Privacy Policy

In short

• We store what we need to run your practice: your Google account, onboarding answers, practice answers and results, and your conversations with Dio.
• When you ask Dio something, your question and the questions you are working on are sent to an AI model provider to generate the answer.
• We do not sell data and we do not run ads. The xplodia.app website uses Google Analytics to count visits; the practice app does not use analytics trackers.
• You can ask for a copy of your data or for your account to be deleted at xplodia.app@gmail.com.

About this policy

This policy explains what personal data Xplodia ("we") collects, what we use it for, who can see it, and your rights over it. It covers the xplodia.app website and the practice app at learn.xplodia.app.

Xplodia is the controller of the personal data described here. Privacy questions can be sent to xplodia.app@gmail.com.

The Indonesian version of this policy is the primary version. If the two versions differ, the Indonesian one applies.

Data we collect

Account

You sign in with your Google account. From Google we receive your name, email address, profile photo, and account ID. We never receive your Google password.

If you try a practice without an account, we create a guest account with no name or email, only a random ID. When you later sign in with Google, the practice from that guest account moves to your account. The exception: if that Google account is already registered with Xplodia, you sign in to the existing account and the guest data does not move.

Onboarding answers

During onboarding we ask about your current stage of life, why you are learning IELTS, the regions and scholarships you are aiming for (if your goal is to study or work abroad), how familiar you are with the test format, your current and target scores, the skill you want to focus on first, when you plan to take the test, your study schedule, your learning style, and how you heard about Xplodia. All of these are multiple choice, not free text.

Learning activity

• Your answers in every practice, including your first answer and how many times you changed it.
• The time you spend reading and answering each question group.
• Practice results: score, accuracy per question type, estimated band, and mastery level.
• Lesson progress and your answers to comprehension checks.
• Question problem reports you send, including the message you write.

Conversations with Dio

We store your questions to Dio and Dio's answers so you can continue the conversation. We also record how many questions you ask and how long your conversations are each day, to apply the daily quota.

Clubs

If you join a club, we store your name, email, and profile photo as they were when you joined, your role in the club, and your membership status.

Technical data

Our servers log the IP address, the requested path, and the time of each request, for security and to track down errors. Our hosting providers also keep standard access logs. On the xplodia.app website, Google Analytics records the pages you visit, the device and browser you use, and your approximate location (see Cookies and browser storage).

How we use data

• To run the service: signing in, saving progress, grading answers, building practice reports, and unlocking the next practice.
• To tailor practice and Dio's explanations to your goals and study habits.
• To apply Dio's quota and prevent abuse.
• To fix questions and materials based on the reports you send.
• To learn how people found Xplodia and how many people visit our website.

We process this data to provide the service you asked for, and with your consent when you sign up or use features such as Dio. Logging for security and abuse prevention is based on our legitimate interest.

We do not sell your personal data, use it for advertising, or use it to train AI models.

Dio and AI providers

Dio runs on a language model from a third-party provider. Each time you ask a question, we send that provider:

• your message, any sentence you highlighted and asked about, and the earlier messages in the same conversation;
• the questions and passage you are working on, with your answers, your first answers, and how many times you changed them. The answer key and explanations are only sent after you press Check;
• if you ask inside a lesson: the page you are reading and your answers to its comprehension checks;
• a summary of your learning profile: name, current score, target score, test timeline, priority skill, and how familiar you are with the test format;
• a summary of your learning history that Dio looks up when needed: accuracy per skill and question type, answer-changing habits, lessons you have opened, and the titles, dates, and scores of your recent practices.

We do not send your email, photo, or account ID to the model provider.

We currently use Ollama (ollama.com) as the model provider, with OpenRouter (openrouter.ai) as a fallback. OpenRouter forwards requests to the model provider we choose. In our OpenRouter settings, we do not allow our requests to be routed to providers that use data to train models.

We use Langfuse (langfuse.com) to manage Dio's instructions and monitor the quality of its answers. To do this, every conversation turn, including everything listed above, is recorded in Langfuse and kept there for 30 days.

