party advertising cookies.

3. How we use your information

We use the information we collect to:

• Provide, operate, and maintain the Service, including your account and challenges;
• Transcribe and analyze your recordings to generate AI-powered feedback;
• Process payments and issue refunds or daily money-back credits in accordance with our Refund & Money-Back Policy and Terms;
• Calculate challenge progress, deadlines, and calendar-day completion rules;
• Respond to support requests and communicate with you about your account or the Service;
• Detect, investigate, and prevent fraud, abuse, and security incidents;
• Comply with legal obligations and enforce our Terms of Service.

4. Third-party service providers

We rely on the following service providers to operate the Service. Each provider processes personal information under its own privacy policy, and your use of the Service may also be subject to their terms as applicable.

• Supabase - Hosts our database, authentication system, and file storage for your audio recordings. Row-level security limits access to your own data.
• Dodo Payments - Processes challenge payments and refunds. We never see your full card number.
• OpenAI - Receives audio recordings to generate transcripts (OpenAI speech-to-text). OpenAI processes this audio under its API terms and privacy policy.
• Anthropic- Receives transcripts (and, for topic translation, short text strings) to generate analysis and coaching feedback. Anthropic's processing is governed by its privacy policy and API terms.
• Google- Provides Google Sign-In if you choose that option, and Google Analytics if enabled on our site. Google's processing is governed by its privacy policy.

We do not sell your personal information, and we do not share it with advertisers or data brokers. We may share information with additional processors if needed to operate the Service; if we do, we will update this Policy to reflect that.

5. What we do not do

• We do not sell or rent your personal information.
• We do not use your recordings or transcripts to train our own AI models.
• We do not share recordings publicly or with other users.
• We do not use your content for advertising.

Our third-party processors handle your data only as needed to perform the services we request from them and under their own terms, which may restrict use of customer data for model training. We cannot and do not guarantee the data-handling practices of any third party.

6. Data storage and security

Your recordings and account data are stored on infrastructure operated by our service providers using industry-standard security controls, including encryption in transit and at rest where supported by those providers. Access to your audio files is restricted through authentication and database policies so users can only access their own takes.

Despite these measures, no system can be guaranteed to be completely secure. We cannot and do not warrant the security of any information you transmit to the Service, and you do so at your own risk. Please use a strong, unique password and keep your account credentials confidential.

7. Data retention

We retain your account, recordings, transcripts, analyses, and challenge data for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.

You may request deletion of your account or specific data by contacting us using the details below; we will process such requests within thirty (30) days, subject to any retention required by law (for example, payment or tax records). Anonymized or aggregated data that can no longer be linked to you may be retained indefinitely.

8. International data transfers

Off the Cuff and our service providers may process and store information in the United States and other countries that may have different data protection laws than your country of residence. By using the Service, you consent to the transfer of your information to such jurisdictions.

9. Your rights

Depending on where you live, you may have the following rights regarding your personal information:

• Access to the personal information we hold about you;
• Correction of inaccurate or incomplete information;
• Deletion of your personal information;
• Objection to, or restriction of, certain processing;
• Portability of your information in a machine-readable format;
• Withdrawal of consent where processing is based on consent;
• The right to lodge a complaint with a supervisory authority.

California residents may have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know what personal information we collect and the right to non-discrimination for exercising your rights. To exercise any of these rights, contact us using the details below. We may need to verify your identity before responding.

10. Children's privacy

The Service is not intended for, and we do not knowingly collect information from, individuals under the age of eighteen (18). If you believe a child has provided us with personal information, please contact us and we will take steps to delete that information.

11. Third-party links

The Service may contain links to third-party websites or services that are not operated by us. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review their privacy policies.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you through the Service or by email. Your continued use of the Service after any update constitutes acceptance of the revised Policy.

13. Contact us

If you have questions about this Privacy Policy or how we handle your information, contact us at offthecuffspeech@gmail.com.