Privacy Policy

Last updated: October 5, 2026

1. Overview

This Privacy Policy explains how Medabrim (“Medabrim”, the “Application”, the “Service”, “we”, “us”, or “our”) collects, uses, stores, protects, and shares personal information when you use the Application.

By using the Application you agree to the practices described here. If you do not agree, please do not use the Application.

This Privacy Policy forms an integral part of Medabrim’s Terms of Service.

2. What Information We Collect

2.1 Information You Give Us

When you create an account we collect your email address and a password. Your password is stored only in encrypted, hashed form — we cannot see or recover it. If you sign in with Apple or Google, we receive your email address and, where available, your name; we never receive your password.

During onboarding you provide details that let us personalize your lessons:

• Name
• Age range
• Gender
• Current Hebrew level
• Your reason or goal for learning Hebrew
• Preferred tutor (male or female)
• Daily practice goal
• Daily reminder time (if you enable reminders)

2.2 Information Created As You Use the Service

Conversation data:

• The text messages you send and the tutor’s text responses
• On-demand corrections you request
• Translations of tutor messages
• Suggested phrases generated for you
• The date, time, and topic of each practice session

Voice data: When you use voice input, your speech is processed in real time to produce a transcription and a conversational response. Your voice audio is not stored on our servers. Voice-processing providers may retain audio temporarily under their own policies, mainly for safety, abuse prevention, and quality.

Usage data:

• Daily practice time
• Number of conversations and messages
• Streak data (consecutive practice days)
• Your device time zone (used to calculate dates for streaks and daily limits)

2.3 Subscription and Payment Information

Subscriptions are purchased and billed entirely through the Apple App Store or Google Play. We never collect, store, or see your card number, billing address, or any financial details.

From our subscription-management provider we receive only:

• Subscription status (active / inactive / expired)
• Plan type (for example, monthly or yearly)
• Purchase and renewal dates
• The store of purchase (App Store or Google Play)
• Anonymous purchase identifiers

We use this solely to determine which features you may access and to manage renewals and refunds.

2.4 Information Collected Automatically

We and our service providers may automatically collect technical information to keep the Application working well and to improve it:

• Device type and model
• Operating system and version
• Application version
• Approximate region (country or region — not precise location)
• In-app usage patterns (screens viewed, features used, session length)
• Performance data and error logs
• Crash reports and diagnostic information
• IP address and basic technical identifiers, collected automatically for debugging
• Network request metadata (URLs, status codes, and timing — not the contents of requests or responses)
• Recordings of how the app’s screens are rendered during your session, used for usability analysis and bug-fixing. Text you type (passwords, messages, profile fields) is automatically masked and is not visible in these recordings.

We do not collect precise GPS location, your contacts, your photos, or other device data unrelated to the Service.

3. How We Use Your Information

3.1 Operating the Service

• Authenticating your account and managing sign-in sessions
• Personalizing conversations to your level, goal, and preferences
• Processing your conversations to generate responses, recognize speech, and produce audio
• Saving your conversation history for review
• Tracking your daily practice time and streaks
• Determining and enforcing your subscription entitlements
• Sending daily practice reminders, if you enabled them

3.2 Improving the Service

• Adapting content to your level and interests
• Finding and fixing technical problems
• Developing new features based on usage patterns
• Reviewing session recordings to understand usability and improve the interface

3.3 Analytics

• Analyzing aggregated usage patterns
• Measuring engagement, retention, and feature adoption
• Identifying trends and areas to improve

3.4 Communication

• Sending service emails (password reset, account changes, important updates)
• Sending reminders and notifications to your device, subject to your permissions
• Sending notifications about new features, product updates, account events, and re-engagement
• Responding to your support requests

We do not send marketing or promotional messages without your consent where such consent is required.

3.5 Security and Abuse Prevention

• Enforcing rate limits to protect the Service
• Detecting and responding to suspicious activity
• Keeping security and audit logs

4. How We Protect Your Information

We use reasonable, industry-standard measures to protect your information:

• Encryption in transit — all communication uses HTTPS/TLS
• Passwords stored using one-way hashing — we cannot view them
• Row-Level Security — each user can access only their own data
• Short-lived authentication tokens for sessions
• Rate limiting against abuse and brute-force attempts
• Cloud infrastructure that meets recognized security standards, with automatic backups and regular updates

If a Breach Occurs

If a breach affects your personal information, we will notify the relevant authorities within 72 hours where required by law, notify affected users without undue delay when the risk is high, and act quickly to contain the breach. Notices are sent to your account email.

Your Responsibilities

• Use a strong, unique password
• Do not share your login credentials
• Sign out on shared devices

No method of transmission or storage is completely secure.

5. Sharing With Service Providers

We rely on third-party service providers to operate the Application. Each provider receives only the minimum data needed to perform its function and is bound to protect it. To protect the Service, we describe these providers by category rather than by name; where disclosure is required, the payment and sign-in providers are identified below.

5.1 AI and Voice Processing

We use third-party artificial-intelligence and voice-processing providers to generate conversation responses, transcribe speech, and produce spoken audio. We share with them only the content and information necessary to deliver the Service — principally your conversation content and, during voice sessions, your voice audio. We do not share your account password with these providers, and we do not share your email address with our AI conversation providers.

To deliver low-latency real-time voice, some features connect directly from your device to a third-party provider over a secure connection using short-lived access tokens that we issue, so that voice interaction happens with minimal delay.

5.2 Backend and Authentication

• A cloud database and authentication provider stores your account and conversation data and manages sign-in.
• Identity providers — Apple (Sign in with Apple) and Google (Sign in with Google) — share the email address and basic profile information you authorize when you use social sign-in.

