Effective date and last updated: August 11, 2026
This Privacy Policy explains how Master 1000 — Learn any language, fast! (“Master 1000,” the “App,” “we,” “us,” or “our”) collects, uses, stores, discloses, and protects personal information when you use our mobile application, website, support channels, and related services (collectively, the “Services”).
Master 1000 is operated by Shaked Yizhak, an Israeli sole trader trading as Master 1000.
Controller / business contact details
For purposes of the EU General Data Protection Regulation (“GDPR”), the UK GDPR, the Israeli Privacy Protection Law, 1981, and other applicable privacy laws, Shaked Yizhak is generally the controller of the personal information described in this Policy. Certain providers, such as Apple, Google, and payment-platform operators, may act as independent controllers for information they process under their own terms.
This Policy applies to information processed through:
This Policy does not govern third-party services that you access independently, even when linked from the Services. Their own privacy notices apply.
Master 1000 is designed around data minimization:
“Anonymous,” “aggregated,” or “de-identified” information is not treated as personal information where applicable law excludes it and where we do not reasonably attempt to re-identify it.
When you create a registered account, we may collect:
Registered accounts are created using Sign in with Apple or Google Sign-In. Guest mode uses an anonymous authentication account as described in Section 3.3.
When you choose Sign in with Apple or Google Sign-In, the provider may send us information permitted by you and needed to create or authenticate your account, such as:
Apple and Google process information under their own privacy terms. We use the information received for authentication, account security, and account linking, and not for advertising.
When you use Master 1000 as a guest, the App creates an anonymous Supabase authentication account so that server-backed features can operate without requiring your name or email address.
Core guest learning progress is stored locally on the device and is not synchronized to the registered-account learning tables.
If a guest uses online Speak mode, we may process and store speaking-attempt records and technical or rate-limit records linked to the anonymous user ID, as described in Section 3.5.
If first-party analytics is enabled, analytics events may also be sent to Supabase with a generated device identifier. The analytics user ID may be null for guest activity.
Local guest information may be removed when App data is cleared or the App is reset or uninstalled. Server-side information associated with an anonymous guest account can be deleted through the deletion mechanisms described in Section 11.
For registered users, we may collect and store:
We use this information to provide lessons, personalize review timing, calculate progress, generate statistics and certificates, and estimate course completion.
Certificates are internal learning milestones only. They are not government-issued, academic, professional, immigration, employment, or regulated-language certificates.
Speak mode allows you to practise a sentence by recording a short voice clip.
When you use Speak mode online:
- Microsoft Azure AI Speech, using the Germany West Central region in the European Union, for speech recognition and pronunciation assessment where supported; or
- OpenAI, using the whisper-1 speech-to-text service in the United States, for speech transcription where Azure pronunciation assessment is not used;
The audio recording itself is processed only for the request and is not written by Master 1000 to a database or storage bucket. We do not retain the recording after processing.
For each online Speak attempt, we may store a speaking-attempt record linked to your registered or anonymous user ID. Depending on the provider and result, the record may include:
We may also store daily provider-usage information linked to your user ID, including the provider used, request count, processed audio seconds, estimated processing cost and technical-failure count. We use these records for rate limiting, service integrity, abuse prevention, troubleshooting and cost control.
When compatible offline speech recognition is available, the App may fall back to Apple’s on-device Speech framework. In that case, the recording does not leave the device.
We do not create voiceprints, speaker embeddings or reusable biometric templates, and we do not use speech recordings or speech characteristics to identify, authenticate or uniquely distinguish a person.
We do not use Speak-mode audio for advertising or model training.
Microphone permission may be denied or revoked through your device settings. If microphone access is denied, Speak mode may not function, but other available learning features can still be used.
Purchases are processed through Apple’s in-app purchase system and associated with your Apple ID. We do not receive your full payment-card number.
We and our subscription-management provider, RevenueCat, may receive:
Apple is responsible for payment processing and may retain financial and transaction information under its own policies. RevenueCat helps us validate purchases and manage feature entitlements.
