Privacy Policy

1. Who we are

SpeechStep (“SpeechStep”, “we”, “our”, “us”) is a product operated by Mendios Technologies Bangalore Pvt Ltd (the company behind WebMobi). Accounts are held by parents and guardians; children use SpeechStep under their parent’s supervision and account. This policy applies to speechstep.com and the SpeechStep apps.

2. Information we collect

From the parent/guardian

• Email address — to create and secure your account (we use passwordless email one-time codes; we do not store a password).
• Child profile — an optional display name (defaults to “My child”) and, if you provide it, your child’s age in months only (we do not collect a full date of birth).
• A phone number — optional, and only if you type one in. There is one reason we ask: so a speech therapist can call you back about your child instead of trading emails for a week. It is never required — you can create an account, practice, and book a session without it. If you do give us a number when you ask for a Welcome Session, we will use it to reach you about that session, because that is the thing you asked us to arrange. Being contacted by SMS or WhatsApp is different: that is a separate box you tick yourself, never one we tick for you, and saying no to it costs you nothing. We ask in two places: an optional step after you sign up, and the form you fill in when you ask for a Welcome Session. It is your number as the parent, never your child’s — we do not ask for a child’s. Who sees it: the speech therapist who calls you, and the small team that runs SpeechStep. It is not passed to the calendar company, never added to a marketing list, never sold or shared, and it never travels with the page counts or product events in §4. You can remove it yourself at any time in your account — that deletes the number, not just the permission — or ask us at privacy@webmobi.com.
• How you found us — remembered between visits. Only if you accept the optional cookie described in §13 do we remember how you arrived: the campaign details in the link you clicked, the site that referred you, and the first page of ours you landed on, kept for 90 days so that a sign-up weeks later can still be matched to the page that helped your family. If you then create an account, we keep a copy of those details with your sign-up record. Without that cookie, nothing is carried from one visit to the next.

From every visit to our website

• Anonymous page counts. Every page view is counted, for every visitor, with no cookie and no identifier of any kind: the page address, how you arrived (recorded once, on the first page of a visit — campaign details and the referring site’s address only), a two-letter country, and the time. This happens whether or not you accept the optional cookie above, because nothing is stored on your device for a banner choice to govern. §4 sets out exactly what is and is not recorded, including what never travels with it.

From your child’s practice

• Voice recordings — only when you have turned on cloud feedback (see §5). By default, practice runs on your device and no audio is sent or stored.
• Practice results — scores, sounds practiced, progress and streaks. These are stored against a random child identifier, not your child’s name.

From our free tools

• If you use a free tool (e.g. the Speech Delay Quiz or Milestone Checker) and choose to get results by email, we collect the email you enter, the child age you provide, and the tool result. This policy explains how we handle that data and how you can delete it.

3. Information we do NOT collect

• We do not use third-party advertising or analytics trackers — no ad pixels, no social-network tags, no analytics company’s script running on our pages. The page counting we do do is our own — first-party and cookieless — and it is set out in full in §4. The embeds we load from other companies — the cal.com booking calendar and the payment checkout — appear only when you choose to open them (see §13).
• We do not sell, rent, or trade your or your child’s personal information.
• We do not collect a child’s full date of birth, address, phone number, or precise location. A phone number, where one exists at all, is the parent’s and is optional (§2).
• We do not use a phone number for marketing, and we do not text or call you to sell you anything. It is used only to reach you about your child, and only if you ticked the box that says so.

4. Usage and technical data (how we count visits)

We count how our pages are used, so we can tell which guides and pages actually help families and where people get stuck. We do this ourselves — it is our own code on our own servers, not an analytics company’s — and we do it without cookies and without identifying you.

What a page view records

• The page address — the path only, such as /pricing. Everything after a ? or # is discarded before the record is written, so a link that happened to carry an email address or a one-time code cannot end up in our logs.
• How you arrived — recorded once, on the first page of a visit: the campaign details in the link you clicked (source, medium, campaign, and our own from parameter) and the referring website’s address only, for example google.com — never the full page, and never the search you typed.
• A two-letter country code such as IN or GB, supplied by the hosting network that serves the page. Country only — no city, no region, no precise location.
• The date and time, that it was a web page view, and whether it was the first page you opened on that visit.

What a page view does not record

• No cookie. None is set and none is read for this, and nothing at all is written to your device — no local storage, no session storage, nothing.
• No identifier. No visitor id, no device or install id, no advertising id, no fingerprint. There is no key in these records that joins one page view to another, and nothing that joins today’s visit to your next one.
• The mobile app works differently — and we would rather say so. Everything in this section describes our website. The SpeechStep app does use a random “install id” for its own diagnostics, so that a crash or a stuck step can be followed through a single install. It is generated on the device, is not your name, email, account or advertising id, is not shared with anyone, and is gone when the app is uninstalled.
• No IP address stored. Your address is used for a moment, in memory, to stop one machine flooding the endpoint — it is never written into the record. The two-letter country above is not something we work out from it either: it arrives as a header our hosting network adds to the request, which that network derives before the request reaches us. (It necessarily handles your IP address to deliver the page at all — see §8.)
• No cross-site tracking. Nothing here can follow you to another website, no ad network is involved, no profile is built, and these records are never sold or shared.
• Nothing about your child. No recording, no score, no sound or word practiced, no name, no age, and no child or account identifier ever travels with a page view — including on the pages your child practices on, where the record is the page address and nothing more.
• Not linked to your account. A page view carries no user id; we deliberately do not look up who is signed in in order to count one.

