Privacy Policy

Talkard is a flashcard app for learning languages, along with the website talkard.app. Both are run by Pedro Henrique Ferreira da Costa Damião, an individual based in Juiz de Fora (MG), Brazil.

Under the Brazilian General Data Protection Law (Law No. 13,709/2018, “LGPD”), Pedro Henrique Ferreira da Costa Damião is the controller of the personal data described in this policy and also acts as the data protection officer. For anything about privacy, write to privacy@talkard.app.

If you are in the European Union, the European Economic Area or the United Kingdom, you also have the rights under the General Data Protection Regulation (GDPR) described in this policy.

This policy covers the Talkard app for Android (and for iPhone, once released) and the website talkard.app. It explains what data is processed, why, who it is shared with and how you can exercise your rights.

Talkard was built to work without an account and without a server of its own: almost everything you do in the app never leaves your phone.

To work, the app keeps the information below only in your device’s storage. It is not sent to us and we have no access to it.

• Decks, words, translations and example sentences you create.
• Study results: right and wrong answers, dates and the text of the answer you typed or that speech recognition transcribed. They feed spaced repetition, the stats and your day streak.
• Your settings, such as theme, app language, time per card, pronunciation speed and reminder time.
• The last known status of your subscription, so the app works offline.

If you uninstall the app or clear its data in your phone settings, this information is deleted and we cannot recover it.

When you study by voice, the app asks for access to the microphone (and, on iPhone, to speech recognition). The audio is used only while you study, to transcribe and check your answer. Talkard does not record, keep or send the audio to us.

Transcription is done by your phone’s system speech recognition service. The app prefers on-device recognition. When it is not available for a language, the system may send the audio to the provider’s servers (Google on Android, Apple on iPhone), which handle it under their own policies: Google and Apple.

The app may suggest downloading the offline recognition pack for a language. That download is made by your phone’s system.

This permission is optional. If you deny it, you can study normally by typing, and you can withdraw it anytime in your phone settings.

To play the pronunciation, the app sends the text of the card to your phone’s system voice engine. This is a feature of the operating system and, depending on the installed engine, it may use the internet, under the provider’s policy.

The reminder is a local notification scheduled on your phone. It is only turned on if you enable it in Settings and allow notifications. We do not use remote (push) notifications or notification identifiers.

When you export a backup, the app creates a file with your decks, cards, sentences and results and opens the system share sheet. The file goes wherever you choose to save or send it, under your control and the rules of the service you use. It is not encrypted: keep it like any personal file.

If Android automatic backup is on for your phone, the system itself may include the app’s data in your Google account backup, according to your settings and Google’s policy. You control this in your phone settings.

The Pro subscription is purchased and billed through Google Play (or the App Store, once the app comes to iPhone). We never receive your card number, name, email or any other payment details.

To validate purchases and unlock Pro, we use RevenueCat, a service of RevenueCat, Inc. (United States), which processes the data on our behalf. When you open the app or return to it (to check whether Pro is active), open the Plans screen, buy, restore or manage your subscription, the app sends RevenueCat:

• a random, anonymous identifier created in the app, not linked to your name or your Google account;
• the purchase data received from the store: product, date, price, currency, store country, purchase receipt and subscription status;
• technical data needed for the connection, such as IP address, operating system, app version and device language.

RevenueCat uses this data to confirm the purchase with the store, tell the app whether Pro is active, let you restore purchases, show the subscription management center and give us aggregate reports, such as the number of active subscriptions. We do not use this data for advertising. RevenueCat’s policy: revenuecat.com/privacy.

Google Play also processes the purchase data, under Google’s privacy policy.

The website talkard.app is hosted by Vercel Inc. (United States). Like any server, it logs technical data about each visit (IP address, browser, requested page, date and time) to deliver the pages, protect the site from abuse and investigate errors. These logs are temporary.

The talkard.app domain uses Cloudflare, Inc. (United States) DNS only to point the address to Vercel: site traffic does not go through Cloudflare, and it sets no cookies.

The site has no forms, no sign-up and no advertising cookies. Fonts are served by the site itself.

With your permission, given in the cookie notice, the site also uses:

• Google Analytics 4, by Google LLC, to measure visits and where they come from: pages viewed, time on page, link clicks, device and browser type, language, approximate location (city and country, estimated from the IP address) and the referring page. Analytics 4 does not log full IP addresses. Data is kept for 14 months and sharing for advertising is turned off.
• Microsoft Clarity, by Microsoft Corporation, to understand the site’s usability through heatmaps and anonymous session recordings: mouse movement, scrolling, clicks and taps, screen size, device and browser, approximate location and pages visited. Clarity masks typed text. Recordings are available for up to 30 days and aggregate data for up to 13 months.

