Privacy Policy

Last updated: June 2, 2026

English Bujhbo ("we," "us," or "the app") provides a daily English-learning service for Bangladeshi learners. This Privacy Policy explains what we collect when you use our mobile app or website, how we use it, who we share it with, and the choices you have. By using English Bujhbo you agree to the practices described here.

1. Information we collect

1.1 Account information

You sign in with either Google or Apple. Firebase Authentication (a Google service) handles the sign-in flow on our behalf, so we never see or store your password. We receive the email address and display name associated with the account you choose, and we save them on our server so we can show you the right progress on every device.

If you sign in with Apple, Apple sends us your full name only on the very first sign-in, and may give us either your real email address or an Apple-issued private relay address. We treat the relay address the same as a real one and do not attempt to unmask it. You can stop relayed mail at any time from your Apple ID settings.

1.2 Onboarding profile

During onboarding we may ask you for information that helps us tailor the lessons to you. All of these answers are optional and you can skip any of them:

• Your learning goal and self-reported English level
• Topics that interest you and contexts where you want to use English
• Daily study target (minutes), preferred reminder time
• Age range, occupation, gender (with a "Prefer not to say" option)
• How you heard about us (referral source)

If you provide an answer, we save it on our server linked to your account. You can change or clear these answers from the Profile tab.

1.3 Learning activity

So we can save your progress and resume on any device, we collect information about your activity inside the app:

• Which lessons and activities you have started, completed, or abandoned
• Your answers, accuracy, and time spent on individual quiz items, flashcards, and speaking prompts
• Daily streak, XP totals, achievements, and chapter progress
• Game rounds played, stars earned, and weak-item tracking
• Notification preferences and language settings

1.4 Speaking practice (microphone)

When you tap the microphone for a speaking exercise, the app records a short audio clip (a few seconds). The clip is sent to our server, which forwards it to DeepInfra, our speech-to-text provider running OpenAI's open-source Whisper model, so we can score your pronunciation and return per-word feedback. We do not retain the audio recording after scoring — only the transcript and your accuracy score are saved with your learning data. The microphone is accessed only while you are actively recording for a speaking exercise.

1.5 Chat practice (situational role-play)

Situational chat scenarios run entirely on your device. The conversation choices you tap are not sent to our server as conversational content; we only log anonymous analytics about which scenario you opened and how far you progressed.

1.6 Payments and subscriptions

If you upgrade to premium, two payment paths exist:

• In-app purchase (App Store / Google Play). Subscriptions purchased inside the app are processed by Apple or Google. We use RevenueCat to keep track of your subscription state across devices: RevenueCat receives an opaque identifier (your Firebase user ID) and the entitlement events (purchase, renewal, cancellation, refund) returned by Apple or Google. RevenueCat then notifies our server, which updates your plan. We do not see your card or bank details.
• Direct payment (website). If you upgrade through our website, payment is processed by EPS, a Bangladesh-licensed payment gateway, or another local provider. We store the transaction ID, package purchased, amount, and timestamp so we can grant access and issue receipts. We never see or store your card number, mobile-banking PIN, or bank login.

If you redeem a promotional code, we record the code (in uppercase form) and your user ID against the payment, and we increment the code's usage counter.

1.7 Push notification token

If you allow notifications, the app registers a Firebase Cloud Messaging (FCM) token with our server so we can deliver reminders and important account messages. The token identifies your specific app install on your device, not you as a person. When you sign out the token is removed from our server.

1.8 Diagnostics and analytics

We use the following Google services to keep the app stable and understand how it is used:

• Firebase Analytics records in-app events such as lesson opened, lesson completed, activity finished, paywall viewed, and screen views. The events are linked to your Firebase user ID so we can understand product usage trends, never to identify you to third parties.
• Firebase Crashlytics captures crash reports and JavaScript error stack traces when the app misbehaves, plus technical context like device model, OS version, and the error message and stack. We attach your Firebase user ID so we can correlate a crash to a specific account when you contact support. Crash reports do not include your lesson answers, chat choices, microphone audio, or payment details.
• Firebase Remote Config delivers small configuration flags to your app — for example, when a new release is required, which paywall variant to show, or how many chat scenarios are free. It does not collect personal data from your device.
• Firebase Cloud Messaging delivers the push notifications described in section 1.7.

1.9 Advertising attribution (Meta)

We use the Facebook (Meta) SDK so we can measure the effectiveness of our ads on Facebook and Instagram and understand which campaigns lead to sign-ups and purchases.