Sign-up and in-product events

Separately from page counts, we record a short, fixed list of product moments so we can see where families get stuck: reaching the sign-up screen (which page you started from, and where you were heading), requesting a sign-in code (and whether that request was a “resend”, plus whether sending it succeeded or failed, so we can tell a delivery problem from someone changing their mind), verifying that code (how many attempts it took — never the code itself, and never your email address or phone number), seeing the upgrade screen, choosing a plan, and clicking to book a Welcome Session. Each carries the same two-letter country and time as above. From the moment you are signed in, these are linked to your account — and if you accepted the optional cookie, the “how you found us” details travel with them (§13).

Your choices here

Because these page-view records contain no cookie and no identifier, there is nothing on your device to switch off, and nothing in them we could single out as yours to show, correct or delete — which is precisely why we keep them that way. Declining the optional cookie does not stop the counting, and accepting it adds nothing to it. If you would rather not be counted at all, the counting is ordinary page script, so browser settings or extensions that block scripts will prevent it, and we make no attempt to work around them. The in-product events recorded once you are signed in are account data, and are deleted when you delete your account (§10).

5. Voice recordings & AI feedback

Practice is on-device by default — nothing leaves the device. To give your child spoken-word AI feedback, you can turn on cloud feedback, which you control:

• Cloud feedback (recording consent). Each attempt’s audio is sent securely to our AI scoring service to be analysed, and — because you are signed in — saved to your account so you can review it. We verify this consent on our servers before a recording is stored, and you can turn it off at any time.
• Help improve SpeechStep (training consent). A separate, optional choice. Only if you grant it may a saved recording be used — with clinician review — to improve our scoring models. You can decline this and still use cloud feedback.

You can change or withdraw either choice at any time in your account. Withdrawing stops future use; to remove already-stored recordings, use “Delete recordings” or contact us.

6. How we use information

• To provide practice, scoring, feedback, and progress tracking.
• To create and secure your account and send service messages.
• To reply to you — and, where you gave us a phone number and ticked the box saying we may use it, to call or message you about your child’s speech. Nothing else.
• With your separate consent, to improve our AI scoring models.
• To operate, debug, and protect the service, and to comply with law.

7. Children’s privacy (COPPA)

SpeechStep is designed to be used by a child through a parent/guardian account. We treat children’s data as sensitive and apply extra protections. See our dedicated Children’s Privacy (COPPA) page for what we collect from children, the parental-consent model, and your rights as a parent.

8. How we share information — our providers

We do not sell your data. We use a small set of vetted service providers (subprocessors) to run SpeechStep. They may process data only to provide their service to us:

• Supabase — database, authentication, and file storage (accounts, profiles, recordings), and the service log that holds the records in §4.
• Hugging Face — hosts our AI pronunciation-scoring model (receives audio for cloud feedback).
• Vercel — website and application hosting. As the network that serves every page, it handles your IP address to deliver it, and it is what supplies the two-letter country code in §4.
• cal.com — scheduling for the free Welcome Session. It receives the name, email and notes you enter when you book (including which page you came from), and it sets its own cookies once you open the calendar — see §13.
• Resend — email delivery (your sign-in code, and any results or tips you asked us to send). It receives your email address and the message.
• Dodo Payments and Razorpay (India) — payment processing if you subscribe. They handle your payment details directly; we never see your card number.
• Amazon Web Services (AWS) — planned, for our machine-learning data and model infrastructure.

We may also disclose information if required by law, or to protect rights, safety, and the integrity of the service.

9. Data security

We protect data with encryption in transit and at rest, strict per-account access controls (row-level security), a private recordings store that is not publicly accessible, and passwordless sign-in. Details are on our Security page.

10. Data retention

We keep your account data while your account is active. Recordings are retained until you delete them or close your account. Practice results are retained to show progress. We are rolling out automatic time-based deletion of recordings that are not needed; until then you can delete recordings at any time. This also covers the “how you found us” details copied onto your sign-up record (§13): they are kept with your account and go when your account does.

A phone number is kept while it is useful for reaching you and goes when your account does — but you do not have to wait for that: removing it in your account erases the number from our records there and then. We keep one thing after a removal, and only one: the date you told us to stop, so that “has this parent asked us not to call?” stays answerable without keeping the number to answer it with. If you asked for a Welcome Session but never created an account, that request is held so we can follow it up; there is no automatic time limit on it yet — the same honest gap as the recordings above — so until there is, email privacy@webmobi.com and we will delete it.