If you allow push notifications, we may process:
We currently use push notifications for optional daily practice reminders and for one reminder relating to the end of an eligible free trial.
You can disable notifications at any time through the App or your device settings.
If first-party analytics is enabled, the App sends analytics events to our own Supabase database.
These records may include:
Events currently include App open and close, lesson start, lesson finish, lesson abandonment, hint use, recall-item results and notification opens.
We use this information to understand how the App is used, evaluate functionality and improve the Services.
We do not send these analytics events to a third-party advertising or analytics provider, and we do not use them for advertising or cross-app tracking.
You can disable first-party analytics at any time in Settings. After analytics is disabled, new analytics events will not be uploaded. Events generated while offline may be buffered locally and uploaded when connectivity returns if analytics remains enabled.
We may also process authentication and security records and the technical or error information described in Section 3.5 as necessary to operate, troubleshoot and protect the Services.
We do not use a third-party crash-reporting SDK.
If you contact us, we may collect:
Do not send sensitive information that is unnecessary for us to address your request.
The Services are not designed to collect:
If a future feature requires a new category of information, we will provide notice and obtain permission where required before collection.
Unless we expressly state otherwise, you are not legally required to provide personal information to Master 1000, and providing it is voluntary.
Some information is necessary to use particular features. For example, authentication information is necessary to use a linked Apple or Google account, microphone input is necessary to use online Speak mode, and a push-notification token is necessary to receive reminders.
If you choose not to provide information required for a particular feature, we may be unable to provide that feature, but other available parts of the Services may remain usable.
We obtain information:
We do not purchase consumer profiles from data brokers.
Where GDPR or UK GDPR applies, we rely on the following legal bases:
| Purpose | Typical information | Legal basis |
|---|---|---|
| Create and administer an account | Name, email, login identifiers, anonymous or registered user identifier and preferences | Performance of a contract; steps requested before entering a contract |
| Deliver lessons and synchronize progress | Learning records, language selections, progress, Smart Recall schedule | Performance of a contract |
| Provide online Speak mode | Temporary microphone audio, transcript, pronunciation and scoring results and speaking-attempt metadata | Performance of our contract with you where the processing is necessary to provide the Speak feature you request. Device-level microphone permission and any separate permission required by an app-platform rule are obtained separately and are not themselves the GDPR legal basis for this processing |
| Personalize Smart Recall and learning forecasts | Answers, mastery, timing, error patterns and progress | Performance of a contract; legitimate interests in effective product functionality |
| Operate, secure and control use of speech-processing services | Provider usage records, request counts, processed audio duration, errors and technical records | Legitimate interests in service integrity, abuse prevention, troubleshooting, security and cost control |
| Process and restore purchases | Receipt, product, entitlement and status | Performance of a contract; legal obligations; legitimate interests in fraud prevention |
| Send optional reminders | Push token and reminder preferences | Consent |
| Understand product usage and improve the Services | First-party analytics events, generated device ID, user ID where applicable and product-interaction properties | Our legitimate interests in understanding feature usage and improving the Services, subject to necessity and balancing against your rights and interests. You may object to this processing by disabling analytics in Settings. Consent is used instead where applicable law requires consent |
| Provide support | Contact details, messages and troubleshooting data | Performance of a contract; legitimate interests in customer service |
| Protect the Services | Security logs, IP address where technically processed, identifiers and abuse signals | Legitimate interests in security, fraud prevention and service integrity; legal obligations |
| Comply with law and enforce rights | Account, transaction, support and security records | Legal obligation; legitimate interests in legal claims and compliance |
| Send material service or legal notices | Email address and account status | Performance of a contract; legal obligation; legitimate interests |
Our legitimate interests include keeping the App secure, preventing abuse, understanding feature performance, fixing errors, providing support and improving the educational experience. We consider the impact on users and apply data-minimization and opt-out controls where appropriate.
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing already lawfully completed.
Smart Recall uses learning data to schedule reviews and estimate mastery. The App may also calculate a projected completion date based on your pace and stated goals.
