Privacy Policy

1.Who is responsible

Talking Photos (talkingphotos.app) is operated by My Little Indie Studio (“we”, “us”), the controller of the personal data described here. Privacy questions and requests: info@talkingphotos.app.

2.Aplikacja Android i Twoje dane

Ta polityka obejmuje talkingphotos.app oraz aplikację Talking Photos na Androida.

Podczas logowania przez Google na Androidzie otrzymujemy adres e-mail, imię i identyfikator konta Google, aby Cię zalogować. Google przetwarza żądanie zgodnie ze swoją polityką prywatności; nie zapisujemy zdjęcia profilowego Google.

Płatności na Androidzie obsługuje Google Play. Otrzymujemy tokeny zakupu, numery zamówień, produkt, status subskrypcji, daty i skrót identyfikatora konta, aby weryfikować zakupy i przyznawać PRO lub tokeny. Nie otrzymujemy danych kart. Google prowadzi własną dokumentację płatniczą.

Firebase Cloud Messaging (Google) używa tokena urządzenia do powiadomień o gotowych filmach lub błędach. Przechowujemy token, platformę Android, wersję aplikacji i powiązanie z kontem. Aplikacja usuwa rejestrację przed wylogowaniem lub po wyłączeniu powiadomień; usunięcie konta usuwa wszystkie jego tokeny. Google przetwarza dane dostarczenia zgodnie ze swoimi warunkami.

Punkty twarzy, maski segmentacji, głębia i przygotowanie neuronowe są obliczane na urządzeniu przy użyciu pobranych modeli. Na tym etapie zdjęcia nie są nigdzie wysyłane. Zdjęcia i wyniki są przesyłane oddzielnie, gdy są potrzebne do zapisania sceny lub renderowania filmu.

Zgłaszając treści, przekazujesz identyfikatory konta i sceny lub filmu, powód, opcjonalne szczegóły oraz czas, które zapisujemy w celu oceny obraźliwych wyników AI i zapobiegania nadużyciom. Kopia trafia do pomocy przez naszego dostawcę poczty. Zgłoszenia nie są publiczne; unikaj zbędnych danych osobowych.

Analityka: aplikacja używa Google Firebase Analytics do pomiaru korzystania z funkcji (ekrany i działania, informacje o urządzeniu i aplikacji, przybliżona lokalizacja z adresu IP — nigdy Twoje zdjęcia, teksty, imię ani e-mail). W EOG, Wielkiej Brytanii i Szwajcarii działa dopiero po Twojej zgodzie w aplikacji; gdzie indziej można ją wyłączyć w profilu. Funkcje reklamowe pozostają wyłączone; Google działa jako nasz podmiot przetwarzający.

Usuń konto w profilu Android rozpoczyna opisane poniżej usuwanie konta i treści oraz usuwa tokeny powiadomień i zgłoszenia z bazy. Kopie w poczcie pomocy mogą pozostać tak długo, jak wymaga tego obsługa zgłoszenia, zapobieganie nadużyciom lub prawo; kopie zapasowe wygasają zgodnie z harmonogramem poniżej. Wnioski o usunięcie: info@talkingphotos.app.

3.What we collect and why

Account

• Email address, a password hash (Argon2id; we never store the password itself), an optional display name and avatar, whether the email is confirmed, your plan and when the account was created. Used to run your account and send service emails.
• Sign-in sessions: a random session token (stored only as a hash), a CSRF token, your browser or app User-Agent string (up to 200 characters) and when the session was created and last used, so you can see and end your sessions in the profile. Sessions expire after 30 days.
• Email links (sign-in, confirmation, password reset, email change): the address and a hashed one-time token. Links expire after 15 minutes to 24 hours depending on their purpose.
• Failed password attempts per email address, to stop password guessing; kept for 15 minutes.
• Google sign-in: when you sign in with Google, we receive your email address, name and Google account ID from Google and use them to create your account or sign you in to it (the name becomes your display name for a new account). We do not store your Google profile photo.
• Photo-rights confirmation: the date and time you confirmed, before your first photo or clip upload, that you may use the photos and that the people in them agreed (see the Terms). Kept with the account as a record of that confirmation and deleted with it; photo and clip uploads are not accepted without it.

Your content

• Photos, video clips and images you upload, the processed versions and previews we make from them, and your avatar.
• Scenes and heroes: titles, hero names and personas, face points and animation settings, depth and mask images computed in your browser or on your Android device, the dialogue text and montage settings.
• Generated results: speech audio, the lip-sync data derived from it, and exported MP4 videos with their poster images.
• AI marks in exported videos (see the AI transparency page): the visible “AI” label, C2PA Content Credentials and MP4 metadata stating that the video was generated with AI by Talking Photos, and an inaudible watermark in the soundtrack. None of them contains your name, email address, account id or IP address. The watermark carries a random code that we store with the export and delete together with it; when someone checks a video, the code reveals only the export date, nothing about you.

