Privacy

The controller of your personal data is Talkabout LLC:

Email: talkaboutlang@proton.me. See also our legal notice.

If you're in the European Union or the United Kingdom, contact us about anything in this notice at talkaboutlang@proton.me.

We follow Georgia's Law on Personal Data Protection and, because we offer Talkabout to people in the European Union and the United Kingdom, the GDPR and UK GDPR.

• Account: your name, email address and a hashed password.
• Profile: birthdate (to check you're 18 or older), country, languages and levels, interests, mood, bio, who you'd like to hear from, and an optional photo. Your country also drives the optional Block people in Russia filter: when a member switches it on and the other member's profile says Russia, the two of them don't see or message each other.
• What you do: messages, images and voice messages you send, corrections, favourites, blocks, reports, appeals, feedback posts and votes, your notification and privacy settings, and the language you chose for Talkabout and the one it last showed you, so emails reach you in it. We only use your microphone while you're recording a voice message, and nothing is sent until you press Send. From when messages were sent we keep a practice streak for each chat: how many days in a row you and your partner both wrote.
• Safety records: trust signals (for example how many people replied to you, blocks and reports about you, attempts to share contact details too early), and any moderation decision about your account.
• Technical data: for each signed-in session, the IP address and browser it started from; the days you were active; and short-lived request logs at our host.
• Where you came from: if you arrive through a tagged link, someone's invite link or from another website, the campaign tags, the invite code, that website's address and the first page you opened. Your browser keeps this only in the open tab; it reaches us, and is stored with your account, only if you sign up.
• Invites: your personal invite code, created the first time the app shows you your invite link, and included in your data download. If someone signs up through your link, their account records your code. Once they've finished signing up and someone other than you has replied to them, we record that they joined through you. Once they've been a member for a week, used Talkabout on three different days and had a real conversation with someone other than you, we record when they settled in, which raises your daily translations and new chats and earns Connector badges; to decide that, we count their active days and how many messages each side sent in their chats, never what the messages say. A friend suspended or banned within 30 days of settling in stops counting. You see a count, never who. Anyone who opens your invite link sees your name, profile photo and languages on the page it opens, unless you switch that off in Settings, Privacy; the person who signs up through it sees you in Discover as the one who invited them and can write to you even if your choice of who can start a chat with you would otherwise not allow it. Blocking works as always.
• Games: if you record something in Games, which needs no account, we store the recording, how long it is, the shape of its waveform, the language and prompt you chose, your answer, and the guesses and ratings other people leave on it. A recording is published on a public page anyone with the link can open. We do this only with your consent, which you give by ticking the box before the microphone turns on; a second, separate box asks whether the clip may also be used in Language Recognition. We do not analyse your voice, try to identify you from it, or train anything on it.
• Translations: when you tap Translate on a message, its translation and which service made it, stored with the message so it's only translated once, and how many translations you asked for each day. The messages you send can be translated for your partner in the same way when they ask.
• Notifications: if you turn on push notifications on a phone or browser, that device's push subscription (an address at your browser maker's push service, stored once per device) and the keys to encrypt notifications to it; when we sent you a notification and whether you opened it; and whether you installed the app and answered the browser's notification prompt.
• Usage analytics: pages you visit, errors, things you do in the app (for example that you sent a message, never what it said), your device and browser, and an approximate location from your IP address. We don't record clicks, scrolling or your screen. Once you're signed in, this is linked to your account id, never your name or email. Before that, a random id that only lasts until you leave or reload the page, so we can't recognise you across visits.

• To provide Talkabout: your account, profile, discovery, chats and corrections, and the data export and account deletion. Legal basis: performing our contract with you (GDPR Article 6(1)(b)).
• To keep people safe: checking you're an adult, limiting how many chats new accounts can start, holding back images and contact details until a conversation is established, reviewing reports and appeals, and acting against spam, scams and abuse. Legal basis: our legitimate interest, and yours, in a safe service (Article 6(1)(f)), and our contract with you.
• To keep Talkabout secure and working: session records and request logs. Legal basis: legitimate interest (Article 6(1)(f)).
• To understand which channels bring people in and how Talkabout is used, so we can improve it. Legal basis: legitimate interest (Article 6(1)(f)). You can object at any time.
• To publish a recording you made in Games, and to show the guesses and ratings people leave on it. Legal basis: your consent (Article 6(1)(a)), given by the box you tick before recording. You can withdraw it at any time by deleting the recording from its own page, and every recording is deleted after 30 days in any case. A recording is checked by a person before it is offered to anyone who was not sent its link.
• To tell you when someone writes to you while you're away, on the devices where you turned notifications on. Legal basis: your consent (Article 6(1)(a)), which you can withdraw at any time in Settings or in your browser.
• To comply with the law, for example answering a lawful request from an authority. Legal basis: legal obligation (Article 6(1)(c)).

Trust signals are calculated automatically and decide limits such as how many new chats you can start in a day, when you can share images, and whether your profile appears in discovery. They never warn, suspend or ban anyone on their own: warnings, suspensions and bans are decided by a person.

• Other members see your profile (your age, never your birthdate) and the messages you send them. Favourites are private unless they're mutual. A practice streak is shown only to you and that partner. Your email address is never shown. Feedback posts are visible to other members.
• Moderators can open any conversation. They do so to review reports and appeals, and every time a moderator opens one, it is recorded.
• Anyone with the link to a Games round can play its recording, with no account. Once a moderator has approved it, it can also be offered to people who were not sent the link. Nothing about you as a person is shown beside it: no name, no photo and no account, unless you sign up and choose to be credited.
• Rounds you record or play while signed in are linked to your account, and so are the ones you played on the same device before you signed up. When the other player in one of your rounds has an account too, each of you sees the other in Discover as someone you played with, with a Say hi button, until you have a chat. That follows your privacy settings: it doesn't happen while Show me in Discover is off, and never between people who have blocked each other. The other player never learns anything else about you from the game.
• We don't sell your data and don't show ads.

