Privacy Policy

1. Scope and Data Controller

This Privacy Policy explains how Talder Team (“we”, “us”, “our”), the operator of the Talder mobile application, collects and processes personal data. For the processing described here, the data controller is Talder Team, based in Italy. Privacy requests may be sent to [email protected].

This document covers the mobile app. Browsing our public website and using its support chat are covered separately by the Website Privacy Policy; the app analytics described below are not installed on the public website.

Some processing is necessary to create an account and provide communications. Contacts, live/background location, music activity, optional profile information, and device permissions are processed only when you enable the related feature, provide the information, or grant permission.

2. Data We Collect and Its Sources

Account and profile data:

• Email address, username, custom ID, optional phone number and its verification status/date, avatar, profile image, profile styling, account-creation date where available, verified-badge state, language, settings, and privacy choices.
• Hashed passwords, authentication provider identifiers, session tokens, account-recovery data, and device installation identifiers. Saved sessions and linked-account relationships support sign-in restoration and authorized account switching.
• Verification and recovery-code digests, expiry and attempt records, account-security email events, and Sign in with Apple credential-validation and revocation records. Supported Apple provider tokens are encrypted on our server. Saved login credentials and sensitive local keys use iOS Keychain; account snapshots, drafts, preferences and media caches may also be stored locally, including shared storage needed by app extensions.
• Apple subscription product, signed transaction and original-transaction identifiers, an account-linked purchase identifier, test or production transaction environment, entitlement state, purchase and expiration dates, and verification, renewal, refund and revocation records. Apple handles payment details; Talder does not receive your payment-card number.

Contacts and discovery:

• If you allow Contacts access, Talder reads contact names and phone numbers on your device. Contact phone numbers are normalized and converted into one-way matching hashes on device; only hashes are sent for matching. Contact names remain on the device and are used to label matches locally. Limited Contacts access, where supported by iOS, limits matching to the contacts you authorize.
• If you link your own phone number, the server stores a matching hash and an encrypted copy so it can be displayed back to your account. Linking enables other users who already have that number to find your profile through contact matching; the current app has no separate switch to hide a linked number from matching. Matching does not reveal your full number or upload another person’s contact name to their Talder profile. Blocks restrict matches in both directions. A hash remains pseudonymous personal data and is not treated as anonymous.
• Updated contact-discovery flows match verified phone links; older clients can retain a compatible matching path for historical phone links. Results can be cached on the device. A failed or offline lookup is not evidence that none of your contacts use Talder. Revoking Contacts permission stops access to your address book, but does not remove your own linked number or stop other users from matching it.

Phone-number verification: Linking a number is optional. When you request a verification, we process the number, country, chosen supported channel, app language, request and challenge references, expiry, attempt count, delivery outcome, verification time and security/rate-limit records. Number checks may run before a code is requested. Security counters can use keyed pseudonymous references derived from the account, number and network origin.

A configured verification or messaging provider receives the destination number and the information needed to deliver or check a one-time code, including the code/message text when that provider sends it. Telecommunications carriers also process the delivery. A reserve provider may be used when the primary route is unavailable for that destination or confirms a quota-related non-delivery; a timeout or uncertain delivery does not automatically trigger a second SMS. Delivery and sender display depend on the provider, destination and carrier.

When phone-line screening is enabled, a specialist telephone-validation service receives the number and country to distinguish mobile lines from VoIP or other non-mobile lines. Talder retains a short-lived line-type verdict rather than returned names or an enriched identity profile. An unavailable or inconclusive check does not itself establish that a number is invalid and does not bypass code verification or security limits.

An unfinished SMS request can be saved in protected, backup-excluded device storage, separately for each account, with the number and challenge/status details needed to resume it after reopening the app. This record does not contain the entered verification code or a reusable verification credential. An existing linked number is replaced only after the new number is successfully verified. The current app offers replacement, not standalone removal; contact us to exercise deletion rights without deleting the whole account.

