← TC Fusion

Papote Privacy Policy

Effective date: August 27, 2026 · Last updated: August 29, 2026

This Privacy Policy explains how TC Fusion LLC ("TC Fusion," "we," "us," or "our") handles personal data when you use the Papote mobile application and related services (together, the "Service"). It also describes your rights under the EU and UK General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act ("CCPA/CPRA"), and other applicable laws.

1. Who we are

Papote is published by TC Fusion LLC, a limited liability company registered in the United States. For privacy questions, contact privacy@tcfusion.dev. TC Fusion is the data controller for the processing described here.

2. What we collect

Papote is designed to need as little about you as possible. We do not ask for a name, email address, phone number, or social login, and there is no account to create.

We do not collect your contacts, photos, precise location, microphone or camera input, or health data. We collect your device advertising identifier only if you allow tracking when we ask, and you can change that answer later. Meta's SDK, which measures our ads, is the one advertising-related SDK in Papote, and we never show ads inside the app.

3. What stays on your device

Everything that makes Papote yours, meaning the words you saved, when they're next due, how many clips you've watched, your streak, lives in a local database on your phone. We designed it this way deliberately: there is no profile of your learning on our servers to leak, subpoena, or sell.

The trade-off is that we hold no copy to give back to you. If you delete the app, reset it, or switch phones without a backup, your saved words and progress are gone. Section 4 covers the two ways to keep a copy. Your subscription itself is not affected, as Section 6 explains.

4. Optional iCloud backup

Papote can keep a backup of your learning data, and it is off until you switch it on in Settings. When it is on, the app writes a single file into its own iCloud container on your Apple ID. That container is yours: the file appears in the Files app under the Papote folder, and you can copy, move, or delete it. We never receive the file, we hold no key to it, and we cannot read it or delete it for you. Apple's handling of iCloud is governed by Apple's Privacy Policy.

The same data is also available on demand as a manual export you can save or send wherever you like. It is the same file format as the iCloud backup, so a file pulled out of iCloud Drive can be pasted back into the app by hand, and an export made by hand can be restored the same way.

Automatic backup is available on iOS only. On Android there is no automatic cloud backup, and the manual export is how you move your data to a new phone. Turning the backup off stops future backups; it does not delete the file already in your iCloud container, because that file is yours and only you can reach it.

5. YouTube and embedded video

Papote does not host, download, or re-upload video. Every clip plays inside the official YouTube player, embedded in the app, and each clip credits and links back to the channel that made it.

Transcripts, translations, and word glosses shown alongside a clip are produced by us in advance, stored in our catalog, and served identically to everyone at that level. They are not generated from anything about you.

6. Subscriptions and payments

Papote is a paid app: after the introduction, access requires a subscription. Purchases are handled entirely by Apple or Google. We never see or receive your card number, billing address, or app-store account credentials.

We use RevenueCat to check whether a purchase is valid and still active. RevenueCat identifies your purchase with a random, app-generated identifier, not your name or email. This is what lets "Restore purchases" work if you reinstall the app or get a new phone, even though Papote has no accounts.

7. Analytics, crash reports, the off switch, and ad measurement

We use PostHog (hosted in the European Union) to understand how the app is used in aggregate: which screens people reach, where onboarding loses people, whether a feature is working. Events are keyed to a random identifier generated on your device. We do not combine this with any identity, and we do not use it for advertising or cross-app tracking.

PostHog can also reconstruct a session as a redacted screen recording, so we can see where the app confuses people: which screens were visited and where taps landed. Redaction happens on your device before anything is sent. Every piece of text, every image and every video is replaced with a blank rectangle, so a replay never contains a caption, a video frame, a word you saved, or anything you typed. Replays are keyed to the same random identifier, kept for 30 days, and the analytics switch in Settings turns them off along with everything else in this section.

We use Sentry to receive crash and error reports so we can fix bugs. Reports contain technical diagnostics, not your saved words or learning history.

Settings has one switch that covers both. Turn analytics off and the app stops sending PostHog events and Sentry reports on your device, for as long as it stays off. Nothing about the app is withheld or degraded if you do.

How we measure our ads

We run ads for Papote on Facebook and Instagram. To see which of those ads bring people who go on to try the app or subscribe, we send Meta a short list of events. Meta's SDK inside the app reports installs and app opens. RevenueCat sends trial starts, subscription starts, and renewals from its own servers through Meta's Conversions API, with the amount and currency of the purchase.