These outputs are educational recommendations and estimates. They do not make decisions that produce legal, employment, credit, insurance, immigration, healthcare, educational-admission, or similarly significant effects. You may continue learning even if a forecast is inaccurate, and you can change your daily goals and practice patterns.
Some lesson material may be drafted, translated, edited or quality-checked with the assistance of artificial-intelligence tools and then reviewed by our content team.
AI-assisted lesson-content creation is separate from Speak mode.
When you use Speak mode online, microphone audio may be sent to Microsoft Azure AI Speech or OpenAI as described in Sections 3.5 and 8.1.
We do not send Speak-mode audio to either provider for advertising, voice identification or model training.
We disclose personal information only as reasonably necessary for the following purposes.
| Provider | What we use it for | Personal information involved | Main processing location |
|---|---|---|---|
| Supabase | Authentication, PostgreSQL database, Edge Functions and first-party analytics | Account identifiers, profile information, learning data, speaking results and metadata, analytics events and technical records | European Union; our project is configured in eu-central-1 |
| RevenueCat | Subscription entitlement and purchase-status management | App user identifier, receipt and purchase information, entitlement and subscription status | As described by RevenueCat’s applicable terms and privacy documentation |
| Apple | Sign in with Apple, App Store billing, push-notification infrastructure and on-device speech/TTS functions | Apple account information authorized by you, purchase information and push tokens, as applicable | Under Apple’s applicable terms and privacy documentation |
| Google Sign-In | Google identifier, name and email address authorized by you | Under Google’s applicable terms and privacy documentation | |
| Microsoft Azure AI Speech | Online speech-to-text and pronunciation assessment for supported languages | Short transient voice recording, language/locale and request information; Azure returns transcript and pronunciation/scoring information | Germany West Central, European Union |
| OpenAI | Online speech-to-text fallback using whisper-1 | Short transient voice recording and related language/request information; OpenAI returns a transcript | United States |
We require processors acting on our instructions to protect personal information and process it only for authorized purposes, subject to applicable contractual and legal requirements.
Some providers, including Apple or Google for certain activities, may process information as independent controllers under their own terms.
We may disclose information where reasonably necessary to:
We assess requests and disclose only information we reasonably believe is required.
If we are involved in a merger, acquisition, financing, reorganization, insolvency, or sale of all or part of the business, information may be disclosed under appropriate confidentiality and privacy safeguards. We will provide notice where required before information becomes subject to materially different practices.
We do not sell personal information for money or other valuable consideration as those concepts are defined by applicable privacy law. We do not share personal information for cross-context behavioral advertising, and we do not use third-party advertising SDKs.
Because we do not sell or share personal information for those purposes, we do not currently provide a “Do Not Sell or Share My Personal Information” link. If our practices change, we will update this Policy and provide legally required controls before beginning the new practice.
We are based in Israel and serve users globally. Personal information may therefore be processed in Israel and in countries where our providers or their subprocessors operate.
Our primary Supabase project is configured in the European Union in eu-central-1.
Microsoft Azure AI Speech processing described in Section 3.5 is configured in the Germany West Central region in the European Union.
Speech audio sent to OpenAI for transcription may be processed in the United States.
Where EEA or Swiss personal data is transferred to a recipient in the United States or another country outside the EEA or Switzerland, the transfer is protected by the European Commission’s Standard Contractual Clauses incorporated into the applicable Data Processing Addendum or, where applicable, by a valid adequacy decision.
For UK personal data, the Standard Contractual Clauses as amended by the UK International Data Transfer Addendum apply where required.
Where Israeli or other applicable law imposes additional international-transfer requirements, we apply the legally required contractual, organizational or technical safeguards.
You may contact us to obtain further information about, or a copy of, the applicable transfer safeguards, subject to appropriate confidentiality and security limitations.
We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, comply with legal duties, resolve disputes, prevent fraud and enforce agreements.