Communications and social data:

• Direct and group messages, replies, images, view-once state, voice messages, location messages, call history, timestamps, read/listened/delivery state, friends, blocks, requests, groups, roles, invitations, and notification preferences.
• Real-time one-to-one and group audio packets while a talk or call is active. Recorded voice messages and media may be stored for later delivery. Selected voice effects for supported one-to-one talks and calls are applied on the sender’s device before transmission; the selected preset is stored locally in app preferences and supported talk-history records can include the effect used.
• Waves, including published audio, transcripts and word timings where available, detected or fallback language, waveform/audio-feature data, text or voice replies, reactions, views/listen counts, feed deliveries, hidden content or authors, reply permissions, selected voice-effect metadata, and reports or moderation actions associated with that content.
• Telepathy invitations, acceptance or withdrawal state and, while enabled between two users, the current text being typed before it becomes a sent message.
• E2EE public keys, key versions, encrypted key envelopes, ciphertext, capability data, and delivery metadata where encryption is supported.
• Locally cached link-preview URLs, titles, descriptions, thumbnails and retrieval times. Generating a preview can contact the linked website and its image hosts from your device even if you do not open the link. Those hosts receive the requested URL and ordinary network information; previews are not a safety check or endorsement.

Location, device and activity data:

• Precise live location, update time, optional background-location events, street/address and weather display requests, battery level, charging status, online/last-seen status, foreground/background state, and active talk/call state when the corresponding features are enabled.
• APNs, Push-to-Talk, VoIP, Location Push, Live Activity, and battery-refresh tokens and local authentication tokens required to address the device.
• Music activity: Last.fm username and account-link date, temporary authorization state and callback result, current track title, artist, album, artwork URL, music identifiers, duration and available listening timestamps; Apple Music playback information, including progress where provided by the device. Last.fm responses may include recent listening history used transiently to distinguish a replay from a stale current-track indication; Talder does not publish a historical listening log.

Technical and safety data:

• Connection and account identifiers, IP and network-derived information, rate-limit events, server errors, security events, product interaction, performance information, and diagnostics such as app state, connection generation, failure category and delivery delay. Diagnostics for unusually frequent requests can include operation types, counts, byte sizes and timings, not the message payloads.
• Third-party sign-in components may process account/profile information, user and device identifiers, technical usage data and other service metadata for authentication, security and service measurement. Google Sign-In can use the connection IP address to estimate approximate location for fraud prevention. This network-derived estimate is distinct from precise GPS sharing and does not mean that another Talder user receives your location.
• Reports submitted about profiles, Waves or replies; block and moderation state; account status, suspension or ban reason and date; and Premium entitlement, verification, expiration or revocation state.
• Runtime diagnostics are designed not to include message bodies, audio payloads, passwords, APNs tokens, or signed media URLs.

Surveys and support: Optional in-app surveys collect the selected answers, any comments you choose to write, campaign reference and submission time linked to your Talder account. They are not anonymous submissions, even though the administrator summary shows aggregate counts/percentages and recent comments without displaying names or custom IDs. Answers are sent only when you confirm the final question. Incomplete answers remain in memory and are lost if the app process closes. An account-specific, locally saved foreground-use total controls when the invitation appears; it does not record the contents of what you do during that time.

When you contact the official Talder account, your support conversation is processed as an in-app chat and can be reviewed by the support team. Email reports contain the message and attachments you choose to send, your sender details and, if you keep the app’s prefilled text, app version, build and iOS version. Opening help or shaking the device to open the support sheet does not automatically send an email, screenshot, recording or diagnostic attachment.

Authenticated update checks transmit app version, build and distribution channel. An authorized administrator can request a short-lived version check for a particular account for troubleshooting. That account-specific result is kept in server memory, not a permanent version-history database. Access to the result expires five minutes after the check finishes; a pending request expires after ten minutes. Expired entries are discarded during later registry operations or when the server process ends.

Account-creation date: New accounts record their creation time. For older accounts without that record, a one-time migration may use the earliest stored outgoing talk timestamp as an estimate; some historical dates were assigned administratively. If no date was available, it remains absent. This is an account-history date, not your date of birth. The displayed date can be visible to people who are not your friends and is cached locally between app launches. You may request correction of an inaccurate date.

Music and listening activity: The current Spotify-branded listening feature uses Last.fm, not a new direct Spotify Web API connection. You connect Last.fm in Talder and manage Spotify Scrobbling separately on Last.fm. Talder verifies the Last.fm account during linking but does not retain the Last.fm session key, ask for your Last.fm password, submit scrobbles or change your Last.fm library. The account link is saved on the Talder server and can remain available after reinstalling Talder.

