Privacy Policy

We collect information you provide directly and automatically:

• Account information: Name, email address, phone number, and login credentials used to create and secure your account.
• Child profile information: Name or nickname, age, avatar, and target speech sounds. Child profiles are created by an authorized adult — most often the child's speech-language pathologist (SLP).
• Clinical and practice records: Therapy goals, clinician notes, session and per-trial practice results, adult-entered scoring, accuracy and progress information, custom practice words, and conversation-practice activity.
• Practice audio (not collected by us): When a child records a practice attempt, the audio is captured locally on the device for immediate playback and review during that practice moment. It is not uploaded to SpeechQuest, is not stored on our servers, and is not kept as part of the child's record. It is discarded when the practice experience ends. What is saved is only the adult-entered result or score — never the recording itself. This is separate from the word-model audio in our own content library, which is material we provide.
• Consent and legal records: Records of adult consent for a child's practice data, and records of your acceptance of these documents, including the document versions, timestamp, IP address, and browser information.
• Device information: Device type, operating system, browser, and IP address.
• Operational and delivery records: Email and SMS delivery outcomes, notification and reminder records, invitation records, and error diagnostics used to keep the service working.
• Cookies and similar technologies: Tokens and identifiers used to keep you signed in and understand how the app is used.

We use the information we collect to:

• Create and manage user accounts
• Authenticate users and maintain security
• Save therapy progress and personalize practice
• Improve the app and develop new features
• Provide customer support
• Send transactional emails such as confirmations and alerts
• Send transactional SMS messages such as verification codes, password resets, reminders, and account notifications

SpeechQuest may send transactional text messages for account verification, security alerts, reminders, and other service-related notices. Message and data rates may apply.

SMS consent is not shared with third parties or affiliates for marketing purposes.

You can turn off non-essential SMS messages at any time in your reminder preferences in the app. You may also use the standard STOP and HELP keywords supported by our messaging provider and your carrier. Turning reminders off in the app is the most reliable way to make sure your preference is reflected in your SpeechQuest account.

To reduce the amount of information that travels over text message, our SMS messages are written to be neutral: they do not include a child's name, target sound, scores, or other practice details. Those details are only visible after you sign in.

SpeechQuest is used by adults — parents, legal guardians, educators, and licensed speech-language pathologists — on behalf of children.

• Children do not create SpeechQuest accounts. There is no child sign-up, child login, or child-held password.
• Children do not register themselves for the service or independently provide information to us.
• Child profiles are created and managed by authorized adults, typically the child's SLP, who also enters the clinical information associated with that child.

What may be stored about a child: profile details (name or nickname, age, avatar, target sounds), therapy goals, clinician notes, practice and session results, adult-entered scoring, accuracy and progress information, custom practice words, conversation-practice activity, and related consent records.

Practice audio is not uploaded or retained. A child's recorded practice attempt stays on the device, is used for immediate playback, and is discarded when the practice experience ends. Only the adult's scoring of that attempt is saved.

Adult consent unlocks practice data collection. Before SpeechQuest will save new practice or therapy data for a child, an active adult consent record must exist for that child. This is enforced by the system itself, not only by policy. Two consent methods are supported and they are recorded distinctly:

• Parent-provided digital consent — a parent or guardian signs in to their own SpeechQuest account and grants consent directly.
• Clinician-recorded (attested) consent — a clinician records that they obtained written consent from the parent or guardian outside the app. This is an attestation by the clinician about consent obtained elsewhere. It is not the same as, and is not treated as equivalent to, consent given directly by a parent inside SpeechQuest, and it is labeled differently in the app.

If consent is revoked: new consent-gated practice and therapy data collection for that child stops. Revocation does not automatically erase records that already exist; clinical, consent, and audit records are retained as described in “Data Retention and Account Deletion” below.

Parent and guardian questions. SpeechQuest does not currently offer an in-app data export or an in-app deletion button for a child's records. A parent or guardian who wants to review or correct their child's information, ask a privacy question, or raise a concern should contact us using the details in “Contact Information” below, or speak with the child's treating SLP, who manages the child's profile and clinical record. If you believe a child has provided information to us without appropriate adult authorization, please contact us.

Access to a child's information depends on the relationships and permissions set up in the product:

• The child's assigned SLP can see that child's profile, goals, notes, and practice results, because they are the clinician responsible for that child's care.
• Linked parents and guardians can see their own child's family-facing information — progress, practice history, goals, reminders, and messages with the SLP.
• Other families and other clinicians cannot see your child. Accounts are separated from one another, and the system blocks access to children a person is not connected to.
• A small number of SpeechQuest administrators have limited access for operations, support, security, and troubleshooting.
• Caseload transfers can change which clinician has access. If a child moves to a different SLP, that transfer changes who can see the child's clinical information. Transfers require agreement from more than one party and are recorded.

Access is enforced by the application's permission and consent rules, not just by convention.

We do not sell your personal information. We may share data only with trusted service providers who help us operate the platform, such as:

• Cloud hosting, database, authentication, and storage providers
• Network and content-delivery infrastructure providers
• Email and SMS delivery providers
• A model provider used to generate conversation-practice prompts

The specific providers we use are listed in “Third-Party Services” below.

