Rechtliches

Datenschutzhinweis

Version 0.1 · gültig ab 8. November 2026

Dieses Dokument ist auf Englisch. Maßgeblich ist die englische Fassung.

Beta version v0.1. If it changes, we will tell you in the app.

This notice explains what personal data Talkalike collects, why, who it goes to, how long we keep it and what your rights are. It applies to the Talkalike app, to our website (talkalike.app) and to the waitlist on it.

The short version

Talkalike translates your messages, voice messages and calls with AI. To do that, what you write and say is sent to AI companies: OpenRouter and the model hosts it uses (DeepInfra and CoreWeave in the United States, Nebius in the Netherlands) for messages and voice messages, xAI for calls and as a backup, ElevenLabs for speech to text and AI voices, and Cartesia for AI voices in calls.
You choose whether to give that consent. If you do not, what you write and say is not sent to AI and is not translated; the other person sees your original words.
Talkalike does not use end-to-end encryption. Your messages are encrypted in transit; photos, videos, voice messages, files and backups are also encrypted when stored. Our server and our AI providers can read your messages so they can translate them.
We do not show ads, we do not sell your data, and we do not use analytics trackers.
Talkalike never records or saves your calls. ElevenLabs, which turns call speech into text, may keep logs of it under its own terms (see section 10).
Explicit photos, videos and voice messages are shown blurred or locked to everyone: a person whose age has been verified opens them with one tap, anyone else verifies their age first. Pictures of people who have given the consent above are checked by a model that runs on our own server; they never go to a third party for this. To open or send explicit content you verify your age once with Yoti, which does the check for us; we keep only the result, never a photo or a document (see section 6).
You can delete messages, switch off the chat memory, withdraw your consent and delete your account at any time.

1. Who we are

Talkalike is run by Friendify Ltd, a company registered in England and Wales (company number 16656938). Registered office: 128 City Road, London, United Kingdom, EC1V 2NX.

Friendify Ltd is the controller of your personal data. This means we decide why and how it is used and we are responsible for protecting it.

Privacy questions and requests: through our complaints form (Settings → About and legal → Complain, or without an account at chat.talkalike.app/complaints, linked from the footer of every page of our website).

We have not appointed a Data Protection Officer. Talkalike is a small invite-only beta; we will look at this again before it opens to the public.

2. Who can use Talkalike

Talkalike is only for adults aged 18 or over. During the beta you can only join with an invitation from an existing user. We ask people to invite only people they know who are 18 or over, and when you sign up you confirm that you are 18 or over. The waitlist on our website is for people aged 18 or over too; joining it does not give you an account.

Before you can open or send explicit photos, videos or voice messages, you verify your age once with Yoti (see section 6, "Explicit content: blurring and age checks"). This check is only for explicit content; it is not needed to sign up or to use the rest of Talkalike.

We do not knowingly collect data from anyone under 18. If we learn that an account belongs to someone under 18, we close it and delete its data. We keep only a one-way scrambled form (a "hash") of its email address, so it cannot be used to sign up again, and anything the law requires us to keep (see section 10).

3. The data we collect

Data you give us

Data	Examples
Account details	Username, email address, display name, profile photo, "About me" text, the language you read and write in, your settings.
Your messages and media	Text messages, photos, videos (including view-once and timed media), files, captions, reactions, stickers, your own custom emoji.
Nicknames	In a chat, either of you can give yourself or the other person a nickname, which only that chat shows instead of the display name. Both of you see both nicknames. Each time a nickname is set or removed, the chat shows a note saying who changed whose nickname, and to what.
Voice messages	The recording, its transcript, its translation and the AI voice version.
Calls	During a call with live translation, your voice is turned into text and translated as you speak. The captions and translated voice are sent to the other person in real time. Talkalike saves no audio, captions or translations from a call. ElevenLabs, which turns the speech into text, may keep logs of it under its own terms (see section 10). We keep a line in the chat saying that a call took place and how long it lasted, a record of the call (who called whom, when and for how long), and the record of the notice shown before translation and your answer.
"My voice" settings	The voice characteristics you choose (for example gender, age and tone) so that the AI voice that reads your messages suits you. These settings are not a recording of your voice.
Chat glossary and chat memory	Word pairs you and your contact add so that translations stay consistent, and the optional chat memory summary (see section 6).
Link previews	When a message contains a link, the preview card our server makes for it: the title, a short description, an image and, for some sites, the length of the video or song (see section 8).
Reports, complaints and appeals	What you tell us when you report content or a user, make a complaint or appeal a decision.
Consent records	Which version of our terms and notices you accepted, which consents you gave or withdrew, and when. The same for the notice shown before a translated call.
Age checks	Only if you verify your age to open or send explicit content. For each age check: its result (for example passed, failed or cancelled), the method Yoti used (only when it passed: a face age estimate, a digital ID or an identity document), when it was made and finished, and Yoti's session ID. On your account: whether and when your age was verified, and the method. Your face image, digital ID or identity document goes from your device to Yoti, not to us.

