PodiumPrivacy Policy

Last updated 1 September 2026Account-based · audio stays on the device

Podium records your voice, which is the most sensitive thing it touches. That audio is transcribed on your device and is never uploaded.

The short version

Podium holds an account and your practice history. Your recorded speech is transcribed on the device by a local Whisper model; the audio never leaves the phone. Only the resulting text transcript is saved to your account, and only when you choose to save the session.

Your voice, specifically

Where transcription happens: on your device. Podium downloads a quantised Whisper model into its own private storage and runs it locally. There is no speech-to-text service involved and no audio upload in that path.

What is sent to us: the text transcript of a session you saved, with its word timings, plus the article and prompt it relates to. Not the audio.

Where the recording lives: in the app's private storage on your device, for as long as you keep the session. Deleting a session deletes its recording.

Why this matters: a voice recording is biometric-adjacent data that identifies you far more strongly than a transcript does. Keeping it on the device removes that risk rather than managing it.

Who we are

Podium is operated by Divyansh Karan, trading as Stelr Studio (Remote · India), the data controller for the purposes of the UK GDPR and GDPR. Contact: karandivyansh01@gmail.com.

Account information

Data	Why	Required
Email address	To create your account and sign you in	Yes
Display name	Shown on your profile	Yes
Avatar	Shown on your profile	Optional
Native and target language	To pick appropriate articles and feedback	Yes
Difficulty level and daily goal	To set your practice load	Yes

Sign-in can be completed with Google. In that case Google confirms your identity to us and we receive your email address, name and avatar — we never receive your Google password.

Practice data

Generated by the sessions you record and save:

Session records — which article and prompt, the stance you were assigned, duration and completion status
The text transcript of what you said, with per-word timestamps
The feedback generated for that session
Your statistics — streaks, practice time and progress against your daily goal

Permissions

Permission	Why
Microphone	Recording your speaking round. Required for the app's core function; audio is processed on-device.
Storage (app-private)	Holding the downloaded Whisper model and your session recordings, in the app's own private area.
Notifications	Optional — practice reminders you turn on.

Model downloads

The first time you use transcription, the app downloads a Whisper model file from Hugging Face. That request fetches a public file — it carries no account identifier and no content of yours. Hugging Face will receive the request's originating IP address, as it would for any download.

What we never collect

None of the following is collected, by design:

Advertising identifiers, or any data used for advertising or profiling
Contacts, calendar, SMS or call logs
Data bought from, or shared with, data brokers
Any cross-app or cross-site tracking

Who we share data with

We use these processors, and share your data with no one else except where legally required.

Processor	What it handles	Their policy
Our own backend and database	Account, session, transcript and feedback data	This policy
Google Sign-In	Identity verification, only if you choose it	policies.google.com/privacy
Hugging Face	Serves the public Whisper model file. No personal data.	huggingface.co/privacy
Expo / EAS	App builds and updates. No personal data.	expo.dev/privacy

How long we keep it

While your account exists — as long as you keep it. Delete an individual session at any time, which removes its transcript and its on-device recording.
When you delete your account — your profile, sessions, transcripts, feedback and statistics are permanently deleted.
Database backups may retain deleted data until they rotate out on the hosting plan's retention schedule.

Security

The protections actually in place:

No system is perfectly secure. If you find a vulnerability, email karandivyansh01@gmail.com — we will acknowledge within five working days.

All traffic between the app and our servers uses HTTPS/TLS.
Passwords are stored only as a salted hash by the authentication provider — we never see them.
Session tokens are held in the device's hardware-backed secure storage (Keychain on iOS, encrypted storage on Android), never in plain app storage.
Row-level security is enforced at the database level, so one account's queries cannot read or modify another account's rows.
Sign-in uses the PKCE authorization-code flow.
Recorded audio is never transmitted, so it cannot be intercepted in transit or exposed by a server breach.

Your rights

Wherever you live, you can exercise all of the following. If you are in the UK or EEA these are your rights under the UK GDPR and GDPR; in California, under the CCPA/CPRA.

To exercise any right, email karandivyansh01@gmail.com. We respond within 30 days.

Access — everything we hold is visible inside the app.
Correct — edit any entry or profile field directly.
Export — request a machine-readable copy of your data.
Delete — delete individual sessions, or your whole account, from inside the app.
Withdraw consent for anything optional, by removing the data or revoking the permission in your device settings.
Object or restrict processing, and lodge a complaint with your data protection authority (in the UK, the ICO at ico.org.uk).

Deleting your account

Profile → Account settings → Delete account permanently erases your profile, every session, transcript, piece of feedback and your statistics. Recordings held on the device are removed with the sessions they belong to; uninstalling the app removes any that remain.

If you cannot access the app, email karandivyansh01@gmail.com from your registered address and we will delete the account within 30 days.