Learn Malay
Privacy
Learn Malay teaches spoken Malay to English speakers. To do that we keep a small amount of information about you and a record of how you are learning. This page says exactly what, why, where it lives, and how to have it removed. It is written to be read, not scrolled past.
What we collect
| What | Why | Kept |
|---|---|---|
| Your email address | To sign you in (we send a link; there is no password) and to reach you about your account. | Until you delete your account |
| Your learning record — which phrases you have seen, how you rated them, which sentences you put in order, which episodes you finished and when, your settings | To schedule what you see next, and to carry your progress between your phone and the web. | Until you delete your account |
| Your answers to the three onboarding questions (why you are learning, how much Malay you have, when to remind you) | To set your starting pace and the daily reminder. | Until you delete your account |
| Subscription status and any discount code you used | To know what to open. The payment itself is taken by Apple, Google or Paddle, and we never see or store your card, your billing address or your tax details. | Until you delete your account |
| Usage events in the app — an episode started or finished, a deck cleared, a day completed, a purchase | To see whether the course works and to run advertising honestly (we pay for people who learn, not for installs). | Up to 14 months, then aggregated |
| If you book classes: your tutor and your bookings, the objective you write for a class, the plan drafted from it, and the sentences written on the canvas during the class | To run the class, and to turn its sentences into your flashcards afterwards. | Until you delete your account |
What we do with your learning record
Two things. First, it drives the app: the scheduler uses it to decide when a phrase comes back. Second, in aggregate, it tells us how people learn — which phrases are hardest, where in the course people stall, which episodes get finished — and we use that to improve the course. That analysis is done across everyone, on counts and averages; nobody on the team sits and reads an individual's record.
What we do not do
- The course never listens to you. You say the yellow lines out loud, for yourself, and nothing is recorded. The only time the app uses the microphone and camera is a live class with a tutor, once you have joined it — and classes are not recorded either.
- No advertising inside the app, no selling or renting of your data, no data brokers.
- No tracking across other apps or websites, and no advertising identifier is read.
- No profiling for anything but what to teach you next, and no automated decision about you that has legal or similarly significant effects. The scheduler decides which card comes next; that is the extent of it.
Who else touches the data
- Supabase (database and sign-in), hosted in Singapore. Your email and learning record live here.
- Google Firebase Analytics (phone apps only) receives the usage events above, tied to a random app-instance id and to your account's internal number — never your email or name. It runs without the advertising identifier. You can switch it off in Settings → Privacy → Usage analytics, which also resets the app-instance id. On a phone set to a European time zone it starts switched off, and stays off unless you turn it on.
- Google Gemini generates the spoken audio for phrases and sentences, and drafts a class plan from the sentence you write about what you want from a class. The text is sent to do that job and nothing else about you goes with it; the phrase audio is cached and shared by every learner.
- Resend sends our emails — your sign-in link and code, the welcome, and the occasional nudge — so it handles your email address and the message.
- RevenueCat keeps track of subscriptions bought in the phone apps: it receives the store's receipt and your account's internal number, and tells us whether you are subscribed.
- Apple and Google Play sell the subscriptions bought inside the apps, under their own privacy policies. We receive only whether you are subscribed, and an anonymous store identifier so a renewal can be matched to your account.
- Paddle.com Market Ltd is the merchant of record for anything bought on learn-malay.com. Paddle is the seller for that transaction, not a processor acting for us: you give Paddle your name, billing address, card details and, where the law needs it, a tax number, and Paddle decides on its own account what to do with them under the Paddle privacy policy. What comes back to us is your email address, the country the tax was charged in, and whether the subscription is live.
- Stripe takes the card payment for classes with a tutor, which are a person-to-person service and are not sold through the app stores. Same again: Stripe sees the card, we do not.
- LiveKit carries the live video and audio of a class between you and your tutor while it is happening. It is not recorded, by them or by us.
- Vercel serves the website.
Some of these providers process data outside Malaysia — in Singapore, the EU and the United States. Each is bound by a data processing agreement to use it only to provide the service to us. Where data about someone in the EU or UK goes to a country without an adequacy decision, the transfer is covered by the European Commission's Standard Contractual Clauses (and the UK addendum), or by the EU–US Data Privacy Framework where the provider is certified under it.