5.3 Subscription Management

• A subscription-management provider manages in-app purchases, entitlements, and renewals using an anonymous user identifier and purchase events.
• The Apple App Store and Google Play process all payments and recurring billing directly — we have no access to your payment details.

Our subscription-management provider may share anonymized subscription events (such as purchase, renewal, or cancellation) with our analytics and advertising partners so we can understand how subscriptions relate to engagement and measure our advertising. These events may include device advertising identifiers where available, and never include payment details.

5.4 Analytics and Session Replay

An analytics provider records product-usage events, device information, approximate region, basic identifiers (such as a user ID, name, and email) together with the learning preferences you choose during sign-up, and masked session recordings to help us improve usability, support our users, and fix bugs. Text input fields are masked, so what you type is not visible in recordings.

5.5 Crash Reporting

A crash-reporting provider collects crash logs, device information, error context, IP address, and basic identifiers (such as a user ID and email) so we can correlate errors to affected users and fix them.

5.6 Notifications

The Application can send notifications to your device, including:

• Daily practice reminders (only if you enable them), streak alerts, and learning milestones
• Subscription and account notices (renewal reminders, payment failures, trial endings, important account updates)
• Product updates about new features and significant changes
• Occasional re-engagement notifications if you have not been active recently

You can turn off all notifications in your device settings, and turn off reminders inside the Application.

5.7 Over-the-Air Updates

We use an over-the-air update service to deliver improvements and fixes between store releases. It receives basic device and version information needed to deliver the correct update.

5.8 Advertising and Measurement

We use advertising and measurement partners to understand how well our marketing works. Our software may collect device-level information and send app events — such as installs, registrations, content views, and purchases (amount and currency) — to these partners for attribution and optimization. This may include device advertising identifiers where available. We do not share your conversation content, messages, or voice recordings for advertising.

On iOS you may be asked to allow tracking through Apple’s App Tracking Transparency prompt; if you decline, our partners receive only limited attribution data. On Android you can opt out through your device’s ads-personalization setting.

5.9 Third-Party Policies

Each provider processes data under its own privacy policy. As of the date of this Policy, our AI providers state that data sent through their APIs is not used to train their models by default; however, we cannot control or guarantee future changes to third-party policies.

6. Where Your Data Is Stored

Your data is stored on servers located in the European Union and the United States, depending on the provider. Where data is transferred outside the European Economic Area, we rely on appropriate safeguards such as Standard Contractual Clauses. By using the Application you acknowledge that your data may be processed outside your country of residence.

7. How Long We Keep Your Data

While your account is active, we keep your profile, conversations, corrections, usage data, and streaks to provide the Service and your learning history. Subscription records may be kept as required by tax law. Voice audio is not stored on our servers.

When you delete your account in the Application settings:

• Your account is deactivated immediately and you are signed out.
• For 30 days your data is retained so you can restore your account by signing back in and choosing to restore.
• After 30 days all personal data is permanently and irreversibly deleted.

Anonymized, aggregated data that cannot identify you may be kept for analytics and service improvement. To delete specific data without deleting your account, contact us at the email in the final section.

8. Your Privacy Rights

8.1 Rights for Everyone

• Access — request a copy of the information we hold about you
• Correction — update inaccurate information (most fields are editable in the app)
• Deletion — delete your account and data in the app settings
• Portability — request a copy of your data in a portable format

To exercise these rights, contact us at the email in the final section.

8.2 European Economic Area (GDPR)

If you are in the EEA, you have additional rights and we process your data on these legal bases:

• Account creation and service delivery — performance of a contract
• Subscription management and payment — performance of a contract
• Analytics, session replay, and service improvement — legitimate interest
• Crash reporting and security — legitimate interest
• Service communications — legitimate interest
• Reminders — your consent; product and service notices — legitimate interest
• Voice processing via third-party AI — your consent
• Legal compliance — legal obligation

You also have the right to restrict or object to processing, to data portability, to withdraw consent at any time, and to lodge a complaint with your local supervisory authority. If you withdraw consent for voice processing, please stop using the voice features.

We are not currently established in the European Union. If we are later required to appoint an EU representative under GDPR Article 27, we will publish the details in an updated version of this Policy.

8.3 California (CCPA / CPRA)

California residents may request details about the information we collect and how we share it, request deletion or correction, and are protected from discrimination for exercising these rights.

We do not sell your personal information. To measure and optimize advertising we may share device identifiers and subscription-event data with advertising partners, which may be considered “sharing for cross-context behavioral advertising” under California law. You can opt out by emailing us, by declining the App Tracking Transparency prompt on iOS, or by enabling the ads opt-out setting on Android.

9. Age Restriction

The Service is intended only for adults aged 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it promptly. Parents or guardians who believe a minor has provided us information should contact us at the email in the final section.

10. On-Device Storage and Tracking

The Application stores some data locally on your device — authentication tokens to keep you signed in, a temporary cache of tutor audio for replay, and your preferences such as language. This local data is not sent to our servers except as described in this Policy.

The Application does not use browser cookies, but integrates third-party software that may use anonymous device identifiers for analytics, crash reporting, session replay, and advertising. These identifiers do not by themselves contain your name or email. You can limit device-level tracking in your device’s privacy settings.

11. Updates to This Policy

We may update this Policy from time to time. We will communicate material changes through the Application or by email and update the date above. Continued use after the effective date means you accept the changes. Please review this Policy periodically.

12. How to Contact Us

Medabrim

Operated by Amit Shemesh

Netanya, Israel

Email: Medabrimsupport@gmail.com

Using the Medabrim Application means you have read, understood, and agree to this Privacy Policy. If you do not agree, please do not use the Application.