1. Scope and service operator
This Privacy Policy explains how the ROYU mobile application, website and related services process personal data. ROYU is a shared language-learning product for two linked profiles.
The legal identity and postal address of the service operator must be completed before publication. Those details are intentionally not invented in this draft.
2. Data we process
- Profile and account data, including name, optional surname, email address, Firebase user ID, authentication provider identifiers and onboarding state.
- Authentication data used by Sign in with Apple and, where configured and chosen, Google Sign-In. ROYU receives provider tokens for authentication and reauthentication; provider credentials are not used as advertising identifiers.
- Learning data, including selected instruction and target languages, workspace identifiers, personal words, official-content progress, spaced-repetition level, review history, due dates, mastery state and learning-curve activity.
- Relationship data, including couple membership, relationship and workspace identifiers, partner invitation state and hashed invitation records. A valid invitation code may be shown to the people who possess its link.
- Shared-learning data, including shared words, Together Inbox items, quiz invitations, quiz answers and results, shared goals, each person’s contribution, streaks and activity summaries.
- Personal and shared learning plans, including goal category, duration, grammar route and topic-completion records. A personal plan is visible to its owner; a shared plan becomes active after the partner accepts.
- Weekly relationship-question answers and revisions, optional relationship dates, journey milestones, partner nudges and their delivery state. Answers are disclosed to the partner according to the feature’s mutual-answer rules.
- Shared-creature data, including its name, species, habitat, lifecycle, mood, progress, Bond Gifts, reward selections and streak-recovery inventory.
- Optional Together League participation and consent, team identity, first-name and avatar fields, an agreed custom team name where used, score, tier, ranking and season history. Individual member contribution details are not published in the group ranking.
- On-device learning copies and pending synchronization records, including personal word edits, reviews and deletions, their timestamps and conflict-resolution archives. Device preferences include appearance and learning-view choices.
- User-created content, such as words, meanings, examples, goal titles and AI feature prompts or topics.
- AI input and output needed to provide a requested feature, plus limited usage and token-count records used for quota, reliability and abuse prevention.
- Subscription and entitlement metadata, including app account token, Apple product and transaction identifiers, original transaction identifier, billing/access status, entitlement dates, relationship coverage and server-notification event identifiers. ROYU does not receive your full payment-card details.
- Notification data, including a random installation identifier, Firebase Cloud Messaging token, selected notification locale, opt-in state, app version and build number.
- Timezone identifier used to calculate local-day streaks and daily activity correctly.
- Selected avatar identifier and limited partner-readable profile fields needed for the couple experience and widget.
- Technical and security data needed for Firebase App Check, request validation, error classification and service protection. Diagnostic logs are designed not to contain prompts, submitted words, API keys or email addresses.
3. Why we use data
- Create and secure accounts; authenticate users; restore sessions; and verify sensitive actions.
- Create the private couple relationship, shared workspaces, invitations and partner-readable product features.
- Save, synchronize and restore learning progress; schedule spaced repetition; calculate streaks and display widgets.
- Deliver word sharing, shared goals, Together Inbox activity, official quizzes and shared quiz results.
- Provide personal learning plans, mutual weekly questions, shared journey milestones, creature growth and earned rewards; operate the optional team league and its season rankings.
- Provide requested translations and Premium AI explanations, vocabulary, grammar quizzes and custom together quizzes.
- Verify purchases, provide Premium entitlements to the purchaser and the covered second ROYU profile, handle renewals, grace periods, expiry, refunds and revocations, and prevent subscription fraud.
- Deliver opt-in push notifications and route a notification to the relevant in-app inbox item.
- Protect the service, enforce quotas, diagnose failures and comply with legal obligations.
4. Service providers and data sharing
ROYU does not sell personal data. Data is shared only as needed to operate requested functionality, measure the service as disclosed in the final release, protect the service or comply with law.
- Google Firebase: Authentication, Firestore, Cloud Functions, App Check and Firebase Cloud Messaging.
- Apple: Sign in with Apple, Apple Push Notification service, StoreKit, App Store purchase processing and App Store Server Notifications.
- Google: Google Sign-In where it is configured and chosen by the user.
- Groq: requested word translation, AI word explanation, personalized AI vocabulary generation and grammar feedback for weekly-question answers.
- Google Gemini: requested AI grammar quiz and custom AI together-quiz generation.
