Privacy Policy
We are committed to protecting your privacy. This policy explains how we collect, use, and safeguard your information.
Table of Contents
Privacy Policy for Talkey
Talkey ("we," "our," or "us") is committed to protecting your privacy.
This Privacy Policy explains how we process personal data when you use Talkey. Where we rely on your consent, we will request it separately through an appropriate consent screen.
1. Introduction & Contact Information
Data Controller
Entity: Remelith
Registered Address: Matbuat Ave. 12b, Baku, Azerbaijan
Registration Number / VÖEN: 1309694561
Email: privacy@talkey.app
Remelith is a company registered under the laws of the Republic of Azerbaijan. We are committed to protecting your privacy and ensuring transparency about how we handle your personal information.
Representatives & Officers
EU & UK Representation: We periodically assess whether the appointment of an EU or UK representative is required. Where such an appointment is legally required, representative details will be published in this Policy.
Data Protection Officer (DPO): We have not appointed a DPO as our core activities do not consist of processing operations that require systematic monitoring of users on a large scale. All data protection inquiries are managed directly by our privacy team.
Contact Information
Privacy Inquiries
privacy@talkey.app
General Support
support@talkey.app
2. Information We Collect
2.1 Personal Information You Provide
We collect information that you provide directly to us when using the App:
- Account Information: Name (optional), email address (required), profile picture (optional), user tag/username (optional)
- Authentication Credentials: OAuth tokens and user identifier tokens handled securely by our authentication service (we do not collect, process, or store passwords)
- Learning Preferences: Target language, native language, learning pace/streaks, notification configurations
- User-Generated Content: Custom flashcards, vocabulary decks, personalized notes, learning logs
- Communication Data: In-app support logs, attachments, emails sent to support/privacy addresses
2.2 Information Automatically Collected
We automatically collect certain information when you interact with our services:
- Usage Data: App features used, session metrics, learning progress, spaced repetition intervals
- Device Information: Device model type, operating system version, app version, local timezone, and device identifiers (such as IDFV/Vendor ID for iOS)
- Performance & Diagnostics: Crash logs, resource loading durations, API request latency profiles
- Location Data: General location (country/region level derived from your IP address) for localization and regulatory compliance purposes
- Local Caching: App preference cache, deck metadata, and speech assessment results stored locally on your device's sandbox
2.3 Information from Third Parties
We integrate with specific third-party partners to support authentication, content, and transactions:
- Apple Sign In: Contact email address and user name (as configured in your Apple account)
- Google OAuth: Social email address, display name, and profile photo URL
- App Stores & Payment Providers: StoreKit transaction IDs, product IDs, purchase receipts, and subscription state logs (no credit card numbers are shared with us). For website purchases, Paddle (acting as our authorized reseller and Merchant of Record) processes buyer and payment information under its own privacy terms and passes some buyer information to us for fulfillment, fraud prevention, order management, and support.
- Gutendex & PodcastIndex: Book search requests and podcast audio feed selections are routed through public APIs
3. How We Use Your Information
We process your personal data under defined legal bases in accordance with GDPR, UK GDPR, and local regulations. Below is a detailed mapping of our processing activities:
| Processing Activity | Data Category | Lawful Basis (GDPR / UK GDPR) |
|---|---|---|
| Account Creation & Authentication | Email, name, OAuth/account identifiers | Performance of a contract (Art. 6(1)(b)) |
| Syncing Learning Data | Flashcards, custom decks, logs, preferences | Performance of a contract (Art. 6(1)(b)) |
| Subscription Verification | StoreKit transactions, product ID, expiry date, Paddle subscription references | Performance of a contract (Art. 6(1)(b)); Legal obligation (Art. 6(1)(c)) |
| Security & Fraud Prevention | IP address, server logs, device IDs | Legitimate interests (Art. 6(1)(f)) to keep the app secure; Legal obligation (Art. 6(1)(c)) |
| Customer Support | Emails, messages, attachments, diagnostics | Performance of a contract (Art. 6(1)(b)); Legitimate interests (Art. 6(1)(f)) |
| Optional Analytics | Usage statistics, crash details, performance profiles | Consent (Art. 6(1)(a)) where requested by the platform, otherwise Legitimate interests (Art. 6(1)(f)) |
| AI Flashcard Generation | Submitted words, translation prompts, sentence requests | Performance of a contract (Art. 6(1)(b)) with privacy-preserving filters |
| Marketing Communications | Email, name, campaign interaction data | Consent (Art. 6(1)(a)) |
| Compliance & Legal Claims | Account records, payment timestamps, audit logs | Legal obligation (Art. 6(1)(c)); Legitimate interests (Art. 6(1)(f)) |
4. Data Sharing and Disclosure
4.1 Subprocessors & Service Providers
We disclose information to the following specific service providers to enable the functionality of Talkey:
Cloud infrastructure provider (United Kingdom)
- • Purpose: User authentication, database management, backups, server-side functions, and media storage.
