Privacy policy
Privacy policy
1. Who we are
The "data controller" for talklint is:
- Valentina Koniukhova (sole proprietor, individual)
- Avenida del Silencio 332, 7607 Miramar, Provincia de Buenos Aires, Argentina
- Privacy email: privacy@talklint.me
talklint is offered worldwide via the Apple App Store and Google Play Store. Because we accept users from the European Union and the United Kingdom, this policy applies the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018 in addition to Argentina's Personal Data Protection Law (Ley 25.326). The European Commission has recognised Argentina as providing adequate data protection (Decision 2003/490/EC), so transfers between the two regions do not require additional safeguards.
2. What data we process
On our servers
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| RevenueCat App User ID (a random identifier assigned to your device, not your name or email) | Verify your subscription status, enforce the daily free quota | Performance of a contract — Art. 6(1)(b) | Indefinitely, until you sign out or delete the app |
| Daily usage counter (an integer per user per UTC date) | Enforce the free-tier limit (5 checks per day) | Performance of a contract — Art. 6(1)(b) | Auto-deletes after ~48 hours via database TTL |
| Request metadata (request ID, timestamp, status code, latency, device platform) | Diagnose bugs and detect abuse | Legitimate interest — Art. 6(1)(f) | 30 days in CloudWatch Logs |
What we explicitly do not store
- The text you submit to
/v1/checkor/v1/rewrite/concise. - The AI provider's responses (corrections, explanations, rewrites).
- Your name, email, phone, address, or any contact information.
- Your contacts, calendar, photos, microphone, location, or any device sensor data.
- Anything that could identify you as a person beyond the opaque RevenueCat ID.
The "never stores text" guarantee is enforced by an automated test in our backend that fails the build if user content ever appears in our log output.
On your device
- Your "journal" of saved corrections. This sits in an SQLite file managed by the app and never leaves your device. Settings → Sign out & clear data wipes it.
- Your selected theme (day / night / system).
3. Third parties (sub-processors)
The following services receive limited data on our behalf, each bound by a data-processing agreement under GDPR Art. 28.
| Service | Role | Data shared |
|---|---|---|
| Anthropic, PBC (Claude API) | AI provider — generates the corrections | The text you submit. Anthropic processes it to generate a response, does not train models on it per their API terms, and retains it up to 30 days for abuse monitoring. |
| Amazon Web Services, Inc. | Hosts our backend (region: us-east-1, United States) | All API traffic. AWS is bound by GDPR Standard Contractual Clauses for transfers outside the EEA. |
| RevenueCat, Inc. | Subscription management | Anonymous App User ID, purchase events, entitlement state. |
| Google LLC (Firebase Crashlytics & Analytics) | Crash reports and anonymous usage analytics | Crash stack traces, screen-view events, anonymous device metadata. No user content is logged. Ad-personalisation signals are disabled. |
| Apple Inc. / Google LLC | App Store / Play Store distribution and billing | Standard store-managed billing data. We never see your payment method. |
4. International transfers
Our backend runs in AWS region us-east-1 (United States). Anthropic also processes requests in the United States. Transfers from the EEA, UK, or Switzerland to the US rely on the EU–US Data Privacy Framework where applicable and on Standard Contractual Clauses for any service not yet certified. Argentine users' data is processed in the US under contractual safeguards consistent with Ley 25.326.
5. Your rights
Under the GDPR and Ley 25.326 you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate data.
- Erase your data ("right to be forgotten"). You can do this immediately yourself via Settings → Sign out & clear data; this clears the RevenueCat App User ID and wipes the local journal.
- Restrict or object to processing based on legitimate interest.
- Portability — request your data in a structured, machine-readable format.
- Withdraw consent at any time, where applicable.
- Lodge a complaint with your supervisory authority. In Argentina, the Agencia de Acceso a la Información Pública (AAIP); in the EU, your national Data Protection Authority; in the UK, the ICO.
To exercise any right, write to privacy@talklint.me. We respond within 30 days as required by GDPR Art. 12(3).
6. Children
talklint is not directed at children under 13 (or 16 in EU member states with a higher age threshold). We do not knowingly collect data from children. If you believe a child has used the app, contact us and we will delete any associated records.
7. Security
All traffic between the app and our backend is encrypted with TLS 1.2 or higher. Data at rest in DynamoDB is encrypted with AWS-managed keys. Our Lambda execution role follows the principle of least privilege and explicitly denies access to services not required for the API. We do not store secrets, payment data, or sensitive personal information.
8. Changes to this policy
If we make material changes — for example, adding a new sub-processor — we will update the "last updated" date above and, where the change affects existing users meaningfully, prompt you inside the app at next launch. Continued use after a change constitutes acceptance.
9. Contact
For any privacy question or request: privacy@talklint.me.