Data we collect automatically

Data	Examples
Technical data	IP address, device and browser type, app version, login times, error logs. Our server logs record errors and technical events, not the content of your messages.
Delivery data	Whether a message was sent, delivered and seen (you can switch "seen" and "online" off).
Push notification tokens	A token that lets us send notifications to your device.
Usage and cost records	How many minutes of transcription or characters of AI voice were used (including in calls), so we can control costs. These records do not contain message content and are not linked to your name or account.
Explicit-content marks	For each photo, video, GIF, sticker, custom emoji, profile photo, chat background, link preview image and voice message: whether it counts as explicit, unsure, clear or not checked; the model's score when our model checked it; and what set the mark (the model, the voice check, the sender, or someone who blurred it, never who). For a message: whether it is waiting for its sender's age check. See section 6.

If you visit our website without an account (talkalike.app, which explains Talkalike and shows the legal documents, or the legal documents and the complaints form in the app), our server's log records your request as it does every request: your IP address, the address of the page without anything after a "?", and what your browser sends with the request, such as its type (never the address of the page you came from). These pages set no cookie, and we do not count visitors or use analytics (see section 11).

If you join the waitlist

On our website you can put your email address on the Talkalike waitlist. We keep:

your email address (in lower case);
the language of the page you used, so we write to you in it;
when you joined, and whether and when we sent you the confirmation email;
a one-way scrambled form (a "hash") of the random code in your "Remove my address" link, never the code itself.

We ask for nothing else: no name and no age. We send a new address one confirmation email with a link to remove your address (none if our email service fails or too many people join that day: see section 10); if your address is already on the list, we do not send it again. We use your address only for the waitlist: the confirmation, and one email if we open Talkalike to more people. We do not share it with anyone and never use it for marketing; our providers handle it only as section 8 describes (the host of our server, and our email delivery service, which sends the emails).

To stop the waitlist being misused, our server counts how often it is used from one IP address (for IPv6, only the network part of the address) and how often one email address is entered (counted by its hash). These counts are kept only in our server's memory and are not written to our database; the request itself is in our server's log like any other (above).

Special category data (sensitive data)

People talk about everything in private chats. Your messages, voice messages and calls may include information about your sex life or sexual orientation, your health, your religion, your political views or other sensitive matters. Sexual content between consenting adults is an allowed use of Talkalike, and we translate it faithfully without softening it.

The law calls this special category data. We only send what you write and say to our AI providers with your explicit consent, which you can choose to give when you sign up (see section 5).

Your voice recordings are used to transcribe and voice your messages. We do not use your voice to identify you.

Data about other people

Your messages may contain information about other people, including the person you are talking to and people you mention. Please only share information about others where you have the right to do so.

4. Why we use your data and our legal basis

Data protection law requires a legal reason ("lawful basis") for each use.

