Privacy Policy
At LowKey, your privacy and personal autonomy are foundational to everything we build. This Privacy Policy details the types of personal information we collect, how it is processed and secured, your rights under global privacy laws (including GDPR and CCPA), and our strict policies regarding real-time voice and video communications.
Privacy at a Glance
Table of Contents
01.Who We Are & Scope
This Privacy Policy applies to the services, applications, and website provided by LowKey ("LowKey", "we", "us", or "our"), accessible via lowkey.talk and related applications.
LowKey is an open online language practice and conversation platform where language learners connect worldwide through live voice and video rooms, persistent practice groups, language exchange networks, and community messaging.
02. Information We Collect
We collect information you provide directly to us, as well as limited technical telemetry generated automatically when you interact with our platform:
Account & Authentication Information
When you create an account via Google OAuth or email sign-up, we collect your email address, display name, profile picture, and account credentials (passwords are salted and cryptographically hashed with strong one-way algorithms; LowKey never has access to plaintext passwords). For guest sessions, we issue temporary anonymous tokens.
Profile & Learning Preferences
Information you voluntarily provide on your profile, including your native language(s), languages you are learning, proficiency levels (A1 to C2 / Native), bio, learning goals, interests, tags, and survey responses used to recommend relevant conversation rooms.
Platform Interactions & Social Graph
Your friendships, user follows, group memberships, room participation timestamps, practice streak counts, earned experience points (XP), leaderboard visibility preferences, and direct messages sent between mutual friends.
Device & Network Telemetry
Browser type, operating system, IP address, approximate geographical location (country/city level for optimal regional media routing), connection quality metrics (WebRTC packet loss, jitter, latency), and crash logs to maintain platform stability.
03.Real-Time Audio & Video Privacy
Zero Call Recording Policy
Your live voice and video communications are transmitted transiently in real-time using secure, encrypted WebRTC connections routed through our media infrastructure (powered by LiveKit). LowKey does not record, intercept, transcribe, or store your live voice or video conversations. Once an audio or video packet is delivered to participants in the room, it ceases to exist in memory.
Please be aware that public conversation rooms are accessible to other registered participants. We strictly prohibit users from recording or broadcasting other members without explicit, unanimous consent (as outlined in our Terms of Service), but you should always exercise discretion regarding personal details you share during live calls.
04. How We Use Your Information
We process your personal information strictly for legitimate operational purposes:
- Providing the core service: Authenticating users, facilitating WebRTC room connections, managing persistent groups, and routing direct messages.
- Personalizing practice recommendations: Matching you with rooms, learners, and topics aligned with your target languages and proficiency level.
- Safety and abuse prevention: Enforcing our Community Guidelines, moderating disruptive behavior, mitigating harassment, and protecting the platform against automated spam and unauthorized intrusions.
- Transactional communications: Sending essential system notifications, security alerts, room invitations, and email newsletters (you may opt out of promotional emails at any time).
- Platform performance: Monitoring connection quality, resolving media transmission bottlenecks, and improving infrastructure reliability.
05. Legal Bases for Processing (GDPR)
If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your personal data under the following legal bases pursuant to Article 6 of the General Data Protection Regulation (GDPR):
- Performance of a Contract: Processing necessary to provide the LowKey services requested by you according to our Terms of Service.
- Legitimate Interests: Processing to secure our network, prevent fraud, debug technical issues, and improve platform experience, balanced against your fundamental rights.
- Consent: Where you have explicitly opted into specific features, such as voluntary survey responses or optional email announcements (consent can be revoked at any time).
- Legal Obligation: Processing required to comply with binding legal duties, regulatory requirements, or lawful court orders.
06. Third-Party Service Providers
We partner with reputable third-party infrastructure providers who adhere to strict data processing agreements and enterprise security standards:
| Service Provider | Purpose | Data Processed |
|---|---|---|
| LiveKit | Real-time WebRTC media routing (audio/video/data) | Ephemeral audio/video packets, connection telemetry |
| Amazon Web Services (SES) | Transactional and broadcast email delivery | Recipient email, notification content |
| Amazon Web Services (Bedrock) | AI email drafting and language topic suggestions | Anonymized topic prompts (no personal identifiable data) |
| Google Cloud Platform | OAuth identity authentication | Name, email address, profile avatar |
| PostgreSQL / Cloud Database | Encrypted database storage | Account data, profile, friends, groups |
08.Data Retention & Deletion
We retain personal data only for as long as your account remains active or as required to deliver our services.
- Ephemeral Data: Voice and video streams are completely discarded upon transmission. Guest sessions expire automatically after inactivity.
- Account Deletion: You can permanently delete your account and all associated profile information directly from your Settings page. Upon deletion, your profile, friends list, group memberships, and direct messages are erased from our active databases.
09.Your Rights (GDPR, CCPA & Global)
Regardless of your geographic location, LowKey respects your universal data privacy rights:
You have the right to request a copy of the personal data we hold about you in a structured, machine-readable format.
You can correct or update inaccurate or incomplete profile information at any time via your account settings.
You can request the permanent deletion of your personal data from our systems.
You can restrict or object to the processing of your data under applicable legal circumstances.
California Consumer Privacy Act (CCPA / CPRA) Notice:
We do not sell personal information, nor do we share personal information for cross-context behavioral advertising. California residents have the right to know, delete, and correct their personal information, and will not experience discrimination for exercising their privacy rights.
10.Children's Privacy (COPPA)
LowKey is designed for language learners aged 13 and older (or 16 and older in the European Economic Area and UK). We do not knowingly collect or solicit personal information from children under the required age of digital consent.
If we discover that an account has been registered by an underage individual without verifiable parental consent, we will promptly delete the account and associated information. Parents or guardians who believe their child has registered an unauthorized account may contact us at privacy@lowkey.talk.
11. Information Security
We implement industry-standard administrative, physical, and technical safeguards to protect your personal information against unauthorized access, destruction, loss, or disclosure:
- All web and API traffic is encrypted in transit using modern TLS 1.3 encryption.
- Real-time WebRTC media streams are encrypted end-to-end between your browser and our secure SFU servers via DTLS-SRTP.
- Databases are hosted in isolated VPCs with encryption at rest and strict role-based access controls.
12.Contact & Data Protection Inquiries
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, you may reach our privacy team directly: