New: OET Live now works in your browser, on any computer or phone. Open the web app →

OET Live
Legal

Privacy Policy

Effective date: 2026-10-12

1. Overview

OET Live (“we”, “us”, “the app”) is an AI-assisted Occupational English Test (OET) Speaking practice tool built for migrating healthcare professionals. This policy describes what we collect, how we use it, who we share it with, and the controls you have over your data.

OET Live is not affiliated with, endorsed by, or sponsored by Cambridge Boxhill Language Assessment or any official OET body. The OET name and rubric are referenced for educational comparison only. Scores produced by the app are an AI-generated estimate intended to support practice; they are not official OET scores. See our Terms of Service for the full disclaimer.

Operator: OET Live. Contact: support@oetlive.com.

2. What data we collect

2.1 Account data

  • Sign-in identity. When you sign in with Google, Apple, or Microsoft via OAuth, we receive your name, email address, and OAuth provider user id. We do not request access to your Gmail, Drive, Calendar, contacts, or any other Google scope beyond openid email profile.
  • Email/password sign-up. If you sign up directly we store your email and a hashed password (Better Auth, Argon2id).
  • Email verification token. A short-lived token to confirm you own the email address.

2.2 Profile preferences

  • OET profession track (e.g. Medicine, Nursing, Pharmacy, …)
  • Target country and recognising organisation (e.g. AHPRA, NMC, NCSBN)
  • Target exam date, target score, practice cadence
  • Reminder time, study-reminder + countdown notification preferences
  • Avatar choice and the optional photo you upload to your profile
  • Calibration consent (whether you allow your audio to inform model accuracy)

2.3 Practice data

  • Stereo audio recordings of your role-play sessions. One channel captures your voice from the device microphone; the second channel captures the AI patient's responses. We store the combined stereo file so you can replay the session inside the Feedback screen.
  • Transcripts generated from those recordings by an automated speech-to-text service.
  • Scores from automated assessment (the 9 OET communication criteria, overall 0–500 score, OET band) and per-task cue verdicts.
  • Pronunciation reports including per-word pronunciation scores and speech-rate metrics.

2.4 Subscription & in-app purchase data

  • Apple In-App Purchase receipts for your subscription, including product id, transaction id, and renewal/expiry timestamps. We do not receive your Apple ID payment information.
  • Web purchases (Stripe). When you subscribe or buy an Exam Sprint pack in the web app, payment is taken on a page hosted by Stripe. We receive and store the Stripe customer id, subscription or payment id, the plan, its status, and renewal/expiry timestamps. We never receive or store your card number or other payment details.
  • Current tier, usage credits, and renewal status to enforce subscription gating.

2.5 Product analytics & crash diagnostics

  • Product analytics (iOS app and web app). We use PostHog to record in-app events (e.g. “session started”, “feedback opened”) so we can understand which features are used and where users get stuck. These events are linked to your account: they carry your account id, email address, name, profession, and sign-in method. They do not include practice audio or transcripts. When you buy a subscription or an Exam Sprint pack on the web, or a web subscription renews or ends, our server also sends a purchase, subscription-renewed or subscription-ended event, linked to your account id and naming the plan, but with no amount and no card data. PostHog traffic is routed through a first-party subdomain (posthog.oetlive.com) to PostHog's US cloud, so it is not blocked by content blockers. We do not record your screen or sessions. In the web app, the page address sent with an event is reduced to the page type (for example “/app/sessions/[id]” rather than a real session id), with no query string other than campaign (utm_) tags, and we do not collect the text on the pages you view.
  • Web analytics. The oetlive.com marketing website uses Google Analytics 4 and Cloudflare Web Analytics. The web app uses Google Analytics 4 too: it receives page views (the page template, not session ids), a few key events (sign-up, login, session started, checkout started, purchase), and your account id. It does not receive your email address or name. See “Opting out” in Section 6.
  • Crash diagnostics. Approximate device type and OS, plus crash stack traces when the app unexpectedly quits. Crash payloads are inspected only for bug triage and contain no practice content.