Those events carry an anonymous identifier that Meta's SDK creates on your device, your device and app details (model, OS version, app version, language, IP address), and your advertising identifier if you allowed tracking. Your name, email, phone number, saved words, watch history and learning progress are never part of it. We do this so we spend less on ads that don't work. Meta may also use these events for its own purposes under the Meta Privacy Policy, and you can review or disconnect what apps send it under Activity off Meta technologies.

On iOS we explain what we are asking for in our own words, and then Apple's App Tracking Transparency prompt appears. Say no and we do not share your advertising identifier, and Meta is told that tracking is not permitted, which limits what Meta may do with the events. You can change your answer any time in Settings > Privacy & Security > Tracking. On Android, Settings > Google > Ads lets you reset or delete your advertising ID.

The same analytics switch in Settings turns off Meta's event logging and advertising identifier collection on your device. Meta's SDK still starts with the app, so a launch may register once as an anonymous app open. The subscription events RevenueCat sends from its own servers carry on while you have a subscription, without your advertising identifier.

8. Legal bases (GDPR)

9. Sub-processors

These providers process limited data on our behalf:

Apple iCloud is not on this list on purpose. When you turn the optional backup on, the file goes into your own iCloud account under your agreement with Apple, and we are not a party to it.

10. Retention

• On-device learning data: kept until you delete or reset the app. We have no copy.
• iCloud backup, if you turned it on: kept in your iCloud container until you delete it. We cannot delete it, because we cannot see it.
• Analytics events: retained in pseudonymous form for up to 12 months, then deleted or aggregated.
• Crash reports: retained up to 90 days.
• Subscription records: kept for the life of the subscription plus the period required for tax, accounting, and dispute-resolution purposes.
• Ad measurement events: Meta keeps what it receives under its own policy. Our copies sit with the subscription records above and follow the same schedule.
• Server logs: typically 30 days.
• Support email: kept while the issue is open and for a reasonable period afterwards.

11. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent. California residents have rights to know, delete, correct, and to opt out of "sale" or "sharing." We do not sell personal information. Sending Meta the pseudonymous ad measurement events described in Section 7 may count as "sharing" for cross-context behavioral advertising under the CCPA and CPRA, so you can opt out: decline tracking on iOS, turn the analytics switch off in Settings, or write to privacy@tcfusion.dev.

Because Papote has no accounts, most of your data isn't identifiable to you by us. The fastest way to exercise deletion of your learning data is to delete the app, and to delete the backup file in the Files app if you turned iCloud backup on. For analytics, crash, or subscription records, write to privacy@tcfusion.dev. To locate the right records we may need the anonymous identifier shown in the app under Settings, or your app-store receipt, or both. We respond within 30 days.

If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

Deleting your data

Your learning data lives on your phone, so deleting the app deletes it. If you turned iCloud backup on, delete the backup file in the Files app too, under the Papote folder. Only you can reach it.

For analytics, crash, subscription and ad measurement records, write to privacy@tcfusion.dev. Include the anonymous identifier shown in the app under Settings, your app-store receipt, or both, so we can find the right records. We delete or anonymise them within 30 days, and we ask RevenueCat and Meta to do the same with the identifiers we hold. Whatever Meta has collected on its own side, you can manage under Activity off Meta technologies.

12. Children

Papote is not directed to children under 13 (or under 16 where local law sets that age), and we do not knowingly collect personal data from them. The app displays third-party video from public YouTube channels. We curate the catalog for language learning, and we still recommend parental judgement for younger teenagers. If you believe a child has provided us personal data, contact us and we will delete it.

13. International transfers

We are based in the United States and some of our providers are too. Where personal data is transferred out of the EEA or UK, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) or another approved transfer mechanism.

14. Security

Data in transit is encrypted with TLS. Access to our systems is limited to people who need it and protected by multi-factor authentication. Keeping your learning data on your device instead of on our servers is itself a deliberate security measure. No system is perfectly secure, and we cannot guarantee absolute security.

15. Changes

If we change this policy materially, we will update the date at the top and, where the change is significant, notify you in the app. Continuing to use the Service after a change means you accept the updated policy.

16. Contact

TC Fusion LLC, privacy@tcfusion.dev
Support: support@tcfusion.dev or trent@tcfusion.dev