When music sharing is enabled, our server can retrieve the current public Last.fm listening indication for authorized friends even when Talder is closed on the listener’s phone. The API can be delayed, miss a repeated song, or temporarily retain an old indication after playback stops. Talder uses expiry checks and limited caches; this is not a precise play/pause monitor. Turn off Music activity to hide sharing through Talder without removing the link, or use Disconnect in Talder to remove the link. Revoking access only on Last.fm does not make public Last.fm listening data private or remove the saved Talder link.

To fill missing artwork or duration, the server may query public music-catalog and artwork services using track, artist, album or public music identifiers, without sending your Talder account ID or Last.fm username to those catalog searches. Artwork hosts receive normal network-request information when images are downloaded. Tapping a listening link opens the external music service, which applies its own terms. The current listening feature does not require direct Spotify authorization in Talder; legacy credentials from earlier connections may remain until disconnected or deleted and are not required for Last.fm.

Wave language and translation: Supported Apple speech-recognition paths transcribe recordings on-device. Audio is uploaded when you publish a Wave or voice reply; the available transcript, timings and language are uploaded with the content. Language identification uses Apple tools with Google’s on-device language-identification software as a fallback where included. This Google component does not send the input transcript text to Google, but may send technical usage data such as device/app details, installation identifiers, performance, configuration and identified languages.

When an authorized viewer requests a translation, the Talder server sends the Wave’s transcript text and source/target languages to a third-party AI translation service, not the audio recording or account credentials. The result may be cached in the Talder database until the Wave expires or is removed. Compatible devices may use Apple’s on-device translation as a fallback; language-model downloads can require a network connection. Translations and transcripts can contain mistakes and do not change the original recording.

A Wave view may be recorded as soon as the selected Wave becomes visible, including when playback is muted, interrupted or not completed. View/listen totals therefore do not prove that everyone heard the whole recording. Playback duration, completion and replay information can be recorded separately. Counts and supported listener details may be available to the author or audience through the feature.

Product analytics: The app sends a limited set of manually selected events directly to a European-hosted product-analytics service to understand app use and improve onboarding and reliability: app/session openings, onboarding and account-setup steps, authentication method and broad success/failure category, Home views, opening help or feedback, sharing Talder, supported incoming-link categories, confirmed friendships, chat openings, Telepathy invitation outcomes, location-sharing setting changes, Last.fm link or unlink outcomes, Talk and call lifecycle stages, group creation or joining and group Talk stages, and Wave submission, publication, playback or reply actions. Event records include the time, event identifier, random installation identifier, session identifier, app version/build and the relevant screen, step, source, content type, mode, role, outcome or moderation category where applicable. These identifiers are pseudonymous, not fully anonymous, and are not your Talder account ID.

This integration does not send your email address, username, Talder account ID, password, message contents, microphone recordings, photos, precise location or listening titles. It does not use the advertising identifier, automatic interaction capture, heatmaps or screen recording. Geographic enrichment and person-profile creation are disabled in the app’s event payloads. The analytics service still receives ordinary connection information, including the IP address needed to receive a network request; disabling geographic enrichment is not a guarantee that no network information is processed. Events can be buffered locally for later delivery, with a maximum queue of 200 events. There is no dedicated analytics switch in the current app; see Section 9 for requests and objections.

Notifications and reminders: In addition to communications, account, Telepathy, Wave and battery alerts, supported app versions offer talk suggestions and reminders about recent visible friend activity or new Waves. The scheduler uses notification choices, device/push identifiers, time zone, last observed app opening, delivery attempts and relevant friend/feed activity to avoid inappropriate or repeated reminders. The current limit is two reminder attempts in seven days with at least 48 hours between attempts; ordinary message and call notifications are separate. Talk suggestions and friend-activity reminders are enabled by default when no preference has been saved and can be turned off in notification settings. A default setting or iOS notification permission does not by itself constitute express consent to promotional notifications.

We receive data directly from you and your device, from people who communicate with or invite you, and from the login, platform, music, catalog, translation and purchase services described in Section 6 when the corresponding feature is used.