We use your content only to provide the Service to you. We do not publish it, sell it, use it for advertising or use it to train AI models.

Usage, tokens and payments

• A token ledger (every token credit and spend with its reason and time), active token holds, and usage records of paid AI providers (provider, model, amount and cost), used for your balance, fair-use limits and our cost accounting.
• Subscription data received from Dodo Payments: subscription id, customer id, plan, status, renewal and end dates, the customer portal link, and payment ids of token packs. Payments are handled by Dodo Payments as Merchant of Record for web purchases: we never see or store your card or bank details. Android purchases use Google Play Billing as described in the Android section above.

Checking a video

On the verify page anyone, with or without an account, can check a video for our AI marks (files up to 100 MB). The file is analysed in a temporary file on our server and deleted immediately; we do not keep it or log its content. Our technical logs record only the request path, status and time. Your IP address is used briefly in memory to allow at most 10 checks per 10 minutes and is never stored.

Technical logs

Our servers write technical logs for troubleshooting (errors, job progress). They can contain account ids or email addresses and are overwritten automatically as new logs arrive (a few megabytes per service). We do not store IP addresses in our database and our web server does not keep access logs.

Technical error reports (error message, stack trace, page path, browser and OS, app version and anonymous account id) are sent to our self-hosted error tracker at errors.freshbox.ee, operated by us, to fix problems with the website. Reports are retained for 14 days and IP addresses are truncated. Reports do not include your name, email, photos, audio, request bodies, cookies or tokens. In the Android app, crash and error reports (error type, code location, app and OS version, device model and anonymous account id — never your text, photos or audio) are sent to Google Firebase Crashlytics for the same purpose.

Analytics

With your consent, the website loads Google Analytics 4 (Google) to measure how the site is used. The banner on your first visit decides; your choice is stored in your browser and can be changed any time via «Analytics settings» in the footer. Declining keeps analytics fully off — no measurement, no analytics cookies. Google’s Consent Mode keeps analytics storage off until you accept, and advertising signals (ad_storage, ad_user_data, ad_personalization) stay disabled permanently.

Analytics collects usage events (page views and funnel actions such as sign-up, upload or export steps), device and browser information, and coarse location derived from the IP address. Page addresses are stripped of ids, tokens and query strings before they are sent. We never send your email, name, project titles, dialogue text, photos, audio or sign-in tokens, and we do not build advertising profiles of you. In the Android app, Firebase Analytics works the same way with an in-app consent choice where the law requires one (EEA, UK, Switzerland). We send only service emails (sign-in links, email confirmation, password reset, email change) — no newsletters or marketing emails.

4.Cookies and data stored in your browser

We use only cookies that are needed for the Service to work, so no cookie banner is needed:

The app also keeps a few items in your browser’s own storage. They never leave your device unless stated:

• Guest draft (IndexedDB talking-photos): a scene you start without an account, including its photos. It is uploaded to your account only after you sign in and choose to continue it.
• Local storage: ids of running voice and export jobs so they resume after a reload (tp:speechJob:*, tp:exportJob:*, tp:exportKey:*, removed when the job ends); that you have read the Gemini voice notice (tp:geminiOk); whether the 18+ dialogue mode is on and its age confirmation was given (tp.uncensored,tp.uncensored.confirmed); and, without an account, when you confirmed the photo rights (tp:photoRights).
• Session storage (cleared when the tab closes): your balance before a checkout, to detect the completed payment (tp:checkoutBase), and a dismissed email reminder (tp_verify_banner_dismissed).
• Browser cache: downloaded face-detection and animation model files, so they are not downloaded again.
• Analytics: your consent choice (tp:gaConsent) and, after you accept, Google Analytics cookies (_ga, _ga_*) that distinguish visits. Declining sets none of them.

Face and landmark detection, depth and mask estimation and neural animation preparation run entirely in your browser or, in the Android app, on your device using downloaded models; the photo is not sent anywhere for that preparation step. Saving a scene and server rendering involve separate uploads.

5.Service providers and where your data goes

We use these providers (processors) and give each only what its task needs:

Free voices (Supertonic), lip-sync analysis and video rendering run on our own servers. Photos, clips and images are never sent to an AI provider. The dialogue assistant and “Arrange with AI” only run when you press their buttons, and your scene description is not stored in our database. Do not put personal information about real people into scene descriptions, personas or dialogue lines.

We do not sell or share your personal data with anyone else, except where the law requires it.

