Legal · ScrollSpring

Privacy Policy

Effective / last updated: 22 July 2026

This Privacy Policy explains how Cosa (“we”, “us”) handles information in connection with the ScrollSpring mobile application and this website. Please read it carefully. It is designed to match how the app works today and to support App Store and Google Play privacy disclosures.

1. Who is responsible

ScrollSpring is operated by Cosa (Australia).

• Privacy / support email: caleb@cosa.net.au
• Website: https://scrollspring.cosa.net.au

2. Scope

This policy covers:

• The ScrollSpring iOS and Android apps
• This public website (privacy, support, terms, and related pages)
• Support emails you send to Cosa about ScrollSpring

It does not cover Apple, Google, or other independent platforms’ own privacy practices for store accounts, payments, or device backups.

3. Information we collect and where it is stored

3.1 Information stored on your device (primary)

ScrollSpring supports guest use and optional Cosa accounts. The following may be stored on your device to provide the service:

• Learning data: progress, XP, streaks, badges, skill settings, and related practice history
• Profile data you choose to add: display name, bio, and optional profile image
• Speaking recordings: audio you record during speaking practice so you can play it back and compare with model audio
• App preferences: settings such as haptics / sound preferences where available

Creating an account is optional. Guest mode does not require an email address.

3.1b Account information (if you sign up)

• Email address and password (handled by Supabase Auth)
• Display name in the Supabase profiles table

3.2 Information you send us by email

If you contact support, we receive whatever you include (for example your email address, device type, screenshots, and description of an issue). We use this only to respond and improve the product.

3.3 Payment information

If you buy ScrollSpring through the Apple App Store or Google Play, payment is processed by Apple or Google. Cosa does not receive or store your full payment card details.

3.4 Information we do not currently collect

• No required cloud account / login email for core use
• No advertising identifiers for ads
• No third-party ad networks
• No sale of personal information
• No camera, contacts, or location access
• No continuous background microphone recording

4. Device permissions

ScrollSpring may request the following permissions, only when needed:

• Microphone: to record your voice for speaking practice. Recordings are used in-app for playback / comparison and are stored locally on your device.
• Photo library / media access: only if you choose a profile image. You can decline and still use the app.

You can withdraw permission in your device settings. Some features (speaking practice or custom avatar) may not work without the related permission.

5. How we use information

• Provide and operate ScrollSpring’s learning features
• Save your progress and preferences on your device
• Enable speaking practice comparison and optional profile personalisation
• Respond to support and privacy requests
• Fix bugs and improve the app
• Comply with law and enforce our Terms where required

We do not use your information to show third-party ads.

6. Sharing of information

We do not sell personal information.

We may share information only in these limited cases:

• App stores: Apple / Google process purchases and may provide us limited non-sensitive purchase / receipt information needed to support customers
• Service providers: only if we later engage providers to operate optional cloud features, and only as needed for that purpose
• Legal requirements: if required by law, regulation, or valid legal process
• Business transfer: if Cosa assets related to ScrollSpring are transferred, information may move with them under equivalent protections

7. Third-party services and accounts

ScrollSpring uses Supabase (operated under the Cosa business) for optional email/password accounts. When you sign up or log in, Supabase stores your authentication credentials and a basic profile record (user id and display name).

Core learning progress (XP, streaks, skill levels, speaking recordings) remains stored on your device today. Cloud progress sync may be added later; if it is, this policy will be updated before that ships.

Guest mode still works without an account. You can delete an account by emailing caleb@cosa.net.au or using in-app sign-out plus Delete your data instructions.

Cosa does not sell your personal information.

8. Analytics, tracking, and advertising

ScrollSpring does not currently include third-party advertising SDKs and does not use App Tracking Transparency for cross-app advertising tracking.

If we later add crash reporting or analytics, we will update this policy and our store privacy / data-safety declarations before enabling them.

9. Retention

• Local app data remains on your device until you reset it, clear app data, or uninstall ScrollSpring
• Speaking recordings remain local for practice use until deleted with app data or overwritten by new recordings in normal use
• Support emails are retained only as long as needed to handle your request and maintain ordinary business records

10. Your choices and rights

Depending on your location, you may have rights to access, correct, or delete personal information we hold.

• Local data: use in-app reset / clear options where available, or uninstall the app. See Delete your data.
• Permissions: change microphone / photos access in device settings.
• Support / privacy requests: email caleb@cosa.net.au

Australian users may also have rights under the Australian Privacy Principles. Contact us if you wish to make a privacy complaint; we will respond as soon as reasonably practicable.

11. Children’s privacy

ScrollSpring is a general-audience learning app. It is not directed at children under 13 (or the equivalent minimum age in your country) for the purpose of knowingly collecting personal information online. Do not provide personal information about a child to us by email unless you are a parent / guardian making a support request.

If you believe we have received a child’s personal information inappropriately, contact caleb@cosa.net.au and we will take reasonable steps to delete it.

12. Security

We take reasonable technical and organisational measures appropriate to a local-first app and email support workflow. No method of electronic storage or transmission is completely secure. Please keep your device locked and updated.

13. International users

Local app data remains on your device. Support email is handled by Cosa in Australia. If you contact us from another country, the information in your email may be processed in Australia.

14. Store privacy questionnaires

When completing Apple App Privacy and Google Play Data safety forms, declare data consistent with this policy. In particular, for the current guest build:

• Data used for app functionality may include user content you create (profile, voice recordings) and product interaction / progress stored on device
• Do not declare tracking for advertising if you have not enabled it
• Do not declare account data / cloud sync until those features actually ship
• Payment processing is handled by Apple / Google, not by Cosa card storage

15. Changes to this policy

We may update this Privacy Policy when the product or legal requirements change. We will revise the “Effective / last updated” date above. For material changes, we will take reasonable steps to notify users (for example in-app notice or website update) before or when the changes take effect.

16. Contact

Privacy questions, access requests, or complaints: caleb@cosa.net.au