Privacy Policy

Last Updated: May 29, 2026 · Effective Date: May 29, 2026

Talky ("the Service") respects your privacy and complies with applicable laws including the Korean Personal Information Protection Act (PIPA), EU GDPR, and Russian Federal Law 152-FZ. This Privacy Policy explains what information Talky processes, how it is used, and how it is protected.

1. Operator Information

• Operator: Yeong-Won Kim (Individual)
• Location: Republic of Korea
• Contact: bryan910508@gmail.com
• Data Protection Officer: Yeong-Won Kim

2. Information Talky Processes

2.1 Minimum Information for Account Creation (At Sign-Up)

• Anonymous user ID (randomly generated string)
• Display name (set by user, freely chosen)
• Backup code hash (for account recovery, never stored as plaintext)
• Public key (Curve25519 public key for E2E encryption of secret chats)
• Sign-up timestamp

2.2 Social Login (User's Choice)

Current iOS app: The default path is anonymous user ID + backup code. Continue with Apple links your account using Apple's identifier. Google / Kakao sign-in are coming soon; Google/Kakao bullets below apply only after those features are enabled.

If you use Apple / Google / Kakao login:

• Identifier provided by the chosen service (email is either not stored or stored as anonymous hash)
• Display name (optional, user can change)

2.3 Information for Message Delivery (Service Operation)

• Message content: Text, images, videos, voice, files (Firebase Firestore + Storage)
• Friends list: Friends added directly by you (we do NOT access device contacts)
• Channel activity: Subscribed channels, comments
• Online status: Last seen timestamp, "typing..." indicator (Firebase RTDB)
• Device token (FCM): Device identifier for push notifications

2.4 What Talky NEVER Processes ⭐⭐⭐

Unlike other messengers, Talky never processes the following:

• ❌ Phone numbers — Anonymous sign-up principle
• ❌ Email addresses — Backup code system makes email unnecessary
• ❌ Real names — Display names are user-defined (no real-name verification)
• ❌ Uploading/storing your phone contacts on our servers — We do not upload or store your phonebook in the cloud. (Your device may show a Contacts-related permission string; if a contacts-assisted feature exists, it is processed only on-device within that feature's scope.)
• ❌ Chat location sharing — No GPS-based location messages (no continuous location tracking)
• ❌ Advertising identifiers — IDFA, AAID never collected
• ❌ Behavioral analytics — Firebase Analytics is disabled
• ❌ Third-party tracking SDKs — Zero advertising/marketing SDKs
• ❌ App Tracking Transparency — Permission never requested

Designed for true anonymity.

2.5 User Protection Features (v1.0+) ⭐ NEW

Talky provides the following user-protection features:

Capture Feature (User-Initiated)

• Behavior: Activated only when you tap Chat → "+" button → "Screenshot" menu
• Storage location: Your device's Photo Library (iOS Photos)
• No server transmission: Captured images are NEVER sent to Talky servers
• Permission: Photo Library Add permission (NSPhotoLibraryAddUsageDescription) — requested only when capturing
• Friend nickname protection: If you have set a custom name for a friend, the capture briefly displays the friend's original account name in the saved screenshot (preventing fake screenshots / impersonation)

Screen Recording / AirPlay Detection

• Behavior: When iOS reports that screen recording or AirPlay mirroring has started, Talky detects this automatically
• Purpose: In chat rooms where you have set a custom name for a friend, the friend's original account name is shown automatically during recording (user protection)
• Not collected: The fact that recording/mirroring is occurring is processed only on your device and is NEVER transmitted to Talky servers
• No notification to other party: We do NOT send any "screenshot taken" notification to the other person, in any chat type (preserving user privacy)

2.6 Chat Message Translation (Optional, iOS 26+)

Applies only when you use full-chat or bubble translation. Message text is not sent to Talky servers or cloud AI for translation.

• How it works: On iOS 26+, Apple on-device Translation APIs process the text on your device.
• Purpose: Language conversion for your convenience only — not used for ads or profiling.
• Retention: Results are cached briefly in-app on your device; Talky does not store permanent server logs for translation.
• Unsupported: Translation is not available below iOS 26.

2.7 Crash and Error Diagnostics (Firebase Crashlytics)

• What may be sent: On crashes or errors, diagnostic data (device model, OS version, stack traces, etc.) may be sent to Google Firebase Crashlytics.
• Purpose: Stability and bug fixes only — not used for marketing, ads, or behavioral tracking.

3. Purpose of Processing

Talky processes information only for the following purposes and for no other purpose whatsoever:

🚫 Talky does NOT use personal information for marketing, advertising, sale to third parties, or any similar purpose.

4. End-to-End Encryption (E2E) Security

4.1 Secret Chats (Even the Operator Cannot Read Them)

• Algorithm: Curve25519 key exchange + AES-GCM 256-bit encryption
• Private key storage: Stored only in the device's secure storage (e.g., iOS Keychain) and never sent to servers
• No server access: Even the operator cannot decrypt secret chat messages
• Single device: Moving to a new device means previous secret messages cannot be read (intentional security design)

4.2 Regular Chats

• HTTPS/TLS communication encryption (in transit)
• Stored in Firebase Firestore (Google data center security standards)
• Plaintext storage on server: Regular chat messages are stored on the server and may only be disclosed in response to lawful legal requests. The operator does not read user messages and reviews system logs only for security incident investigation or legal requests
• For truly confidential conversations, please use Secret Chat (see 4.1)

4.3 Security Measures

• All communication via HTTPS/TLS 1.2 or higher
• User authentication through Firebase Authentication
• Unauthorized access blocked by Firestore security rules
• Passwords/backup codes stored as hashes only (no plaintext)

5. Retention Period

5.1 Manual Account Deletion

When you confirm Delete Account in Settings → Account & Security:

1. You are shown as a withdrawn user in chats you participated in
2. Server data (Firestore, Storage, Firebase Authentication, etc.) is permanently deleted immediately (cannot be undone)

5.2 Auto-Delete on Inactivity

If you enable it in Settings, your account may be deleted automatically after 30, 90, 180 (default), or 365 days without sign-in. This is separate from manual deletion.

