Nerola Privacy Policy
Effective date: October 27, 2026 (previous version: October 22, 2026) Last updated: October 27, 2026 — per-install usage counts from version 4.8 (section 6). Data controller: Tolga Sayan (individual developer; App Store seller name) Contact: tolgasayan@icloud.com
Nerola offers English vocabulary games played by typing answers and, from version 4.0, an AI-powered English speaking coach (Nerola Coach). This policy explains what data the Nerola iOS app processes and how. Solo play and Nerola Coach do not require an account, a name or an email address. Optional friend games (Word Table and friend races) ask for a display name; a nickname is sufficient.
1. Data that stays on your device
Except for the competition features described below and Nerola Coach described in section 5, the following is stored only on your device: app language, level, onboarding status; round history, scores, learning list, review words and badges; dictionary bookmarks, pronunciation dialect (US/UK) and slow-playback preference; the record of your daily new-round allowance; your daily streak record (the days you practised and the days your streak froze) and unfinished game rounds. Deleting the app deletes this data from your device. If device backup is enabled it may be included in Apple’s backup, which is governed by Apple’s terms.
Reminder notifications
Nerola can send optional local reminder notifications. Only you switch them on (the “Want a reminder?” screen in the app or “Practice reminders” in the home menu); iOS asks for notification permission separately. Reminders are scheduled entirely on your device: one notification 24 hours after your last visit and, if you do not return, one more on days 2, 3 and 7, then they stop; opening the app restarts the timer. Once you have a daily streak, the same schedule counts from your last completed practice and the notifications remind you about your streak. There is no push notification, server, device token or usage data transfer; the texts are fixed sentences in the app language. You can turn them off from the menu at any time.
In Nerola Coach you can also set an optional daily reminder (during onboarding or in Profile → Daily reminder). It is a local notification at the time you choose; iOS asks for notification permission separately. From version 4.4 the coach may also remind you of an unfinished lesson, an unfinished introduction, your first conversation, your first week and your streak, at most one coach reminder a day and none between 22:00 and 09:00 except the time you chose. All of them are scheduled entirely on your device for the next 14 days; there is no push notification, server or device token, and no data leaves your device for them. In Profile you can turn off the daily reminder and, with a second switch, all the other coach reminders; “Delete my coach data” removes them all, and you can also turn off notifications for Nerola in iOS Settings.
2. Written answers
You type your answers into letter spaces using the keyboard. Nerola evaluates the written words on your device. The word games do not use the microphone, do not request speech recognition permission and do not send audio for recognition. The microphone is used only in Nerola Coach, while you hold the microphone button or, if you choose “Tap and talk”, from your tap until your answer is sent (see section 5). Solo written answers stay in your local round history. Word Table and friend-race answers are also sent to the race service described below; answers are not sent to an analytics service. Keyboard features provided by iOS or a keyboard you install are governed by that provider’s settings and privacy policy.
Optional friend games
Word Table (version 2.0 and later): When you create or join a table for 2–4 players, Nerola sends your chosen display name and avatar (a symbol and a colour), a table-specific random credential, level, content versions, your ready and connection status and your submitted answers to our Cloudflare-hosted race service. The service stores only a hash of the credential, grades answers and keeps the scores. Everyone at the table sees your name, avatar, ready and connection status, score and your result on each question (such as correct, wrong, passed or time up); when a question closes, the correct word is shown to everyone. The text of your typed answer is shown only to you and is not sent to other players. The person who created the table can remove a disconnected player in the waiting room.
Friend races (the two-player room in earlier versions): When you create or join a two-player room, Nerola sends your chosen display name, room-specific random credential, level, content version, submitted answers and race events to our Cloudflare-hosted race service. The service stores a hash of the credential, grades answers and measures elapsed time. Your room partner sees your name and readiness; both players can see scores and answer details after both finish or the race expires. No contact list, telephone number or microphone data is accessed. Sharing uses the iOS share sheet; your chosen messaging app handles the invitation under its own policy.
Table records are deleted within 24 hours of creation. A table that stays idle for 20 minutes in the waiting room or on the results screen, or whose players have all been disconnected for more than 2 minutes, closes and is deleted sooner. Room records are also deleted within 24 hours of creation; unused lobbies expire after 15 minutes. Your own learning history remains on your device. The service processes request IP addresses to limit abuse; IP addresses are not stored in the table or room record. Cloudflare also processes network requests to deliver and protect the service. See Cloudflare’s privacy policy. To request deletion of a table or room before it expires, contact us with its code.