2.6 Fraud prevention (web)

To stop the same free mock exam being claimed repeatedly across different accounts, the anti-abuse check we run when you take your first free exam on the web app looks at: the network prefix of your IP address (the first 24 bits for IPv4, the first 48 bits for IPv6 — this is the only part of your IP the check itself uses as a matching key), a random device id we store in your browser (in localStorage and a first-party oet_did cookie), and a hash of your browser's characteristics (via the open-source FingerprintJS library). Sign-up itself does not use this device id or fingerprint check — it is protected separately, by a Cloudflare Turnstile bot check (web only, see below) and by rate limiting. We never store or log the raw device id or browser fingerprint — only a keyed HMAC-SHA256 hash of each (the first 12 characters of that hash may appear in our operational logs when we review grant decisions, never the full hash or the raw value), and only on the session that claims the free exam and on the audit record of an attempt we reject or would have rejected. On iOS, where this check does not yet block a request, an audit record is still written for an attempt it would have rejected, containing your network prefix only — iOS does not send a device id or browser fingerprint. Those two hashes (device id, browser fingerprint) are set back to null 90 days after they are recorded (see Section 5).

The session created by that same first-free-exam request separately stores your full IP address as part of its session record, along with your browser/app User-Agent and a city + country derived from that IP — this is not specific to the free-exam check, every practice and Writing session stores it, and it is not covered by the 90-day clearing above. See “Session records” in Section 2.7 for what is stored, why, and how long. This is also separate from the 30-day server access logs further down in Section 2.7, which are a different system (nginx/application request logs) used for general operational logging, not fraud prevention.

The free-exam anti-abuse data above (network prefix, device id, browser fingerprint) is used only to detect the free allowance being claimed repeatedly across accounts — never for cross-site tracking, advertising, or any purpose beyond fraud prevention, and never shared with anyone outside the processors listed in Section 4. Our legal basis for this processing is our legitimate interest in preventing abuse of the free tier.

Before web sign-up and before your first free web exam, we also run a bot check through Cloudflare Turnstile — see Section 4 for what that sends Cloudflare. The iOS app does not use Turnstile, a device id, or a browser fingerprint; iOS requests are checked by network prefix only.

2.7 Technical data

  • Authenticated session cookies and tokens
  • Session records. Every practice session and Writing session stores your full IP address (from the request's X-Real-IP), the IPv4 /24 or IPv6 /48 network prefix derived from it, your browser/app User-Agent string verbatim, and a city and country derived from that IP via a GeoLite2 lookup. Purpose: security, abuse investigation, and support (for example, diagnosing a reported session problem or investigating suspected fraud). These fields are visible to OET Live admin staff. Retention: for the lifetime of the account, on the session record itself — deleting your account in-app (Section 5) revokes sign-in and obfuscates your name and email, but does not remove or anonymize these fields on existing session rows; they are removed only via a full-erasure request (Section 5).
  • Server access logs (IP address, timestamp, request URL) retained for 30 days

We do not collect: precise GPS location, browsing history, contacts, social-graph data, or any health-record data outside what you record during a practice session.

3. How we use the data

  • Run the practice service: generate AI patient responses, score role-plays, surface feedback, recommend next cases.
  • Send transactional emails (sign-in verification, password reset, support replies). We do not send marketing emails without an explicit opt-in.
  • Compute your personal “weak area” profile to target the recommender at your bottom-2 criteria.
  • Check for the same free mock exam being claimed repeatedly across accounts on the web app, using the IP network prefix, device id, and browser-fingerprint hash described in Section 2.6. Legal basis: our legitimate interest in preventing abuse of the free tier.
  • Understand which features are used and where users get stuck, through the account-linked product analytics described in Section 2.5.
  • Debug crashes and operational issues. Server logs are scoped to minimum-needed fields.
  • Aggregate, fully de-identified usage counts (e.g. “how many sessions did users complete this week”) to help us improve the product.