What we do	Why	Lawful basis (UK GDPR / EU GDPR)
Create and run your account, log you in with an email code	To provide the service you signed up for	Contract (Art 6(1)(b))
Store and deliver your messages, media, voice messages and calls, and show the nicknames in a chat	This is the service	Contract (Art 6(1)(b))
Translate messages, the descriptions on link previews and your "About me" text, transcribe voice messages and calls, read translations aloud with an AI voice, using recent chat context and your glossary	This is the service; context makes translations accurate	Contract (Art 6(1)(b)) and, because the content may be sensitive, your explicit consent (Art 9(2)(a)). Without that consent, none of what you write or say is sent to AI.
Chat memory summary (optional, can be switched off)	To improve translation quality	Legitimate interests (Art 6(1)(f)) and your explicit consent (Art 9(2)(a)). Messages of a person who has not given that consent never go into the memory.
Send push notifications	So you know when a message or call arrives	Contract (Art 6(1)(b)); your device also asks your permission
Keep your email address on the waitlist, send you its confirmation email and, if we open Talkalike to more people, one email to tell you	You asked to be on the waitlist	Your consent (Art 6(1)(a)), given when you join. You can withdraw it at any time with the "Remove my address" link in the confirmation email, or through our complaints form, and we then delete your address
Keep the service secure, prevent abuse (including the limits on how often the waitlist can be used), keep nightly backups	To protect you and the service	Legitimate interests (Art 6(1)(f))
Check pictures with a model on our own server, and voice messages with our AI providers, to blur or lock explicit content (people whose age is verified open it with one tap, others verify first); hold explicit content from a sender whose age is not verified; let people mark or blur media (section 6)	To keep explicit content away from children and from anyone who has not shown they are an adult	Legitimate interests (Art 6(1)(f)); for what you send, which may show or describe your sex life, also your explicit consent (Art 9(2)(a)) in section 5: the checks cover your photos, videos, GIFs, stickers, custom emoji, profile photos, chat backgrounds and voice messages, and the consent's text names each of them and where it is checked. Nothing a person sends, pictures or voice messages, is checked unless they have given that consent to its current text (earlier texts did not name every kind, see section 5). Link preview images, which come from websites, are always checked. Without the consent nothing they send is checked and their media stays blurred or locked: people whose age is not verified must verify first, and people whose age is verified see it blurred until they open it with one tap. Pictures never leave our server for this.
Verify your age with Yoti before you open or send explicit content, and keep a record of each age check	To keep explicit content away from children, and to be able to show that we checked	Legitimate interests (Art 6(1)(f)) and, where the Online Safety Act 2023 requires age checks, legal obligation (Art 6(1)(c))
Handle reports, keep a separate evidence copy of reported content, remove illegal content, suspend or close accounts, handle complaints and appeals	To keep users safe and meet our online safety duties	Legal obligation (Art 6(1)(c)) under the Online Safety Act 2023, and legitimate interests (Art 6(1)(f))
Keep a one-way scrambled form (a "hash") of the email address of an account we closed for breaking our rules or because its owner is under 18	So the same person cannot sign up again	Legitimate interests (Art 6(1)(f))
Report child sexual exploitation and abuse to the National Crime Agency and keep the required evidence	Required by law	Legal obligation (Art 6(1)(c)); for sensitive and criminal offence data, the conditions in Schedule 1 to the Data Protection Act 2018 that allow processing to prevent and detect crime and to safeguard children
Keep records of consents, terms accepted, and the notice shown before live call translation	To prove we told you and asked you, as the law and our providers require	Legal obligation (Art 6(1)(c)) and legitimate interests (Art 6(1)(f))
Voice cloning (future, optional, see section 7)	To read your messages in a voice like your own	Explicit consent (Art 6(1)(a) and Art 9(2)(a))
Accounting and tax (only if paid plans start)	Required by law	Legal obligation (Art 6(1)(c))

We send service emails (your login code, our answers to reports and complaints, and, if you join the waitlist, its confirmation and at most one more email if we open Talkalike to more people). They carry no tracking: our logo is part of the email, and opening it loads nothing from anywhere. We do not send marketing emails. The one email we may send to the waitlist if we open Talkalike to more people is the one you asked for by joining, and you can remove your address at any time. If we ever want to send you marketing emails, we will ask first.

5. Your explicit consent to sensitive content

When you sign up, we show you two boxes, neither ticked in advance. The first is required: with it you confirm that you are 18 or over, agree to our Terms of Use and say that you have read this notice. The second is separate: with it you can give explicit consent to us sending what you write and say, which may include sensitive data, to our AI providers for translation, transcription and AI voices, including providers in the United States, and to us checking what you send for explicit content: your photos, videos, GIFs, stickers, custom emoji, profile photo and chat backgrounds with the model on our own server, and the words of your voice messages through the same AI providers that translate them (section 6). This box is optional.

If you gave this consent to an earlier text (the first named only translation, transcription and AI voices; the second added the check of photos and videos but did not name every kind we check), the app asks you once more, with two equally prominent choices: give consent to the current text, or withdraw it. Until you give consent to the current text, what you write and say is still translated under your earlier consent, but nothing you send, pictures or voice messages, is checked for explicit content, so it is treated as not checked (section 6). If you close the question without choosing, nothing changes and it is asked again the next time you open the app.

If you do not give this consent, or withdraw it later:

what you write, your voice messages and what you say in calls are not sent to our AI providers. They are not translated, transcribed or voiced;
the other person sees your original words, with a short note that you turned off translation;
your messages do not go into the chat memory;
your new photos, videos, other pictures and voice messages are not checked for explicit content, so they are shown blurred (voice messages locked) to everyone: people whose age is verified open them with one tap, anyone else has to verify first (section 6);
messages you receive are still translated, because that is the other person's content and they have given their own consent;
in a call, live translation stays off for both of you;
your existing messages are not deleted, and you can keep using Talkalike as a messenger.

Messages you write while consent is off stay untranslated even if you give consent again later.

You can give or withdraw this consent at any time in Settings. Withdrawing does not affect what we did before.

