1. Scope
This policy applies to the Areto app, the official getareto.org website, and related account and support features.
2. Data we process
Account and identity data, such as email, name, username, account identifier and a profile image you provide or your sign-in provider supplies. The current profile-completion flow asks for a name, username, date of birth, gender and the city or province you enter in the address field. A phone number is optional when provided. These are stored profile details; entering a city or province does not grant access to GPS location.
Learning data, such as specializations, goals, level, assessments, answers, tasks, terminology, progress, XP and rank. These support the learning experience, synchronization and achievement displays.
Content you choose to share, such as AI conversations, social messages, community and support content, photos, videos, voice recordings and files. This content may be stored in our services to provide the feature, conversation history and synchronization.
Operational, security and notification data, such as session state, service requests, errors, the Firebase Cloud Messaging notification token, platform type and token-update timestamps. Firebase, Google Cloud and ML Kit services may process installation identifiers, device information and diagnostics depending on the service used. Not using an advertising identifier does not mean these data are absent.
3. Why we use data
To sign you in, operate the account, store profile details and specializations, synchronize progress and provide educational content suited to the learning level and specialization.
To deliver messaging, community, content sharing, notifications, AI and audio features you use, and to provide support.
To verify sensitive operations, prevent abuse, protect accounts, diagnose failures and improve service reliability.
4. Service providers and content recipients
Areto relies on Firebase and Google Cloud for authentication, databases, storage, notifications, backend functions and operational information needed for these services.
AI features may send your request text and necessary context, images or text extracted from files to DeepSeek, depending on the feature. These data are processed off the device to generate the requested reply or educational content. Do not submit passwords, verification codes or content you do not want sent to these services.
In the current Android and iOS app release, text-to-speech uses voices installed locally on your device. ARETO does not send spoken text to Edge TTS and does not send text during audio preparation. You may need to install language voice data through device settings. This differs from dictation, which may use the device recognition provider as described below. Earlier app versions used Microsoft through Edge TTS; the new release removes that path.
When you use social features, the recipients or audience you share with can see messages, attachments and content. Profile and achievement information may appear in community and leaderboard views, depending on the feature and sharing scope.
Processing may take place in countries other than your own, depending on the locations of our services and providers. Provider processing and retention are subject to their terms and service settings; this policy does not mean every provider excludes training use or deletes data immediately after a request.
5. Permissions, audio and sharing choices
The public website does not require camera, microphone or geolocation access. In the app, a feature may request permission for photos, the camera, files, the microphone or notifications depending on the device and function. You can decline or revoke permissions in device settings; the related feature may then be unavailable.
Voice recording and dictation are different features. Sending a voice message uploads the recording to provide messaging. Dictation uses the device speech-recognition service, which may process audio on the recognition provider's servers depending on the system and settings; Areto does not enforce on-device-only recognition. Recognized text appears in the composer. If you send it, the text is processed according to the messaging or AI feature used.
ML Kit may extract text from an image locally, but sending an image or extracted text to an AI feature is a separate path that may transfer content off the device. Selecting a file or image does not by itself change your device permission settings.
6. Account security
Authentication is handled through Firebase Authentication. Sensitive operations such as account deletion and restoration require an authenticated identity and recent authentication under the current server controls.
Never share your password or verification codes with anyone claiming to be support.
7. Retention, account deletion and restoration
Account, progress and feature-related content are stored to operate and synchronize those features while the data remain in the service, until removed through an available feature or the account-deletion lifecycle. Operational and security logs and service copies may follow retention policies different from account content; requesting deletion does not mean every copy held by every provider is erased immediately.
You can request account deletion from the app or the website account-deletion portal. Once accepted, the account enters a 30-day pending-deletion state. During that window you can explicitly restore it; signing in alone never restores the account. After the window expires, server operations begin final deletion of the account, its related data and attachments. Processing and retries may take time to complete.
Accepted general educational material in the shared knowledge bank is stored independently of an account. Account deletion does not require deleting this general, non-personal material. This exception does not include a learner's personal answers, AI conversations, messages or private attachments.
For questions about your data, deletion or retention, use the support center or support@getareto.org.
8. Your choices
You can update certain account details in the app, sign out, contact support, or use the account-deletion portal. Device permissions such as microphone and photos can be revoked in your operating-system settings.
9. Changes and contact
We may update this policy as the service or applicable requirements change. The latest revision date appears above.
For privacy or account questions, contact support@getareto.org or use the in-app support center.