Effective date: 12 April 2026
CreamTea ("we", "us", or "our") operates the CreamTea web application (the "Service"), an AI-powered English pronunciation and communication coach. This Privacy Policy explains what information we collect, how we use it, and the choices you have.
By using the Service you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.
When you sign in with Google, we receive your Google display name, email address, profile photo URL, and unique Google user identifier. If you use the anonymous demo mode, we generate a temporary anonymous identifier with no personal data attached.
During a coaching session the Service records your voice through your device microphone. A separate user-only audio track is captured and uploaded to our servers for pronunciation analysis. The full session audio (including the AI tutor's voice) may also be stored so you can replay past sessions.
We store the following data generated during and after each session:
We track token consumption and estimated cost per session to enforce usage limits and display cost information in your profile. This data is stored per user and aggregated by month.
We automatically collect standard technical information such as browser type, device type, and IP address through our hosting provider (Firebase Hosting). We do not use third-party analytics or advertising trackers.
| Purpose | Data used | Legal basis |
|---|---|---|
| Provide real-time AI coaching | Audio stream, account info | Performance of contract |
| Pronunciation analysis | User-only audio recording | Performance of contract |
| Personalise future sessions (memory loop) | Transcripts, grammar errors, personal context, vocabulary | Legitimate interest / consent |
| Spaced-repetition vocabulary review | Flashcards, SRS scheduling data | Performance of contract |
| Display session history and progress | Transcripts, pronunciation scores, topics | Performance of contract |
| Usage tracking and cost display | Token counts, cost estimates | Legitimate interest |
| Service security and abuse prevention | Account info, technical data | Legitimate interest |
We do not use your data to train AI models. We do not sell your personal information to third parties. We do not serve advertisements.
We use the following third-party services to operate CreamTea. Each service receives only the minimum data necessary for its function:
| Service | Provider | Data shared | Purpose |
|---|---|---|---|
| Firebase (Authentication, Firestore, Storage, Hosting, Cloud Functions) | Google LLC | Account info, session data, audio recordings, all stored data | Infrastructure, authentication, data storage |
| Gemini API | Google LLC | Audio stream (live session), transcripts (post-session analysis) | Real-time AI conversation, vocabulary extraction, memory consolidation |
| Azure Speech Services | Microsoft Corporation | User-only audio recording (converted to WAV) | Phoneme-level pronunciation assessment |
| Anam.ai | Anam AI Ltd | Session token (no user audio or personal data) | Animated avatar rendering |
Each provider processes data under their own privacy policy. We encourage you to review:
All data is stored in Google Cloud Platform (Firebase) in the europe-west4 (Netherlands) region. Data is encrypted in transit (TLS) and at rest (AES-256) using Google Cloud's default encryption.
Access to your data is restricted by Firebase Security Rules that enforce user-level isolation — you can only read and write your own data. Administrative access is limited to authorised personnel and protected by additional Firestore security rules.
API keys for third-party services (Gemini, Azure, Anam) are stored as Google Cloud Secrets and are never exposed to the client application. The client receives only short-lived ephemeral tokens.
Depending on your jurisdiction, you may have the following rights:
To exercise any of these rights, contact us using the details in Section 10 below. We will respond within 30 days.
The Service is not directed at children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
CreamTea uses browser local storage and session storage solely for authentication state and application preferences. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the "Effective date" at the top of this page and, where appropriate, by displaying a notice within the application. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at:
Email: privacy@creamtea.app
Last updated: 12 April 2026