Optional Game Center competitions
The app does not ask you to sign in to Game Center when it first opens. The first time you open the daily wheel it asks once whether you want to join the rankings; if you do not connect, the wheel still opens and your result stays on your device. If you connected before, the app reconnects to Game Center at launch. If you use Game Center, Apple receives the submitted daily competition score and associates it with your Game Center player identity. Leaderboard visibility follows your Game Center settings. Nerola does not send individual written answers to Game Center.
3. Pronunciation audio
In version 1.0, pronunciation uses your device’s speech synthesizer. From version 1.1, selected English word and story recordings are created in advance with ElevenLabs and included in the app. Listening plays these files on your device; your text, answers and identity are not sent to ElevenLabs. Other accents, missing recordings and newly generated story wording use the device’s speech synthesizer. No network connection is needed to play these word and story recordings. Speech in Nerola Coach works differently; see section 5.
4. Purchases and Nerola Plus
If you buy Nerola Plus, payment is handled by the Apple App Store; we never see your card details. We use two providers to manage purchases: RevenueCat (stores your purchase record and Plus access status) and Superwall (shows the Nerola Plus offer screen). These providers receive a random identifier generated when the app is installed (it contains no name or email). The identifier persists for that installation; reinstalling creates a new one. Your purchase history is linked to it. SDK processing does not begin only after a purchase. In the current implementation, RevenueCat starts at app launch and checks access status when its public key is configured. Superwall starts when sales and its keys are enabled; it may also process data about free users who see an offer. To operate, the providers’ SDKs also process:
- RevenueCat: the App Store purchase receipt and Plus access status, app version, device platform and OS version. RevenueCat uses these for receipt validation and for aggregate statistics in its dashboard; no advertising identifier (IDFA) is collected.
- Superwall: device attributes used to decide where to show the offer screen and to keep offer-screen statistics (Apple’s vendor-scoped device identifier, device model, OS version, language and region, time zone, app version and install date, network type, low-power mode, light/dark appearance), interactions with the offer screen (view, dismiss, purchase attempt) and Plus access status. Superwall may derive an approximate country/region/city from the request IP address; this is not precise location and the app never asks for location permission. The current app integration does not use this data for advertising or cross-app tracking as defined by Apple. Provider information: RevenueCat privacy policy and data processing addendum; Superwall privacy policy and data processing addendum. The providers retain this data for the periods set out in their own policies; if you want your purchase record deleted, write to the address in section 8 and we will forward the request to the providers. The Nerola Coach subscription is also bought through the App Store and kept in RevenueCat under the same random identifier. The coach subscription screen is the app’s own screen; Superwall is not used there. Section 5 explains how the coach server verifies the subscription. In the free version the dictionary, pronunciation audio, learning list, badges, the daily wheel and Word Table are available to everyone; Plus removes the daily limit on new rounds and unlocks the chapters after the first three in A2, B1, B2 and C1, 60 narrated stories and unlimited rounds in the three mini games. The A1 chapter path and 40 stories remain free.
5. Nerola Coach (voice English speaking coach)
Nerola Coach, introduced in version 4.0, is an AI-powered English speaking coach. Nero and your conversation partners (for example an interviewer or a receptionist) are AI characters; there is no real person on the other side. Their replies, corrections and voices are generated by AI.
Consent. Your voice and conversation text leave your device only after you give explicit consent on the in-app consent card (“You need to give permission to talk to Nero”). You can withdraw consent at any time with the “Allow cloud processing for my conversations” switch in Profile → Privacy and data; while it is off, no audio or text is sent to the coach. When Nerola Coach opens, the random identifier described in section 4 is registered once with our server so that your usage allowance can be tracked; this registration contains no audio or text.
Microphone. The microphone is used only with iOS permission and only while you hold the microphone button or, with “Tap and talk” (below), from your tap until your answer is sent (with VoiceOver you start and stop it with the button); one recording lasts at most 60 seconds. You can also type instead of speaking. The recording is deleted from your device after it is sent to our server, and also if sending fails. From version 4.5 you can choose “Tap and talk” in Profile → Lesson settings → Microphone: the microphone then opens with a tap, and your answer is sent after a short silence or another tap. From version 4.5, for the “This word” sheet, the recording of your answer stays on your device until the lesson ends, so you can hear a word you said; it is then deleted. In a live voice lesson (from version 4.6) your voice is streamed to our server while the microphone is on, instead of being sent as one recording; one answer lasts at most 3 minutes. From version 4.7, the short level test can ask you to read one sentence aloud and answer one question in English. These recordings take the same path as your lesson answers: they are sent to our server and to ElevenLabs to be turned into text, and the text is sent to OpenAI, first for moderation and then to estimate your level. The recordings are deleted from your device once sent and are not stored on our server. Only the estimated level (for example B1) stays on your device; it is also counted, without your answers, in our usage statistics (PostHog).