3. Purposes of Processing

We process data to create and secure accounts; authenticate users; verify and replace linked phone numbers; deliver messages, media, groups, calls, Push-to-Talk and Waves; publish and deliver replies; show profile and permitted presence, battery, music and location information; match contacts; deliver requested verification messages, notifications and Live Activities; verify, activate, expire and revoke Premium entitlements; send recovery and security email; provide support; receive and investigate profile, Wave and reply reports; prevent abuse, spam and fraud; enforce feature, rate and talk-duration limits; suspend or ban accounts when necessary; maintain E2EE-capable delivery infrastructure; troubleshoot reliability; and comply with legal obligations.

We do not use Contacts, precise location, microphone audio, photos, messages, or music activity for advertising or third-party marketing.

We also process the limited data described above to relay Telepathy drafts, identify Wave language, provide requested translations, distribute Waves and replies, maintain account-history and verification-badge dates, evaluate voluntarily submitted survey feedback, measure product use and manage the frequency of optional reminders. Talder does not use communications or music data to train its own AI models.

4. Legal Bases for EEA/UK Processing

Where GDPR or similar law applies, we rely on:

• Contract: account authentication, requested phone verification, requested communications (including enabled Telepathy), groups, message history, requested transcription/translation features, purchases, support, and core service delivery.
• Consent: optional Contacts access and matching, live/background location, music integrations, optional sharing controls, and device permissions where consent is required. You may withdraw consent in Talder or iOS Settings without affecting earlier lawful processing.
• Legitimate interests: service and network security, narrowly scoped diagnostics, account-history accuracy, evaluation of optional survey feedback and limited product-use measurement where legally permitted, fraud and abuse prevention (including telephone-line checks), rate limiting, reliability, and protecting users and our legal rights. We balance these interests against your rights and expectations; this basis does not replace prior consent where the law requires it.
• Legal obligation: records or disclosures required by tax, accounting, consumer, court, law-enforcement, or other applicable law.

Account credentials and core communications are necessary to provide the requested account-based service. If you do not provide them, Talder cannot provide those features. Optional data is not required for unrelated features.

Consent, when required for non-essential analytics or promotional notifications, must be specific to that processing. Accepting these Terms, receiving this policy or granting an unrelated device permission is not a substitute for that consent.

5. Sharing with Other Users

Your username, custom ID, profile image, styling, badge and account-history date where present may be visible to other users, including non-friends. Eligible profile cards can appear in Home discovery suggestions, with language used to prioritize relevant suggestions and activity/block rules limiting eligibility. Messages, media, modified or unmodified voice audio, group content, Waves, replies and related delivery metadata are shared with the recipients or audience selected by the feature and its visibility settings.

Presence, activity, friends-list visibility, talk/call history visibility, battery status, Now Playing data and precise location are shared according to the applicable setting and feature state. Phone matching follows the linked-number rules in Section 2 and has no separate discoverability switch in the current app. The choice to share location is distinct from whether a recent coordinate is available: friends may see that sharing is enabled even when your current position cannot be obtained. No privacy control can remove copies another person already captured, exported, recorded, or stored outside Talder.

Read, delivery and listened indicators communicate supported conversation activity to other participants; they can be delayed by offline use, reconnects or older app versions. Copying text or an ID uses the device clipboard. The resulting copy can outlive the original message and is subject to the operating system’s clipboard permissions and any clipboard access you allow to other apps.

Telepathy: After an invitation is accepted and Telepathy is active with a friend, the text you type can be transmitted through our server and displayed to that friend before you press Send, including text you later edit or delete. You can disable Telepathy for that relationship. The live draft is not saved by this relay as an ordinary sent chat message, but the other person may have already seen or captured it.

Waves may reach users who are not your friends through the service’s feed rules. Reply settings control who can submit new replies; making that setting stricter does not erase replies already received or make the Wave itself private. Blocks, hidden-content choices and moderation can restrict availability. Music activity is delivered to authorized friends and may appear in profile cards, chat headers, lists and Wave replies, but a visible music badge does not grant other users access to your private music account.