We do not: sell your data, share it with advertising networks, or use OAuth-provided Google data for any purpose beyond authenticating you into the app.

4. Third-party services

To run the service we send certain data to the following processors:

  • Cloud-hosted AI inference provider. Receives your practice audio (for transcription) and transcript text (for scoring and AI patient response). Stored according to the provider's data processing terms; not used to train general-purpose models when called under our enterprise configuration.
  • Cloud-hosted pronunciation assessment service. Receives a compressed copy of your practice audio for syllable-level pronunciation scoring. Stored according to the provider's data processing terms; not used for model training.
  • Encrypted object storage provider (EU region). Stores your encrypted audio files so you can replay them in the Feedback screen.
  • Transactional email service (our self-hosted mail server). Sends verification, password reset, and support emails.
  • Authentication service (self-hosted on our servers). Handles authentication tokens, sessions, and password hashing on the same infrastructure as the rest of the service.
  • PostHog (product analytics, US). Receives in-app event data from the iOS app and the web app, linked to your account (account id, email, name, profession, sign-in method), plus purchase, subscription-renewed and subscription-ended events from our server for web purchases (account id and plan, no amount or card data), so we can understand feature usage. Traffic is routed through our own first-party subdomain (posthog.oetlive.com). PostHog does not receive practice audio, transcripts, or scores, and we do not use session recording.
  • Apple In-App Purchase. Apple processes subscription and one-time purchase payments and sends us signed transaction events. Apple does not share your payment details with us. If you request a refund for a purchase through Apple, Apple may ask us to share information about your use of the purchased content (for example, how many minutes of a practice-minute pack you have used) to help Apple review your refund request. By making a purchase you consent to OET Live sharing this consumption information with Apple for that purpose. You can withdraw your consent at any time by emailing info@oetlive.com; if you withdraw, we will stop sharing this information, which may affect Apple's review of your refund.
  • Stripe (payments, web app only). Stripe processes subscription and one-time purchase payments made in the web app, on its own hosted checkout and billing pages. Stripe receives your email address, your account id, the plan you chose, and the payment details and billing address you enter on its pages, and it collects your IP address and device information to prevent fraud. Stripe sends us signed events about your purchase and subscription; it does not share your card details with us. Refunds for web purchases are handled by us through Stripe.
  • Cloud crash diagnostics provider. Receives anonymous crash stack traces and device-class metadata when the iOS app unexpectedly quits. Does not receive practice content.
  • Google Analytics 4 (oetlive.com website and web app) and Cloudflare Web Analytics (website). Used to understand which marketing pages convert and how the web app is used. On the website they receive page visits and conversion events. In the web app, Google Analytics 4 also receives page views, a few key events, and your account id, but not your email address or name. The iOS app does not send data to either service.
  • Cloudflare Turnstile (bot check, web app only). Runs before web sign-up and before your first free web exam. To verify the challenge, we send Cloudflare the Turnstile token and your IP address (the same address described in Section 2.7's session records). The Turnstile widget running in your browser also collects its own browser and device signals as part of Cloudflare's bot-detection process, under Cloudflare's own privacy policy — separate from, and not shared with, the device-id and browser-fingerprint hashes described in Section 2.6, which we generate ourselves and never send to Cloudflare. See the Cloudflare Privacy Policy.

We do not use Facebook Pixel, advertising SDKs, ad-attribution SDKs, or any analytics service on the iOS app beyond PostHog and our crash diagnostics provider. The web app's fraud-prevention browser fingerprint (Section 2.6) is the only fingerprinting we do anywhere in the product — it never leaves fraud prevention, is never used for tracking or analytics, and is never used on iOS.