- A linked partner: limited profile, learning, shared-word, inbox, goal, quiz, streak and contribution data necessary for the shared experience. Private answer keys remain restricted until the quiz result is released.
- Other participating couples in your league group: the team identity, selected avatars, team score, tier and ranking disclosed during league participation. Personal words, email addresses and weekly answers are not included in the group ranking. League participation requires both partners’ agreement.
- Authorities or professional advisers where disclosure is legally required or necessary to protect rights, safety and the service.
5. AI features
AI features send the text and structured context needed for the feature to the configured provider. Server-side prompts may include the active instruction and target language, a word or topic, CEFR level and existing-word exclusions. ROYU’s server instructions are designed not to send your UID, email address or partner name to the AI provider.
When you request grammar feedback on a weekly answer, the answer and relevant question and language context are processed by the AI provider. Requesting this assistance does not make the answer public to other couples.
AI outputs may be incomplete or inaccurate. Do not submit sensitive personal information in AI prompts or user-created learning content.
6. Advertising, measurement and website cookies
ROYU does not display third-party advertising in the app and does not use Google AdMob.
The final release is expected to include Meta measurement tooling for app-install attribution and campaign analytics. Before publication, this policy, the iOS privacy manifest, consent behavior and App Store privacy answers must be updated to match the exact SDK configuration, events, identifiers, purposes and retention in the release build. This draft intentionally makes no tracking-free or analytics-free claim about that future build.
This static website includes no analytics, advertising pixels, tracking scripts or account cookies. It may use only the browser features required for user-requested actions such as copying an email address or invitation code.
7. Retention
Account and learning data are generally retained while the account is active so the service can synchronize progress and provide shared features. Invitation records may be retained in revoked, expired or used state for integrity and abuse prevention. Subscription records and server-notification identifiers may be retained as needed to establish entitlement history, prevent fraud, resolve disputes and meet legal obligations.
When an account is deleted, ROYU’s server workflow deletes the user profile, authentication user, public profile, official progress, AI and together-quiz usage records, owned personal words, entitlements, push device records and relationship-scoped data. A former partner keeps content they independently own, including words previously copied into their own list. Limited records may remain where legally required or in protected backup systems until normal backup rotation completes.
Signing out does not erase pending personal learning work on the device. After the server confirms account deletion, the app cleans up the account’s local learning store, queued and archived operations, matching widget data and local quiz drafts on that device. If cleanup is interrupted, the app retries it. Data on another offline device cannot be removed immediately from that device.
8. Security
ROYU uses authenticated access controls, Firestore security rules, relationship-scoped data, server-validated write paths, Firebase App Check, limited server quotas and secret-managed AI credentials. The widget reads a sanitized local App Group snapshot and does not initialize Firebase.
No method of transmission or storage is completely secure. Please use a protected device and notify support if you believe your account is at risk.
9. Your choices and rights
- Access and update profile information in the app.
- Control push-notification permission in iOS and Together Inbox notification preferences in ROYU.
- Request access, correction, deletion, restriction or portability where applicable under local law.
- Object to or withdraw consent for processing that relies on consent, without affecting earlier lawful processing.
- Complain to the competent data-protection authority.
- Contact privacy@royuapp.com to exercise a privacy right. Identity verification may be required.
10. Account and data deletion
In the iOS app, open Profile → Account & Security → Delete Account, review the consequences, confirm the acknowledgement and complete fresh Apple or Google authentication. Deletion is permanent.
If you cannot access the app, email privacy@royuapp.com from the address connected to the account. Deleting a ROYU account does not cancel an Apple subscription; manage or cancel it through Apple first if needed.
11. Children’s privacy
ROYU is not directed to children under 13. If local law requires a higher age to consent to digital-service data processing, a parent or legal guardian must provide any required authorization. If you believe a child provided personal data without appropriate authorization, contact us so we can investigate and take appropriate action.
12. International processing
Service providers may process data in countries other than your own. Where required, ROYU will rely on an available lawful transfer mechanism and appropriate safeguards. The production Firebase region and final service-operator details must be confirmed before this policy is published.
13. Changes to this policy
We may update this policy when the product, providers or legal requirements change. We will update the effective date and provide additional notice where required.
14. Contact
Privacy questions and rights requests: privacy@royuapp.com
General support: support@royuapp.com
Legal notices: legal@royuapp.com