These providers are contractually obligated to use your data only to perform services on our behalf and to protect it consistent with this policy.

We use reasonable administrative, technical, and physical safeguards to protect the information we collect. This includes encryption in transit, access controls, secure authentication, and regular review of our security practices.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a security incident occurs, we will take appropriate steps to address it and notify affected users as required by law.

SpeechQuest is used to create clinical and therapy documentation about children. Because of that, our retention model is deliberately conservative, and it is important that you understand how it actually works.

• Account deletion is a reviewed request, not an instant self-service wipe. You can submit a deletion request from your account. We review it, and we tell you what would be retained before it is processed. Submitting a request does not immediately destroy all data associated with you.
• Clinical records are retained. Therapy sessions and practice results, goals, clinician notes, and related clinical documentation are treated as records and are preserved. They are not deleted when a clinician or parent account is closed, and they cannot be removed through a self-service action in the app.
• Consent, legal-acceptance, and audit records are retained so that we can show who consented to what, and when, and so that changes to sensitive records remain accountable.
• Revoking consent does not erase the past. It stops new consent-gated practice data from being collected going forward.
• Operational data — such as invitations, notifications, verification attempts, and message-delivery logs — is subject to retention and minimization policies that we are phasing in. We are not publishing fixed retention periods for these categories until those processes run automatically in production.

We will handle privacy requests in accordance with applicable law and the processes actually available to us, and we will tell you plainly when something you have asked for cannot be done — for example, when a record must be retained as part of a clinical or audit record.

Depending on your location, you may have the right to request access to, correction of, or deletion of your personal information. To exercise these rights:

• Update the profile and preference settings available in your account
• Submit an account deletion request from your account settings, which we review as described above
• Contact us directly using the information at the bottom of this policy

SpeechQuest does not currently provide a self-service data export feature, and some records — including clinical, consent, and audit records — are retained even after a deletion request, as described in “Data Retention and Account Deletion.”

We will respond to requests in accordance with applicable law and will not discriminate against you for exercising your rights.

SpeechQuest uses cookies and similar technologies to keep you signed in, remember your preferences, understand how the app is used, and improve performance. You can manage cookie preferences through your browser settings, but disabling certain cookies may affect app functionality.

SpeechQuest uses select third-party services to operate and improve the platform. These services may process data according to their own privacy policies:

• Supabase — database, authentication, and file storage. This is where account information, child profiles, clinical and practice records, consent records, and legal-acceptance records are stored.
• Lovable — application hosting and platform infrastructure, including the secure gateway that our servers use to reach the email, SMS, and model providers below, and platform error diagnostics.
• Cloudflare — network and request-routing infrastructure. This processes connection information such as your IP address in the course of delivering the app.
• Resend — transactional email delivery. Resend receives the recipient's email address and the contents of the message being sent. Some emails, such as a progress update sent to a parent, include a child's first name, target sound, and practice accuracy.
• Twilio — transactional SMS delivery. Twilio receives the recipient's phone number and the message text. Our SMS messages are deliberately written to exclude a child's name, target sound, scores, and other practice details.
• Google Gemini, accessed through the Lovable AI Gateway — used only to generate conversation-practice prompts. The information sent for this purpose is limited to the target speech sound, the position of the sound in a word, the child's age, a difficulty level, and an optional interest or theme chosen by the adult. Child names, clinician notes, session history, and other clinical records are not sent.

We do not currently use Firebase, Google Analytics, or any third-party advertising or behavioral-analytics service. SpeechQuest is free during beta and we do not currently use a payment processor; if we introduce paid plans in the future, we will update this policy before doing so.

We encourage you to review the privacy policies of these providers to understand how they handle data.

One feature of SpeechQuest uses an AI model: conversation-practice prompts (for example, picture-description or story-retell starters) may be generated automatically. As described above, only a target sound, word position, child age, difficulty level, and an optional interest theme are used to generate them.

Other analysis in the product — such as clinical insights, recommended goals, progress narratives, and engagement scoring — is produced by fixed rules and calculations running inside SpeechQuest, not by an AI model, and does not send your data anywhere.

SpeechQuest is currently a free beta. We do not represent that SpeechQuest is certified or accredited under HIPAA, FERPA, COPPA, or any similar framework, and we do not currently offer a Business Associate Agreement. Clinics, schools, districts, and individual professionals should evaluate their own legal, professional, and compliance obligations before using SpeechQuest with identifiable student or patient information.

SpeechQuest is based in the United States. If you access the app from outside the United States, you consent to the transfer, storage, and processing of your information in the United States or other countries where our service providers operate. Data protection laws in those countries may differ from those in your location.

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top of this page and notify users as appropriate. Continued use of SpeechQuest after changes means you accept the revised policy.

If you have questions, concerns, or requests about this Privacy Policy or how we handle your data, please contact us:

• Email: [email protected] — please write “Privacy request” in the subject line.
• In-app: Use the Feedback button or Support option in your account menu