Classes with a tutor
If you book classes, your tutor sees what they need to teach you and nothing more: your first name, why you are learning (from your onboarding answers), which phrases you know, and what you have written as the objective for the class. They do not see your email, your payment details or your usage history. A class is live video and is not recorded. The sentences written on the canvas are kept, because they become your flashcards; the video is gone the moment the class ends. Tutors are bound by a written agreement to keep what they learn about you to themselves.
If you apply to teach
The form at learn-malay.com/teach asks for your name and email, a WhatsApp number if you give one, where you live and where your Malay is from, your Malay and English, your teaching so far, the hours you could teach, your answers to our two questions, a video link if you add one, and your CV. We use them for one thing: deciding on your application, which includes writing to you about it and arranging the call and the practice class. The legal basis is taking steps, at your request, towards a possible agreement with you.
- Who sees it: the people at Learn Malay who decide on applications. Nobody else, and never learners.
- Where it lives: Supabase, in Singapore: the application in the database, the CV in a private file store that only our server can open. Resend sends you the acknowledgement and tells us a new application has arrived; the email to us carries your name and where your Malay is from, not your answers or your CV.
- How long: if we decline or you withdraw, the application and the CV are deleted six months after that decision; an open application nobody has touched for a year is deleted too. If you join as a tutor, it is kept while you teach with us and deleted within six months of your last class.
- Your rights: the same as everyone's on this page. See, correct or delete what you sent at any time by writing to hello@learn-malay.com; withdrawing is as simple as telling us.
Cookies and storage
The website and app keep your session and your offline copy of the course in your browser's own storage, so the app works on a plane. That is all. We set no advertising or third-party cookies, and there is no third-party analytics script on the website — which is why you will not see a cookie banner. We do count page views ourselves: each visit adds one row with the page, the site you came from, any campaign tag in the link, and whether it was a phone or a desktop. No cookie, no identifier, nothing that could be traced back to you. If that ever changes, it will be with your consent, asked for on the page, and this section will say so.
Your rights
Wherever you are, you can ask us to show you everything we hold about you, correct it, export it, restrict what we do with it, or delete it — and you can object to the aggregate learning analysis or withdraw a consent you gave (such as usage analytics) at any time, without affecting what happened before. Most of this you can do yourself in Settings → Privacy: download your data, delete your account, switch analytics and nudge emails off. For anything else email hello@learn-malay.com from the address you signed in with; we answer within 14 days, and there is no charge. Deleting your account deletes your email, your entire learning record and the log of emails we sent you; the shared phrase audio, which has nothing of you in it, stays.
An email address is the one thing we need to give you an account: without it you can read our pages but not keep a learning record or subscribe.
Under Malaysia's Personal Data Protection Act 2010 you may also complain to the Personal Data Protection Commissioner. Under the EU and UK GDPR, if you are there: our lawful basis is the contract with you for running your account and the course; our legitimate interest for the aggregate analysis of how people learn, which you may object to; and your consent for usage analytics in Europe. You have the right to complain to the data protection authority where you live or work — though we would like the chance to put it right first. Under California law (CCPA as amended by the CPRA), if you are there: we do not sell or share personal information, we do not use sensitive personal information, and you have the rights to know, correct, delete and not be treated differently for using them.
Children
Learn Malay is for adults. It is not directed at children under 13, and we do not knowingly hold data about them. If you think a child has an account, email us and we will remove it.
Security
Data travels encrypted (TLS). Sign-in is by one-time link, so there is no password to leak. Access to the database is limited to the team and to the app's own server function, and every table is locked to its own user by policy.
Changes
If we change what we collect, we update this page and the date at the top, and tell you in the app if the change matters. Old versions are kept and available on request.
Learn Malay, in Kuala Lumpur, Malaysia, is the controller of the data described here, and hello@learn-malay.com is the address for any question about it — including the formal ones. Written in plain English on purpose; if a sentence is unclear, that is worth telling us.