If you reject, none of these tools is loaded. If your browser sends the Global Privacy Control signal, we treat it as a rejection. You can change your mind anytime under “Cookie preferences” in the site footer; when you withdraw consent, these tools’ cookies are deleted. Policies: Google and Microsoft.

We process personal data on the following legal bases of the LGPD (art. 7) and, for people in Europe, of the GDPR (art. 6):

• Performance of a contract (LGPD, art. 7, V; GDPR, art. 6(1)(b)): validating and keeping your Pro subscription, through RevenueCat and the store.
• Consent (LGPD, art. 7, I; GDPR, art. 6(1)(a)): Google Analytics and Microsoft Clarity on the site, and the microphone and notification permissions in the app. You can withdraw consent anytime.
• Legitimate interests (LGPD, art. 7, IX; GDPR, art. 6(1)(f)): hosting logs, to keep the site secure and working, and aggregate subscription reports, to run the app.
• Legal obligation and exercise of rights (LGPD, art. 7, II and VI; GDPR, art. 6(1)(c)): keeping records when the law requires it or to defend ourselves in legal proceedings.

We do not sell, rent or share personal data for advertising. The data described above is processed only by the providers that make the app and the site work:

• Google: Google Play, speech recognition on Android, Google Analytics and the mailbox (Gmail) that receives messages;
• Apple: App Store and speech recognition on iPhone, once the app comes to iOS;
• RevenueCat: subscription management;
• Microsoft: Clarity;
• Vercel: website hosting;
• Cloudflare: domain DNS and forwarding of emails sent to the @talkard.app addresses.

We may also provide data to authorities when required by law or a court order.

These providers may process data outside Brazil and your country, mainly in the United States. Under art. 33 of the LGPD, the transfer is based on performing the contract with you (item IX), for subscriptions, and on your specific consent (item VIII), for the site analytics tools.

These providers offer contractual data protection safeguards, such as standard clauses and, for data coming from Europe, the clauses approved by the European Commission or the EU-U.S. Data Privacy Framework.

• Data on your phone: until you delete it in the app, clear the app’s data or uninstall it.
• Subscription data at RevenueCat: while the subscription exists and then for as long as needed to comply with the law and exercise rights, usually up to 5 years. You can ask for deletion earlier, where the law allows.
• Google Analytics: 14 months. Microsoft Clarity: recordings for up to 30 days and aggregate data for up to 13 months.
• Hosting logs: for the short period set by Vercel for security and operations.
• Emails you send us: for as long as needed to reply and then for up to 5 years, for the possible defense of rights.

Under the LGPD (art. 18), you can ask for: confirmation that we process your data; access to it; correction; anonymization, blocking or deletion of data that is unnecessary or processed against the law; portability; deletion of data processed with consent; information about who we share it with and about the option of not consenting; and withdrawal of consent. You can also object to processing based on legitimate interests.

People in Europe also have the GDPR rights (arts. 15 to 22), including the right to lodge a complaint with their country’s data protection authority.

App data stays on your phone: you can view, change, export or delete it in the app anytime. For requests about subscription data, write to privacy@talkard.app with your Google Play order number (it starts with GPA.), shown on the receipt Google sends you. That way we can find the record at RevenueCat without any other data about you.

We reply within 15 days. You can also complain to Brazil’s National Data Protection Authority (ANPD).

Talkard is meant for people aged 13 and over and is not directed at children. Teenagers aged 13 to 17 should use it with their parents’ or guardians’ knowledge, and purchases must be made or approved by them. Google Play offers parental controls for this.

We do not knowingly collect data from children. If you learn that a child has sent us data, write to privacy@talkard.app and it will be deleted.

Communication between the app and RevenueCat, and between the site and your browser, is encrypted (HTTPS). On the phone, the app’s data sits in the system’s protected space, accessible only to the app. We recommend keeping your screen lock on, your system up to date and your backups in a safe place.

If a security incident could bring relevant risk or harm, we will notify you and the ANPD, as required by law.

We may update this policy when the app, the site or the law changes. The date at the top shows the current version. Relevant changes will be announced in the app or on the site before they take effect.

Questions, requests or complaints about privacy: privacy@talkard.app. Controller and data protection officer: Pedro Henrique Ferreira da Costa Damião, Juiz de Fora (MG), Brazil.