6. AI translation and automated processing

Talkalike uses AI to translate. This is automated processing:

Messages and voice messages are translated by an AI model (currently DeepSeek V4.1 Flash) that we reach through OpenRouter. OpenRouter only sends our requests to the model hosts we have chosen: DeepInfra (United States), Nebius (Netherlands) and CoreWeave (United States). If they are slow, fail or refuse, the same request goes to xAI's Grok model instead.
Calls are translated by xAI's Grok model, because it is fast enough for live speech.
To translate well, the model also receives up to the last 30 messages of the chat, your shared glossary, and, if it is switched on, the chat memory. Messages of a person who has not given the consent in section 5 are never sent as context.
Chat memory is a short summary of your relationship and the way you talk (for example nicknames and inside jokes). It is made automatically by the same AI services from your messages now and then. Both people in the chat can see it, edit it, delete it, and switch it off. When it is off, no new summary is made and the memory is not sent with translations; the messages written while it is off never go into the memory. Because it is made from your messages, it can touch on personal matters; you can read exactly what it says at any time. A voice message's transcript goes into the memory, and into the context of other translations, only once its check found it clear (section 6): never while it is locked, unsure, not checked or still being checked.
Nicknames set in a chat (section 3) are not sent to our AI providers and are not translated; the notes about nickname changes are not translated either, and the chat memory is made with your display names.
Search inside a chat does not use AI. When you search a chat, your search words go to our own server, which looks for them in the messages of that chat that you can see, both as the chat shows them to you and as they were written. Your search words are not saved to our database or logs, are never part of a web address, and are never sent to our AI providers. The answer tells your app only which messages matched, not their text.
Translations can be wrong. You can always see the original, see what the other person received ("Show what they got"), ask for a new translation, and in calls tap "Wrong translation" to have a sentence translated again.
AI translation does not make decisions about you that have legal or similarly significant effects. We do not use AI to profile you for advertising or anything else. So the rules on solely automated decision-making (Article 22) do not apply. The explicit-content checks below decide automatically whether a picture or voice message is blurred or locked (and so whether a person whose age is not verified must verify to open it), and whether explicit content from a sender whose age is not verified waits (and is deleted after 7 days if they do not verify). We do not think this has legal or similarly significant effects on you; you can always verify your age to send it, and you can complain to us (section 13).
We do not scan your private chats for illegal content. People at Talkalike only look at content that has been reported to us (see our Complaints and Reporting policy). The explicit-content checks below are an age gate, not moderation: nobody at Talkalike looks at their results, and they are not used for reports, decisions about your account or anything else.

Explicit content: blurring and age checks

Sexual content between consenting adults is allowed (see our Acceptable Use Policy), but explicit photos, videos and voice messages are shown blurred or locked to everyone. A person whose age has been verified opens them with one tap; anyone else verifies their age first.