- • Data Processed: Active account metadata, email addresses, workspaces, flashcards, profile pictures, audit logs, and session tokens.
- • Processing Location: Hosted in the United Kingdom (London).
- • Safeguards: We have entered into a Data Processing Addendum with our provider, including applicable international-transfer safeguards, and rely on SOC 2 Type II certified infrastructure.
- • Further details: Contact privacy@talkey.app to request subprocessor documentation.
AI inference provider (pre-trained model)
- • Purpose: Generate translations, pronunciations, vocabulary suggestions, and flashcard context using a pre-trained language model.
- • Data Processed: Words, phrases, and sentences intentionally submitted by the user. No account IDs, emails, device tokens, or profile names are transferred.
- • Processing Location: May be processed outside your country of residence by our AI provider.
- • Retention & Training: We do not use your private study decks to train or fine-tune models. Submitted prompts may be retained by our provider under its own policies. Retention periods vary based on processing requirements and legal obligations.
- • Safeguards: Transfers are evaluated under applicable transfer risk metrics. AI features require an explicit user action and are disabled entirely for accounts identified as belonging to users under 18. Users are cautioned never to enter private or sensitive personal information into flashcards.
- • Further details: Contact privacy@talkey.app to request subprocessor documentation.
Paddle (Paddle.com Market Limited)
- • Purpose: Reseller, Merchant of Record, billing agent, and transaction processor for website purchases.
- • Data Processed: Billing address, email, name, subscription tier, and transaction metadata. Paddle processes buyer and payment info under its own privacy policy.
- • Processing Location: UK and global servers.
- • Privacy Policy: https://www.paddle.com/legal/privacy
Apple Inc. (Auth & Payments)
- • Purpose: iOS Sign-In authentication and in-app purchase validation.
- • Data Processed: StoreKit payment transaction tokens, product identifier records, and configuration logs.
- • Privacy Policy: https://www.apple.com/privacy/
Google LLC (Auth)
- • Purpose: Social OAuth login authentication.
- • Data Processed: Authentication tokens, user email address, display name, and profile image URL.
- • Privacy Policy: https://policies.google.com/privacy
4.2 Legal Requirements
We may disclose your information if required to do so by Azerbaijani law, EU/UK regulations, court orders, or requests by competent public authorities, or where we believe in good faith that disclosure is necessary to protect our legal rights, address fraud, or prevent physical harm.
4.3 Business Transfers
In the event of a merger, corporate restructuring, acquisition, or asset sale, your personal data may be transferred to the acquiring entity. We will notify you in advance of any such change in data controller status.
5. Data Security
We use technical and organisational safeguards designed to protect personal data, including encrypted network transmission, access controls, authentication controls, database security rules, logging, backups, dependency management, and restricted administrative access. The safeguards used depend on the nature and sensitivity of the information.
- Encryption in Transit: Data is transmitted using HTTPS with modern TLS configurations.
- Authentication Security: Passwordless authentication (OTP via email, Apple ID, Google Sign-in) reduces risks associated with user-selected passwords, although no authentication method eliminates all account-security risks.
- Access Isolation: We use database access policies, including Row Level Security where applicable, to isolate user data.
- Infrastructure Security: Project data is isolated inside secure databases on our servers in the United Kingdom (London).
5.2 Incident Response & Notification
We maintain an internal incident response plan for detecting, containing, and assessing security breaches. Where required by applicable law, we will notify the competent supervisory authority without undue delay and, where applicable, within 72 hours after becoming aware of a qualifying breach (where likely to result in a risk to rights and freedoms). Where a breach is likely to result in a high risk to affected individuals' rights and freedoms, we will also notify those individuals without undue delay.
