Privacy policy

What this policy covers

This privacy policy explains how Loral (loralhk.com) handles account information, English practice and support enquiries. The Loral team handles data enquiries through the dedicated support email below.

Accounts and sign-in methods

Email registration uses your email address and password to create an account; Supabase handles authentication. You may instead choose Google sign-in and authorise access to your Google account identifier, email address and basic profile information, such as your name and picture. You can also use Apple sign-in and choose to share or hide your email address. This information identifies and authenticates your Loral account across devices. An Apple private relay address may correspond to a separate account; keep using your original sign-in method.

Your nickname is optional. Interface language and preferences are stored with your account. Google and Apple sign-in are optional; email accounts can use the same practice features. We do not sell sign-in account data or use it for advertising.

Practice, recordings and learning records

When you choose to start a voice activity, your browser uses the microphone you have permitted. Depending on the activity, audio, recognised text, questions and conversation content are sent to speech or AI services to provide conversation, pronunciation analysis and learning feedback. Share only what the practice needs; avoid real names, schools, contact details and other people’s private information.

Member history includes topics, dates, written answers or recognised text, feedback and practice results. Completed Free Talk records also include captions from both the learner and the AI coach for conversation review. DSE also stores oral practice records, bookmarks, reading positions and read status. These records belong to your account for access across devices. Previous anonymous records are not imported into member accounts.

General practice history does not add a raw recording archive. Free Talk temporarily retains the earliest captured audio, up to five minutes for pronunciation and fluency feedback. Selected clean excerpts are sent to the AI reviewer. Audio is kept in private, memory-only server storage during processing, then removed on completion or cancellation, and expires within ten minutes of being stored after the conversation ends. Audio is not available for history playback; external AI providers follow their own retention terms. DSE oral practice temporarily stores recordings for audio review and playback. Recording access lasts 24 hours; the relevant screen shows the expiry. Access stops at expiry and a background process removes the recordings. Expiry does not mean that every system copy disappears at the same instant.

Vocabulary learning data

Vocabulary learning stores your own words, notes, favourites, review progress, quiz answers and results with your account so you can continue learning and view your history. Unsynced vocabulary changes expire after seven days in the current browser and are cleared when vocabulary is next opened after expiry. Completing account deletion in this browser also clears that account’s vocabulary drafts. Drafts on other offline devices follow the same expiry policy.

If a record is damaged and you confirm starting again, the original data is kept as a recovery backup. It expires after thirty days and is cleared on the next vocabulary record read. Account deletion also removes these backups.

Service providers and processing

Loral uses Supabase for accounts and data storage, Resend for verification and recovery emails, and Render for website and backend hosting. Depending on the activity, speech and AI features use external AI processing services or Microsoft Azure Speech. Providers receive the information needed for the relevant feature.

Providers may process data outside Hong Kong. Their retention and security measures depend on their terms and actual service settings; we do not claim that every external provider retains no data. Google Groups receives support email, with conversations and member information kept private.

Cookies, temporary state and security

The website uses sign-in cookies and necessary browser and server temporary state to manage active practice, retries and duplicate submissions. Clearing browser data does not delete saved member records.

The website and its providers also process operational connection and error records for security, abuse prevention and troubleshooting. Account records have access restrictions. Protect your sign-in details and log out after using a shared device.

Retention, access and deletion

Confirmed saved learning records remain with your account until you delete them or we handle a related deletion request. There is currently no single automatic expiry period for all member text records. Unfinished or unconfirmed practice has limited temporary availability and may not be recoverable after leaving, expiry or a service interruption.

You can update your nickname and language in your account and delete your records where a record view offers deletion. Use Account settings → Delete account and learning data, or loralhk.com/account/delete, to verify your identity and confirm permanent deletion of your account, learning records and saved recordings. Contact us from your account email for managed accounts requiring assistance or other data requests. Account deletion revokes linked Apple authorisation. The credential needed for revocation is encrypted on the server and removed with the account after revocation. Temporary in-flight work and provider records follow their respective cleanup and retention processes. Separately removing Loral’s Google authorisation revokes that authorisation; it does not automatically delete your Loral account or saved records.

Support and updates

Younger users can ask a parent or guardian to help understand these practices or contact us. Do not send passwords or verification codes in a support enquiry.

We update this policy when our data practices change. Before using Google data beyond the original authorisation, we provide updated information and obtain the required consent.

Contact Loral