Privacy notice
Last updated 19 August 2026
Who we are
Stacklab X Limited
support@stacklabx.com
For the purposes of the UK GDPR and the Data Protection Act 2018, Stacklab X Limited is the data controller for the personal data described in this notice. You can reach us at support@stacklabx.com for anything to do with your data.
The short version
The English Coach app works entirely on your device. Your voice, your practice, your mistakes and your scores never leave it, and there is no account to create. The only personal data we ever receive is what you deliberately publish: a certificate you choose to register for public verification.
Data we process, and why
| What | Why | Lawful basis | Kept for |
|---|---|---|---|
| Certificate details you publish: certificate ID, the name label you chose (initials or full name), level, skill levels, issue date and version stamps | To provide the public verification page so a third party can confirm your certificate | Consent (UK GDPR Art. 6(1)(a)) — you choose to publish, per certificate | Until you ask us to remove it |
| Server logs: IP address, time, requested page, user agent | To keep the service running and to detect abuse such as automated attacks | Legitimate interests (Art. 6(1)(f)) — securing our service | Up to 10 days |
| Emails you send us | To answer your question or handle your request | Legitimate interests (Art. 6(1)(f)) — responding to enquiries | Up to 24 months |
We do not use cookies, analytics, advertising identifiers or tracking of any kind, and we do not sell or share personal data with anyone for their own purposes. See our cookie statement.
What stays on your device
Speech recognition, the AI tutor, marking and CEFR grading all run locally using Apple's on-device models. Recordings, transcripts, corrections, scores and your learner profile are stored only on your device and are never transmitted to us. You can export everything as a JSON file, or delete all of it, from Profile in the app.
Publishing a certificate
Publishing is optional and off by default. Before you publish, the app shows exactly what will appear and lets you choose whether the page shows your initials or your full name. A published page is public and can be indexed by search engines. If you publish your full name, that name becomes publicly accessible until you ask us to remove it. Unpublishing is immediate on request — email us with the certificate ID.
Payments
Subscriptions are bought and managed through Apple. Apple processes the payment and shares no payment details or personal data with us; we receive no card data at any point. Apple's handling of that data is covered by Apple's own privacy policy.
Where your data is held
Published certificate data is stored on servers in the United Kingdom and is not transferred outside the UK. Nothing else about your practice is stored on any server.
Automated decision-making
Your CEFR level and scores are produced automatically, on your device. They are guidance for your learning and produce no legal or similarly significant effect. A certificate records an unsupervised self-assessment and is not a proctored qualification. You can request a re-assessment in the app at any time.
Children
English Coach is rated 4+ and contains no user-to-user content, advertising or external links to unmoderated content. We do not knowingly process personal data of children beyond a published certificate label, which is always the learner's own choice. If you believe a child has published a certificate and you are their parent or guardian, email us and we will remove it.
Your rights
Under the UK GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to our processing, to data portability, and to withdraw consent at any time. Because we hold nothing about you unless you have published a certificate, most requests are answered by removing that page — email support@stacklabx.com with the certificate ID. We respond within one month.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113. We would rather you told us first so we can put it right.
Security
The verification service is served over HTTPS only. Certificate registration is authenticated, rate limited and validated. Certificates can be revoked, which marks the public page as no longer valid.
Changes
If we change this notice we will update the date above and, for anything that materially affects you, say so in the app. Earlier versions are available on request.