• On iOS, before any tracking, we show Apple's standard App Tracking Transparency prompt. The Meta SDK only attaches your device advertising identifier (IDFA) to events if you say "Allow."
• We send Meta a small number of milestone events — sign-up, lesson started/completed, paywall opened, purchase initiated and completed — plus a SHA-256 hashed copy of your email address (Meta never receives your email in plain text).
• You can limit ad tracking at any time from your device-level controls (iOS "Allow Apps to Request to Track" or Android "Ads" settings). Doing so reduces the data shared with Meta.

1.10 Website analytics

Our marketing website (english.bujhbo.com) and our payment pages (api-english.bujhbo.com/v1/web/*) use Google Analytics 4 and the Meta Pixel to measure page views, ad campaigns, and successful checkouts. These set their own cookies in your browser; you can clear or block them through your browser settings.

1.11 Information we do not collect

We do not collect your precise location, contacts, photos, files, calendar, SMS, or phone-call history. The microphone is accessed only while you are actively recording for a speaking exercise.

2. How we use your information

• Provide the lessons, scoring, and progress tracking you sign up for
• Save your progress so you can resume on the same or another device
• Personalise the experience based on your onboarding answers
• Send the daily reminder you opted in to and important account messages
• Score your pronunciation and show you per-word feedback
• Process payments, manage your subscription, and provide receipts
• Diagnose crashes and improve app stability
• Understand which features are used so we can improve them
• Measure the effectiveness of our advertising on Meta platforms
• Detect and prevent abuse, fraud, and security incidents

3. Sharing with third parties

We share information with the following service providers, each only for the purpose listed:

• Google — Firebase Authentication, Analytics, Crashlytics, Cloud Messaging, Remote Config; Google Sign-In as your identity provider on Android and the web.
• Apple — Sign in with Apple as your identity provider on iOS.
• RevenueCat — keeping your App Store and Google Play subscription state in sync with our server.
• DeepInfra (OpenAI Whisper) — short-term speech-to-text transcription of your speaking-exercise audio.
• EPS and other Bangladesh-licensed payment gateways — processing direct payments made through our website.
• Meta (Facebook) — ad attribution and campaign measurement, receiving milestone events and a hashed email only.
• Hosting and infrastructure providers — hosting our database and servers under industry-standard security practices.

We do not sell your personal information. We do not allow third parties to use your data for their own marketing purposes.

We may disclose information if required by law, court order, or other legal process, or if necessary to protect the rights, property, or safety of our users or the public.

4. Data retention

We retain your account and learning data for as long as your account is active. If you delete your account (see Section 6), we permanently remove your learning history, attempts, achievements, streak, notification preferences, and game data, and we anonymise your account record so it can no longer identify you. Payment records are kept for accounting and tax purposes for up to seven years, but in anonymised form.

Voice recordings are not retained. Crash logs and anonymised analytics events are retained for up to fourteen months, in line with Firebase's default retention settings.

5. Security

We use industry-standard measures to protect your information, including HTTPS encryption for all network traffic, hashed credentials via Firebase Authentication, access controls on our databases, and constant-time signature verification on incoming payment-provider webhooks. No system is perfectly secure; if we become aware of a breach affecting your personal information we will notify you and the appropriate authorities as required by applicable law.

6. Your rights

6.1 Access and correction

You can review your profile information, learning progress, and preferences at any time inside the app under the Profile tab. You can edit your display name, goal, level, daily target, and reminder time there.

6.2 Deleting your account

You can permanently delete your account at any time:

• From the mobile app: Profile tab → Settings → Delete account.
• By email: send a request from your account email to support@bujhbo.com and we will complete the deletion within 30 days.

Deletion removes your profile fields, learning history, attempts, achievements, streak, notification preferences, and game data. As described above, payment records are anonymised but kept for accounting compliance, and your Firebase Authentication record is also removed.

6.3 Notifications, microphone, and ad tracking

You can disable daily reminders inside the app under Settings → Daily reminder, or in your device's system settings. You can revoke microphone access at any time in your device's system settings; speaking exercises will become unavailable until you re-grant it. You can limit ad tracking through iOS "Allow Apps to Request to Track" or Android "Ads" settings.

7. Children's privacy

English Bujhbo is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at support@bujhbo.com and we will delete it.

8. International data transfers

Some of our service providers (such as Google Firebase, RevenueCat, DeepInfra, and Meta) process data outside Bangladesh. By using English Bujhbo you consent to this transfer. We require all our processors to protect your information to a standard at least as strong as this policy.

9. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. If the changes are material we will notify you in the app or by email. Your continued use of English Bujhbo after a change indicates your acceptance of the revised policy.

10. Contact us

For any questions, concerns, or requests about your information, contact us at:

Email: support@bujhbo.com
Address: Dhaka, Bangladesh