What is checked. Photos, videos, GIFs you upload, your own stickers and custom emoji, profile photos, chat backgrounds, the images on link previews, and voice messages. A file is checked only when it is a common photo or video format (such as JPEG, PNG, GIF, WebP, HEIC or MP4); other files, including other picture formats and pictures inside documents or archives, are not checked and are not blurred. Audio sent as a file is not checked, so it stays hidden for people whose age is not verified. Text messages, captions, calls (including video), the built-in stickers and GIFs from GIPHY are not checked or blurred; GIPHY's results are limited to its "PG-13" rating.
A model on our own server. Pictures are checked by an image recognition model that runs on our own server (for a video or a moving image, several frames). Your media never goes to a third party for this check, and no copy is kept for it. The model gives a score: a high score counts as explicit, a middle score as unsure, and both are blurred. This happens only for people who have given the consent in section 5. Without it, nothing they send is checked and it is treated as not checked. The same goes for the pictures of someone whose consent is to an earlier text, until they give consent to the current one (section 5). Link preview images come from websites, not from a person, and are always checked.
Voice messages. When a voice message is translated, the AI provider that translates it (see above) also says, in the same answer, whether the words are sexually explicit. When it is not translated (for example because you both read the same language), we make one short extra request to the same AI providers, with only the transcript and its language (no chat, memory or glossary). Both happen only with the sender's consent in section 5, given to its current text (until then the translation is still made, but the provider is not asked about the words). Without it, or if the provider fails, refuses or does not answer, the voice message counts as not checked. A voice message with no words counts as clear.
While a check runs (usually a few seconds), and whenever something could not be checked, it is blurred or locked like explicit media (see "Who sees what"). If the sender's age is not verified, the other person sees "Sending" until the check is done, whatever their own age.
Who sees what. You always see your own media as usual. A person whose age is verified sees explicit, unsure and not-yet-checked media blurred (a voice message locked), marked "Explicit content", and opens it with one tap on "Show"; it then stays open on that device until the app is closed or reloaded. Profile photos, chat backgrounds, custom emoji and the stickers and GIFs in the picker are the exception: a person whose age is verified sees them as usual. Everyone else sees a plain blurred surface instead, marked "Explicit content", which starts the age check when tapped; their device gets no image data for it. A locked voice message has no recording, transcript, translation or AI voice for them, only its length. Instead of such a profile photo they see initials, instead of such a background the default one. Chat list and notification previews of such media say only the kind, such as "Photo" or "Voice message", whoever reads them. Files are the exception for a person whose age is verified: a file (also a photo or video we could not process, which is shown as a file) is shown as its row with its name and downloads with one tap, without a blur; for everyone else such a file is hidden as above. A link preview whose image is hidden or blurred offers no "Play" (the website's player could show the same image) until "Show" opens it; the link itself still opens.
Marking your own media. When you send a photo, video or GIF you can mark it as explicit content. If your age is not verified, the app asks you to verify first, and the message waits on your device until you do.
Blurring for everyone. You can blur a photo, video, GIF or sticker that the other person sent, and they can do the same with yours: from then on everyone sees it blurred (a person whose age is verified opens it with one tap). You cannot blur your own media, or media you have sent yourself (it would not stop the check that may hold it). This cannot be undone. We record that someone blurred it, not who.
Explicit content from someone whose age is not verified. If a message with explicit media (a photo, video, GIF, sticker, a picture or video sent as a file, or a voice message) is sent by someone whose age is not verified, and the model or the voice check finds the media explicit, the message is not delivered, whoever made the media (for example a sticker someone else made): the other person sees "Sending" and none of its content, its caption or its voice until the sender verifies. If the sender does not verify within 7 days, the message is deleted for both people (a copy kept as evidence after a report stays, see section 10). Separately, a profile photo, chat background, or a sticker, GIF or custom emoji saved in a chat's lists, that is found explicit while its owner's age is not verified is shown only to its owner until they verify, wherever it appears (also in a message someone else sends); the same goes for an explicit photo its owner sent before these checks existed. A message its owner sends with it waits as described above.

Age checks with Yoti. The first time you want to open or send explicit content, the app explains the check and, if you continue, sends you to Yoti, which checks that you are over 18 for us as our processor. You choose how: a face age estimate, a digital ID, or a photo of an identity document. These are methods listed by Ofcom for age checks. Your face image, digital ID or document goes from your device straight to Yoti. Our server then asks Yoti for the result and keeps only the result (passed, failed, cancelled and so on), the method when you passed, the dates and Yoti's session ID (section 3). We send Yoti only a random reference for the check, the address in our app to send you back to and your app language; Yoti also sees your IP address and device information. We do not send Yoti your name, email address or messages, and we do not keep any photo or document. What we keep is described in section 3 ("Age checks") and section 10. You only need to do it once; if a check fails or is cancelled, nothing changes and you can try again later (up to 5 times a day).

7. Voice cloning (not available yet)

In future we may offer an optional feature that reads your messages in a voice like your own. It will only be created from a recording you make yourself in the app, only with your separate explicit consent, and you will be able to delete it with one tap, including from the provider's systems. We will update this notice and ask for your consent before it starts.

8. Who receives your data

We do not sell your data. We share it only with the providers that help us run Talkalike, and only what each one needs.

Provider	What they do	Where	What they receive	Their role
OVHcloud (our contract is with OVH Limited, United Kingdom)	Hosts our server and our call server	France (Gravelines), in the European Economic Area	Everything stored in Talkalike; photos, videos, voice messages, files and backups are encrypted when stored	Processor
OpenRouter	Passes message, voice-message and chat-memory requests to the AI model, with zero data retention	United States	Message text, recent chat context, glossary, chat memory; for the explicit-content check of a voice message that is not translated, its transcript and language alone (section 6)	Processor
DeepInfra, Nebius and CoreWeave (through OpenRouter)	Run the AI model that translates messages and voice messages, writes the chat memory and checks voice messages for explicit content	DeepInfra and CoreWeave: United States; Nebius: Netherlands	The same requests, through OpenRouter	They receive our requests from OpenRouter
xAI (Grok)	Translates call sentences; translates messages, writes the chat memory and checks voice messages for explicit content when OpenRouter cannot	United States	Call sentences (text) with recent chat context, glossary and chat memory; when it is the backup, the same as OpenRouter	Processor
ElevenLabs	Turns voice messages and live call speech into text; reads translated voice messages aloud with an AI voice	United States	Voice message audio, live call audio, text to be read aloud	Processor
Cartesia	Speaks translated sentences in calls with an AI voice	United States	Translated call sentences (text)	Processor
Yoti	Checks that you are over 18 when you want to open or send explicit content (section 6)	United Kingdom (where Yoti processes the check is being confirmed in its data processing agreement)	From your device: your face image, digital ID or a photo of your identity document, whichever you choose, and your IP address and device information. From us: a random reference for the check, the address to send you back to and your app language. Never your name, email address or messages	Processor. If you prove your age with a digital ID app, that app's own terms also apply between you and its provider
Our email delivery service	Sends your login code, our answers and the waitlist emails	See section 9	Your email address and the email we send	Processor, under a data processing agreement
Web Push services (run by your browser maker, for example Google, Mozilla or Apple)	Deliver notifications to your browser	Varies	An encrypted notification they cannot read. It contains the sender's name (their nickname in that chat, if they have one) and, unless you turn off previews in Settings, the start of the message as you would see it	They only carry the encrypted notification
Google LLC (Firebase Cloud Messaging), only when the Android app launches	Wakes the Android app when something new arrives	United States / global	A notification with no message content (only its type and an ID) and a device token	Processor

