Privacy Policy
Last updated: 17 September 2026
Scope: This policy covers the Portugal Speaks applications for Windows (distributed via the Microsoft Store) and iOS (distributed via the Apple App Store), and this website, operated by Portugal Vivo, including its email signup form. An Android version is planned, and this policy will be updated to cover it before it ships.
Data We Collect
In the app: nothing reaches us. Portugal Speaks has no analytics, telemetry, or crash-reporting SDKs of any kind. All learning progress (lessons completed, quiz scores, streak, points, bookmarks, saved/favorited items, and settings) is stored locally on your device. No account, sign-up, or login is required, and the app never asks for your name, email, or any other identifying information. No data is sent to our servers - we don't operate any servers that the app talks to.
The optional AI features are the exception, and they don't send anything to us either. If you turn on AI Conversation Practice or Speech Recognition, the app sends what you type or say to the provider you chose, using an API key you supplied. That is described in full below. That is why, where a store asks whether the app collects personal information, the answer is yes: your voice and your typed messages do leave your device. They go to OpenAI, Google, or Microsoft under your own account with them, never to Portugal Vivo. If you never enter an API key, the app transmits nothing at all.
Where it's kept on your device. On Windows, progress and settings live in Windows app storage, and any API keys you enter are encrypted with the Windows Data Protection API (DPAPI). On iOS, progress and settings live in the app's own storage, and API keys are held in the iOS Keychain. In both cases that encryption protects your keys from other user accounts on the machine and from an offline copy of the data file; it is not protection against software already running as you.
On this website: email signup only. If you use the "Get notified" form to hear about the iOS/Android launch or new lessons, we collect the email address you provide and, optionally, your first name and which updates you'd like (mobile launch, new lessons/features). This is used solely to send you the emails you signed up for. We don't sell, rent, or share this list with third parties for their own marketing.
Fonts
In the app: Portugal Speaks uses the Google Fonts library for DM Sans (the default interface typeface) and Lexend (used only if you turn on the dyslexia-friendly font setting) - on first use, this may fetch font files from Google's font servers over your device's network connection. Georgia, used for Portuguese vocabulary, lesson titles, and story text, is a system font reference, not fetched from Google or any external server - if Georgia isn't installed on your device, the app falls back to your system's default serif font.
On this website: the site loads DM Sans from Google Fonts (fonts.googleapis.com) to display its typeface. Loading these fonts involves a standard request to Google's font servers, which may log ordinary network metadata (e.g., your IP address) under Google's own privacy practices - see Google Privacy Policy.
AI Conversation Practice & Speech Recognition
These features are optional and require you to supply your own API key from a third-party provider.
- AI Conversation Practice sends your typed messages to OpenAI (GPT-4o-mini) or Google (Gemini Flash), depending on your chosen provider. Responses are returned in real time and are not stored by us.
- Speech Recognition sends your voice audio to OpenAI's Whisper API for transcription. Audio is processed in real time and is not stored by us.
- Voice Synthesis - AI Conversation replies are spoken aloud using Microsoft Azure's Neural Text-to-Speech service. The AI's reply text is sent to Azure using your own Azure API key to generate the audio; this text is processed in real time and is not stored by us.
Your API key(s) are stored only on your device and are never transmitted to Portugal Vivo. OpenAI's, Google's, and Microsoft's own privacy policies govern any data they process:
Because these features send your typed messages and your recorded voice to a company other than us, the app is declared to each store as collecting Audio Data and User Content, used only to make the feature work. It is not linked to your identity, and it is never used to track you. We have no access to any of it.
The app asks before it sends anything. The first time one of these features would send data to OpenAI, Google, or Microsoft, the app shows what will be sent and to which company, and sends nothing unless you tap Allow. Permission is given per company, and you can withdraw it at any time under Settings → Data Sharing Permissions.
Each company receives your data under its own API terms, which require it to protect that data and do not allow it to sell it. OpenAI and Microsoft do not use data sent through their APIs to train their models unless you opt in. Google's free Gemini tier is the exception: Google may use what you send it to improve its products, and may have people review it. If that matters to you, use a paid Gemini key, or OpenAI instead.
These features are inactive unless you enter an API key. You may remove your key at any time from the Settings screen.
Purchases
In-app purchases are handled entirely by the store you bought from - Microsoft on Windows, Apple on iOS. We do not receive or store your payment information. Their privacy policies govern purchase data: Microsoft Privacy Statement and Apple Privacy Policy.
Third Parties
Beyond the optional AI/speech providers described above (used only when you supply your own key) and the email service provider we use to send signup-list emails, we do not share any data with third parties.
Your Rights Under GDPR (EU/EEA/UK Users)
If you are located in the European Union, European Economic Area, or United Kingdom, you have the following rights over the personal data we hold about you (in practice, this only applies to the email address and optional name you give us through the website signup form - the app itself never sends us any personal data, including when you use the optional AI features described above):
- Access - request a copy of the personal data we hold about you
- Rectification - ask us to correct inaccurate data
- Erasure - ask us to delete your data ("right to be forgotten")
- Restriction - ask us to limit how we use your data
- Portability - request your data in a portable format
- Objection - object to our processing of your data
- Withdraw consent - unsubscribe at any time using the link in any email we send, or by contacting us directly
Legal basis for processing: we process your email/name only with your consent, given by submitting the signup form.
Data controller: Rui Matos, an independent sole trader (Atividade Independente) registered in Portugal, doing business as Portugal Vivo - contact details below.
Retention: we keep your signup information until you unsubscribe or ask us to delete it.
International transfers: our email service provider and the optional AI/speech providers you may choose to use are based outside the EU/EEA/UK (primarily the United States); where required, transfers rely on those providers' own compliance mechanisms (e.g., Standard Contractual Clauses).
Complaints: if you believe we have not handled your data properly, you have the right to lodge a complaint with your local data protection supervisory authority. As our data controller is based in Portugal, this is the CNPD (Comissão Nacional de Proteção de Dados) - though you may also complain to the authority in your own EU/EEA country of residence.
This section is provided as a general compliance summary and is not a substitute for legal advice - if you have concerns about our GDPR compliance, please contact us using the details below.
Children
Portugal Speaks does not knowingly collect personal information from children under 13 (per the US Children's Online Privacy Protection Act). For users in the European Union, European Economic Area, or United Kingdom, we do not knowingly collect personal information from anyone under 16 without parental consent, in line with GDPR Article 8. If you believe a child has provided us with personal information (e.g., via the website signup form), please contact us so we can delete it.
Changes
We may update this policy as new features are added. The "Last updated" date at the top reflects the most recent revision.
Contact
Questions or concerns? Email: support@portugalvivo.app