Privacy Notice
2-Minute Mic is a daily speaking-practice app. This notice explains, in plain words, what personal data we process, why, who else handles it, how long we keep it, and the rights you have under India’s Digital Personal Data Protection Act, 2023. You can also read it inside the app under Profile → Privacy & your data.
1. What we collect and why
| Data | Purpose | Where it lives |
|---|---|---|
| Email address, or your Google / Apple account identifier | Creating and securing your account; password resets | Supabase (Mumbai) |
| The name you choose, your speaking goals | Personalising the app; your name is shown to people you follow or who follow you | Supabase (Mumbai) |
| Your practice recordings (video or audio) | Stored on your phone only. If you tap “Evaluate”, that one recording is uploaded so the AI can score it | Your phone; the uploaded copy is deleted within 24 hours |
| Transcript, scores and written feedback of evaluated speeches | Showing you your results and progress | Supabase (Mumbai), until you delete them |
| Practice dates, durations, streaks, topics shown to you | Streaks, the 21-day challenge, choosing topics you have not seen | Supabase (Mumbai) |
| Follow code, who you follow and who follows you, your daily community card (that you practised, streak, speaking time; and only if you choose to add them: your score, one highlight line, the topic), cheers and nudges | The Community features you choose to use | Supabase (Mumbai) |
| A one-way hash (SHA-256) of your sign-in email and phone number | Letting friends who already have your number or email find you in Community (switch off in Profile → “Let friends find me”). When you use “From your contacts”, the app first explains what happens and asks you. Your phone then turns each contact number and email into a one-way code (SHA-256) and sends only those codes to find matches. Contact names and the rest of your address book are never sent, and the codes are not stored | Supabase (Mumbai) |
| Profile photo, if you add one | Showing your picture to the people in your hive; it is shrunk to 512 pixels on your phone first. Without a photo we show your initial | Supabase (Mumbai). The photo is published at a web address: anyone who has that link can open it, even without the app, and blocking someone does not hide it from them. It is removed when you remove it or delete your account |
| Purchase product and store receipt reference | Granting what you paid for; support | Supabase (Mumbai); Google Play holds payment details, we never see card numbers |
| Reminder time | Your daily reminder | Your phone and Supabase |
| Optional usage events: screens opened, practice duration, evaluation waiting time and outcomes, downloads, follows, nudges and checkout outcomes; an account ID, app version and device platform | Understanding which features help people practise and where the app fails. Only after sign-in and when you enable “Help improve 2-Minute Mic”. No names, email addresses, contacts, payment receipts, recordings, topics, transcripts or feedback text are sent to analytics | PostHog Cloud EU; device and operating-system metadata may also be added by its SDK. Location enrichment and session replay are disabled |
| App version, device platform and a short description of app errors (no names, emails or recordings) | Fixing crashes | Supabase (Mumbai), 30 days |
We do not sell personal data, show advertisements, track you across other apps, or use your data for profiling beyond the features above.
2. Who else processes your data
- Supabase – database, file storage and sign-in. Your data is stored in Mumbai, India.
- Google Gemini API – when you request an AI evaluation, the recording, the topic and your practice focus are sent to Google’s Gemini service to produce the transcript and feedback. This processing may happen outside India. Google handles that data under the Gemini API terms for the plan we use.
- Google (Sign in with Google), Apple (Sign in with Apple) – only if you choose that sign-in method.
- Google Play – purchases and payment processing.
- Firebase Hosting – serves this page and other static pages; it does not receive your account data.
- PostHog – optional product analytics hosted in the EU, outside India. Usage is linked to an account ID rather than your name or email. The service receives network requests to deliver analytics; we disable IP-based location enrichment. We do not record your screen or use advertising identifiers.
3. Consent
We process your data on the basis of the consent you give when you create an account and tick “I am 18 or older and I agree to the Privacy Notice”. Sending a recording for AI evaluation is a separate choice you make each time by tapping “Evaluate this speech”; practising without evaluation keeps the recording on your phone. You can withdraw consent at any time by deleting your account (Profile → Delete online account); withdrawal does not affect processing that already happened.
4. How long we keep data
Optional analytics starts off. You can enable it on the welcome screen or in Profile → Privacy & your data, and switch it off there at any time on this device. Switching it off stops new events; you can continue using all app features. To request a copy or deletion of previously collected analytics, email info@2minutemic.com. Account deletion also queues analytics erasure separately from deletion of the app database.
- Uploaded recordings: deleted automatically within 24 hours.
- Account, profile, practice history, evaluations, community data: until you delete your account, after which they are erased immediately. Backups roll off within 7 days.
- Error reports: 30 days.
- Optional analytics: up to one year, or earlier on a deletion request. Analytics erasure is processed asynchronously; we handle requests within 30 days. A minimal account identifier is retained in the deletion queue while the request is being processed.
- Purchase records: as long as needed to honour the purchase and for accounting duties under Indian law. When you delete your account, the purchase record is unlinked from you; we keep the store order reference, product and date so a purchase cannot be claimed twice and for our accounts.
- Reports and blocks: blocks are deleted with your account. A report you make, or a report about you, is kept for up to one year so we can act on misuse; the reporter is unlinked if they delete their account.
5. Your rights
- Access – Profile → Privacy & your data → Download my data gives you your app database records. If you enabled optional analytics, email us for those separate usage events.
- Correction – change your name and goals in Profile; email us for anything else.
- Erasure – Profile → Delete online account removes your app account and queues erasure of optional analytics. Delete local practice data removes recordings from your phone.
- Withdraw consent – as above, at any time.
- Grievance – write to info@2minutemic.com with “Privacy” in the subject. We respond within 30 days.
- Nominate – you may name a person to exercise these rights for you if you are unable to; email us to do so.
- If you are not satisfied with our response, you may complain to the Data Protection Board of India.
6. Children
2-Minute Mic is for people aged 18 and over. We do not knowingly process the data of children. If you believe a child has created an account, email us and we will delete it.
7. Security
Data is encrypted in transit and at rest. Access to your records is restricted to your own account by database rules; our staff access production data only to resolve a support request you raise. Recordings uploaded for evaluation live in a private bucket and are removed within 24 hours. If a breach affecting your data ever occurs, we will inform you and the Data Protection Board without delay.
8. Changes
When this notice changes in a way that matters, the app asks for your agreement again before you continue. The version date at the top tells you which notice you agreed to.