Our server is in Gravelines, France.

GIPHY. The GIF tab connects your phone directly to GIPHY (owned by Shutterstock, Inc., United States). Before it does so for the first time, the app tells you and asks you to continue. When you open GIF search, GIPHY receives your IP address and information about your device and, when you search, your search words. Receiving a GIF also loads it from GIPHY: when someone sends you a GIF from GIPHY (or you see one in a chat or among your favourites), your phone fetches it from GIPHY's servers, so GIPHY receives your IP address and information about your device, even if you have never used GIF search yourself. We never see your GIF searches. GIPHY uses this data under its own privacy policy as a separate controller, not on our behalf. We store only the ID and the web address of a GIF you send or save as a favourite.

Link previews. When a message contains a link, our server (not your phone) makes a preview card for it: a title, a short description, an image and, for some sites, the length of the video or song.

For Spotify, YouTube and X (Twitter) links, our server asks the platform's own services for the card (for X also its embed service at twimg.com). For Instagram links it asks Meta's oEmbed service when we have set that up, and otherwise reads the Instagram page. For Apple Music and every other link, it reads the linked page itself. Those sites receive the link and our server's IP address; they do not receive your IP address, your name or your messages. They use the request under their own terms.
The card's image is copied to our server, so your phone does not load it from the other site.
If the sender of the link has given the consent in section 5, the card's description is translated into the reader's language by our AI providers (as in section 6, without the rest of the chat). The link and the title are not sent to them.
Spotify, YouTube, Apple Music and Instagram cards can play the song, video or post in the chat. The player loads from that site (for YouTube, from its privacy-enhanced youtube-nocookie.com address) only when you tap Play; that site then receives your IP address and information about your device and uses them under its own privacy policy.

Other disclosures. We may also share data:

with the National Crime Agency, the police or other authorities where the law requires it (for example reports of child sexual abuse, see section 10) or to protect someone's life;
with Ofcom, the UK data protection regulator or a court where the law requires it;
with our professional advisers (for example accountants) under confidentiality;
with a buyer or successor if our business is sold or reorganised, who must protect your data in the same way.

How we limit what providers keep.

OpenRouter: every request asks for zero data retention and refuses hosts that use data for training, so it only goes to model hosts that do not keep prompts.
xAI: we use xAI's zero data retention setting, so xAI does not keep requests after answering them.
ElevenLabs: we have switched off ElevenLabs' use of our data to improve its models, and we ask ElevenLabs to delete each transcript and each AI voice it makes for us as soon as we have it.
Cartesia: we have opted out of Cartesia's use of our data for training.

None of our providers may use your content to show you ads.

9. International transfers

Your data is stored on our server at OVHcloud, in Gravelines, France (in the European Economic Area). Some providers are in the United States, so your data is transferred there. The law requires safeguards for these transfers:

Provider	Safeguard for UK users	Safeguard for EU users
OVHcloud (server in France)	The UK's adequacy regulations for EEA countries	Within the EEA
OpenRouter (US), and through it DeepInfra (US), Nebius (Netherlands) and CoreWeave (US)	International Data Transfer Addendum to the EU Standard Contractual Clauses ("UK Addendum"), in OpenRouter's data processing agreement	EU Standard Contractual Clauses, in OpenRouter's data processing agreement
xAI (US)	UK Addendum, under xAI's published data processing terms (being confirmed)	EU Standard Contractual Clauses, under xAI's published data processing terms (being confirmed)
ElevenLabs (US)	UK Extension to the EU–US Data Privacy Framework ("UK–US data bridge"); ElevenLabs' data processing agreement also includes the UK Addendum	EU–US Data Privacy Framework (and Standard Contractual Clauses in its agreement)
Cartesia (US)	UK Addendum, under Cartesia's published data processing terms (being confirmed)	EU Standard Contractual Clauses, under Cartesia's published data processing terms (being confirmed)
Yoti (UK)	None needed if Yoti processes the check in the UK (being confirmed); otherwise the safeguards in its data processing agreement	The European Commission's adequacy decision for the UK
Google LLC (US, Android app only)	UK Extension to the EU–US Data Privacy Framework	EU–US Data Privacy Framework
Our email delivery service	If it is outside the UK and the EEA, the safeguards in its data processing agreement (such as the UK Addendum)	If it is outside the EEA, the Standard Contractual Clauses in its data processing agreement

