Privacy Policy

This policy explains what Gora collects, why, and what you can do about it. It covers all three ways of using Gora — the website, the iPhone and iPad app, and the Android app.

1. Who is responsible for your data

Gora is operated by two companies, and which one is the data controller depends on how you use it.

How you use Gora	Who controls your data
In a web browser at gora.academy or app.gora.academy	Meadows and Brown Limited
The Android app from Google Play	Meadows and Brown Limited
The iPhone or iPad app from the App Store	Flare Digital DOO

Meadows and Brown Limited is registered in England and Wales (company number 13327945), registered office Second Floor, 57 Brewer Street, London W1F 9UL, United Kingdom.
Flare Digital DOO is registered in Montenegro (registration number 51141231), registered office Filipa Kovačevića BB, Budva, 85310.

Either way you can reach us at hello@gora.academy and we will route your request to the right company.

2. What we collect

Everyone, however you use Gora:

• Your account — email address, and your name and profile picture if you sign in with Google or Apple. If you sign up with a password we store a secure hash, never the password itself.
• Your learning — lessons completed, XP, streak, review scheduling, placement level, chosen language and settings.
• Conversations with the fox — what you type or say to the AI tutor, so it can reply.
• Speech — if you use the microphone, the audio clip is sent for transcription and is not kept afterwards.
• Product analytics — which screens you open, which features you use, app version, device type and approximate country, so we can see what works. Our mobile apps use Firebase Analytics without advertising identifiers; advertising storage, ad user data and ad personalisation are disabled.
• How you found us — the referring website or campaign tag from your first visit, recorded once on your account.
• Support messages — anything you email us.

Web only: cookies and similar storage, subject to the choice you make in the cookie banner (see our cookie policy), and — if you subscribe — billing details handled by Stripe.

Apps only: your purchase and subscription status from the App Store or Google Play, received through RevenueCat. We never receive your card number from either store.

We do not collect advertising identifiers, we do not track you across other companies' apps or websites, and we do not sell your data. Ever.

3. Why we use it, and on what basis

• To run the Service — your account, your progress, your subscription. Basis: performance of our contract with you.
• To improve Gora — analytics, understanding which lessons work. Basis: our legitimate interest in building a better product, and your consent where cookies require it.
• To contact you — confirmation and account emails, and product updates you can unsubscribe from. Basis: contract, and consent for marketing.
• To keep it safe and legal — fraud and abuse prevention, accounting and tax records. Basis: legitimate interest and legal obligation.

4. Who else sees it

We use a small number of suppliers who process data on our behalf under contract:

• Supabase — accounts, progress and subscription records (hosted in the EU, Frankfurt).
• Google — the Gemini model that powers the fox, and Google sign-in.
• Microsoft — text-to-speech for the spoken audio.
• Apple — Sign in with Apple, and App Store billing.
• RevenueCat — subscription status for app purchases.
• Stripe — payments on the web. Stripe is a controller in its own right for payment data.
• Resend — sending account emails.
• PostHog — product analytics (EU hosting).
• Firebase Analytics (Google) — first-party product analytics in the iOS and Android apps. We configure it without advertising identifiers and disable advertising uses.
• Google Analytics — on the marketing site only, and only if you accept analytics cookies.
• Hetzner / our hosting provider — the servers Gora runs on.

We also share data where the law requires it, or if the business is sold — in which case you would be told first.

5. Where your data goes

Our primary database is in the EU. Some suppliers process data in the United States. Where that happens we rely on the European Commission's and the UK's approved transfer mechanisms, including standard contractual clauses.

6. How long we keep it

Your account and learning data are kept while your account exists. Delete your account and they go, immediately and permanently — we cannot restore them afterwards. Fox conversations are kept only as long as needed to give the app context. Records we must keep for tax and accounting are held for as long as the law requires, typically six years.

7. Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to processing, or ask us to restrict it. Most of this you can do yourself: your data is visible in the app, and Settings has a delete-account button that removes everything. For anything else, email hello@gora.academy and we will respond within one month.

If you think we have handled your data badly, please tell us first — but you can complain to a regulator. In the UK that is the Information Commissioner's Office (ico.org.uk); in Montenegro, the Agency for Personal Data Protection; in the EU, your national supervisory authority.

8. Children

Gora is not for children under 16. We do not knowingly collect data from anyone under 16. If you believe a child has an account, email us and we will delete it.

9. Security

Data is encrypted in transit and at rest, access is limited to those who need it, and payment card details never touch our servers. No system is perfectly secure, but if a breach ever affects you we will tell you and the relevant regulator as the law requires.

10. Changes

If we change this policy materially we will tell you in the app or by email before it takes effect. The date at the top always shows the current version.

11. Contact

hello@gora.academy — for anything at all, including data requests.