Assertr

App privacy policy

Last updated: 25 October 2026 · Effective: 8 November 2026

This policy explains how Fortnight AI Ltd ("we", "us") collects and processes your personal data when you use the Assertr mobile application (the "App"). It is written for UK GDPR and UK Data Protection Act 2018 compliance and also applies to users in the EEA under the EU GDPR.

We are the data controller for personal data processed through the App. Registered office: 45 Woodland Close, Southampton SO18 5RD, United Kingdom. Company number 17085717. Contact: privacy@assertr.app.

This page is the authoritative version of the App's privacy policy. If any other description of how the App handles your data, including text shown inside the App, differs from this page, this page applies.

1. What data we collect

  • Account data. Your email address, the name you enter when you sign up (or that Google or Apple share with us if you sign in with them), your account identifier, and authentication tokens. You can sign in with email and password, Google Sign-In, or, on iOS, Sign in with Apple.
  • Optional profile. Personal and work details you choose to add to your profile, including gender, relationship status and partner type. See section 2.
  • Session set-up. What you enter to configure a practice session: the scenario, your goal, your arguments and concerns, a description of the situation, and the name, role and personality of the person you are practising with. This can describe a real person, for example your manager or your partner.
  • Voice and transcripts. During a practice session your voice is streamed to ElevenLabs, which runs the AI counterpart. ElevenLabs keeps an audio recording and a transcript of each conversation for up to 730 days (section 6). We store the transcript with your account.
  • Feedback and results. Scores, key moments and AI feedback for each session, and voice analysis results if you turn voice analysis on.
  • Progress and activity. Session history, XP, level, badges, streaks, weekly challenges, training recommendations based on your history, notification preferences, in-app notifications, and a record of the consents you give in the App.
  • Feedback you send us. If you send feedback from the App, we store your message with your account email address, the app version and your platform.
  • Subscription and purchase data. Only if you buy a subscription; the free plan works without a purchase. Your subscription status and transaction details (product, price, currency, transaction ID and store) from RevenueCat, Google Play or the App Store. We do not see your card details.
  • Push notification data. The push token and device installation identifiers used to deliver notifications, linked to your account identifier, together with your language, whether you have a paid plan, your platform, and the app version and build number. The OneSignal SDK also collects automatically your device model, operating system, mobile network operator, time zone, the country inferred from your IP address, and when you open the App (see OneSignal in section 4).
  • Anonymous usage analytics. Events recorded when the App is installed, updated, opened or moved to the background, with a random identifier that is not linked to your account (see PostHog in section 4).
  • Device and diagnostic data. Device manufacturer and model, operating system and version, app version and build, language, time zone, mobile network operator, screen size, and whether the App runs on an emulator, sent with the analytics events above. Your device model, operating system, mobile network operator and time zone are also sent to OneSignal for push notifications. When a voice session starts, your device model and operating system version are also sent to ElevenLabs' real-time voice connection.
  • Error and crash reports. Diagnostic data about crashes and errors in the App and in our server functions, sent to Sentry (section 4). A report from the App contains only an event identifier and the time, the severity (error or fatal), the environment, the app version and build number, the type of error, a fixed error message without details, and up to 40 stack frames from the App's own code showing where the error happened (file name, function and line number). A report from our server functions contains only the function name, the type of error, the HTTP status code, the time and the server version. Error reports do not include your name, email address, account identifier or any other identifier of you, the content of your conversations, transcripts, audio, session set-up, request or response content, or screenshots.
  • Usage records. Which App features (server functions) your account used and when. We use these records to enforce usage limits and prevent abuse.

The App does not ask for access to your device's location. Our providers receive your device's IP address when the App connects to them, as with any internet service. OneSignal uses your IP address to work out your approximate country, and we have not asked OneSignal to stop storing IP addresses. Our PostHog project is configured to discard IP addresses, and its location lookup from IP addresses (GeoIP) is turned off. Our Sentry projects are configured not to store IP addresses.

We do not ask you for health information, political opinions, religious beliefs or similar special category data. Some optional profile fields can indirectly reveal your sexual orientation (see section 2). If you mention special category information in a session, it becomes part of that session's content and transcript and is processed with it.

2. Your optional profile

The profile (Profile in the App's side menu) is optional. You can use Assertr without filling it in, and you can fill in only the fields you want. It can contain:

  • Basic details: name, gender (female, male or other) and age range.
  • Work: industry, position, company type, years of experience, last pay rise, management level, number of direct reports, and whether you work remotely, hybrid or in an office.
  • Relationship and family: relationship status, how long you have been in the relationship, whether you live together, partner type (wife, husband, girlfriend or boyfriend), and whether you have children and how many.
  • Communication and preferences: preferred communication style, how you approach conflict, favourite scenarios, default difficulty, and whether to skip the step where you describe the person you are practising with.

