This policy explains how Kicau ("we") collects, uses, stores and protects your personal data when you use the Kicau app and the kicau.ai website. It follows Indonesia's Personal Data Protection Law (Law No. 27 of 2022, "UU PDP").
In short: we record your voice only to score your pronunciation, recordings are deleted automatically after 30 days, we never sell your data or use it for advertising, and you can delete your account at any time.
1. Who we are
Kicau is an English speaking and pronunciation practice app operated by Kicau. We are the data controller for the personal data you provide in Kicau.
Send privacy questions or requests to privacy@kicau.ai.
2. Kicau is separate from Pintarly
A Kicau account is its own account. Kicau does not use Pintarly accounts, databases, servers or storage, and no user data is shared between the two. Your Kicau data is stored only on infrastructure Kicau owns.
If you also have a Pintarly account, deleting one does not affect the other.
3. Data we collect
| Type of data | Examples | Source |
|---|---|---|
| Account and sign-in identity | Email address, name and profile photo from Google or Apple, your Kicau user ID. If you use Apple's Hide My Email, we only receive Apple's relay address. | You, when you sign in with Google, Apple or an email code |
| Profile and preferences | Display name, native language, learning goal, starting level, reminder settings | You, during onboarding and in Profile |
| Voice recordings | Audio from practice, the placement test and Ngobrol conversations (up to 2 minutes per recording) | Your device microphone, only while you hold the record button |
| Transcripts and conversation text | Speech-recognition text from your recordings, Ngobrol conversations, session recaps | Generated from your recordings and Kiki's replies |
| Scores and progress | Word- and phoneme-level pronunciation scores, CEFR level, estimated IELTS band, XP, streak, weekly league, hearts | Calculated by Kicau |
| AI usage records | Which AI feature was used, the AI model, token counts, estimated cost per request | Logged automatically each time an AI feature runs (see the Fair Use Policy) |
| Subscription status | Whether you subscribe to Kicau Pro, the plan and its expiry date. We never receive your card number or payment details. | The App Store or Google Play, through RevenueCat |
| Consent records | Which versions of the Terms, Privacy Policy and voice-recording consent you accepted, your age confirmation, and when | You, on the consent screen |
| Usage analytics | In-app events (for example screens opened or lessons finished), device type, OS and app version. Session recording is off. | The app, tied to your Kicau user ID, not your name or email |
| kicau.ai website analytics | Pages opened, download buttons clicked, where the visit came from (utm parameters), device type. No name, email or screen recording. | Your browser on kicau.ai, only after you press "Terima" (Accept) on the consent bar. Your choice is stored in the browser, and you can change or withdraw it at any time with "Pengaturan analytics" (Analytics settings) in the footer of the kicau.ai pages (home, pricing, download). |
| Crash and technical data | Error messages, stack traces, IP address in server logs, a push token if you allow notifications. Emails, sign-in tokens and recording links are filtered out before sending. | The app and Kicau servers |
We do not collect precise location, contacts, photos or data from other apps.
4. How we use data
- Running Kicau: creating and securing your account, saving your progress and showing the weekly league.
- Scoring pronunciation and giving feedback: turning your recordings into text, scoring each word and phoneme, and generating Kiki's replies in Ngobrol.
- Personalising practice: picking material for your level and goal.
- Managing subscriptions: unlocking Kicau Pro features based on your subscription status.
- Keeping AI usage fair: counting AI usage per account under the Fair Use Policy.
- Security: preventing abuse, fraud and unauthorised access.
- Improving the app: understanding which features are used and fixing crashes, using data tied to a user ID rather than your name or email.
- Contacting you: answering your questions and telling you about important changes.
We do not sell your personal data, do not use it for advertising, and do not use your voice recordings to train AI models.
5. Legal basis
Under the UU PDP, we process your data on these bases:
- Your consent: to record and process your voice. You give it on the consent screen before you start practising.
- Performance of a contract: to provide the account, features and subscription you ask for under the Terms of Service.
- Legal obligation: for example keeping records required by tax rules, or responding to an official request from a competent authority.
- Legitimate interest: to keep the service secure, prevent abuse and improve the app, where this does not override your rights and interests.
6. Voice recordings
Your voice is the most sensitive data we hold, so here is exactly what happens to it:
- The app records only while you press the record button.
- The recording uploads straight from your device to Kicau's own Google Cloud Storage (Singapore region) through a single-use upload link that expires in 15 minutes. The storage is not publicly accessible.
- Kicau's servers turn the recording into text with the Whisper speech-recognition model and score your pronunciation with a wav2vec2 model. Kicau runs both models itself on Google Cloud; the audio is not sent to a third-party AI service.
- For Kiki's replies in Ngobrol, session recaps and written feedback, the server sends the transcript text (never your voice recording) to Google Gemini.
- Recordings are deleted automatically after 30 days.
You can withdraw your voice-recording consent at any time by deleting your account or contacting us. Without it, the speaking features cannot work, because pronunciation scoring needs your recording.