6. Service Providers and Third Parties

We disclose only the data needed for the relevant service to:

• Apple: iOS platform services, Sign in with Apple and credential validation/revocation, APNs, Push-to-Talk, VoIP, Location Push, Live Activities, MapKit, WeatherKit/geocoding, local Speech/Translation features, Apple Music, StoreKit and purchase verification.
• Google: Google Sign-In and on-device language identification with the technical software metrics described above.
• TikTok/ByteDance: optional TikTok Login.
• Last.fm: optional verification of your music-account link and retrieval of public listening information. Spotify Scrobbling is managed between you, Spotify and Last.fm; Talder does not receive your Spotify password for this feature.
• Music-catalog, metadata and artwork providers and their image hosts: optional retrieval using the limited music information described above. Spotify may also receive a request when you open a track link or manage a legacy connection.
• Cloud hosting and communications infrastructure providers: operation of the application server, real-time connections, network security and service logs, processing the traffic and operational records necessary to provide those services.
• Database and media-storage providers: storage and delivery of account records, relationships, settings, messages, profile/chat images, recorded audio, Waves, surveys and related service data.
• Transactional email, telephone-verification and SMS-delivery providers, their delivery partners and telecommunications carriers: email addresses or phone numbers, verification/security messages, code-validation references and delivery records needed for the requested action. A verification provider can create its own phone-linked identity record; this is distinct from your Talder sign-in account.
• Telephone-validation and fraud-prevention providers, when screening is enabled: the number and country needed for the limited line-type check described in Section 2.
• A European-hosted product-analytics service: the manually selected pseudonymous events and ordinary connection information described above, for product measurement and reliability.
• Third-party AI translation infrastructure: transcript text and source/target languages for a requested Wave translation, not the audio recording or account credentials. The translation relay does not add a separate persistent content store; results can be cached with the Wave. This processing provides the requested translation and is not a separate authorization to train models on your content.
• Linked websites, image hosts and external apps: the network requests needed to generate link previews, load artwork, open a link or hand content to an app you choose.

These recipient categories include cloud-software, data-storage, analytics, authentication and telecommunications businesses established in the European Economic Area and the United States, with international processing as described in Section 11. The analytics project uses European hosting; this does not mean that every provider or support operation is confined to Europe. You can contact us for information about the actual recipients of your data and the transfer safeguards that apply.

Providers process data under their own terms and, where they act for us, applicable data-processing commitments. We select providers whose contractual and security commitments are intended to protect personal data consistently with this policy and applicable law. We may also disclose narrowly necessary information to professional advisers, authorities, or affected parties when required by law or necessary to investigate abuse, fraud, security incidents, or threats to safety and rights.

We do not sell or rent personal data.

7. Security and Encryption

We use password hashing, TLS for client-server transport, signed Apple transaction verification, session authentication, access controls, rate limits, encrypted storage fields for supported data, and operational security monitoring.

Talder includes E2EE-capable infrastructure, but its general rollout is currently disabled. Until E2EE is enabled for a supported flow, content is protected in transit using TLS but is not end-to-end encrypted, and the server may process content as necessary to provide the service.

When a supported E2EE rollout is enabled, E2EE-capable clients encrypt supported content before upload. Servers may still process sender, recipient, group, time, message type, delivery/read state, key version and other necessary metadata. Unsupported, legacy, compatibility, notification, and rollout-disabled flows are not end-to-end encrypted. E2EE private keys are intended to remain in device Keychain/app-group storage; the server stores public keys and encrypted key envelopes.

No system is completely secure. Protect your device and credentials, and contact us if you suspect unauthorized access.

8. Retention and Account Deletion

We keep identifiable data only while needed for the purposes above, using these criteria:

• Active account, profile, settings, relationships, groups, message history and associated media are retained while the account or content remains active and the data is needed to provide the service.
• Pending registration data is periodically removed when verification is not completed. Password-reset secrets are hashed, expire quickly, and stale reset requests are removed.
• Phone-verification codes normally expire after five minutes. Completed, expired, cancelled or failed verification records become eligible for scheduled batch cleanup after 30 days; unresolved delivery records may remain while their outcome is reconciled. Keyed proof fingerprints used to prevent verification replay become eligible for cleanup after 180 days. Expired rate-limit windows are also cleaned up. A verified phone link remains until replaced, the account is deleted, or a deletion request is handled under applicable law.
• Deleting a Talder account removes its local-service phone links and verification challenges, but does not automatically delete a phone-linked identity held by a verification provider. Such provider records require separate handling and may remain under the provider’s applicable retention and legal obligations. Contact us for assistance with a request concerning them. Limited replay-prevention fingerprints may remain for the security period above.
• Unfinished SMS-resumption records are discarded when next read after expiry or when the flow is resolved; setup-progress markers can remain until setup is completed or reset. Phone-error diagnostics use a separate protected local queue of up to 64 events; only events no older than seven days are eligible for sending after authentication when connectivity permits. Expired entries are discarded when the queue is read or maintained. Local files can remain while the app is not running. Diagnostics contain restricted error/status/correlation data, not phone numbers, codes, credentials or contact lists. Server-log retention is separate.
• Survey answers remain linked to the account while needed to evaluate that campaign and are removed when that account is deleted. Aggregated results that no longer identify a person may be retained. Support conversations and email reports are retained as needed to respond, follow up, resolve disputes and meet applicable obligations; contact us about deletion.
• Device and push tokens are replaced or removed when invalid, disconnected, disabled, or no longer needed.
• Security, rate-limit and operational logs are retained according to incident, reliability and provider-log lifecycle needs, then deleted or aggregated when no longer necessary.
• Reports, moderation decisions, suspension or ban records, and related safety evidence are retained only as long as needed to review reports, protect users, enforce the Terms, resolve disputes, prevent repeat abuse, or meet legal obligations.
• Purchase and original-transaction claim records may remain after account deletion where needed to meet accounting or legal obligations, prevent a transaction from being claimed by multiple accounts, resolve refunds, or investigate fraud. Active entitlement links are disabled on deletion.
• Waves normally expire from active availability 24 hours after publication. Each text or voice reply has a separate 24-hour lifetime from its own publication, so it can remain available after its parent Wave expires; the minimum parent context needed to show those replies may remain temporarily. Expiry is not a guarantee that all database, moderation, cache, backup or media copies disappear at that instant. Media deletion is queued and retried; technical records may be compacted later. The translation cache follows the Wave’s expiry and deletion.
• Last.fm account links remain until you disconnect them in Talder or delete the account. Incomplete authorization flows expire after approximately ten minutes. Current-listening and catalog data use limited caches rather than a permanent Talder listening-history archive.
• Reminder-attempt history is cleaned up after 35 days; scheduling preferences and state remain while needed for the account’s notification service. Account deletion removes that account’s reminder records and clears its friend reference in other users’ reminder histories.
• Pseudonymous product-analytics events are retained according to the analytics project’s applicable retention period and the continuing need to measure the product, then deleted or irreversibly aggregated when no longer needed. The local queue is bounded and cleared when account-isolation or exclusion rules apply. Deleting a Talder account does not automatically erase previously sent analytics events, because those events use an installation identifier rather than the account ID; contact us for assistance with a request relating to them.

Account deletion from the App removes or deactivates primary account records, relationships, messages, group membership, device tokens, Last.fm links and pending authorization flows, legacy Spotify credentials and associated active service data. It also initiates cleanup of the account’s Wave media and related records and revocation of stored Sign in with Apple credentials where applicable. Deleting Talder or disconnecting Last.fm does not delete an external Last.fm or Spotify account or its listening history. Content already delivered may remain on recipients’ devices. Residual media objects, caches and backup copies may persist until provider lifecycle, backup-expiration and technical cleanup processes complete; they are not used for a new purpose during that period. Some records may be retained when law, dispute preservation, fraud prevention, or safety obligations require it.

9. Your Choices and Rights

In Talder and iOS Settings you can edit profile data; control friend requests, activity, friends-list and talk-history visibility; disable battery, music and location sharing; disconnect supported integrations; manage notifications and device Contacts access; block users; report profiles, Waves and replies; delete supported content; and delete your account. You can replace a linked phone number after verifying the replacement. The current app does not provide standalone phone removal or a separate switch to disable matching of a linked number; contact us for a deletion or objection request.