6. Data Retention & Deletion
We do not retain personal data longer than necessary for the purposes for which it is processed. We adhere to the following retention schedule:
| Data Category | Retention Period / Rule |
|---|---|
| Active Account Profile | Until account deletion is requested. Deleted immediately from active servers. |
| Learning Content & Progress | Until deleted by the user in-app, or until account deletion. |
| Deleted Database Records | Purged immediately from live production database tables. |
| Storage Buckets & Media Files | Purged immediately from our cloud storage. |
| Database Backups | Overwritten through standard backup rotation within 30 to 90 days. |
| Security & Server Logs | Retained for 180 days, then overwritten. |
| Support Correspondence | Retained for up to 2 years after closure of the request. |
| Subscription Records | Transaction and subscription records are retained for the period required by applicable accounting, tax, fraud-prevention, and legal-obligation rules. |
| AI feature inputs | Subject to our AI provider's retention policies, based on processing requirements and business obligations rather than a fixed universal period. |
| Consent Records | Retained for the duration needed to prove consent validity. |
6.2 Permanent Account Deletion
You can initiate account deletion manually inside the App at any time via Settings → Account → Delete Account or directly through the Talkey website interface.
Account data is removed from active production systems promptly after deletion is initiated. Residual copies may remain in encrypted backups until normal backup rotation completes. Certain transaction, security, fraud-prevention, or legal records may be retained where required or permitted by law.
Note: Active subscriptions must be cancelled separately through Apple or Paddle. Google authentication is unrelated to subscription cancellation.
7. Your Privacy Rights
7.1 GDPR / UK GDPR Rights (EU/EEA & UK Users)
Individuals residing in the EU, EEA, or UK have specific statutory rights under the GDPR and UK GDPR:
- Right to Access: Request a copy of your personal data processed by us.
- Right to Rectification: Request correction of inaccurate or incomplete personal records.
- Right to Erasure (Right to be Forgotten): Request the permanent deletion of your data.
- Right to Restrict: Request a temporary halt to processing under specific circumstances.
- Right to Portability: Obtain a structured, machine-readable export of your personal data.
- Right to Object: Object to processing carried out based on our legitimate interests.
- Right to Withdraw Consent: Withdraw your consent at any time where processing is consent-based.
- Right to Complain: Lodge a complaint with a competent supervisory authority in your country.
7.2 California Rights (CCPA/CPRA)
To the extent the California Consumer Privacy Act (CCPA) as amended by the CPRA applies to Talkey, California residents have the following rights:
- Right to Know & Access: Access categories of data collected, specific sources, and third parties who received it.
- Right to Delete: Request deletion of collected personal information.
- Right to Correct: Request correction of inaccurate personal information.
- Right to Limit Use: We may process account-access credentials and user-provided content that could contain sensitive personal information. We use such information only as reasonably necessary to provide, secure, and support the Service, and not for the purpose of inferring sensitive characteristics.
- Right to Opt-Out: Opt-out of the "sale" or "sharing" of personal data. We do not sell personal information or share personal information for cross-context behavioural advertising, as those terms are defined by the CCPA.
- Right to Non-Discrimination: Receive equal service and pricing when exercising CCPA rights.
We recognize Global Privacy Control (GPC) signals sent by browsers. We do not sell or share data, so no opt-out links are required. You may submit requests via authorized agents meeting California regulatory standards.
How to Exercise Your Rights
Submit your request to privacy@talkey.app. To protect your data, we verify your identity by sending a confirmation code to the email address registered with your account.
- • GDPR/UK GDPR: One month, potentially extended by up to two further months for complex/multiple requests.
- • CCPA: 45 calendar days, potentially extended by up to 90 days.
All standard privacy rights requests are processed free of charge. We may refuse requests that are manifestly unfounded, excessive, or repetitive.
8. Children's Privacy
We implement comprehensive technical safeguards and data restrictions to ensure minor safety in accordance with the GDPR, COPPA, and the UK Children's Code (Age-Appropriate Design Code):
Minor User Safeguards
- • Minimum Age Gate: Users under 16 years of age may not create an account. Talkey does not knowingly process data from children under 16.
- • High-Privacy Defaults: Users aged 16–17 receive high-privacy defaults. Sharing, public settings, and general tracking are disabled by default.
