UIMI Privacy Policy
Last updated: 27 September 2026
This policy explains what UIMI collects, why, who it is shared with, and how to get rid of it. It is written to be read by a teenager, because most of the people using UIMI are teenagers.
If anything here is unclear, email support@uimi.app and we will explain it in plain words.
1. Who we are
UIMI ("we", "us") runs this app and decides how the information described below is used, which makes us its "controller" under data protection law.
Contact: support@uimi.app
2. Who can use UIMI
UIMI is for people aged 13 and over. We ask your age before you create an account and we do not create accounts for anyone who says they are under 13. If we learn that an account belongs to someone under 13, we delete the account and everything in it.
If you are between 13 and 17, please read this page with a parent or guardian.
3. What we collect
| What | Why we need it | Where it lives |
|---|---|---|
| Email address | To sign you in, confirm your account, and send password resets and security notices | Supabase Auth |
| First name, if you give one | To greet you in the app | Supabase Auth |
| Age band (13 to 17, or 18 or older) and the date you accepted these terms | To keep under-13s out and to record your agreement | Your account's rows in our database, and on your device |
| Audio recordings of your practice | To transcribe and analyse what you said | A private storage folder only your account can read |
| Transcripts of those recordings | To generate your feedback and let you look back | Your account's rows in our database |
| Feedback results, practice history, and your "was this accurate?" ratings | To show your progress, let you retry, and improve the coaching | Your account's rows in our database |
| Notes you type, such as a prompt you edited, your own material, or a note about your real situation | To make the coaching and suggested answers match your actual conversation | Your account's rows in our database |
| Purchase status, if you subscribe | To unlock Premium | Written by RevenueCat, stored as your plan, its renewal date, and whether it is a trial |
| Waitlist sign-up, if you join the waitlist on uimi.app: your email and whether you're a student, parent, educator or other | To email you when UIMI launches and about early access. Nothing else, and never shared | Our database, until you ask us to remove it, or 12 months after launch, whichever comes first |
| Security records | To stop abuse: counts of failed sign-ins on your account, and counts of requests from a network address, which we store only as a scrambled code, never the address itself | Our database, deleted automatically within two days, or when your account is deleted |
Our hosting provider also keeps short-lived technical logs of requests (such as IP address and time) to run and secure the service.
We do not collect your contacts, your location, your photos, your browsing on other sites, or advertising identifiers. We do not use tracking pixels, analytics SDKs, or advertising networks.
Your voice. We use your recordings only to transcribe and coach what you said. We do not create a voiceprint, and we do not use your voice to identify you or to recognise you across recordings.
4. What we do NOT do
- We do not sell your data. Ever. Not to anyone, for any price.
- We do not share your data for targeted advertising.
- We do not share your recordings or transcripts with other users.
- We do not show your recordings, transcripts or feedback to a parent or guardian, even if they are the one paying for Premium. Paying for the subscription does not buy access to what you said.
- We do not use your recordings, transcripts, or notes to train AI models, ours or anyone else's.
- We do not make decisions about you that have legal or similarly significant effects. The feedback is practice advice that you are free to ignore.
5. Who processes your data for us
To make the app work, some data is handled by these companies. They act on our instructions, under contracts that limit what they may do with it.
| Processor | What they receive | Purpose |
|---|---|---|
| Supabase (database, authentication, file storage, hosting) | Your email, account record, recordings, transcripts, feedback, notes | Runs the accounts, the database, and the private recording storage |
| Google (Gemini API, paid service) | The audio of the practice you just recorded, the resulting transcript, the situation you chose, and any notes or edited prompt you typed | Converts your speech to text, writes your feedback, and writes suggested answers when you ask for one. Under the terms of Google's paid Gemini API service, Google does not use this content to train or improve its models. |
| RevenueCat | A random account identifier and your purchase events | Tracks whether a subscription is active |
| Apple (only if you subscribe or use Sign in with Apple) | Payment and account information, handled by Apple, not by us | Processes the payment and the sign-in |
| Google Sign-In (only if you choose "Continue with Google") | Google tells us your email address, name and a Google account identifier; we never see your Google password | Signs you in |
Your audio leaves your device. It goes to our private storage, and then to Google for transcription and analysis. If you are not comfortable with that, please do not record.
We may also disclose information if the law requires it (for example, a valid court order), or if we believe in good faith that it is needed to protect someone from serious harm. If UIMI is ever sold or merged, this policy's promises go with your data, and we will tell you before anything changes.
6. Where your data is held
Our database, authentication, and file storage run in the United States. Google processes audio in its own data centres. If you are outside the United States, this means your data is transferred to the United States, and we rely on the standard contractual clauses offered by those providers for that transfer.
7. How long we keep it
- Recordings, transcripts, feedback, notes: until you delete them, or until you delete your account.
- Account record: until you delete your account.
- Security records: two days at most.
- Purchase records: kept by Apple and RevenueCat for as long as the law requires them to keep financial records.
- Backups: deleted data can remain in our hosting provider's encrypted backups for up to 30 days before those backups are overwritten. Backups are never used to restore deleted data.
You can delete a single practice, all your recordings at once, or your entire account, from the You tab in the app. Deleting your account removes your recordings, your transcripts, your feedback, your history, and your login. This cannot be undone. Deleting your account does not cancel an App Store subscription; cancel that in your Apple ID settings.
8. Your rights
Depending on where you live, you may have the right to:
- see the data we hold about you,
- correct it,
- delete it (the app does this for you, immediately, in the You tab),
- get a copy in a portable format,
- object to, or ask us to restrict, how we use it,
- withdraw consent at any time, and
- complain to your data protection regulator.
To exercise any of these beyond what the app already does for you, email support@uimi.app from the address on your account. We will respond within 30 days. A parent or guardian of a user under 18 can also contact us about their child's account.
If you are in the UK or the EEA, the legal bases we rely on are: performing our agreement with you (running your account and your practice), our legitimate interest in keeping the service secure and improving the coaching, and your consent where we ask for it (you can withdraw it at any time).
If you are in California or another US state with a privacy law, we do not sell or share personal information as those laws define it, we do not use sensitive personal information to infer things about you, and we will not treat you differently for exercising any right.
9. How we protect it
- Recordings sit in a private bucket. The storage rules only let your own account read a file in your own folder.
- Every table is protected by row level security, so one account cannot read another account's rows.
- Passwords are stored and checked by Supabase Auth as salted bcrypt hashes. We never see, store, or log your password.
- Repeated failed sign-ins are slowed down and limited, and requests to the service are rate limited.
- Traffic is encrypted in transit, and stored data is encrypted at rest by our hosting provider.
No system is perfect. If we ever suffer a breach that puts you at risk, we will tell you and the relevant regulator as the law requires.
10. Cookies and local storage
The web version stores a few small values in your browser so the app works: your login session, whether you have seen onboarding, and your age answer. There are no advertising or analytics cookies. Our website, uimi.app, sets no cookies at all and loads nothing from other companies.
Every waitlist email has a way to unsubscribe, and you can ask us to remove you from the waitlist at any time by emailing support@uimi.app.
11. Changes to this policy
If we change this policy in a way that matters, we will tell you in the app before the change takes effect, and update the date at the top.