You can disable Telepathy with an individual friend, choose who can reply to Waves, and control supported notification categories globally or for a particular friend, including low-battery and Wave-reply alerts. Talk suggestions and friend-activity reminders have separate controls in notification settings. Disabling music visibility is different from removing the Last.fm account link; neither action changes the privacy of your public Last.fm profile.

Depending on applicable law, you may request access, correction, deletion, restriction, objection, portability, information about safeguards, or withdrawal of consent. Email [email protected] from or with enough information to verify the account. We may request limited additional verification and will respond within the period required by law, normally one month under GDPR.

You may object to processing based on legitimate interests, including limited product measurement, and to direct marketing. For installation-based analytics, we may need information about the relevant device and time period to locate events without linking unrelated users; we will not ask for your password. The absence of an in-app analytics switch does not remove your statutory rights.

You can decline to submit a survey or request access, correction or deletion of an account-linked response. You may also request correction of a historical account date and information about the specific providers that received your data, including relevant verification records held outside Talder. These requests are handled under the applicable access and deletion rules; changing this policy does not limit those rights.

You may complain to the supervisory authority where you live, work, or believe an infringement occurred. In Italy, the authority is the Garante per la protezione dei dati personali (garanteprivacy.it). Exercising a privacy right does not affect mandatory processing or the rights and safety of other people.

10. Device Permissions

Talder may request Microphone for calls, talks, voice recording and Waves; Speech Recognition where required by the supported local transcription path; Camera and Photos for QR scanning, profile and chat images; Contacts for optional on-device hashing and discovery; When In Use or Always Location for chat/map sharing and background updates; Media/Apple Music for Now Playing; Notifications for alerts and background wake features; and Face ID/Touch ID to confirm sensitive local actions such as account deletion.

The attachment gallery requests Photos access when first used; you can choose limited Photos access instead of full-library access and later change the selection in iOS. Album names, recent thumbnails, selection and camera previews are used locally to build the picker. Opening the picker does not automatically upload your library: selected images and captions are sent only when you confirm sending. Camera permission is requested for camera features; the still-photo camera does not itself require microphone access. Saving an image to Photos can require the corresponding save permission.

A one-time location attachment is different from ongoing location sharing. iOS location permission and the app’s sharing setting are distinct, and access can be revoked. A remembered map style or fallback map center is a display preference, not a new location measurement and is not sent as your actual location. When permission is missing, the location feature may show an explanation instead of a live map.

Background modes support audio, VoIP, Push-to-Talk, location, remote notifications and refresh tasks. You can revoke permissions in iOS Settings. Refusal disables only the dependent feature where technically possible.

11. International Transfers

Providers may process data in Italy, the European Economic Area, the United States, or other countries. Where a transfer from the EEA/UK requires safeguards, we rely as applicable on adequacy decisions, standard contractual clauses, provider participation in recognized transfer frameworks, and supplementary technical or organizational measures. You may request information about the safeguard applicable to your data.

12. Children

Talder is not directed to children under 13. A user must also meet the digital-consent age applicable in their country or have legally valid parental authorization where the service supports it. In Italy, consent-based information-society processing by a child under 14 requires authorization from the holder of parental responsibility.

If you believe a child is using Talder contrary to these requirements, contact [email protected] so we can investigate and take appropriate action.

13. No Advertising Tracking or Significant Automated Decisions

Talder does not sell personal data, serve behaviorally targeted advertising, or combine activity across unrelated companies’ apps and websites for advertising. We do not make decisions based solely on automated processing that produce legal or similarly significant effects.

Automated technical controls may temporarily rate-limit requests, reject invalid credentials or payloads, enforce feature and talk-duration limits, detect duplicate transactions, and protect service security. New registrations and email changes can be checked against disposable-email domains and domain-delivery records; these checks do not inspect your mailbox. Phone checks can reject an explicitly unsupported line type or a number already linked elsewhere. Successful code verification establishes control of the number at that time, not legal identity or age. Account restrictions may also follow moderation or safety review. You may contact support if you believe a technical control or account action affected you incorrectly.

14. Policy Changes

We may update this policy when the App, providers, or legal requirements change. We will update the date and provide prominent notice or request consent when required. A policy update does not itself authorize a new incompatible use of data; additional consent or another valid legal basis will be obtained where required.

15. Contact