These companies process data on our behalf, under a data processing agreement:

• Cloudflare, Inc. (United States) hosts Talkabout: the app, database, photo storage, live chat, voice messages and request logs. Its Workers AI service translates chat messages when a member asks for it, without keeping the text or training models on it. Cloudflare runs a global network, so data can be processed outside Georgia and the EU. Transfers rely on the EU–US Data Privacy Framework and standard contractual clauses.
• PostHog, Inc. (United States) provides usage analytics, stored in its US region. Transfers rely on the EU–US Data Privacy Framework and standard contractual clauses. Requests go through our own domain first, and PostHog sets no cookies.

Push notifications travel through your browser maker's push service (Google for Chrome and Android, Apple for Safari, Mozilla for Firefox, Microsoft for Edge), which stores the device address and delivers them. They're encrypted so the push service can't read them, and they never contain what anyone wrote: only who wrote to you.

Games uses Cloudflare Turnstile to tell people from bots before anything is recorded, reported or deleted. It loads a script from challenges.cloudflare.com, Cloudflare's own domain, and the check runs there. It sets no cookie on Talkabout and stores nothing on your device from our side; Cloudflare receives your IP address and information about your browser to make the check. It is the only third party anything on our pages loads from.

• A session cookie keeps you signed in. It's necessary for the service and expires after 7 days without a visit.
• If you pick a language in Settings, at the bottom of a page or on a landing page, a cookie remembers it on this device for a year, so pages open in it before you sign in.
• If you arrive through a tagged link, an invite link or from another website, your browser's session storage remembers where you came from until you close the tab, so it can be stored with your account if you sign up. It's never sent to us otherwise, and it's not a cookie.
• A service worker keeps the offline page, the app's code, fonts and icons on your device so the app starts quickly and opens when you're offline, and your browser's local storage remembers whether you put off the install and notification suggestions, the reminder to add a photo, the safety tip in your first chats or the note that the homepage is also in your language.
• If "Keep chats on this device" is on (it is by default in the installed app, and off in a browser tab until you turn it on in Settings → Privacy), your device also keeps a copy of what you've recently seen: your recent chats (up to the latest 50 messages in each of your 30 most recent conversations), your inbox, profiles you've opened, photos you've already viewed, the first page of Discover, your own settings and messages waiting to send. It's kept in your browser's storage for this site, only for the account that's signed in, and removed when you sign out, when you switch it off, when you remove it in Settings, or after 14 days without going online. It's never sent anywhere. Anyone who can use your browser can see it while you're signed in, so on a shared device, sign out when you're done or leave it off.
• If you play Games, a cookie called penpal-play holds a random id and nothing else: no name, no email and nothing about your device. It exists so you can delete your own recording without an account, so nobody can rate the same clip a hundred times, and so your rounds can come with you if you sign up. It lasts 30 days and is necessary for those things, so there is nothing to accept or decline. Turnstile sets no cookie on Talkabout.
• Analytics store nothing on your device: no cookies and no local storage. The random id exists only in the open page.

We don't use cookies or storage for advertising or to follow you across visits or other websites, so there's nothing to accept or decline.

• Your account data, including your invite code, for as long as your account exists.
• A device's push subscription until you switch notifications off there, delete your account, or its push service tells us the address no longer works.
• When you delete your account, we immediately delete your profile, photos, languages, interests, favourites, practice streaks, blocks, notification settings, push devices and notification history, trust records, sessions, invite code, invite progress and badges, where you came from and your activity days, and replace your name and email with "Deleted user". If you joined through someone's invite, the record that you joined through them stays, so they keep the badge they earned.
• A message's translations for as long as the message exists. Your daily translation counts until you delete your account.
• The text of messages and corrections you sent stays in the other person's chat, shown as from "Deleted user", because it's part of their conversation too. Images and voice messages you sent are deleted.
• Reports, feedback posts and moderation decisions stay attached to the deleted account so we can keep enforcing our rules; the text of your appeals is removed. If an account was banned, we keep a one-way hash of its email address to stop it signing up again. If you delete your account while it is suspended or banned, or while a report about it is still open, we keep the same kind of hash until the suspension ends and the reports are decided, and that address can't sign up until then.
• If someone gives a birthdate under 18, the account stays locked so it can't be used again.
• Games recordings for 30 days from when they were made, always, with no way to extend them; after that the audio file is deleted and the page stays with the result on it. You can delete your own recording sooner from its page. The round, its guesses and ratings stay after the audio has gone. Rounds linked to your account, and your guesses and ratings, are deleted with your account, recordings included.
• Request logs at Cloudflare, for up to 7 days.
• Analytics events at PostHog, for at least a year; ask us to delete yours at any time. When you delete your account, we also ask PostHog to delete the analytics linked to it.

You have the right to:

• get a copy of your data: "Download a copy of your data" in Settings
• correct it: edit your profile at any time
• have it erased: "Delete your account" in Settings
• take it elsewhere: the download is a machine-readable JSON file
• restrict our processing, and object to processing based on legitimate interest

For anything you can't do in the app, email us at talkaboutlang@proton.me. We answer within a month.

You can complain to Georgia's data protection supervisor, the State Audit Office of Georgia (personal data protection). If you live in the European Union or the United Kingdom, you can also complain to the data protection authority where you live or work. We'd appreciate the chance to fix things first.

Talkabout is for people aged 18 or older. We don't knowingly collect data about anyone younger.

When we change this notice, we update the date at the top. We tell members about significant changes before they apply.