Privacy policy

Optional practice channels and learning referrals

Channel participation records your chosen channel, rules acceptance version and joining time. Membership is voluntary and is not inferred from your profession or interests. Posts and prepared replies use your public garden name; only eligible channel members can read them. You can leave, block, report, delete a contribution or opt out of Community. Leaving hides your channel contributions; opting out removes memberships and hides posts.

Learning referrals use random shareable codes and aggregate reward counts. We do not access contacts or automatically send invitations. Eligibility uses account verification, account age and server-recorded lesson opening days alongside completed lessons. A referral link never contains an email address. The other person does not receive your email or lesson answers.

To administer rewards and prevent repeated claims, we retain referral claim records and a keyed email fingerprint for up to 120 days, with expiry purged on routine authenticated activity or restart. This limited pseudonymous fraud-prevention record may outlast account deletion; account identifiers are detached when an account is deleted. Wallet accounting follows the existing retention policy. You can contact us to dispute a reward or object to this fraud-prevention processing. Account exports include memberships and referral status. See the offer terms for eligibility and limits.

What this policy covers

This policy covers the HoiDutch language-learning website, installable web app and its Android edition. It was last updated on 7 October 2026.

Information we handle

Required account and age group

An account is required to enter the learning app. We store your email address, a one-way password hash, verification status, broad learner age group (16–17 or 18+) and security-session records. We do not request a birth date. Your readable password is never stored.

Learning and personalisation

We store your learning progress, lesson scores, adaptive review schedule, earned Petals, chosen support-language and country variant, chosen healthcare career path, self-selected interests, theme and modular avatar settings, wardrobe wishlist, saved outfit presets, notebook entries, notebook memo and drawing, tutorial status and community-consent preference. A local copy is kept separately for each account on your device, then synced to that account. Signing out hides the local copy; signing back into the same account restores it. Recent chat stays in that account?s device storage and is not included in progress sync. Older device saves without reliable account ownership are retained separately and are not automatically imported into any account. Everyday-mission practice also stores task-level help and correction tags, such as time or location, to suggest follow-up practice. Typed mission replies are not stored. Language-country and career choices are explicit teaching preferences; we do not infer nationality, ethnicity, profession, personality or interests.

Speech and AI coaching

Dutch pronunciation can use a free synthetic Piper voice hosted by HoiDutch or a voice installed on your device. App voices play prepared lesson clips; for a new phrase, its text is sent to the HoiDutch server to generate audio, without a third-party speech API. Authored lesson clips are stored on the server. Other generated audio is reused in bounded, account-separated server memory, with a ten-minute reuse window, and in bounded browser session memory; its text and audio are not saved in the account database or a persistent personal audio archive. Temporary generation files are removed after each request. App voices require an internet connection and do not depend on the app owner’s computer. This feature does not use your microphone recording to create playback audio. If you use speech recognition, your browser or phone may process microphone audio according to its own speech-service settings. Transcript comparison is provisional and is not a clinical or biometric voice assessment. In Adult Mode, when protected AI coaching is enabled, recent conversation text, selected support language and selected interests are sent to OpenAI solely to generate Dutch-language learning feedback. HoiDutch does not save that conversation text in its own application database. Requests use the OpenAI Responses API with store: false, which prevents ordinary Responses application-state storage for those requests; it does not by itself provide Zero Data Retention. Under OpenAI's default controls, abuse-monitoring logs may contain prompts and responses and may be retained for up to 30 days, or longer when required by law or reasonably necessary to protect OpenAI's services or third parties from harm. Stronger retention controls require OpenAI approval and configuration and are not currently claimed by HoiDutch. OpenAI states that API data is not used to train or improve its models unless the customer explicitly opts in. See OpenAI's data-controls documentation. The HoiDutch server keeps daily and monthly request counts and non-personal operational success/failure timing so plan limits, costs and reliability can be controlled. Live AI is disabled in Teen Mode.

Community

The optional, Adult Mode Community Greenhouse stores a learner-chosen public garden name, an approved milestone and Dutch sentence, reactions, blocks, reports, moderation decisions, notices and appeals. Email, location, photos, links, open-text posts and direct messages are not published. Community is disabled in Teen Mode. Opting out hides your posts. Account deletion removes posts, reactions, blocks and profile data; limited report or decision records may be retained where necessary to handle safety abuse, disputes or legal obligations.

Avatar

HoiDutch uses one modular illustrated character whose selected appearance, clothes, accessories, expression and pose are stored with learning progress. The portrait-generation feature has been retired. A legacy private portrait created during an earlier test remains deletable and is removed by account deletion; HoiDutch no longer accepts a portrait prompt or creates a new portrait.

Google Play purchases

When Google Play checkout is activated, Google handles payment details. HoiDutch receives a purchase token and product identifier, verifies them with Google Play, then stores a hashed receipt, currency ledger, balance and cosmetic ownership. HoiDutch does not receive or store a card number. Checkout is disabled in Teen Mode and remains unavailable for everyone until the Play configuration is complete.

Operational information

The host may process limited network and security information such as IP address, requested route, time and response status. HoiDutch also records service health, backup age, disk capacity, moderation queue totals and billing-reconciliation state without exporting learner content. We do not use advertising identifiers, analytics trackers or cross-app tracking.