Our current retention approach is:
| Information | Typical retention |
|---|---|
| Registered account and active learning records | While the account remains active and until deletion is requested or otherwise required |
| Anonymous guest authentication and guest server records | While the anonymous guest account remains in use and until deletion, subject to limited legal or security exceptions |
| Local guest learning records | On the device until App data is cleared, reset, overwritten or removed |
| Speak-mode audio recording | Processed transiently for the request and not retained by Master 1000 as an audio recording |
| Speaking-attempt results and metadata | Transcripts, scores and speaking-attempt records are retained as part of registered or anonymous user records until deletion or earlier deletion under our retention practices |
| Daily speech-provider usage and technical records | Only for as long as reasonably necessary for rate limiting, troubleshooting, abuse prevention, service integrity and cost control |
| First-party analytics records | Only for as long as reasonably necessary for the analytics purposes described in this Policy and deleted or de-identified when no longer necessary |
| Purchase and entitlement records | For as long as needed to provide access, restore purchases, prevent fraud and meet applicable tax, accounting or legal requirements |
| Push token and reminder settings | Until notifications are disabled, the token expires, the account is deleted or the information is otherwise no longer needed |
| Support correspondence | For the time reasonably needed to resolve, document and defend the request or claim |
| Security logs | For a limited period based on security, abuse-prevention and legal needs |
| Backups | Until overwritten through the ordinary backup cycle |
| Aggregated or irreversibly de-identified information | May be retained without a fixed period where legally permitted |
After account deletion, limited information may remain where retention is required or permitted for legal compliance, transaction records, fraud prevention, dispute resolution or security.
Apple, Google and other independent controllers may retain information under their own privacy policies.
Deleting a Master 1000 account does not automatically cancel an Apple subscription. You must separately cancel the subscription through your Apple ID subscription settings.
Registered users and users with an anonymous guest authentication account can initiate deletion through the in-App account-deletion flow:
Settings → Delete account
When deletion completes, we delete the authentication user and associated user-linked rows under our control from the active service, except for limited information that we are legally required or permitted to retain for legal, security, fraud-prevention or similar purposes.
Deletion may permanently remove learning progress, certificates, Speak-mode records and other information linked to the account and generally cannot be reversed.
Deleting your Master 1000 account does not itself cancel an Apple App Store subscription. Subscription cancellation must be managed separately through Apple.
Information independently controlled by Apple, Google or other third parties remains subject to those providers’ own retention obligations and privacy practices.
You may also contact us at [Shaked54321@gmail.com](mailto:Shaked54321@gmail.com) regarding a deletion or privacy request. We may take reasonable steps to verify the request.
Depending on your location and applicable law, you may have the right to:
These rights may be subject to legal exceptions. We may ask for information needed to verify identity and protect your account. We will not request more verification information than reasonably necessary.
To exercise a right, use available in-App controls or email Shaked54321@gmail.com with the subject “Privacy Request.” Describe the right you wish to exercise and the account email involved. We may need to confirm control of that account.
You may use an authorized agent where applicable. We may require proof of authorization and may verify your identity directly.
You may complain to the supervisory authority in the country where you live, work, or believe a violation occurred. Before doing so, we welcome the opportunity to address your concern directly.
Where processing relies on legitimate interests, you may object based on your particular situation. Where processing is for direct marketing, you may object at any time. Master 1000 does not currently use personal information for third-party behavioral advertising.
Subject to Israeli law, you may request access to personal information about you in a database and request correction or deletion where information is inaccurate, incomplete, unclear, outdated, or processed contrary to applicable requirements. Rights and procedures may be subject to the Israeli Privacy Protection Law, regulations, and lawful exceptions.
This section applies to California residents to the extent Master 1000 is subject to the California Consumer Privacy Act, as amended (“CCPA”).