7. Who processes your data
We use the service providers below to run Kicau. They process data only on our instructions and under their agreements with us, never for their own purposes.
| Provider | Purpose | Data processed |
|---|---|---|
| Supabase (Kicau's own project) | Accounts, sign-in, sending email sign-in codes, and the database | Account, profile, progress, scores, transcripts, consent records |
| Google Cloud (Cloud Run and Cloud Storage, Kicau's own project) | Kicau servers, including the Whisper, wav2vec2 and Kokoro models we run ourselves, and recording storage | Voice recordings, transcripts, pronunciation examples |
| Google Gemini API (Kicau's own API key) | Kiki's replies in Ngobrol, session recaps and written feedback | Transcript and conversation text, without voice recordings, names or emails |
| RevenueCat | Tracking Kicau Pro subscription status | Kicau user ID, store purchase receipts |
| Apple App Store and Google Play | Subscription payments, renewals and refunds | Payment details, processed directly by Apple or Google |
| Google Sign-In and Sign in with Apple | Signing in | The email, name and profile photo you allow them to share |
| PostHog | Product usage analytics, and kicau.ai website analytics if you agree to it | In-app or website events, device info, Kicau user ID (app only) |
| Sentry | Crash and error reports | Technical error data, device info, Kicau user ID, without emails or recordings |
| Apple, Google and Expo notification services | Sending practice reminders, if you allow them | Device push token |
Beyond this, we disclose data only where the law requires it, for example an official request from a competent authority, or to protect the safety of users.
8. Transfers outside Indonesia
Kicau's servers and storage are in the Singapore region (Google Cloud asia-southeast1). Some of the providers above, such as Google Gemini, PostHog, Sentry and RevenueCat, may process data in other countries, including the United States.
As Article 56 of the UU PDP requires, we transfer data only to providers that offer an equal or higher level of protection, set out in a data processing agreement with each of them.
9. How long we keep data
| Data | Kept for |
|---|---|
| Voice recordings | 30 days, then deleted automatically |
| Improved pronunciation examples | 90 days |
| Practice and placement-test transcripts | 90 days, then the text is erased |
| Ngobrol conversation text, including the recap's quoted corrections and vocabulary | 180 days |
| Scores, XP, streak, league and Ngobrol recaps (Kiki's notes and the estimated level) | While your account is active |
| Account, profile, consent records and AI usage records | While your account is active |
| Data export files (Download My Data) | 7 days. The download link expires after 24 hours. |
| Encrypted database backups | 37 days, then deleted |
Kiki's voice is generated from lesson text, not from your voice, so it is kept as a shared cache that contains no personal data.
When you delete your account, its database records are deleted immediately. Remaining copies in file storage and backups are gone within 90 days at the latest. See Delete Your Account for details.
10. Security
- All data travels over encrypted connections (HTTPS/TLS) and is stored encrypted by our infrastructure providers.
- Every table of user data is protected by Row Level Security: your account can only read and change your own data.
- Recording storage is closed to the public. Recordings are reached through signed links that expire within minutes.
- Server secrets are kept in Google Secret Manager and never ship inside the app.
- Internal access to user data is limited to the people who need it to run the service.
If a personal data breach occurs, we will notify you and the competent authority within 3 x 24 hours, as Article 46 of the UU PDP requires.
11. Your rights
Under the UU PDP, you have the right to:
- Access and get a copy of your data: through Profil > Unduh Data Saya (Profile > Download My Data) in the app, or by emailing us.
- Correct inaccurate data: change your display name and preferences in Profile, or ask us to correct it.
- Delete your data: delete your account through Profil > Hapus Akun (Profile > Delete Account), or ask by email for some or all of your data to be deleted.
- Withdraw consent: including voice-recording consent. Withdrawal does not affect processing that already took place.
- Restrict or object to certain processing, such as analytics.
- Port your data in a commonly used format (the export file is JSON).
- Object to decisions based solely on automated processing. Scores and level estimates in Kicau are for practice only and are not used for any decision with legal effect on you.
- Lodge a complaint with the competent personal data protection authority.
Send your request to privacy@kicau.ai from the email address registered to your account. We respond within 3 x 24 hours of receiving it, and may ask you to confirm that the request comes from the account owner.
12. Children
Kicau is only for people aged 13 and over. The app asks your age before you start, and users under 13 cannot continue.
If you are between 13 and 17, you must use Kicau with the knowledge and consent of a parent or guardian.
If you are a parent or guardian and learn that a child under 13 is using Kicau, contact privacy@kicau.ai. We will delete the account and its data.
13. Changes to this policy
When this policy changes, the "Last updated" date above changes too. For significant changes, we tell you in the app and ask for your consent again before you continue using Kicau.
14. Contact
Privacy questions, requests or complaints: privacy@kicau.ai.
This policy is available in Indonesian and English. If the two differ, the Indonesian version prevails.