Privacy Policy
Last updated: August 8, 2026
HiTCF (hereinafter referred to as “the Platform” or “we”) values your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information, in compliance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).
1. Information We Collect
1.1 Authentication Information
Users register and log in via email. Through this process, we collect:
- Email address
- Name (provided during registration)
1.2 Payment Information
Paid subscriptions are processed through Stripe. We do not directly store your credit card numbers or bank card information. Stripe, as a PCI DSS Level 1 certified payment processor, independently manages your payment data. We only store:
- Stripe customer ID
- Subscription status and expiration date
- Payment event records (success/failure, no card numbers)
1.3 Usage Data
During your use of the Platform, we automatically collect:
- Practice and exam records (answers, scores, time spent)
- Wrong answer records
- Practice statistics (accuracy rates, streak days, etc.)
1.4 Voice Recordings and Speech Data
Speaking practice, the mock speaking exam and read-aloud practice record your voice through your microphone. What happens to a recording depends on which one you used:
- Speaking exam and conversation recordings: uploaded so your pronunciation can be scored, and deleted from our storage as soon as scoring finishes. What stays with your practice record is the recognized text and the scores — not the audio.
- Read-aloud recordings: kept alongside the score they belong to so you can listen back to yourself, and deleted when you delete that record or your account.
- Pronunciation scoring is performed by Azure Speech (Microsoft). The recognized text of your answers, together with any written drafts you submit for correction, is sent to Azure OpenAI to produce scores, corrections and feedback.
- In the iOS app, speech recognition runs on your device wherever the device supports it; where it does not, that audio is processed by Apple's speech recognition service.
Recordings are never used to train speech or language models, and are never sold or shared for advertising.
1.5 Cookies & Similar Technologies
The Platform uses the following cookies or similar technologies:
- Authentication Token: Used for identity verification and maintaining login state (essential cookie)
- Locale Preference: Used to remember your language preference (essential cookie)
The Platform currently does not use third-party analytics tools (such as Google Analytics) or advertising tracking cookies. If introduced in the future, this policy will be updated and users will be notified.
2. Purpose of Information Use
Personal information we collect is used solely for:
- Providing and maintaining Platform services (authentication, practice records, performance statistics)
- Processing subscription payments and managing account status
- Sending you important account-related notifications (subscription changes, terms updates)
- Improving Platform features and user experience
- Preventing fraud and abuse
- Sending you notification emails you can switch off at any time (Express Entry draw results, exam seat alerts, study reminders and offers)
We will not use your personal information for advertising or sell it to third parties.
3. Data Storage & Security
- User data is stored in a MongoDB database deployed in a secure cloud server environment.
- Audio files are hosted on Microsoft Azure Blob Storage.
- All data transmission is encrypted via HTTPS/TLS.
- We take reasonable technical and organizational measures to protect your data, but no internet transmission or electronic storage is 100% secure.
4. Third-Party Services
The Platform uses the following third-party services, each with their own privacy policies:
| Service | Purpose | Data Type |
|---|---|---|
| Stripe | Payment processing | Payment info, subscription status |
| Azure Blob Storage | Media and audio file storage | Practice audio and images; your read-aloud recordings; exam recordings until scoring finishes |
| Azure Speech | Pronunciation assessment and speech recognition | Voice recordings |
| Azure OpenAI | Grading, correction and explanations | Your answers, speech transcripts and written drafts |
| Vercel | Website hosting | Access logs |
| Sentry | Crash and performance diagnostics | Crash logs, performance traces, account ID |
| Resend | Transactional and notification emails | Email address, name |
5. Data Retention
- Account information: Retained for the duration of your account.
- Practice records: kept while your account exists. After account deletion, handled as described in “6. Account Deletion” below.
- Payment records: May be retained for up to 7 years as required by tax and legal obligations.
- Voice recordings: exam and conversation recordings are deleted as soon as pronunciation scoring finishes; read-aloud recordings are kept for as long as the score they belong to.
6. Account Deletion
You can delete your account yourself at any time: in the iOS app go to Profile → Delete account, or use the Account page on the web. No support request or extra approval step is involved.
Once you submit the request the account stops working immediately and we email you a confirmation. Signing in again with the same email within 30 days cancels the deletion and nothing is lost. After 30 days the account is erased as described below and cannot be recovered.
Permanently deleted
- Account information: email, name, password, third-party sign-in links.
- All practice data: answers, scores, wrong-answer book, review progress, mock exams.
- Speaking assessments, writing feedback and related drafts.
- Saved words, word books, bookmarks, notes and export files (including the exported files themselves in cloud storage).
Kept in anonymized form
Content corrections, question reports and grading feedback you submitted are kept with the link to your account removed. Those reports were already used to fix questions and calibrate grading; deleting them would strip the basis for changes that are already live. Once anonymized the records contain nothing that points back to you.
Kept for legal reasons or third-party rights
The following records survive account deletion. We use them only for the stated purpose:
| Record | Why it is kept | Retention |
|---|---|---|
| Transaction and billing records | Required by Canadian tax and accounting rules | Up to 7 years |
| Email delivery logs | Proof of sending and consent required by anti-spam law (CASL and equivalents) | For the period the law requires |
| Administrative and audit logs | Security auditing and dispute resolution | For the period the law requires |
| Security and abuse incident records | Protecting other users and the service | For the period the law requires |
| Referral relationships and renewal credits | They encode a reward another person has already earned or has yet to claim; deleting one side would take it away from them | While the credit remains valid |
Record kept to prevent repeat sign-up perks
When an account is deleted we keep an irreversible hash of the email address plus the device identifier and IP address recorded at sign-up. It contains no readable address, no name and no practice content — it can only answer “has this address or device registered before?”
It is used solely to stop the same person from repeatedly claiming one-time perks (free trial, referral bonuses) by deleting and re-registering, and is deleted automatically after 12 months. It does not prevent you from signing up again and using the service normally.
Reading plaza content
The text you submitted, your published readings and your reading collections are deleted with the account. Reading audio is deduplicated per sentence across users: a sentence only you ever synthesized is deleted together with its audio, while a sentence other users also synthesized keeps its shared audio cache — which contains nothing that identifies you.
7. Your Rights
Under PIPEDA and applicable laws, you have the right to:
- Access: View the personal information we hold about you.
- Correction: Request correction of inaccurate personal information.
- Deletion: Request deletion of your personal information (subject to legal retention obligations).
- Data Export: Obtain a copy of your practice data.
- Withdraw Consent: Withdraw consent for data processing (which may result in inability to use certain services).
- Unsubscribe: turn notification emails off in your settings, or with the one-click unsubscribe in any such email. Account emails — verification codes, password resets, payment receipts — are unaffected.
To exercise these rights, please contact: support@hitcf.com. We will respond to your request within 30 days.
8. Minors
The Platform is not intended for individuals under 16 years of age. We do not knowingly collect personal information from minors. If we discover we have collected information from a minor, it will be immediately deleted.
9. Cross-Border Data Transfers
Your data may be stored and processed on servers outside of Canada (including but not limited to the United States, due to the use of Stripe, Azure, and similar services). We ensure that these service providers maintain adequate data protection measures.
10. Policy Changes
We may update this Privacy Policy from time to time. Updated policies will be posted on this page with an updated “Last updated” date. For significant changes, we will notify you by email.
11. Contact
If you have any questions about this Privacy Policy or need to exercise your data rights, please contact:
- Email: support@hitcf.com