Privacy policy

Last updated 9 November 2026.

This policy explains how the Fuego mobile application (the "App") and heyfuego.com (the "Website") process personal data. Fuego provides an AI language tutor, practice exercises and progress tracking.

1. Controller and contact

The controller is Filip Kowalski, c/o Coworking Minds, Carrer Ferrers, 1, 07510 Sineu, Islas Baleares, Spain. For privacy requests, contact privacy@heyfuego.com.

2. Using the App

The App creates an installation-linked account through Firebase Authentication. You can use the App without providing an email address or password. Sign-in is optional: you can connect Google, Apple or an email sign-in link to that account. Connecting a sign-in method keeps your learning records linked to the same account and lets you sign in to it on another device. You can sign out or delete your account in the App. These account records are personal data.

We store your supplied name, language and learning preferences, assessed level, progress, exercises, answers and flashcards. We also store your messages, the tutor's replies and transcripts of voice conversations. The tutor builds a memory of your goals, interests, preferences and recurring mistakes, including earlier versions. You can view and correct that memory in the App.

If you connect a sign-in method, Firebase Authentication holds your email address, any display name supplied and the sign-in provider identifier. We also store the email address and any supplied display name to manage your account.

The onboarding age question is optional and can be skipped. It does not accept an age below 13. If you answer it, we store the answer as a birth year and derive your age from that year. If you state your age in a conversation with the tutor, we may store the corresponding birth year in the same way, provided that the stated age is 13 or above. We use this information to adapt the tutor's language and topics. Your birth year and derived age are included in the learner profile sent to our AI providers.

Your profile, tutor memory and relevant conversation history are sent to our AI providers to generate replies and learning material. Do not include information about yourself or others that you do not want processed in this way.

Microphone audio is processed through our service and Soniox for speech recognition. Google Gemini processes the resulting text to generate replies, and Soniox provides spoken output. We do not retain your microphone recordings on our servers. The App keeps temporary audio for conversation replay on your device. Synthesised tutor and exercise audio may also be cached for playback; it is distinct from a recording of your voice.

Providing conversation content is necessary to receive a reply. Voice features require microphone access; you can use typed chat without it. Notifications are optional. If you enable them, we process your push token and preferences to send reminders.

3. Purchases, usage and support

Apple or Google processes subscription payments. RevenueCat manages subscription access and purchase attribution. We receive subscription status, transaction references and renewal information, but do not receive payment card numbers.

We collect installation-linked usage and diagnostic information, including onboarding choices, feature use, practice and conversation activity, purchase activity, and device and App information. Analytics events exclude conversation and feedback text. We link usage and purchase information to understand how people use Fuego and which campaigns lead to subscriptions.

RevenueCat also receives your supplied name, learning and reminder preferences, onboarding status and aggregate usage information for customer segmentation. Store-provided campaign information and analytics identifiers help us attribute purchases.

Feedback includes your message, any contact address you provide and relevant App and device information. Feedback and voice-conversation transcripts are delivered to a private Telegram channel for support and tutor-quality review. This means authorised operators can read those transcripts. We do not sell your personal data or use your conversations to train our own models.

4. Website and browser storage

We use self-hosted Umami to measure visits, referring pages, general device and browser information and approximate country. This measurement runs when you visit the Website and does not use analytics cookies or link visits to an App account. Our Website also processes connection information to deliver pages and protect the service.

The Website remembers when you close its download card, so it can avoid showing that card again during the same tab session. You can remove this preference through your browser's site-data controls.

5. Recipients and international processing

We use the following providers for the purposes described above:

Our main service and database are hosted in Germany. Some providers process data internationally, including in the United States and other countries outside the European Economic Area. Their own retention and legal obligations may differ from ours. Contact us for information about the arrangements and safeguards applicable to a particular transfer.

6. Purposes and legal bases

For EEA and UK users, we rely on performance of our contract to provide the tutor, store your learning progress and manage subscription access. This includes authenticating your account, enabling optional sign-in and access on another device, and using your optional age answer to adapt the tutor's language and topics. We rely on legitimate interests in service security, preventing abuse, diagnosing faults and reviewing tutor quality for those activities. Optional notifications rely on your consent. You can disable them in your device settings. Microphone permission controls access to your microphone; it is separate from permission to use conversation content for another purpose.

7. Retention and deletion

Your account identifiers, email address and supplied name, if any, conversations, transcripts, flashcards, learning profile (including your optional birth year) and tutor memory are retained until you delete your account or request deletion. These records do not currently have a general automatic expiry. Copies in routine backups may remain for up to about three months after deletion and are not used for normal service operation.

Signing out does not delete your account or learning records. Account deletion removes your Firebase Authentication account and eligible records held by our service. Deleting the App does not itself delete records held by us or our providers, and may remove the credentials needed to access your installation-linked account. Use account deletion before uninstalling if possible. Subscription transaction records, previously delivered analytics and copies in the support channel require separate handling; account deletion does not automatically remove every such copy. See account deletion for the available steps and exceptions.

Deleting an account does not cancel a store subscription. Cancel through the App Store or Google Play to stop future charges.

8. Rights and choices

Where applicable, you may request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. You may withdraw consent without affecting earlier lawful processing. Contact privacy@heyfuego.com. If you have connected a sign-in method, we may use the email address linked to your account to help locate your records and verify your request. For an installation-linked account without a connected sign-in method, we may need limited information or a step from your App installation to locate and verify your records; you do not need to write from an account email address.

We respond to requests within 30 days, subject to applicable law. You may complain to the Agencia Española de Protección de Datos or the supervisory authority in your country. The tutor assesses learning progress to personalise practice; those assessments do not determine legal rights or eligibility for an official qualification.

9. Children and security

Fuego is not intended for children under 13 or a higher applicable minimum age. If you believe a child has provided personal data without the required authorisation, contact us. We use technical and organisational measures to protect personal data, including encrypted connections and access controls. Report security concerns to security@heyfuego.com.

10. Changes

We update the date when this policy changes. We will provide notice before materially different uses of personal data take effect, and request consent where required. For other support, contact support@heyfuego.com.