Daily lesson Charges

To enforce the daily allowance for unfinished new lessons without charging twice, we store the Netherlands calendar day, lesson identifier and claim time on the HoiDutch backend. Replays, adaptive review, notebook study and daily practice do not create a Charge claim. Claim history is included in your account export, is not shared for advertising or analytics and is deleted with the account, subject to the backup window below.

Notifications and milestone choices

The private in-app inbox stores patch notices, achievement and streak-reminder records, read status, your chosen reminder hour and time zone, and separate switches for study reminders, app updates, optional product news and Adult Mode automatic milestone sharing. Community participation alone never enables automatic posts; that requires a second explicit switch, and only preset milestone cards can be posted.

If you explicitly enable device reminders, HoiDutch stores the encrypted Web Push subscription endpoint and public encryption/authentication keys supplied by your browser. An encrypted notification payload and delivery metadata pass through the push service selected by the browser or operating system, such as a Google or Apple push service. The endpoint is used only for your chosen HoiDutch notifications, is not sold, and is disabled when you unsubscribe or when the provider reports that it has expired. Promotional product notices are off by default and unavailable in Teen Mode.

Optional alpha questionnaires and lesson reports

If invited, you can give feedback from your account. We store your selected answers, optional comment and lesson reference, questionnaire language, invitation and response dates, and response status with your account. Drafts are visible only to you; authorised questionnaire administrators can see participation status and submitted responses linked to your email. This is not anonymous. Feedback is used to improve HoiDutch and is not sent to an AI or external survey service. You may decline or delete your response on the questionnaire page. Your account export includes it, and deleting your account removes it from the live database. Questionnaires expire after 30 days; their response records are removed after 180 days during service start or questionnaire access, subject to the backup rotation described below. Invitations and reminders appear inside HoiDutch; they do not enable email or device push delivery. A lesson report you choose to send includes your account email, lesson title and identifier, step number, issue category, message and support language. Your answer is included only if you tick the sharing box. Only authorised administrators can review and mark reports; reports are removed after 180 days or when you delete your account, subject to backup rotation. Reports are included in your account export. Avoid entering sensitive or other people’s personal information.

Why we use it

• Create and protect the account required to access the app.
• Provide lessons, pronunciation, adaptive review, points and personalisation.
• Sync progress across the learner's devices.
• Enforce the stated daily new-lesson allowance without charging twice.
• Verify email addresses and recover passwords.
• Provide protected AI conversation feedback when enabled.
• Secure, diagnose and maintain the service.

Service providers

Oracle Cloud hosts the application, any legacy private portrait and encrypted account database. Google Workspace sends transactional account emails. OpenAI processes text supplied to the Adult Mode protected AI coach. Google Play will process Android purchases after checkout is activated. The browser or operating-system push provider delivers encrypted device notifications only after opt-in. Tailscale provides the compatibility connection. Each provider handles data under its own terms and privacy commitments.

Backblaze B2 stores encrypted database backups in an EU storage region.

Storage, protection and retention

Traffic uses HTTPS. Account passwords are salted and hashed. Sessions use secure HttpOnly cookies. Local database backups are encrypted, access-restricted and rotated after 30 nightly copies. Encrypted off-site backups are configured to be hidden after 21 days and deleted seven days later.

Active account data remains until the account is deleted. After deletion, the live account, synced progress and sessions are removed immediately. A deleted record can remain only inside inaccessible rotating backups for up to 30 days before aging out.

Optional instruction read aloud

Read aloud chooses a voice matching the support language. Where online narration is used, our server sends only published lesson instruction text and its language to Google Translate’s speech service. It does not forward your account identifier, cookie, answers, notebook, recordings or personal text. The provider sees the app server’s network address. Repeated instruction audio is cached in memory. Online speech requires internet and may be unavailable; an available matching device voice is then used. Dutch examples continue to use your chosen Dutch voice. Read aloud can be switched off inside the lesson.

Your choices and rights

• Download a portable JSON copy of your account, learning, notebook, wallet, purchase, subscription, community and any legacy portrait metadata from Account & sync. Security credentials, raw Play tokens, push encryption secrets, legacy portrait image binary and other learners' private data are excluded.
• Choose from the available support languages and change self-selected interests at any time.
• Turn protected AI feedback off in the coach.
• Keep community consent off, keep automatic milestone posting off, share individual milestone prompts manually, delete posts, report content and separately block a learner.
• Enable or disable device study reminders, app-update delivery and optional product news separately in Notifications.
• Ask Support to remove any legacy private portrait record.
• Reset learning progress from Settings.
• Permanently delete the account and synced data from Account & sync.
• Ask through Support about access, correction, portability, restriction or objection rights that apply to you.

Delete selected data without deleting your account, or open the full account-deletion guide.

Teen learners and children

The current release is designed for learners aged 16 and older. A broad, neutral age choice applies Teen Mode to 16–17-year-olds; Community, live AI and purchases are unavailable in that mode. Accounts for learners under 16 are not accepted until a properly reviewed parent-managed flow exists. HoiDutch is not directed to younger children in this release.

Questions

Use the support page for privacy or data questions. This policy may be updated when the service or its providers change; the date above will change with it.

HoiDutch provides language practice, not immigration, legal, medical or professional-certification advice.