What is sent, and to whom. Coach requests go to our server running on Cloudflare Workers, which forwards them to the providers below under its own account. Your identifier and e-mail address are not sent to the providers. If you enter a first name during onboarding, it is sent with each lesson request to our server and to OpenAI only so that the AI partner and the coach can address you by it (and say it in the spoken greeting); our server does not store it. You can change or remove it in Profile → Name.
- Your recording: to ElevenLabs (Scribe) for speech-to-text. If ElevenLabs cannot be reached or is unavailable, the same recording is sent to OpenAI for this purpose.
- Your sentences in the conversation, recent conversation history (at most the last 12 messages), your chosen explanation language, level, scenario and the error types you practised before: to OpenAI for Nero’s and the characters’ replies, grammar corrections and the “Learn the correct way” text.
- From version 4.3 (coach memory): up to two sentences from My sentences that were corrected in your earlier lessons (what you said and the better form): to OpenAI with a lesson’s conversation, so your partner can give you a chance to use them again and the coach can tell whether you did. They stay on your device; our server does not store them.
- From version 4.3, when you tap the translate button under a partner’s line: that line (written by the AI) and your explanation language: to OpenAI. If you write in your own language when you are stuck, that text is sent like any other answer.
- From version 4.4, when you tap Hint during a lesson: your partner’s last line, the last few lines of the conversation (at most four, which can include your own sentences), your level, your explanation language and the lesson’s pattern: to OpenAI to write one or two replies you could say. Our server does not store them; it only counts how many hints a lesson used.
- For job-specific interview practice, the job, seniority and optional job posting you enter; for “Write your own scenario”, the situation you describe: to OpenAI to build the question plan or the roleplay card.
- When you ask for the meaning of a word that is not in the app’s own word list, the word and the sentence it appears in: to OpenAI.
- Nero’s and the characters’ replies: to OpenAI for text-to-speech.
- From version 4.5, the lesson’s tasks and your answer: to OpenAI, to check which of the lesson’s tasks your answer did.
- From version 4.6, in a live voice lesson: your voice goes through our server to ElevenLabs (Scribe) for speech-to-text; if it hears nothing in an answer (for example when you answer in your own language), the first 15 seconds of that answer go to ElevenLabs once more to be recognised in any language. The text of your answer, the recent lines of the lesson (at most the last 40), your first name if you gave one, your level, the lesson’s pattern and the coach-memory sentences described above go to OpenAI’s Realtime API, which writes and speaks Nero’s and your partner’s replies. The realtime model receives the text of your answer, not your voice. If you answer in your own language, that answer goes to OpenAI to give you its English (“You can say …”); in the lesson part, your answer goes to OpenAI to check it and, if needed, to write its correct form.
- Your conversation sentences, what you write for interviews and scenarios, and the AI character’s replies pass OpenAI’s moderation service for safety.
What our server keeps. Your recordings are not stored on our server. So that the same request is never processed or charged twice, your coach account keeps the latest results for a while: corrections and replies (which can quote your sentence and its corrected form) for about two days, and “Learn the correct way” texts and translated partner lines for up to 30 days. They are cleared once those periods have passed and the coach has not been used for about a day, and always with “Delete my coach data”. Apart from these results, under the random identifier from section 4 and an account key derived from it, the server keeps only: when the account was created, whether the free conversation and the onboarding demo have been used, daily and weekly usage counters (including speaking time), the last subscription check (active or not, expiry date) and the scenario and turn count of at most the 20 most recent conversations. From version 4.4 the account also keeps, for your last 50 offer moments, which plans screen was shown, closed or led to a purchase, which test group your account is in, and counts of your judged answers (numbers only, no text), so we can measure when the plans are offered. From version 4.6 the account also keeps how many seconds of live voice lessons you used today and, for the one-time live demo, in total (numbers only). This account is kept until you delete it with “Delete my coach data”; deleting the app does not delete the coach account on our server. To avoid processing the same request twice and to prevent abuse, request IDs are kept briefly and deleted within two days at the latest. The server processes the request IP address to rate-limit new registrations; the IP address is not stored in the coach account. Server logs contain only technical information (status, duration), not conversation content. Exception: if you report an AI reply with “Report reply”, the reply text, the scenario name and the reason you chose (not your own sentences) are kept for our review, as the last 20 reports in your coach account and in the server log. Cloudflare also processes network requests to deliver and protect the service.