Taken together, your gender, relationship status and partner type can indirectly reveal your sexual orientation, which is special category data under UK and EU GDPR. Only fill in these fields if you are comfortable doing so.

Your profile is stored with your account so you can view and edit it in the App. The App does not currently send profile fields to our AI providers.

You can change your profile at any time in the App. Some choice fields cannot be reset to empty in the App once set; to have any profile field removed without deleting your account, email privacy@assertr.app from any address. Tell us which sign-in method your account uses and the email address associated with your account (for Sign in with Apple with Hide My Email, your private relay address). We send a one-time confirmation code or link to the email address associated with your account. If you use Sign in with Apple with Hide My Email, this is your Apple relay address, which forwards the message to you. We act on the request only after you confirm it. We do not collect identity documents. If your request is not confirmed within 30 days, we close it and let you know. Deleting your account removes your profile.

3. How we use your data and lawful basis

  • Deliver the Service (create and secure your account, run practice conversations, produce transcripts, scores and feedback, keep your history and progress, send the notifications you have enabled, and manage your subscription), performance of our contract with you (UK GDPR Art. 6(1)(b)). Before your first practice session, the App explains how our AI providers process your voice and session content and asks you to agree; practice sessions cannot start without that agreement.
  • Voice analysis, which is optional: only with your consent (UK GDPR Art. 6(1)(a)), which you give by turning voice analysis on. You can turn it off at any time in Settings → Preferences → Voice Analysis; this will not affect analysis already carried out.
  • Keep the Service secure, stable, and abuse-free (usage limits, abuse prevention, diagnostics, and error and crash reports to find and fix crashes and errors), legitimate interests (UK GDPR Art. 6(1)(f)).
  • Understand how the App is used (anonymous usage analytics in PostHog and subscription reporting in RevenueCat), legitimate interests (UK GDPR Art. 6(1)(f)).
  • Service communications by email (changes to this policy and important information about your account or the Service), contractual necessity or legitimate interests.
  • Comply with legal obligations (tax, accounting, lawful requests), legal obligation (UK GDPR Art. 6(1)(c)).

4. Service providers we share data with

We do not sell your personal data. We share it only with the service providers below, which process it to provide the App on our behalf and act on our instructions under data processing agreements.

  • Supabase: our database, sign-in and server functions. Supabase stores your account and the data kept with it (section 1).
  • ElevenLabs: runs the real-time voice conversation with the AI counterpart. It receives your voice while you speak, your session set-up and, when you continue a scenario, a summary of your earlier sessions in it, which can include excerpts of their transcripts. ElevenLabs keeps an audio recording and a transcript of each conversation for up to 730 days (section 6); we retrieve the transcript after the session, and the audio if you use voice analysis. ElevenLabs carries the real-time audio over LiveKit, which also receives your device model and operating system version, and uses a large language model from another provider, Anthropic (Claude), to generate the counterpart's replies, so Anthropic processes the conversation content as ElevenLabs' sub-processor. ElevenLabs processes this data to provide the conversation service to us. Since 4 October 2026, the setting that lets ElevenLabs use our workspace's data to improve its models has been turned off.
  • Deepgram: only if you turn on voice analysis, which needs your separate consent. After a session we send the audio recording of that conversation to Deepgram to analyse speech tempo, pauses and emotional tone, and we store the results with your account. We send these requests with Deepgram's Model Improvement Program opt-out turned on, so Deepgram does not use the audio to train or improve its models.
  • OpenAI: scores each conversation and writes your feedback after the session. It receives the transcript and your session set-up. We do not include your name or email address in these requests (although the transcript contains whatever was said in the session); we include a pseudonymous identifier derived from your account ID, which OpenAI uses to detect abuse. We send these requests with OpenAI's response storage turned off.
  • OneSignal, with Google's Firebase Cloud Messaging: push notifications. They receive your account identifier, push token and device installation identifiers, your language, whether you have a paid plan, your platform, the app version and build number, and the text of the notifications we send you. The OneSignal SDK in the App also collects automatically your device model, operating system, mobile network operator, time zone, the country inferred from your IP address, and when you open the App. OneSignal stores this data for the App in the EU.
  • RevenueCat, with Google Play Billing and the App Store: subscriptions and purchases. RevenueCat receives your account identifier and your purchases, and sends us subscription events (product, price, currency, transaction ID and store), which we store. Google or Apple processes your payment; we never see your card details.
  • PostHog, hosted in the EU: anonymous usage analytics. PostHog receives the App events listed in section 1 (App installed, updated, opened or moved to the background) with a random identifier and the device and app details listed there. We do not identify you to PostHog, so these events are not linked to your account. Our PostHog project is configured to discard IP addresses, and its separate location lookup from IP addresses (GeoIP) is turned off, so the events do not include your location.
  • Sentry (Functional Software, Inc.), with data stored in the EU: error and crash reporting. Sentry receives the error and crash reports described in section 1, which contain no conversation content and no personal details such as your name, email address or account identifier. We use them only to detect and fix crashes and errors in the App and our server functions. Error reports are not linked to your identity or your account, and we do not use them for advertising or user profiling.
  • Google (Google Sign-In) and Apple (Sign in with Apple): if you choose to sign in with them, they confirm your identity to us and share your name and email address.

