Your study data is yours.

What Smort collects

Smort may process account identifiers and the sign-in information you choose to use, such as an email address, phone number, or Apple or Google account identifier. Smort does not receive your Apple Account password or payment card details. If Apple shares your name when you sign in with Apple, Smort stores it with your account. Cloud-connected features and purchases require a Smort account. Signing in does not enable Cloud Sync.

Your decks, items, answers, review history, settings, and related study content are stored on your device. If you enable Cloud Sync, the content you choose to sync is also stored in our Supabase cloud service so it can be restored and kept consistent across your devices. This includes your profile nickname and profile photo. Turning Cloud Sync off stops future syncing but does not delete the copy already in the cloud; deleting your Smort account deletes it.

If you join the waitlist, Smort stores the email address you provide only to invite you to the Smort beta on TestFlight and to send one notification when Smort launches on the App Store. It is not added to a marketing newsletter or linked to a Smort account. We keep it until that launch notification is sent or you ask us to delete it.

To limit automated waitlist submissions, our web server processes your IP address and sends a daily keyed hash of it to Supabase. The rate-limit record contains that hash and an attempt count, not your raw IP address or email. Records older than 24 hours are removed when a valid signup attempt is processed; they can remain longer when the waitlist is inactive.

If you send general feedback or request a Pack in the app, Smort stores the message with your internal account identifier, feedback type, app version and build, interface language, and submission time so we can review it and improve the app. Do not include passwords or sensitive personal information in feedback.

AI processing

When you invoke an eligible Smort AI feature, Smort sends the text needed to create material, answer a Quick Question, or grade an answer through Smort's authenticated cloud gateway to OpenRouter and the selected model provider. Smort records limited operational data such as an internal account value, request type, status, latency, token counts, estimated cost, and safe error code, and keeps these records in its database until you delete your account. For most AI requests, Smort also keeps the generated result in a short-lived server cache so a retry does not run the request again; a scheduled cleanup deletes it, usually within about twenty minutes. We do not put prompts, answers, account contact details, access tokens, or provider keys in our application logs.

If you report a card or a grade, Smort stores the report with the card, your answer and its transcript, the AI request and result, and any reason you give, so we can review it and improve Smort. When you correct a grade, Smort files a grade report automatically. A scheduled cleanup deletes reports after 90 days.

Screenshot import requires a Smort subscription. Before an image leaves your device, Smort asks for a separate image permission, which you can withdraw in Settings. General Smort AI processing requires your permission after sign-in on each device, before using Smort. The screen names the AI providers, and its View Details page lists the data sent to each. You can withdraw that permission in Settings > Privacy & data on that device. Smort then stops new AI requests and shows the permission screen again; requests already sent may finish, and withdrawal does not delete data already shared. Before an image upload, Smort removes location data and other metadata, such as EXIF, GPS, timestamps, and filenames, from the image on your device, and scales large images down.

Smort does not keep the image. It is not stored on Smort's servers, is not written to our logs, and Smort does not hold it after the request completes. If the connection drops, the prepared image stays only in your device's memory so you can retry; it is released when the import succeeds and when you cancel, pick another image, withdraw the permission, or leave the app. Smort denies provider data collection for the request; the model provider may keep it for a limited time for abuse monitoring under its own terms. For an image request, Smort records the same operational data plus the image size and dimensions as ranges. It never records the picture, the filename, or location. To make retries safe, Smort keeps the generated candidate cards in a short-lived server cache; a scheduled cleanup deletes them automatically, usually within about twenty minutes. The cards you review and choose to keep are stored like the other cards you create.

Older supported app versions may still use a temporary anonymous credential for a retired setup AI path. Related AI results and accounting records are retained for up to 35 days, except while reconciliation is pending. Current onboarding does not use a first-card-before-account experience.

If the optional personal OpenRouter-key feature is available and you choose to use it, the key is stored on your device and sent only for the request you initiate. It is not stored in Smort's database.