If you turn on Dio's voice, the text of Dio's answers is sent to Google Cloud Text-to-Speech to be turned into audio. If you use dictation, your voice is processed by your browser's built-in speech recognition. Some browsers, such as Chrome, send it to the browser vendor's servers. Your voice recordings are not sent to our servers.

Do not share sensitive personal data in conversations with Dio, such as ID numbers, health information, or financial details. Dio's answers are generated by AI and can be wrong.

Who can see your data

• You.
• Other club members. Active members of a club can see each other's name, email, profile photo, and activity over the last seven days (number of questions and minutes studied). Scores and practice results are not shared between members.
• Classroom club hosts. In a club set to Classroom mode, the host can see your learning analysis: accuracy, study time, accuracy per question type and skill, mastery, answering habits, and a summary of all your practice results, including practices outside the club's course. In a club set to Study group mode, the host cannot see this.
• The Xplodia team. Authorized team members can see account and profile data for user support and administration, and question reports to fix materials.
• Service providers that process data on our behalf: Google (Firebase Authentication, Cloud Firestore, Cloud Run, Cloud Storage, Cloud Text-to-Speech, Google Analytics), Vercel (hosting for this website), Ollama and OpenRouter (Dio's AI models), and Langfuse (monitoring Dio's conversations).
• Authorities, when required by law.

If Xplodia merges with or is transferred to another party, data may move with it and remains subject to this policy.

Where data is stored

Our main data is stored in Cloud Firestore and processed by our application servers, both run by Google in Singapore. This means your data is stored outside Indonesia. AI model providers and other supporting services may process data in other countries, including the United States, for example the data described in Dio and AI providers.

How long we keep data

Account data, learning activity, and conversations with Dio are kept in our database for as long as your account exists. There is currently no automatic deletion, including for guest accounts that were never continued. Conversation records in Langfuse are deleted automatically after 30 days.

If you ask us to delete your data, we remove your account and data from our database, except data we are required by law to keep. Our database is backed up daily and each backup is deleted automatically after 14 days, so deleted data may remain in backups for up to 14 days. Server logs are kept according to our hosting providers' retention periods.

Your rights

Indonesia's Personal Data Protection Law (Law No. 27 of 2022) gives you the right to:

• be informed about how your data is processed;
• access and receive a copy of your data;
• correct inaccurate data. You can change your name and study goals yourself on the Profile page;
• ask for your account and data to be deleted;
• withdraw your consent;
• object to or ask us to restrict processing;
• receive your data in a commonly used format.

Send your request to xplodia.app@gmail.com from your account's email address so we can confirm it comes from you. For now, account deletion is handled manually because there is no delete button in the app yet. We respond within the time limits set by applicable law.

Security

• All connections to Xplodia use HTTPS.
• The app cannot write to the database directly. Every change goes through our servers, which check your identity on each request.
• Team access to data is limited by role.
• The database is backed up daily and protected against accidental deletion.

No system is completely secure. If a breach affects your data, we will notify you as required by the Personal Data Protection Law.

Cookies and browser storage

We do not use advertising cookies.

The xplodia.app website uses Google Analytics, loaded through Google Tag Manager, to count visits and see which pages are read. Google Analytics stores identifier cookies (_ga and similar) in your browser. You can block them in your browser settings or with the Google Analytics opt-out add-on. The website also stores a preferred-locale cookie when you switch languages.

The practice app at learn.xplodia.app does not use analytics trackers. It uses your browser's local storage to:

• keep you signed in;
• remember practice settings (timer, feedback mode, last package), the course you picked, text size, and Dio's voice setting;
• keep the sentences you highlight during practice and a copy of your lesson progress;
• keep a backup of your onboarding answers if a guest account could not be created.

The app also stores a sidebar_state cookie to remember whether the sidebar is open.

Users under 18

Students under 18 may use Xplodia with the consent of a parent or guardian. If you are under 18, ask your parent or guardian to read this policy before you create an account. Parents or guardians can contact xplodia.app@gmail.com to access or delete their child's data.

Changes to this policy

We may change this policy, for example when we add features or providers. The date at the top of this page always shows the latest version. For significant changes, we will let you know in the app or on this website before they take effect.

Contact us

Questions, requests, or complaints about privacy can be sent to xplodia.app@gmail.com.