Evolui

Compa Privacy Policy

Last updated 5 November 2026

This policy explains what information Evolui AB ("Evolui", "we", "us") collects when you use the Compa app, how we use it, and the choices you have.

The data controller is Evolui AB, corporate identity number 559345-8705, Pildammsvägen 95F, 215 34 Malmö, Sweden. You can reach us at support@evolui.io.

The short version

To run your tutor, your voice, what you say in lessons, your first name and your learning answers are sent to OpenAI during your lessons. We do not store your voice or your lessons on a server, and there is no account. We do not sell your data and we do not show ads.

What Compa stores and sends

Your voice and what you say in lessons

Compa uses the microphone only while you hold the talk button during a lesson. That audio goes straight from your iPhone to OpenAI in the United States, which turns it into text and creates your tutor’s spoken reply. Nothing you say is sent before you start a lesson. The audio and text of a lesson are held only in the app’s memory while the lesson is open; they are not saved on your iPhone afterwards, except the words picked for your word list, and they never reach our servers as recordings. You can turn off the microphone in iPhone Settings, but lessons need it.

Text sent for feedback, translations, your plan and your recap

To correct what you said, translate a line, suggest a reply, suggest lesson subjects, build your study plan and write your recap, the app sends the relevant text to our function on Supabase, which runs in the Supabase region closest to you and forwards it to OpenAI and returns the answer. That text can include what you said in the lesson, your first name, and your languages, level, goals and interests. The function does not store it or write it to logs, and asks OpenAI not to store the completion.

How OpenAI handles it

Under OpenAI’s API terms, data sent through its API is not used to train its models. OpenAI may keep it for up to 30 days to monitor for abuse, then deletes it.

Your choice about AI

The first screen of the app tells you that by continuing you accept this policy, which includes sending this information to OpenAI. Lessons can’t work without it. If you don’t want it sent, don’t start a lesson, and delete the app. Deleting the app doesn’t recall what was already sent, which OpenAI deletes as described above.

Your first name

You give a first name so your tutor can use it. It is stored on your iPhone and sent to OpenAI with your lessons. It is never sent to analytics. You can use a nickname.

Onboarding answers

During setup you answer questions about your age range, gender, languages, level, reasons for learning, goals, interests, confidence and how you like to be taught. They are stored on your iPhone to personalise your lessons. Your languages, level, goals and interests are also sent to OpenAI as described above. All answers except your name are sent to PostHog with a pseudonymous id, so we can see which answers lead to which outcomes and improve the app. They are not used for advertising.

Your progress

Your plan, streak and word list are stored only on your iPhone. They do not reach us, and they are deleted when you delete the app. Analytics record events such as a lesson starting or ending, its length and its number of turns, never its content.

Usage limits

To stop abuse and keep costs bounded, each request to our functions carries the iOS identifier for vendor and comes from your IP address. Both are scrambled with a secret value (hashed) before they are stored as counters in Stockholm, Sweden. The counters are deleted after two days, or after two months for the monthly allowance of free lessons, and cannot identify you by themselves. To check whether you are subscribed, the function sends RevenueCat your anonymous app user id, which is not stored.

Reminders

If you allow notifications, Compa schedules one short reminder a day on your iPhone at your practice time. They are created on your device, with no push server, and nothing is sent to us to do this. You can turn them off in your profile or in iPhone Settings.

Information we collect

Usage analytics

We use PostHog to understand how Compa is used. This includes events such as which screens are opened and which features are used, along with device type, operating system version, app version, and a random identifier for the install. Analytics are pseudonymous: we have turned off PostHog's IP-based location lookup, and we do not send the content of your entries or any health values to analytics.

Purchases

Subscriptions and one-time purchases are processed by Apple through the App Store. We use RevenueCat to validate purchases and manage subscription status. RevenueCat receives a random app user identifier, the purchase receipt, and subscription status. Neither we nor RevenueCat receive your name, payment card, or Apple ID.

Support

If you email us, we keep the email and the information you include in it so we can help you and improve the app.

Crash reports

If the app crashes, a report containing technical details about the device and the state of the app may be sent to us or to Apple, depending on your device settings.

What we do not collect

How we use information

We use the information above to operate the app, provide purchases you make, fix bugs, understand which features are useful, and respond to support requests. Where the GDPR applies, our legal bases are performance of a contract (providing the app and your purchases), our legitimate interest in improving and securing the app (analytics and crash reports), and your consent where we ask for it, for example for location or Apple Health access.

Sharing

We share information only with the service providers named in this policy, who process it on our behalf, and with authorities where the law requires it. We do not sell personal information. The providers for Compa are:

International transfers

We are based in Sweden. PostHog and RevenueCat process data in the United States under the EU-US Data Privacy Framework and standard contractual clauses. OpenAI is based in the United States, under the EU-US Data Privacy Framework and standard contractual clauses. Supabase is based in the Supabase region closest to you, such as the United States or the EU, for the functions; Stockholm, Sweden, for the usage counters.

Retention

Data on your device stays until you delete it. Pseudonymous analytics data is kept for a limited period and then deleted or aggregated. Purchase records are kept for as long as needed to provide your subscription and meet accounting obligations.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or export personal information we hold, and to object to or restrict its processing. Because your data lives on your device, the quickest way to delete it is to delete the app. For anything we hold, email support@evolui.io and we will respond within 30 days. If you are in the EU or UK you can also complain to your data protection authority. In Sweden this is the Integritetsskyddsmyndigheten (IMY).

Children

Compa is not directed at children under 13 (or 16 where that is the applicable age) and we do not knowingly collect information from them.

Security

Data on your device is protected by your device's own encryption and passcode. Data sent to our service providers is encrypted in transit.

Changes

We will post any changes here and update the date at the top. If a change is significant we will tell you in the app.