6.International transfers

Our servers and backups are in the EU. Some providers above process data outside the European Economic Area (USA, India, China). Where the destination has no EU adequacy decision, the transfer relies on the European Commission’s Standard Contractual Clauses or other safeguards offered by the provider, or is necessary to perform the service you request (for example a voice, dialogue or montage you ask to generate). You can avoid sending text to Google, DeepSeek or TypeSafe by using the free Supertonic voices, writing dialogue yourself and arranging the montage by hand.

7.Legal bases

• Performance of our contract with you: your account, content, voices, videos, tokens and subscription.
• Legitimate interests: security, abuse and fraud prevention, rate limits, technical logs, backups, cost control, the record of your photo-rights confirmation and the AI marks in exported videos (which also serve our transparency obligations under Article 50 of the EU AI Act).
• Legal obligations: keeping records required by law and responding to lawful requests.
• Consent: where we ask for it.

8.Retention and deletion

• Your content is kept while you use your account, subject to the inactivity rule and the storage limits and retention rules described here. Temporary processing files, failed jobs and unreferenced intermediate files may be removed earlier when they are no longer needed to provide the Service. Uploads that are not finished within 24 hours are deleted automatically. A free account can store up to 500 MB of files (photos, clips, voice recordings and exported videos); when the storage is full, new uploads, voicing and video exports are blocked until you delete projects or files or upgrade to PRO. Nothing is deleted because of this limit. PRO accounts have no storage limit.
• Inactive accounts: if you do not sign in or use the Service with your account for 12 months, we email you at least 30 days before deleting your content. If you still do not sign in by the date in that email, we delete your scenes, exported videos, saved heroes, uploaded photos and profile photo. Your account, sign-in methods, token balance and purchase history are kept. Any sign-in before that date keeps everything and restarts the 12 months. Accounts with an active PRO plan are not affected. We never delete content under this rule without first sending you the notice.
• Storage changes: to control capacity, security and operating costs, we may introduce or change storage limits or retention periods for uploaded files, generated files and backups. If a change materially shortens the time we keep your content, we will notify registered users at least 30 days before it takes effect by email or in the app, identify the affected categories and date, and give you a reasonable opportunity to download content you want to keep. After that date, affected files may be permanently deleted.
• Deleting a scene immediately cancels its running jobs and removes the scene from your account; its files (photos, audio, videos) that no other scene or saved hero uses are deleted from storage by a clean-up job that starts right away. The scene’s database record is kept, marked as deleted, until you delete your account.
• Deleting a hero removes it from “My characters”; its photo is deleted from storage at the next clean-up if no scene uses it, and in any case when you delete your account.
• Deleting your account (profile → “Delete account”) immediately signs you out everywhere, cancels unfinished jobs and starts a clean-up job. That job, usually within minutes, deletes every file you uploaded or generated and then the account itself together with all its records: scenes, heroes, dialogue, sessions, token balance and ledger, subscription records, usage records, email links and failed-login records. Usage records of paid AI providers that we must keep for cost accounting are kept without any link to you. If the clean-up hits a temporary error it retries automatically.
• Backups: database backups are kept for up to 30 days (daily) and 12 months (monthly), plus 7 days on the server. Your files are backed up daily; a file you delete, or that is deleted under the rules above, stays in the file backup for up to 30 days. Backup retention and the categories included may change under the storage-change notice above. Deleted data disappears from backups as they expire; we restore backups only to recover from a failure and would then repeat the deletion.
• Dodo Payments keeps its own payment and tax records as Merchant of Record under its policy. Google Play keeps its own payment records under its policy. Deleting your account does not cancel a subscription — cancel it in the Dodo customer portal or Google Play, depending on where you purchased it.
• Providers (Google, DeepSeek, TypeSafe, Hostinger, DigiCert) keep the data they receive according to their own terms for API customers.

9.Your rights

Under the GDPR you have the right to access your data, correct it, delete it, receive it in a portable format, restrict or object to processing, and withdraw consent at any time. Many of these you can do yourself: edit your name, avatar, email and password in the profile, delete scenes and heroes, download your videos, and delete your account. For anything else — for example a copy of all your data — email info@talkingphotos.app from your account’s address. We answer within one month.

You can also complain to a data protection authority, for example the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the authority in your country.

10.Children

The Service is not for children under 16 and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it. Photos of children may be uploaded only by a parent or guardian, and never for content that breaks our acceptable use rules.

11.Security

Connections are encrypted (HTTPS). Passwords are hashed with Argon2id, session and email-link tokens are stored only as hashes, uploaded files are kept in private storage and served only to their owner, and repeated failed sign-ins are throttled. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.

12.Changes to this policy

We will update this policy when our processing changes; the date at the top shows the latest version. We will notify registered users by email or in the app about material changes.

13.Contact

Privacy questions and requests: info@talkingphotos.app. See also the contact page.