5. Data retention

  • Account profile: retained while your account is active.
  • Practice recordings, transcripts, scores: retained while your account is active so you can replay sessions and track progress.
  • Server access logs: 30 days, then auto-rotated.
  • Web fraud-prevention hashes: the device-id and browser-fingerprint hashes described in Section 2.6 are set to null 90 days after they are recorded, by an automated hourly job. This 90-day clearing does not apply to the IP network prefix, which is part of the session record below.
  • Session records (IP address, network prefix, User-Agent, city/country): described in Section 2.7, these are retained for the lifetime of the account. Deleting your account in-app does not remove or anonymize them on existing sessions; only a full-erasure request (below) does.
  • Account deletion (in-app): when you delete your account from Profile → Privacy → Delete account, we immediately close the account: you are signed out, the account becomes unusable, your email address is obfuscated so it cannot be used to sign back in or recover the prior account, and all active sessions are revoked. Re-registering with the same email address creates a fresh, independent account with no access to prior recordings, transcripts, scores, or profile data.
  • Practice recordings retained after in-app deletion: the raw audio, transcripts, and anonymized score records may be retained on our servers solely to improve scoring accuracy for future users. These records are detached from your identity (your name, email, profile, and any unsent reminders are scrubbed within 24 hours) and cannot be re-associated with you. If you require full erasure of this anonymized practice data (e.g. under GDPR / UK-GDPR / PIPEDA), see Section 6.
  • Full erasure on request: email support@oetlive.com with subject “Erasure request” and we will hard-delete all practice content (including anonymized audio and transcripts) within 30 days.
  • Billing & fraud-prevention records required by law may be retained even after deletion.

6. Your rights and controls

  • Export. Profile → Privacy → Export my data downloads a complete JSON archive of your profile, sessions, scores, and transcripts, plus 24-hour signed URLs for your audio recordings.
  • Delete. Profile → Privacy → Delete account. The account is closed immediately, you are signed out, and the email is obfuscated so the account cannot be recovered or re-used to access prior data. See Section 5 for what is retained anonymized and how to request full erasure.
  • Email verification + password reset are available from the sign-in screen.
  • Opting out of usage analytics. In the web app, open More → Privacy and turn off Share usage analytics. This stops PostHog and Google Analytics in the web app and also stops Google Analytics on the oetlive.com website, but only in the browser where you set it (the choice is stored in that browser, so clear-site-data or a different browser or device starts from the default). The iOS app has no in-app switch for its product analytics today. The switch does not affect the purchase and subscription events our server records when you pay on the web.
  • Calibration opt-out. Profile → Privacy →Help improve scoring toggles whether your audio is included in our internal scoring-accuracy review process. Default: opt-in.
  • EU/UK/CA users. You also have the GDPR/UK-GDPR/PIPEDA rights to access, rectify, port, restrict, object, and complain to a supervisory authority. Email support@oetlive.com with “Privacy request” in the subject line.

7. Children

OET Live is intended for adults preparing for the OET. We do not knowingly collect data from anyone under 16. If you believe a minor has signed up, email us and we will erase the account.

8. Security

  • TLS 1.3 in transit; server-managed encryption at rest.
  • Audio is stored in Cloudflare R2 with server-side AES-256 encryption.
  • Passwords are hashed with Argon2id; we cannot see them in plaintext.
  • OAuth tokens are stored in iOS Secure Enclave (Keychain) on your device.
  • Access to production systems is restricted to operators with hardware security keys.

No system is perfectly secure. If you discover a vulnerability please email security@oetlive.com.

9. International transfers

Our infrastructure is hosted primarily in Germany. Some processors operate in the United States and other regions. Where required by law, transfers are covered by the EU Standard Contractual Clauses or equivalent safeguards.

10. Changes to this policy

We'll post the updated text here and update the effective date. Material changes (new categories of data collected, new processors, new purposes) will be announced by in-app notification and, where required, by email.

11. Contact

Questions, complaints, or data subject requests: support@oetlive.com. We respond within one business day.