Provider retention. Text-generation requests to OpenAI are sent with the storage (“store”) option disabled; requests to OpenAI’s Realtime API in live lessons have no such option. Under its own terms, OpenAI does not use data sent through its API to train models by default; it may keep it for a limited time for abuse monitoring. ElevenLabs processes, and may retain, recordings under its own policy. See the OpenAI privacy policy, ElevenLabs privacy policy and Cloudflare privacy policy.
On your device. Your conversation history, transcribed sentences and corrections are kept in the coach folder on your device, which is excluded from iCloud and device backups. Your review schedule, interview plan, recent custom scenarios and preferences such as the name you gave during onboarding, level, goal and reminder time are stored in the app’s settings on your device; if backup is on, they may be included in Apple’s device backup. Spoken replies from Nero and the characters are cached on the device so they can be replayed. Some of Nero’s onboarding lines are generated in advance, ship with the app and play without a network connection.
Personal information. We recommend not sharing your real name, address, phone number, company secrets or health information in conversations; scenarios work with fictional names and details.
Subscription. The Nerola Coach subscription is bought through the App Store and verified with RevenueCat. Using your random identifier, our server learns from RevenueCat only whether the coach subscription is active and when it expires. Your payment details never reach us.
Deletion. Profile → “Delete my coach data” first deletes the coach account on our server and then all coach records, coach preferences, the speech cache and the coach reminder on your device. If the server cannot be reached, nothing is deleted and the app tells you so; you can try again later. Your Nerola Plus purchase and game progress are not affected. If you open the coach again, a new, empty coach account is created for the same identifier. Cancel the subscription separately in the App Store.
Age. Nerola Coach is designed for users aged 13 and over.
6. Advertising, tracking and analytics
Nerola shows no ads inside the app and does not use your advertising identifier. The only data that reaches an advertising company is the ad measurement with Meta described below, and only while you share usage data.
Measuring our own ads (Meta), from the version that adds it: We advertise Nerola on Facebook and Instagram. To learn whether those ads lead to installs, the app includes the Meta SDK (Meta Platforms Ireland Ltd.; outside the EU, Meta Platforms, Inc.). The app never reads your advertising identifier (IDFA) and never asks for tracking permission. Only while you share usage data (after you agree in the EU/EEA, United Kingdom and Switzerland; by default elsewhere, where you can switch it off as described above) does the SDK send Meta three events: that the app was opened, that you finished your first lesson and that you subscribed. With them the SDK sends the technical data it needs to count them: app version, device model, operating system, language, time zone, an installation-specific identifier the SDK creates, and, technically, the IP address of the request. No names, e-mail, recordings, sentences or lesson content are sent. If you do not share usage data, nothing is sent to Meta: the app only registers the installation with Apple’s SKAdNetwork on your device, and Apple reports to Meta in aggregate whether an ad led to the install, without identifying you. Switching sharing off stops Meta events from that moment. Provider information: Meta privacy policy and Meta Business Tools terms.
Version 1.0: The app has no usage-analytics or crash-reporting service of its own; your in-game behaviour, answers and voice are never sent to an analytics service. The only exception is the purchase providers in section 4: purchase and offer-screen data are also declared under the “Analytics” purpose in the App Store privacy label.
Version 1.3 — unlinked usage counts: A previous decision to switch sharing off is preserved. The existing consent flow remains for App Store storefronts in the EU/EEA, United Kingdom and Switzerland, and when the storefront is unknown. In other storefronts, usage counts without a persistent analytics identity are on by default for people who have not made a choice. A home-screen notice explains this and the home menu can turn it off. The storefront is used only on-device for this decision and is not sent; interface language is not used as a location. Each event has a different random identifier. Installation, session and run identifiers, installation dates, device model, operating system, time zone and screen dimensions are excluded. These counts do not link a person’s activity across days. They may include event type, app version, interface language, level, content, aggregate results and active time. Explicitly consented analytics continues to use the installation-specific identifier described below. New events record onboarding steps, explicitly leaving the first wheel (which can be resumed), and closing a Plus offer. Backgrounding is not treated as abandonment. Network requests still technically expose an IP address to the provider; discarding IP data is a separate safeguard from the absence of persistent identifiers.
Version 2.0: The start and end of Word Table matches are also counted, with the number of players at the table (2–4) and how the match ended (completed, abandoned, or you left). Player names, avatars, table codes and typed answers are not sent. Your daily streak record stays on your device and is not sent to analytics.