If you are in the EU, your data comes to us in the UK under the European Commission's adequacy decision for the UK.

You can ask us for a copy of the safeguards.

10. How long we keep your data

Data	How long
Messages, media, voice messages	Until you or the other person delete them, or the account is deleted. "Delete for me" removes a message from your view; "Delete for both" removes it for both of you and from our server.
Nicknames and the notes about nickname changes	A nickname is kept until either of you changes or removes it, or the chat or that person's account is deleted. A note about a nickname change stays as a record in the chat: neither of you can delete it for both, and "Delete for me" hides it from you only. It is deleted with the chat, or with the account of the person who made the change. If someone reports a message or a person in that chat, the evidence copy keeps both people's nicknames in that chat and the notes among the messages it copies (see "Reports and their evidence copy" below).
View-once and timed photos and videos	Deleted from our server when they have been viewed or their time is up. If never opened, deleted after 14 days. They are not included in backups.
Calls	Talkalike saves no audio, captions or translations (for ElevenLabs, see "At our providers" below). The call line in the chat is kept like a message. The call record (who, when, how long) is deleted with the chat or the account.
Chat memory and glossary	Until deleted by either person in the chat, or the chat or account is deleted.
Nightly encrypted backups	Kept for 7 days. Data you delete disappears from backups within about 8 days (the last backup made before you deleted it is kept for 7 days).
Link previews (title, description, image and the description's translations)	One card per link, shared by every message that has the link. Deleted within about 7 days after the last message with that link is deleted.
Account details	Until you delete your account. We do not delete inactive accounts during the beta.
Waitlist (your email address, language, dates, and the hash of your removal code)	Until you remove it with the link in the confirmation email, until you sign up to Talkalike with that address, or 12 months after you joined, whichever comes first; we may remove it sooner. If we could not send you the confirmation email (for example because our email service failed, or too many people joined that day), only 7 days after you joined; you can join again after that. If more than 2,000 addresses are entered in 24 hours, the ones after that are not stored at all, although the page thanks you; you can join again later. The same happens when one mailbox is entered more than three times in 30 days (an address with a "+tag", and for Gmail with or without dots, counts as the same mailbox). A job on our server deletes entries within about 10 minutes of their time.
Server logs (no message content)	Each service keeps only a fixed amount of log, so older lines are overwritten as new ones arrive.
Records of the notice shown before live call translation, and your answer	5 years (required by ElevenLabs' speech-to-text terms)
Consent records and terms accepted	For as long as your account exists, and after it is deleted until 5 years have passed since each record was made, to show we met the law
Age check records (result, method, dates, Yoti's session ID)	For as long as your account exists, and after it is deleted until 5 years have passed since each check was made, to show we checked. Your account's "verified" mark goes with the account
Explicit-content marks	As long as the photo, video or other media they belong to
Explicit content waiting for its sender's age check	Until the sender verifies their age (then it is delivered), or deleted for both people after 7 days
Reports and their evidence copy	Until 6 months after the report is closed. If we reported it to the National Crime Agency, at least 1 year, longer if the NCA asks us to keep it.
Complaints and appeals (what you wrote, the email address you gave and our answer)	Until 3 years after the complaint or appeal is closed, also after the account is deleted. Open complaints are kept until they are closed.
Records of our decisions	As long as we need them to handle the matter and to show how we handled it. We review them regularly and delete what we no longer need.
Hash of the email of an account we closed for breaking our rules or because its owner is under 18	For as long as the ban applies. It cannot be turned back into the email address.
Child sexual abuse reports to the NCA	A record of our report (our report number, the NCA's reference and the date, with no content) for 5 years, also after the report itself is deleted; the content, the information sent, the reasons for our decision and the related user data we hold for 1 year (regulations made under the Online Safety Act 2023 on reporting child sexual exploitation and abuse, SI 2026/268, reg 8)
At our providers	OpenRouter and its model hosts: not kept (zero data retention). xAI: not kept (zero data retention). ElevenLabs: we delete the transcripts and AI voices of voice messages that we create there; ElevenLabs may keep debugging and moderation logs under its own terms. For live call translation, unless its zero data retention mode is switched on for our account (an enterprise option), ElevenLabs may keep logs of the call speech it turns into text, under its own terms. Cartesia: as set out in its data processing agreement. Yoti: Yoti says it deletes the face image used for an age estimate straight away; how long it keeps the rest of a check (for example the image of an identity document, and the session data) is set in its data processing agreement, which we are confirming. Google (Firebase tokens): until we delete them, and from Google's backups within 180 days.