Speech and audio

When you grant microphone permission and use spoken Practice answers, Apple's speech-recognition framework processes the audio on your device. For this on-device feature, Smort does not send that microphone audio to our servers or a third-party speech provider, and it does not store the microphone recording.

When you use Voice Chat, your microphone audio is sent to OpenAI for live speech processing and spoken responses. Smort also sends the session context needed for the feature: your study and native languages, conversation settings and optional topic, your profile nickname, if you set one, for the greeting, and, when you choose a Pack to practice, its title and phrases.

Voice Chat saves caption history on your device. Captions and relevant context are also sent through Smort's authenticated cloud gateways to support reconnects and, when used, caption translation, word grouping, and card generation. Generating cards from selected words sends conversation fragments along with your selection. OpenAI processes data under its applicable terms and the retention settings for our account; under OpenAI's standard API terms, it may keep this data for up to 30 days for abuse monitoring, or longer where the law requires or where reasonably needed to protect OpenAI's services or others from harm.

Smort keeps a record of each Voice Chat session, without audio: the languages, the form of address you chose, the time used, and when the session ended. We use it to apply your monthly Voice Chat minutes, and a scheduled cleanup deletes it after 32 days.

Smort also stores the captions of each Voice Chat call, your side and Smort's, with your account and the level you chose. We do not store the audio. We use the captions to learn what learners talk about and how well calls work, so we can improve Voice Chat: our server sends each call's captions to OpenAI, which returns a review with the topics, a short summary, and a rating of the call, and we store that review with the captions. The Smort team may read the captions and reviews for the same purpose. A scheduled cleanup deletes them after 30 days, and deleting your account deletes them sooner. Calls from app versions before this change stay only on your device.

When an eligible signed-in learner invokes Quick Question by voice, Smort sends the live microphone audio directly to a Soniox regional real-time endpoint using a short-lived, single-use credential while Apple speech runs in parallel as a fallback. Smort supplies the learner's known study and native languages as non-strict hints; Soniox automatic language identification can still recognize other supported languages. If Soniox is unavailable, returns no text, or takes too long to finish, Smort uses the Apple result instead.

Smort does not store the microphone recording. Soniox does not retain real-time audio or transcripts after processing and does not use them for model training. Recognized text is handled like text you type and is sent through Smort AI when you submit the question.

Starting a Smort free trial automatically enables Studio Voice. You can also enable it manually or turn it off in Voices & speed. While Studio Voice is enabled, the text Smort needs to speak is sent through our authenticated cloud gateway to ElevenLabs. ElevenLabs generates the Alice voice for English and Mandarin Chinese. Smort asks ElevenLabs not to log each synthesis request where our provider account supports that setting, but ElevenLabs processes data under its own terms and the retention settings available for our account.

Smort stores completed Studio Voice audio in a private, account-scoped Supabase cache so the same text does not need to be generated again. An evictable copy is also kept in the app's cache on your device for instant replay. The app falls back to Apple voice when Studio Voice is unavailable, your plan does not include it, or your monthly allowance is used.

Subscriptions and usage

Apple processes purchases and billing. Smort receives signed transaction information, product and subscription status, renewal state, expiration dates, and an account-binding token so we can verify your plan and restore it to the correct Smort account. Smort records monthly AI usage and short-lived reservations to enforce the allowance shown in the app.

Apple Ads attribution

If you install Smort after you tap or see a Smort ad on the App Store, Apple can tell us which ad it was. After you sign in, the app gets a one-time token from Apple's AdServices framework and sends it to our server, which asks Apple which Apple Ads campaign, if any, led to the install. We store Apple's answer with your Smort account: whether an ad led to the install and, if so, the Apple Ads account, campaign, ad group, keyword, ad, placement, country or region, download type, and the minute you tapped or saw the ad. Apple's answer does not identify you or your device. We use it only to measure which of our ads lead to subscriptions. We do not share it or use it to track you across other companies' apps or websites. It is deleted with your Smort account.