Version 4.0 — Nerola Coach: Depending on your choices above (unlinked counts or consented analytics), coarse counts about coach use are also sent: onboarding steps; the start of a conversation (scenario identifier and type, voice or text mode, and the kind of allowance used: free or subscription); each turn (turn number, response time rounded to half-second buckets, only “10+” above 10 seconds, and how the answer was handled); the end of a conversation (number of turns); reaching a usage limit (the kind of limit); and use of features such as the interview plan, “Write your own scenario”, review, corrections and the subscription screen, with their outcome. Recordings, transcribed or typed sentences, corrections, job and job-posting details, scenario text and the name you gave during onboarding are never sent to analytics.
Version 4.8 — per-install counts: From version 4.8, the usage counts that are on by default in storefronts where consent is not asked (the 1.3 paragraph above) are sent with one random, install-specific analytics identifier instead of a different random identifier for each event. This lets us count the steps of the same installation together (for example, on which onboarding screen it stopped, or what happened after the subscription screen). The identifier contains no name, e-mail, advertising or device identifier; deleting and reinstalling the app creates a new one. No person profile is created in PostHog. Session and run identifiers, installation dates, device model, operating system, time zone and screen dimensions are still not sent with these counts; what is and is not sent is otherwise the same as in the 1.3 and 4.0 paragraphs. Because the identifier is persistent, these counts are not fully anonymous data. The home-screen notice shows this change once more; you can switch sharing off at any time from the home-screen menu, which stops sending. The consent flow in the EU/EEA, United Kingdom and Switzerland is unchanged.
Consented analytics (1.1/1.2 and people who explicitly consent in 1.3): To improve the app, Nerola can collect product analytics with PostHog (PostHog Inc., project hosted in the European Union). This starts only if you choose Share usage data on the in-app “Help us improve Nerola” screen; until you decide, and if you choose Don’t share, nothing is sent. You can change your decision at any time from the home-screen menu; switching it off stops sending, and usage from the period it was off is never uploaded later.
What is sent: session start, welcome and level choice, the start and completion of a wheel, chapter, story, daily wheel, mini game, friend race or Word Table match (content identifier, replay flag, active time and aggregate correct/wrong/pass counts; for Word Table also the number of players and how the match ended), the Plus offer being shown and the purchase outcome (started, pending, cancelled, failure category, verified success, restore), an invite link being opened; plus technical context such as app version, OS version, device model, interface language, time zone and screen size. This data is tied to a random, install-specific analytics identifier; it does not identify you directly, but because it is persistent it is not fully anonymous data. Switching sharing off and on again creates a new identifier.
What is never sent: your typed answers, Nerola Coach recordings and conversation text, dictionary searches, room and table codes, invite links, your name, your avatar, e-mail, Game Center identity, advertising or device identifiers, audio or screenshots. Location derived from the IP address is disabled; session recording, automatic screen/tap capture and surveys are not used. Provider information: PostHog privacy policy and data processing addendum. Usage events are retained for up to one year on our current free PostHog plan. Switching sharing off deletes the unsent device queue; it does not automatically erase events already sent to the server. For analytics data requests, contact us using section 8.
Before you decide, up to 50 usage events may wait in memory for that running app session only. They are sent if you agree and discarded if you decline or the app closes.
7. Children
Nerola is intended for a general audience and is not designed for children under 13. The app does not ask for an email address or location. Optional friend games ask for a display name; a nickname is sufficient. If you believe the random identifier described in section 4 belongs to a child, write to the address in section 8 and we will have the record deleted. Nerola Coach is designed for users aged 13 and over; the coach asks only for an optional first name; it does not ask for an e-mail address or location.
8. Your rights
Because the app does not associate your data with an account containing a name or e-mail address, you can delete on-device data yourself by deleting the app. Delete Nerola Coach data (records on your device and the coach account on our server) with Profile → “Delete my coach data” before deleting the app; deleting the app does not delete the coach account on our server (see section 5). For requests about your purchase record (access, deletion), contact tolgasayan@icloud.com with your random identifier. Because the app does not currently display this identifier, include your purchase date and the details from your App Store receipt. We will try to match the record with this information; a match is not possible in every case, and we will tell you the outcome. This policy is written under Türkiye’s Personal Data Protection Law (KVKK, Law No. 6698); if you are in the European Economic Area or the United Kingdom, you can exercise your GDPR/UK GDPR rights of access, rectification, erasure and objection through the same address.
9. Changes
When this policy changes, the effective date is updated; material changes are announced in the app.
10. This website
These pages are hosted on GitHub Pages. GitHub may log visitor IP addresses for security purposes; that processing is independent of the app and governed by GitHub’s privacy statement. This site uses no cookies or analytics.