Security

Encryption

• In transit: all traffic is served over HTTPS/TLS.
• At rest: our database and file storage encrypt data at rest. Our planned machine-learning storage uses server-side encryption with managed keys.

Access control

• Per-account isolation. Every record is protected by database row-level security scoped to the signed-in account, so one family can never read another’s data. Default is deny.
• Private recordings store. Voice recordings live in a private bucket that is not publicly accessible. Uploads happen only through our server; a parent can access only their own child’s recordings.

Authentication

Sign-in is passwordless — a one-time code sent to your email. We do not store passwords, so there is no password database to breach.

Consent-gated audio

A child’s audio is sent to our AI scoring service only after a parent has granted recording consent, and it is stored only because that same consent covers storage. We verify the consent on our servers — not in the browser — before a recording is scored or stored. A separate, optional consent is required before any stored recording may be used to improve our models.

Decline recording consent and your child can still practice: the loop runs with a local demo scorer that produces practice feedback so the exercise works, and no audio leaves the device. That local tier is a demonstration, not a measurement of your child’s speech — we say so in the product rather than passing it off as a score.

Data minimization

• Recordings are stored under a random identifier, never a child’s name.
• We use no third-party advertising or analytics trackers. The two embeds we do load from other companies — the cal.com booking calendar and the payment provider’s checkout — load, and can set their own cookies, only after you choose to open them. Our own page-view measurement is first-party and carries no identifier — see below.
• We collect age in months only — never a full date of birth — and never require a child’s real name.

Measurement without identifiers

We count page views ourselves rather than embedding another company’s analytics, and we built the counting so that it holds nothing worth stealing. No cookie, no visitor or device identifier and no fingerprint is involved, and no IP address is stored— an address is used only in memory, to rate-limit the endpoint. The two-letter country we do keep arrives as a header our hosting network adds to the request, rather than being derived by us. A page view carries no user id, so these records cannot be joined back to an account or to a child.

The endpoint that receives them is deliberately narrow, because a public write path into a log table is a liability: it accepts only a fixed list of event names, drops known bots and requests with no user-agent, is rate-limited per address in separate budgets, discards the query string and fragment from a page address before storing it (so a stray token or email in a link cannot land in our logs), and keeps only a capped number of short scalar fields — never free-form objects.

That endpoint is also the only way anything reaches the log table from a browser. The table itself accepts no writes from a signed-in or anonymous client — every legitimate write goes through our own server — so the guarantees above are enforced by the database rather than by the page asking nicely.

What is recorded, and what is deliberately not, is written out in full in §4 of the Privacy Policy — including the per-attempt scoring detail that is kept against your account once you turn recording on.

Our service providers

We rely on a small set of vetted providers — Supabase (database, auth, storage), Hugging Face (AI scoring), Vercel (hosting), Resend (email), cal.com (booking the free Welcome Session), Dodo Payments and Razorpay (payments), RevenueCat (subscriptions in the mobile apps), and, planned, AWS (ML infrastructure). Each processes data only to provide its service to us. See the Privacy Policy for the full list and purposes.

Data deletion

You can delete recordings at any time in your account, and delete the whole account from the same page — which also removes the rows that do not cascade with it: your leads and tool results, any email enrolment, any Welcome Session request, and the log rows carrying your account id. If you have no account, speechstep.com/erase does the same for an email address. Or email privacy@webmobi.com and we will do it for you.

How we keep improving

Security is ongoing. We maintain an internal security and privacy review and are actively working on additional hardening — including tighter rate limiting on public endpoints, credential rotation, automatic retention limits on recordings, and moving production data onto dedicated infrastructure.

Reporting a vulnerability

If you believe you’ve found a security issue, please email security@webmobi.com with details. We appreciate responsible disclosure and will work with you to resolve valid reports. Please do not access or modify other users’ data, and give us reasonable time to fix issues before disclosing them publicly.