Website analytics

When website analytics is enabled, we use Vercel Web Analytics to measure aggregate visits to our public pages. It does not use analytics cookies or session replay. We remove query strings and URL fragments from pageview URLs and do not send your waitlist email, form contents, or Smort account identity as analytics properties. Vercel processes request information to produce anonymous traffic statistics and uses a visitor hash that is discarded after 24 hours. We suppress pageviews when your browser has Do Not Track or Global Privacy Control enabled.

App product analytics

Smort sends selected product-usage events to PostHog so we can understand whether onboarding and practice are working. These events describe actions and categories such as an onboarding step, practice mode, result, hint use, item state, counts, response time, and app or device context. They do not include Deck or card text, prompts, answers, transcripts, feedback, names, email addresses, or phone numbers. Session replay, automatic screen and control capture, and IP-based location enrichment are disabled.

Before you sign in, PostHog assigns the app installation a random identifier. When you sign in, Smort associates that installation's earlier events with your internal Smort account identifier so we can measure the onboarding journey. We do not send PostHog your account contact details. Smort resets the device analytics identity when you sign out or switch accounts. We use this data to improve Smort, not for advertising or tracking you across other companies' apps or websites.

Crash reports

After a crash, the app sends a crash report to PostHog when it next opens. The report includes the crash type (the name of the error or system signal), a stack trace of memory addresses, identifiers of the app and system code, the app version and build, and device and system details. It contains no crash message text, decks, items, answers, transcripts, or contact details.

Crash reports carry the same analytics identity as the events above: a random installation identifier, linked to your internal Smort account identifier when you sign in. IP-based location enrichment stays disabled. We use these reports to find and fix bugs, not for advertising or tracking.

Apple may also share crash and performance reports through App Store Connect when you allow sharing with app developers in iOS settings.

Service providers

Smort relies on Vercel for website hosting and aggregate website analytics; Apple for app distribution, purchases, speech, Apple Ads attribution, and optional Apple sign-in; Supabase for authentication, database, and server functions; Soniox for real-time Quick Question transcription when an eligible learner invokes it; OpenAI for Voice Chat and its call reviews; OpenRouter and model providers for requested AI operations; ElevenLabs for Studio Voice synthesis while Studio Voice is enabled; PostHog for privacy-limited product analytics and crash reports; Google only if you choose Google sign-in; and email or SMS delivery providers only if those sign-in methods are enabled. Providers process data under their own terms and privacy policies. We share data only with the providers above, only as a feature needs it, and only with providers whose terms protect it at least as well as this policy.

Retention and deletion

You can delete your Smort account from the app. Account-owned cloud learning data, synced study data, Studio Voice cloud audio, Voice Chat captions and reviews, feedback, image-permission records, internal authorization records, Apple Ads attribution, and AI usage metadata are deleted with the account or, for feedback, may be deleted earlier by Smort, except information we must retain for security, fraud prevention, legal obligations, or transaction integrity. For App Store purchases, Smort retains a minimal transaction record, including the account-binding token stored with the purchase, so the same purchase cannot be claimed by multiple accounts. Signing out or deleting the Smort account clears that account's Studio Voice device cache. Learning stored on your device remains after you sign out or delete the Smort account, until you reset app data in Smort or remove the app.

Deleting a Smort account resets analytics identity on the device but does not automatically erase historical PostHog events or crash reports. You can ask us at the address below to delete analytics and crash reports associated with your internal Smort account identifier. Anonymous events and crash reports that were never associated with an account may not be identifiable as yours.

Deleting a Smort account does not cancel an Apple subscription. Cancel or manage it in the app's Plan & Usage screen or in your App Store subscription settings.

Security and choices

Smort uses authenticated, account-scoped APIs, encrypted network transport, restricted server credentials, and server-side authorization. No system can guarantee absolute security. Smort AI is part of the product and requires an internet connection. You can avoid invoking cloud AI features, use text instead of Quick Question voice input, withdraw screenshot image permission, deny microphone or speech access, sign out of your Smort account, or delete your Smort account.

Children, changes, and contact

Smort is not directed to children under 13. We may update this policy as the product changes and will revise the date above. Questions or privacy requests can be sent to support@getsmort.app.