During the preceding 12 months, or as reasonably anticipated for initial operation, we may have collected the following categories:
| CCPA category | Examples we process | Main purposes | Recipients / processors |
|---|---|---|---|
| Identifiers | Name, email address, internal user ID, Apple/Google provider identity, anonymous-account identifier, generated per-install device ID and authentication-related identifiers | Account creation, authentication, security, functionality and first-party analytics | Supabase; Apple or Google where their sign-in service is used |
| Commercial information | App purchase, receipt, entitlement, subscription and trial status | Providing and managing paid access | Apple and RevenueCat |
| Internet or other electronic activity | App open/close, lesson start/finish/abandon, hint use, recall results, notification opens, selected language, App version, interaction duration, question counts and correct/incorrect counts | First-party analytics, functionality and product improvement | Supabase |
| Audio and related electronic information | A short voice recording used during an online Speak request; recording duration; resulting transcript; pronunciation, accuracy, fluency, completeness, prosody and per-word scores; technical audio diagnostics | Speech transcription, pronunciation assessment and operation of Speak mode | Supabase, Microsoft Azure AI Speech and/or OpenAI |
| Learning and profile information | Native and target language, daily goal, settings, XP, streaks, progress, review schedule, lesson activity, certificates and scores | Providing and personalizing the learning service | Supabase |
| Inferences relating to learning | Mastery state, review timing, learning-performance and pronunciation results derived from activity | Spaced repetition, personalization and Speak-mode feedback | Supabase |
| Technical and service-integrity information | Speaking provider, request counts, processed audio duration, estimated provider cost, errors, technical failures and provider request IDs | Rate limiting, troubleshooting, abuse prevention, service integrity and cost control | Supabase and the relevant speech processor |
We do not sell personal information and we do not share personal information for cross-context behavioral advertising.
California residents may have the right, subject to applicable law and exceptions, to:
Because we do not currently sell personal information or share it for cross-context behavioral advertising, we do not currently provide a sale/sharing opt-out mechanism for those activities.
Requests may be sent to [Shaked54321@gmail.com](mailto:Shaked54321@gmail.com). We may use reasonable methods to verify the request and the authority of an authorized agent.
We do not offer a financial incentive in exchange for personal information.
We use reasonable administrative, technical, and organizational measures intended to protect information, such as:
No system is completely secure. You are responsible for protecting your device, email account, Apple/Google account, and Master 1000 credentials. Notify us promptly if you suspect unauthorized access.
The App stores certain information locally on your device, including:
The App also maintains a local 24-hour practice-hours profile reflecting the times of day at which you practise.
This practice-hours profile is used on the device to help determine suitable times for practice reminders and is not uploaded to our servers.
The generated device identifier and buffered analytics events may be transmitted to our Supabase analytics database when first-party analytics is enabled and an internet connection is available.
Cached lesson content, sentence content and similar educational resources do not themselves contain personal information about you.
The App requests microphone permission only for Speak mode and notification permission only for optional push notifications. You may change these permissions in your device settings, although the related feature may stop working.
Our website may use strictly necessary cookies or local storage for security, language selection, session handling and legal-page functionality. We do not currently use advertising cookies.
Master 1000 is not directed to children under 13, and users under 13 may not create an account or use the Services.
If you are between 13 and the age at which you can validly consent or enter a contract in your jurisdiction, you may use the Services only with permission from a parent or legal guardian where required by law.
We do not knowingly collect personal information from a child under 13. If we learn that we have done so, we will take reasonable steps to delete it. A parent or guardian may contact us at Shaked54321@gmail.com.
The App is not intended for Apple’s Kids Category unless separately configured and reviewed for all applicable child-privacy requirements.
You may:
Disabling first-party analytics will not affect core paid functionality.
We may update this Policy to reflect changes in the Services, providers, law, or security practices. We will post the updated version and revise the “last updated” date. Where required, we will provide additional notice in the App, by email, or through another appropriate method and obtain consent if the change requires it.
Material changes will not be applied retroactively in a manner that unlawfully reduces your rights.
This Policy may be provided in English, Hebrew, and other languages. The versions are intended to be equivalent. If there is a conflict, the English version will control to the extent permitted by law, except where mandatory local law requires another version or interpretation to control.
Questions, requests, and complaints may be sent to:
Shaked Yizhak — Master 1000
Attn: Privacy
Vardon 75B, Vardon, 79535, Israel
Email: Shaked54321@gmail.com
Telephone: +972-53-220-6866
Please do not send passwords or unnecessary sensitive information by email.