Legal hold. If content has been reported to us, we keep a separate evidence copy of it, and we keep its files even if someone uses "Delete for both", the timer of timed or view-once media runs out, or the account is deleted. Only the people who review reports can see it, and we keep it only for the times above and only for that purpose.

Account deletion. When you delete your account, we permanently delete your account details, your messages, media, voice data, custom emoji and the memory of your chats, subject to the legal hold above and the backup period. Age check records stay for the period in the table above. Messages you sent are deleted from our server, including from the other person's side of the chat. The other person keeps the messages they wrote.

Closed accounts. If we close an account for breaking our rules, the person can still sign in only to see our decision, appeal it or delete the account. If they delete it, we keep only the hash of the email address described above, anything under the legal hold above, and the records the table above says we keep after an account is deleted (consent records, age check records, records of the call notice, and complaints and appeals, each until its period ends).

11. Data stored on your device

The app stores some data on your phone or computer so that it works:

a login cookie that keeps you signed in;
a local copy of your recent messages and a queue of messages waiting to be sent, so the app is fast and works offline;
your display settings (such as data saving in calls);
your push notification subscription.

These are strictly necessary for the service you asked for, so we do not ask for separate consent. We do not use analytics or advertising cookies.

Our website (talkalike.app). It sets no cookie, stores nothing in your browser and has no service worker; if you pause its animations, that choice lasts only while the page is open. It loads nothing from other sites: its fonts, pictures and scripts come from our own server. Joining the waitlist sends our server the address you enter, the page's language and an extra form field that people never see and that stays empty (it helps us spot automated sign-ups); leaving it sends the code in your link and the page's language (section 3).

The app's public pages when you are not signed in. In the app, the legal documents and the complaints form set no cookie and do not install the app's service worker (the part of the app that runs in the background for notifications and offline use) while you are not signed in. This applies only to those pages: the sign-in page, invite links and the app install the service worker, and if you have used the app in this browser before, what it stored there stays.

12. Your rights

You have the right to:

access your data and get a copy;
correct data that is wrong;
delete your data;
restrict how we use it;
object to uses based on legitimate interests;
data portability: get the data you gave us in a machine-readable format. During the beta we provide this by hand on request;
withdraw consent at any time, where we rely on consent;
not be subject to solely automated decisions with legal or similarly significant effects (we do not make such decisions).

A chat belongs to two people. When you ask for a copy, we may need to protect the other person's rights too.

To use your rights, use our complaints form (Settings → About and legal → Complain, or without an account at chat.talkalike.app/complaints) or the in-app Settings. We answer within one month. In some cases the law lets us extend this or pause the time limit while we wait for information we need from you; we will tell you if we do.

13. How to complain

Complain to us first. You can complain about how we use your personal data with our complaints form (Settings → About and legal → Complain, or without an account at chat.talkalike.app/complaints).

We acknowledge your complaint within 30 days of receiving it.
We look into it without undue delay, and we keep you updated.
We tell you the outcome when we finish.

(This follows section 164A of the Data Protection Act 2018, in force since 19 June 2026.)

Complain to the regulator. If you are not happy with our answer, or at any time, you can complain to the UK data protection regulator, the Information Commission (formerly the Information Commissioner's Office, ICO). If you live in the EU, you can complain to the data protection authority where you live (in Spain, the Agencia Española de Protección de Datos, AEPD).

14. Security

Connections use TLS encryption. Photos, videos, voice messages, files and backups are also encrypted when stored. Message text is stored in our database without a separate layer of encryption.
There is no end-to-end encryption. Our server and our AI providers process your messages in readable form to translate them.
You log in with a one-time code sent to your email, so please keep your email account secure.
You can hide message text on your lock screen.
If there is a data breach that is likely to cause a risk to you, we report it to the regulator within 72 hours where required, and we tell you without undue delay if the risk is high.

15. Changes to this notice

If we change this notice in a way that matters, we will tell you in the app before the change takes effect. If a change needs your consent, we will ask for it.

Friendify Ltd · registered in England and Wales · company number 16656938 · 128 City Road, London, United Kingdom, EC1V 2NX