- • No Targeted Advertising: We do not conduct targeted advertising, behavioral profiling, or selling of minor users' data.
- • AI Safety: AI features are disabled for all accounts identified as belonging to users under 18. No minor data is sent for AI processing.
- • Location Protection: Country-level location is derived locally, and precise GPS tracking is completely disabled.
- • Parental Rights: Parents or legal guardians of users aged 16-17 can review their child's collected data, request modifications, or instruct us to permanently delete it by contacting privacy@talkey.app.
Parental involvement is required only where applicable law requires it. If we discover we have inadvertently collected data from a child under 16, we will delete that information immediately.
9. International Data Transfers
We and our service providers (including our UK cloud infrastructure provider, AI inference provider, Apple, Google, and Paddle) may process personal data outside your country of residence (including transfers to the United States and other jurisdictions). Where the EU GDPR or UK GDPR applies, we use an applicable adequacy decision or approved contractual safeguards, such as the European Commission’s Standard Contractual Clauses (SCCs) and, where relevant, the UK International Data Transfer Addendum or other lawful transfer mechanism.
We assess applicable transfer risks and implement supplementary technical and organizational safeguards where required to protect data against unauthorized foreign access. You may contact us at privacy@talkey.app to request further information about the safeguards used.
10. Permissions and Device Access
The App may request specific system permissions on your mobile device to enable interactive language features:
Microphone Access
- • Purpose: Speaking exercises and pronunciation assessments.
- • When Requested: When you initiate a speech recognition task.
- • Data Processed: Local audio captures. We do not independently store raw audio unless you explicitly use a feature that saves it.
- • Control: You can deny permission at the OS level; pronunciation exercises will be bypassed.
Speech Recognition
- • Purpose: Transcribing your spoken words to grade vocabulary exercises.
- • When Requested: Alongside microphone access in voice elements.
- • Data Processed: Depending on the device, operating-system settings, language, and availability, speech recognition may occur on-device or may be processed through Apple’s speech-recognition services.
Camera Access (Optional)
- • Purpose: Capture custom profile images or flashcard photos.
- • Control: Denying camera access does not affect core learning progress.
11. Cookies and Tracking Technologies
Our mobile app does not utilize web browser cookies. However, we use equivalent sandbox tracking technologies to maintain app states:
- On-Device Local Storage: We use local preferences cache and CoreData/SQLite database fragments to support offline functionality.
- Authentication State: Session access tokens are stored in the device secure container to prevent requiring repeated OTP logins.
- Web View & Transaction Cookies: The website interface (talkey.app) uses basic security and session cookies necessary to manage logins and support portal operations, alongside functional cookies deployed by Paddle for transaction flow and fraud prevention.
12. Subscription and Payment Information
Our payment processing and billing setups depend on where you purchase your subscription:
- iOS purchases: Processed and billed by Apple. Apple's privacy policy and terms govern your transaction data.
- Website purchases: Processed and billed by Paddle, acting as our authorized reseller and Merchant of Record. Paddle processes transaction data under its own privacy terms.
- Subscription Information: We store subscription tier, billing provider (Apple or Paddle), and expiration date on our servers for cross-device synchronization and access verification.
- No Credit Card Data: We never receive or store your credit card information.
For questions about payments, cancellations, or refunds, please manage your subscription through your Apple Account Settings (for iOS purchases) or via the Paddle Buyer Portal / confirmation receipts (for web purchases).
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by:
- Posting the updated Privacy Policy in the App
- Sending an email notification (if you have provided an email)
- Displaying a prominent notice in the App
The "Last Updated" date at the top of this policy indicates when it was last revised. Changes become effective when they are posted.
If you do not agree to the changes, you must stop using the App and may delete your account immediately.
14. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Privacy Inquiries
Email: privacy@talkey.app
For questions about privacy, data requests, or exercising your privacy rights
General Support
Email: support@talkey.app
For general app support and technical questions
Response Times
- • Privacy inquiries and data rights requests: Handled within the periods required by applicable law (e.g. one month under GDPR).
- • Support & Billing inquiries: We aim to respond within a reasonable period based on the nature and urgency of the request.
Your Privacy Matters
We are committed to protecting your privacy and being transparent about how we handle your data. If you have any questions, please don't hesitate to contact us.