The visit counts and product events in §4 live in our service log. The two behave differently on deletion, and we would rather be plain about it: the events recorded once you are signed in carry your account id, so deleting your account deletes them with it — while an anonymous page count carries no id at all, which means there is nothing in it to find, and nothing that could be traced back to you if we did. We do not yet apply an automatic time limit to that log; adding one sits alongside the recording limits above.

11. Your rights & choices

Depending on where you live, you may have rights under laws such as the GDPR (EU/UK), CCPA (California), and DPDP (India) — including to access, correct, delete, or export your data, and to withdraw consent. Parents may exercise these on their child’s behalf. You can:

• Manage consent and delete recordings in your account.
• Add, change or remove your phone number in your account. Removing it deletes the number — it is not merely switched off — and no call or message follows.
• Email privacy@webmobi.com to request access, deletion of your account and associated data, or a copy of your data. We respond to verified requests within 30 days (or sooner where required by law).
• One honest limit: these rights apply to data that is linked to you or your child. The anonymous page counts in §4 carry no identifier, so there is nothing in them for us to look up, hand over, or delete on your behalf — and equally nothing in them that points back to you.

12. International data transfers

SpeechStep is operated by an India-based entity and uses providers that may process data in the United States and other countries. Where required, we rely on appropriate safeguards for cross-border transfers.

13. Cookies

We use two kinds of cookie, and only the first kind is on by default. Another company sets cookies only where you open something of theirs — the booking calendar or the payment checkout. We do not use advertising cookies, and we do not use cookies to build a profile of you or your child.

This section covers cookies only. Our page counting (§4) uses none — it stores nothing on your device — so your answer to the banner neither switches it on nor switches it off. We say so here because a banner that quietly implied otherwise would be asking for permission under false pretences.

Strictly necessary (always on)

Sign-in and session cookies set by Supabase, our authentication provider, which keep you logged in and your session secure, plus small cookies that remember which child profile is selected and what you chose in the cookie banner. These are required for the site to work, so they are not optional — but they are not used for tracking or advertising. The record of your banner choice lasts 180 days; after that we ask again.

Optional: how you found us (only with your consent)

If you choose “Accept” in the cookie banner, we set one first-party cookie called ss_attr. It records only how you arrived: the campaign details in the link you clicked (source, medium, campaign), the website that referred you — the site’s address only, never the full page or search you came from — and the first page of ours you landed on, plus the date and time, and a flag noting whether we recorded this on your first visit or had to record it again after an earlier cookie was cleared or expired. It contains no name, no email, no account or child identifier, and nothing about your child’s practice. It lasts 90 days and is never shared or sold. We use it to see which of our pages and guides actually help families find us.

Nothing is set until you accept. If you have not answered the banner yet, or you choose “Decline”, this cookie is not written — and if you had one from a previous visit, it is deleted. Declining does not affect signing in or using SpeechStep, and it does not change the anonymous page counting in §4, which has nothing on your device to switch off.

If you create an account while this cookie is present, we copy the same campaign details onto your sign-up record so we can see which page helped your family find us. That copy is account data: it is kept with your account (see §10) rather than for 90 days, and it is deleted when you delete your account. Clearing the cookie later does not remove the copy — ask us at privacy@webmobi.com if you want it deleted on its own.

Third-party embeds

Two places on the site can load something from another company, and neither loads until you ask for it:

• The booking calendar (cal.com). Our booking page shows a placeholder until you select “Show booking calendar”. Only then does cal.com load, and it sets its own cookies under cal.com (including a security/bot-protection cookie) under their privacy policy. If you never open it, nothing is requested from cal.com and no cal.com cookie is set. You can also open cal.com in a new tab from that page instead.
• Checkout (Dodo Payments, or Razorpay in India). If you choose a paid plan, the payment provider’s checkout opens — as a secure panel over our page, or as their own hosted page — and they set the cookies their payment and fraud checks need. This happens only after you click to subscribe, and never on an ordinary page view.

Apart from these, no page on SpeechStep loads advertising or tracking code from another company.

What we count without a cookie

For completeness in one place: we also count page views ourselves, first-party and with no cookie, no identifier and nothing written to your device. It is not a cookie and so is not listed above, but you should not have to hunt for it — §4 describes exactly what it records and what it never touches.

Changing your mind

Select “Cookie settings” at the bottom of any page to re-open the banner and switch your answer at any time. Choosing Decline there removes the optional cookie immediately. You can also clear cookies in your browser settings. If we materially change what we use cookies for, we will ask you again.

14. Changes to this policy

We may update this policy. We will change the “Last updated” date above and, for material changes, notify you by email or in the app. Continued use after an update means you accept the revised policy.

15. Contact us

Privacy questions: privacy@webmobi.com. General support: support@webmobi.com.