Privacy policy

The data controller is Mateusz Solnica, the creator of SpeakAura. For anything about personal data, write to blooser@protonmail.com.

SpeakAura is an independent project and is not affiliated with Toastmasters International.

• Organizer account: email address and password (we store only its encrypted hash). With Google sign-in: email, name and profile picture from your Google account. We also store when the account was created and last used.
• Club and meetings: club name and description, meeting place, club members, meeting dates, themes and agendas.
• Meeting participants entered by the organizer: name, role, speech title and, for speakers, an email address where we send the confirmation and their feedback.
• Guests' votes and feedback: guests vote and write feedback without an account. We store the feedback text linked to the speaker, but not who wrote it. A guest's phone remembers in its browser which forms it has already filled in.
• Presentations uploaded by speakers before the meeting.
• Speech recordings: the organizer can record a speech from the cockpit. We store the voice recording, its transcript, statistics computed from it (speaking pace, filler words, pauses) and the measured speech time. Until they're uploaded, pieces of the recording stay in the organizer's browser storage.
• Bug reports and ideas: the message, the account email, the page address and the browser type.
• Technical data: IP address (in server logs and to prevent abuse) and aggregated website statistics.

• Running your account and the service: meetings, voting, collecting and sending feedback (Art. 6(1)(b) GDPR).
• Recording speeches and speech analysis: the speaker's consent, which the organizer asks for before recording (Art. 6(1)(a) GDPR). The speaker can withdraw it at any time, and we'll delete the recording and its transcript.
• Sending speakers their confirmation and feedback: the legitimate interest of the club and of the speaker taking part in the meeting (Art. 6(1)(f) GDPR).
• Security, abuse prevention, statistics and improving the app: legitimate interest (Art. 6(1)(f) GDPR).
• Answering reports and messages: legitimate interest (Art. 6(1)(f) GDPR).

After the meeting, the feedback about a speech, the speaker's name and the speech title are sent to the DeepSeek language model, which writes a report with advice for the speaker, sent along with the feedback (when downloading the PDF manually, the organizer can turn this analysis off). If the speech was recorded, the transcript, speech statistics and measured time go into the report too. We don't send anything about who wrote the feedback, because we don't store it. The same model reads the agenda text when a meeting is imported from easySpeak.

A speech recording is sent to OpenAI (the Whisper model), which turns speech into text. OpenAI doesn't use data sent through its API to train models and keeps it for at most 30 days for abuse monitoring.

DeepSeek processes data on servers outside the European Economic Area (in China), and OpenAI in the United States. The AI report and speech statistics are generated automatically and may contain mistakes.

We use trusted providers who process data on our behalf and only as needed to run the service:

• Amazon Web Services: application servers and databases, sending email, storing presentations and speech recordings (Frankfurt region, EU).
• Vercel: website hosting and anonymous performance statistics.
• Google: sign-in with a Google account and website statistics (Google Analytics).
• DeepSeek: AI analysis of feedback and reading agendas (see above).
• OpenAI: turning speech recordings into text (described above).
• Slack: forwarding bug reports and ideas to the team.

Some providers (Vercel, Google, Slack, OpenAI) may process data in the United States under standard contractual clauses or the EU-US Data Privacy Framework. DeepSeek processes data in China.

• Account, club and meeting data: as long as the account exists or until the organizer deletes it.
• Feedback, votes and presentations: together with the meeting they belong to.
• Speech recordings, their transcripts and statistics: together with the meeting, or until the organizer deletes the recording or the speaker withdraws consent. A deleted recording disappears from the app right away, and the file itself is removed from storage at most 90 days after recording. The recording is also emailed to the speaker along with the feedback.
• Server logs: for the short time needed for troubleshooting and abuse prevention.
• Website statistics: according to the Google Analytics and Vercel settings.

You have the right to access, rectify and erase your data, to restrict its processing, to data portability, and to object to processing based on legitimate interest. To use these rights or delete your account, write to blooser@protonmail.com.

You can also lodge a complaint with a data protection authority, in Poland the President of the Personal Data Protection Office (uodo.gov.pl).

• Essential: your sign-in session and chosen language.
• Settings in browser storage: e.g. a collapsed menu, a finished tour, the chosen questionnaire, forms a guest has already filled in, the speech timer, and for organizers, pieces of recordings not yet uploaded.
• Statistics: Google Analytics, Vercel Analytics and Speed Insights.

When we change this policy, we'll publish the new version on this page with its date. We'll email organizers about significant changes.