Your account and your data: what Phrazl stores and how to delete it
A language learning app can store a lot or a little, and the honest answer for Phrazl is six things: your sign-in details, your trips, your review history per phrase, a record of what you bought, any support request you send, and one timestamped milestone per trip as it moves from setup towards purchase. Here is each one, why it exists, where it sits, and the buttons built to delete a single trip
Why the list is short
Phrazl is built to do one job: put a set of destination phrases in your mouth before a departure date. That job needs a departure date, a destination, the scenarios you picked, and a memory of which phrases you fluffed last time. Add the record of what you paid for, the support request you send if a pack does not unlock, and one timestamped milestone per trip so the product can see where travellers stop between signing up and buying, and that is the whole inventory. If it is not on the list below, Phrazl does not store it.
What follows is stated plainly rather than buried in a policy. Three services are involved and no more: Amazon Web Services, which hosts the app and its managed Postgres database, Stripe, which takes the card payment for a trip pack, and Resend, which sends a password reset email to your address when you ask for one. There is no fourth service and no analytics vendor on the list. Everything sits on the account for as long as the account exists, and goes when you delete the account.
What Phrazl stores, and why it is there
| What is stored | Why it is there |
|---|---|
| Your email address, name and a hashed password | To sign you in and keep your trips attached to your account |
| Your trips: destination, departure date and chosen scenarios | To select the phrase set and calibrate the review schedule to your departure |
| Your review history per phrase: result, interval, next review time | To schedule what you practise next and show curriculum coverage |
| Purchase records: Stripe checkout session and payment intent ids, amount and status per trip pack | To unlock what you bought, apply the returning traveller discount, and re-lock a pack if Stripe refunds the payment |
| Support requests you send from the account screen | To fix purchase problems and refund what did not unlock |
| Funnel milestones: one timestamped record per trip when you set it up, finish the free 20, see the paywall, start a checkout or complete a purchase | To understand where travellers stop between signing up and buying, so the product can be improved there |
What is not in place
No support email address
There is no support mailbox. Purchase and refund problems are raised from the support form on the account screen instead, and what you write there is stored so it can be answered. Deleting a trip or the account needs no request at all, because both are buttons in the app.
No data export
There is no download of your review history or of the milestone records, so the schedule, the results and the trip timeline live only in the account until you remove them.
No two-factor authentication
Sign-in is an email address and a password, stored hashed rather than in plain text, and the password is the only lock on the account.
No independent security audit
There is no SOC 2 report behind this product, and nothing here is written to suggest one.
Questions
What data does Phrazl store about me?
Six things. Your email address, name and a hashed password, so you can sign in and your trips stay attached to you. Your trips, meaning the destination, the departure date and the scenarios you chose, because those select the phrase set and set the pace of your reviews. Your review history per phrase, which is the result, the interval and the next review time, plus purchase records from Stripe covering the checkout session and payment intent ids, the amount and the status per trip pack. Then any support request you send from the account screen, and one timestamped milestone per trip marking setup, the end of the free 20, the paywall, the start of a checkout and a completed purchase. Nothing else is collected.
Does Phrazl track what I do in the app?
Not tap by tap. What is recorded is one timestamped milestone per trip at five points: when you set the trip up, when you finish the free 20 phrases, when you see the paywall, when you start a checkout and when a purchase completes. The reason is the one question a small paid product has to answer, which is whether people who try the free 20 go on to buy the pack, and those records are read on an operator-only screen rather than handed to anyone else. Your individual reviews, the blanked and shaky and said-it grades, are stored to schedule what you practise next, not to score you.
Does Phrazl store my card details, and where can I see what I bought?
Card details go to Stripe, which takes the payment for trip packs. What Phrazl keeps on its own side is the Stripe checkout session and payment intent ids, the amount and the status, which is enough to unlock the pack you paid for, apply the $5 returning traveller discount on a second destination, and re-lock a pack if Stripe refunds the payment. The account and purchase history screen in the app shows the trip packs you own. If something did not unlock, the support form on that same screen is where you raise it, and that request is stored so it can be fixed.
Where is my data stored?
On Amazon Web Services, in a managed Postgres database. That is the product's hosting stage, and the database is where your account, your trips, your review history, your support requests and the milestone records sit. Stripe holds the payment side as the card processor, and Resend sends a password reset email to your address when you ask for one. Those three are the only services involved.
How long is my data kept?
It is kept while your account exists and removed when the account is deleted. There is no separate clock running on old trips, so a trip you took last spring stays on the account until you delete that trip or the account. Server logs, the routine technical records a hosted app produces, roll off within 30 days. If you would rather not leave an old account sitting there, the delete account button closes it.
How do I delete my account or a single trip, and what goes with it?
Use the delete account button on your account screen for the lot. It removes the account, the trips, the review history, the purchase records and the support requests in one go. If you only want one destination gone, that trip's edit screen deletes the trip and its review history and leaves the rest of the account alone. Stripe retains its own payment records as required by law, so the card processor's ledger sits outside what we can remove.
Can I export or download my review history first?
Not today. There is no data export or download of your review history, so when you delete a trip or the account the schedule and the results go with it. If you want to keep something, note down the phrases that still catch you before you delete. That is a gap, and it is listed above rather than quietly left out.
How is my account protected, and has Phrazl been audited?
You sign in with an email address and a password, and the password is stored hashed rather than in plain text. If you forget it, Resend sends a password reset email to the address on the account. There is no two-factor authentication at present, so the password is the only lock, and what sits behind it is a departure date, a phrase list and a review schedule. There is no SOC 2 report and no independent security audit behind this product, and it would be dishonest to imply one: judge it on the short list of stored data and the deletion buttons instead.