Privacy Policy

Summary

• We collect what we need to build your plan, run the app and take payment — nothing more.
• Analytics only run fully after you accept them, and never include your answers, messages or voice.
• Your practice text and voice are sent to an AI provider to generate feedback. Voice recordings are not stored.
• We do not sell your personal data.

What we collect

• Questionnaire answers and email — to personalize your plan and send you access details. Answers are kept in your browser and on our servers.
• Account details — your email address and name when you create an account.
• Learning data — lesson progress, worksheets you fill in, practice transcripts, coach conversations and your daily activity streak.
• Purchase records — plan, status, renewal date and amounts from our payment provider. We never see or store your full card number.
• Technical data — a random visitor identifier cookie, device and browser type, and usage events (see Analytics).

Analytics (consent-based)

We use PostHog for product analytics, sent through our own domain. Until you accept analytics in the privacy banner, nothing is stored on your device for analytics and only anonymous, cookieless measurement may run. If you accept, PostHog may store an identifier on your device. You can change your choice at any time.

We only send named, typed events (for example “lesson completed”). Automatic click capture, heatmaps and session recordings are switched off. Analytics never include your questionnaire answers, messages, worksheet text, prompts, AI replies or recordings, and web addresses are stripped of personal query values.

AI processing

AI practice, feedback and the coach are powered by models accessed through OpenRouter. When you use them, the text you write — and, if you choose voice, your recording for transcription — is sent to OpenRouter and the model provider it routes to, solely to generate a response. Voice recordings are processed and discarded; we do not store them. The resulting transcript and feedback are saved to your account so you can review your practice. We record usage counts and costs per request, not the content, to enforce fair-use limits.

Service providers

• Cloudflare — hosting, and our database (Cloudflare D1), where your account, answers and learning data are stored.
• Clerk — sign-in and account authentication on sayloft.com.
• Stripe — payment processing and subscription billing. Stripe handles your card details under its own privacy policy.
• OpenRouter and the model providers it routes to — AI responses and transcription, as described above.
• PostHog — product analytics, with your consent.

Cookies and local storage

• A first-party visitor cookie keeps your questionnaire, offer and purchase together before you create an account.
• Sign-in cookies (Clerk) keep you logged in on sayloft.com.
• Your browser's local storage keeps your questionnaire answers and the offer timer so a refresh doesn't lose them.
• Analytics storage is used only after you accept analytics.

How long we keep data

We keep account and learning data while your account is active. Purchase records are kept as long as needed for accounting and legal obligations. You can ask us to delete your account and data at any time.

Your rights

Depending on where you live, you can ask to access, correct, export or delete your personal data, or object to certain processing. Email support@sayloft.com and we'll respond within the time the law requires.

Children

Sayloft is intended for adults. We do not knowingly collect data from children.