5. International transfers

Some processors are located outside the UK/EEA, primarily in the United States. Where that is the case, transfers are protected by the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or adequacy arrangements such as the UK-US Data Bridge, together with technical safeguards including encryption in transit and at rest. PostHog stores our analytics data in the EU, and Sentry stores our error and crash reports in the EU.

6. Retention

  • Data stored with your account (account, profile, session set-up, transcripts, feedback, voice analysis results, progress, consents, notifications, usage records and subscription events) is kept while your account exists. We do not delete it on a schedule. It is deleted when you delete your account, or earlier if you ask us to delete specific data (section 7).
  • Conversation recordings and transcripts at ElevenLabs are kept for up to 730 days, after which the audio and the transcript are deleted. Deleting your account does not automatically delete them sooner; you can ask us to request their deletion (section 7).
  • Data held by Deepgram, OneSignal, RevenueCat and PostHog is kept according to each provider's retention rules and our settings with them, and is not automatically deleted when you delete your account. PostHog events are anonymous and not linked to your account.
  • Error and crash reports in Sentry are kept according to our Sentry organisation's settings and for no longer than 90 days. They are not linked to your account, and deleting your account does not delete them sooner.
  • Requests we send to OpenAI (transcript and session set-up) may be kept in OpenAI's abuse monitoring logs for up to 30 days, even though we send them with response storage turned off, and are not automatically deleted when you delete your account.
  • Conversation content processed by Anthropic as ElevenLabs' sub-processor may be kept by Anthropic according to its own retention rules, and is not automatically deleted when you delete your account.
  • Backups and platform logs of our hosting provider may still contain your data for a period after deletion, according to the provider's backup and logging settings.
  • Store purchase records are kept by Google or Apple under their own policies.

7. Your rights

Under UK and EU GDPR you have the right to access, rectify, erase, restrict, or object to processing of your personal data, the right to data portability, and the right to withdraw consent. To exercise these rights:

  • Turn voice analysis on or off in the App (Settings → Preferences → Voice Analysis).
  • Edit your profile in the App (Profile in the side menu).
  • Delete your account in the App (Settings → Danger zone → Delete Account). Our Delete your account page explains what is deleted and what is not.
  • Email privacy@assertr.app for anything else, for example to get a copy of your data, to delete specific data without deleting your account (such as profile fields, practice sessions, or copies held by our providers), or to withdraw your agreement to AI processing of practice sessions, which has no separate switch in the App. You can write from any address. Tell us which sign-in method your account uses and the email address associated with your account (for Sign in with Apple with Hide My Email, your private relay address). We send a one-time confirmation code or link to the email address associated with your account. If you use Sign in with Apple with Hide My Email, this is your Apple relay address, which forwards the message to you. We act on the request only after you confirm it. We do not collect identity documents. If your request is not confirmed within 30 days, we close it and let you know. We will respond within one month.
  • Lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local EEA supervisory authority.

8. Children

The App is not directed at children under 16. If we learn that a child under 16 has created an account, we will delete the account and associated data.

9. Security

We use encryption in transit and at rest, least-privilege access controls, logging, and regular patching. No system is perfectly secure; please report suspected vulnerabilities to security@assertr.app.

10. Changes to this policy

We will update the "Last updated" date and, for material changes, notify you in-app or by email at least 14 days before they take effect.

11. Contact

Fortnight AI Ltd is the data controller. Privacy questions and data-rights requests: privacy@assertr.app.