Privacy Policy

Last Updated: August 7, 2026

Overview

SmallPanta ("we", "our", "us") built CitiZen to help people prepare for the United States naturalization test. This policy explains what the app collects and what it does not. We do not ask for your name, your email, your address, or any immigration case number, and we never will.

1. Information We Collect

Stored on your device only, never sent to us:

• Quiz scores, progress, and study streak
• Language and study-track preferences
• Your interview date, if you choose to set one
• Which items you have ticked on the interview checklist

Sent to our backend (see sections 2 and 4):

• When an answer needs checking: the question text, its official answer, and what the speech recognizer transcribed. Text only — never audio.
• Anonymous usage and purchase events, the app version, and a random per-install identifier

We do NOT collect your name, email, phone number, address, location, A-number, receipt number, or any data from other apps on your device.

2. Microphone, Speech, and Voice

CitiZen uses your microphone so you can practice answering out loud.

• Your speech is transcribed by Apple's Speech framework. CitiZen asks Apple to do this on your device, and that is what happens whenever your language has an on-device model installed. Some languages do not have one. In that case Apple's framework sends the audio to Apple to transcribe it, under Apple's privacy policy. CitiZen itself never uploads, records, or stores your audio, and your voice is never sent to our backend or to any AI company.
• To read questions aloud in a clearer voice, the question and answer TEXT — not your voice — is sent over a secure connection to our backend and to OpenAI's text-to-speech service, which returns audio. If that is unavailable, your device's built-in voice is used instead.
• When your answer does not clearly match the official answer, the TEXT of the question, the official answer, and what the recognizer transcribed may be sent over a secure connection to our backend, which forwards it to OpenAI to judge whether different wording means the same thing and to write short feedback. Only text is sent.
• Most answers are matched on your device or by simple comparison on our backend and are never sent to OpenAI at all.
• We log non-content metadata per request (timestamp, language, and the random per-install identifier) for rate limiting and abuse prevention. We do not log your transcript.
• You can avoid sending anything off-device by tapping answers instead of speaking.

3. In-App Purchases

Purchases are processed entirely by Apple. We never see or store card numbers, billing addresses, or financial data. We receive only your entitlement status so the app can unlock paid features. Subscriptions are managed in your Apple ID settings.

4. Analytics

We collect anonymous usage events to understand which features are used and whether they work. These include which screens are opened, quizzes started and completed, voice usage, purchase events, the app version, and the random per-install identifier.

Analytics never include your name, email, location, or any personally identifying information. They also never include the content of what you study or which checklist items you tick — checklist progress is sent only as a count, never as a list of items, because the items themselves could reveal sensitive facts about you.

This data is not used to track you across other apps or websites, and is not sold to anyone.

5. Data Storage

Your progress, scores, preferences, and checklist ticks are stored locally on your device. Voice requests pass through our backend on Supabase, which logs only the non-content metadata described in section 2. Anonymous analytics events are stored on that same backend.

6. Data Retention and Deletion

Analytics events are retained for up to 24 months and are then deleted. Voice request metadata is retained only as long as needed for rate limiting and abuse prevention. We do not retain your audio or transcripts.

You can delete the anonymous data associated with your device at any time: open Settings in the app and choose "Delete My Data". This asks our backend to delete the analytics events for your device's random identifier, and then generates a new random identifier, so future events cannot be connected to earlier ones.

Please note: deleting the app removes the data stored on your device, but the random per-install identifier is kept in the iOS Keychain and survives app deletion and reinstallation, by design, so that rate limiting keeps working. Using "Delete My Data" is what resets it.

7. Third-Party Service Providers

• Supabase — backend and edge-function hosting. Receives text and metadata in transit; stores analytics events and request metadata.
• OpenAI — does two separate jobs. (1) Judges whether a spoken answer means the same as the official answer and writes short feedback: it receives the question text, its official answer, and your transcribed answer. (2) Turns question and answer text into the spoken voice you hear: it receives that text only. In neither case does it receive audio, and it never receives your voice.

Both are bound by their own privacy and data-processing terms, which require protection of your data equal to what this policy states.

8. Children's Privacy

CitiZen is not directed at children under 13 and we do not knowingly collect information from them. The app is designed for adults preparing for the U.S. naturalization test.

9. Advertising and Tracking

CitiZen contains no advertising and no third-party advertising or tracking SDKs. We do not share data with advertisers and we do not track you across other companies' apps or websites.

10. Your Choices

• Delete your anonymous backend data at any time with Settings → Delete My Data
• Deny microphone permission to disable all voice features
• Use the Mock Interview by tapping answers instead of speaking, if you prefer not to send audio
• Delete the app to remove all data stored on your device (see section 6 about the identifier)
• Manage subscriptions in your Apple ID settings

11. Changes to This Policy

We may update this policy. Changes are reflected in the "Last Updated" date above. Continued use after a change constitutes acceptance.

12. Contact Us

Questions about this policy: support@citizenapp.us