Privacy policy

This policy explains what Talkawa (“the app”) sends where, what our server keeps and for how long. It says the same as the screen the app shows before you start and the App Privacy section of its App Store page.

1. Who we are

The app is published by Panlab Limited, a company in Hong Kong (“we”, “us”). Email: contact@talkawa.com

2. What the app processes, and why

What you say, as text. Your speech is turned into text on your iPhone. The text of each turn is sent through our server to Microsoft Azure (Azure OpenAI, in Microsoft Foundry), which tidies it up and translates it. This is what the app is for.
Recordings, only with cloud transcription. If you switch on cloud transcription in Settings, the recording of each turn is sent through our server to Microsoft Azure (Azure OpenAI) to be turned into text as well. Your iPhone still turns your speech into text too, and its own text is used if the cloud one does not arrive.
Translations, only with the natural voice. If you switch on the natural voice, the translated text is sent through our server to Microsoft Azure Speech to be read aloud. Otherwise your iPhone’s own voice reads it.
Speech recognition by Apple. The app uses Apple’s speech recognition. It runs on your iPhone when an on-device model exists for the language; otherwise Apple recognises the speech on its servers, under Apple’s privacy policy.
A random device ID. The app creates a random ID for your iPhone and sends it with every request. We use it to count your free allowances and tokens and to prevent abuse. It is not your name, phone number or Apple Account, and it stays on our server: it is not sent to Microsoft.
Apple DeviceCheck. Apple lets us keep two yes-or-no values for each iPhone: whether it has already received the welcome tokens and the natural voice trial. They stay with the iPhone even if the app is deleted, so a reinstall does not hand them out again. We learn nothing else about your iPhone from them.
Purchases. When you buy Plus or tokens, the app sends us the App Store’s signed record of the purchase: its transaction IDs, the product, its dates and whether it was refunded. We use it to credit your tokens and to restore them on your other iPhones. We never see your name, your Apple Account or your payment details.

There are no accounts: we do not ask for your name, email address, contacts or location. The app shows no advertising and does not track you, and we do not sell your data or share it with anyone for advertising.

3. How long it is kept

Our server does not store the text or the recordings of your conversations. They pass through it to Microsoft and are not kept once the request is over.
Daily usage counters (how many tokens a device ID used on a day) are deleted after 3 days.
The one-time allowance counters (welcome tokens and natural voice trial) and a device ID’s DeviceCheck registration are kept while the service runs, so that the same allowance cannot be claimed twice.
Purchase records and token balances are kept while the service runs, and purchase records for as long as the law requires for accounting.
Cloudflare, which runs our server, keeps technical request logs under its own retention rules.
We ask Microsoft not to store translation requests (store: false), so it keeps no history of your conversations. Microsoft does not share the text or the recordings with OpenAI or with its other customers, and does not use them to train or improve AI models. Microsoft checks requests automatically for abuse: content flagged as possible abuse may be kept for a limited period and reviewed by authorized Microsoft staff.
Microsoft Azure Speech does not store the text it reads aloud.

4. Who processes it, and where

Microsoft Azure OpenAI, in Microsoft Foundry: translation, and transcription when cloud transcription is on. Our Azure resource is in India (South India region). What Microsoft stores, including content kept for abuse monitoring, stays in the geography of the region our resource is in, so it is kept in India. The requests themselves may be processed in any Azure region worldwide (a Global Standard deployment).
Microsoft Azure Speech (East Asia region, in Hong Kong): the natural voice, when it is on.
Cloudflare (worldwide network; our server runs near Tokyo, Japan): runs our server and its database.
Apple: speech recognition, DeviceCheck, the App Store and payments.

Your data may therefore be processed outside the place where you live.

The companies that receive your data (Microsoft, Cloudflare and Apple) process it only to provide their services to us, under their data-protection terms (for Microsoft, its Data Protection Addendum), with protection equal to what this policy describes.

5. Your choices

Cloud transcription and the natural voice are off until you switch them on in Settings, and you can switch them off again at any time.
You can stop using the app and delete it at any time. Deleting the app removes its data from your iPhone, except the random device ID, which stays in your iPhone’s keychain so that a reinstall does not refill the free allowances.
To ask what we hold about your device, or to ask us to delete it, email us with your Support code (Settings → About → Support code). We do not know who you are, so without the Support code we cannot find your records.

6. Children

The app is not directed at children under 13, and we do not knowingly collect data from them.

7. Changes to this policy

We will post any change on this page and update the date at the bottom. If a new kind of data is sent, or a new company receives it, the app will ask for your agreement again before sending anything.

8. Contact

Panlab Limited, Hong Kong. Email: contact@talkawa.com