6. Third-Party Sharing and Processing

6.1 Data Processors (Required Infrastructure)

6.2 Advertising / Marketing

• No data shared: Talky does NOT share user information with advertising or marketing companies
• No data sales: Talky does NOT sell user data in any form

6.3 Legal Requests for Information

Talky operates under the laws of the Republic of Korea and is legally obligated to cooperate with valid legal requests.

Information Talky Can Provide (Stored in Firestore or Firebase System Logs)

• User ID (e.g., gqczkwuu)
• Display name, profile photo URL
• Sign-up time, last seen time
• Contacts list (friend IDs the user has added)
• Blocked users list
• Channel subscription information
• Sign-up IP address (Firebase Authentication log, retained 30 days)
• Login IP address (Firebase system log, retained 30 days)
• Regular chat message content: Stored on the server and may be provided in response to lawful legal requests
• Regular chat media files (photos, videos)
• Channel posts and comments (public information)

Information Technically Impossible to Provide

• Secret chat message content: End-to-end encrypted; plaintext does not exist on the server, and the operator cannot decrypt it
• Secret chat media: End-to-end encrypted; exists temporarily on devices and is auto-deleted
• Encryption keys: Stored only on user devices and never transmitted to servers
• Passwords: Only hashes are stored; original cannot be recovered

Information Talky Never Processes

• Phone numbers: Not processed, by design (anonymous sign-up principle)
• Real names: Display names are user-defined; no real-name verification
• Email addresses: Not required (backup code system)
• Chat location sharing: No GPS-based location message feature
• Behavioral tracking: No marketing/ad analytics SDKs (Crashlytics: §2.7)

Legal Request Response Policy: Upon receiving valid court warrants or lawful requests under Korean Communications Privacy Act, Talky responds minimally within the scope of "Information Talky Can Provide" above. Regular chat messages are stored on the server and may be provided in response to legal requests, but Secret Chats are end-to-end encrypted and message content cannot be disclosed for any legal request. For truly confidential conversations, please use Secret Chat. All legal requests should be sent to bryan910508@gmail.com.

7. IP Address and System Log Processing

The Talky app does not directly collect, store, or analyze IP addresses. However, our infrastructure provider (Google Cloud Firebase) temporarily handles IPs for security monitoring and system stability:

7.1 Firebase Automatic System Logs

7.2 Operator Access to IPs

• The operator does not routinely analyze these system logs
• Logs are checked only for security incident investigation or valid legal requests
• The operator does not maintain a database of IP addresses

7.3 GDPR Data Download and IP

When you request "Download My Data," you receive Talky-stored information as JSON. IP addresses are NOT included in this download (Firebase system logs cannot be exported by the operator).

7.4 Rate Limiting (Spam Prevention)

To prevent spam/bots, IPs may be temporarily used (e.g., daily account creation limit per IP). Even in this case, IPs are auto-deleted after 24 hours and never permanently stored.

8. International Data Transfer

8.1 Server Locations

• Primary server: Seoul, Korea (Firebase asia-northeast3)
• Realtime Database: Singapore (Firebase asia-southeast1)
• Regardless of which country you connect from, data is stored in the above two regions

8.2 Russian Users (152-FZ Law)

Notice for Russian users:

• When using the Service, your data is stored on servers in Korea and Singapore
• This differs from Russian Federal Law 152-FZ requirement
• By using the Service, you are deemed to consent to this data transfer
• Data is protected by global standard security; secret chats use E2E encryption (operator has no access)

8.3 EU Users (GDPR)

EU users have the rights set forth in Section 9 in accordance with GDPR.

9. Your Rights

9.1 Available In-App

• View data: Settings → Account → My Information
• Edit data: Settings → Edit Profile
• Delete data: Settings → Delete Account
• Delete messages: Chat room → Message → "Delete for Everyone"
• Block user: Profile → Block

9.2 Available via Email Request

• Data download request (Data Portability)
• Request to stop processing
• Withdraw consent
• Recovery after manual deletion (generally not possible — contact us if deleted by mistake)

Send requests to bryan910508@gmail.com. We respond within 3 business days, and no later than 30 days.

10. Children Under 14

• Talky prohibits sign-up by users under age 14 (per Korean PIPA and US COPPA)
• Accounts identified as belonging to users under 14 are immediately deleted
• If you discover a child has signed up without parental consent, please report to bryan910508@gmail.com
• App Store age rating: 17+

11. Cookies and Tracking

• As a mobile application, we do not use web cookies
• We do NOT process advertising identifiers (IDFA, AAID)
• We do NOT request App Tracking Transparency permission

12. Security Incident Response

1. Operator initiates first response immediately upon discovery
2. Notify affected users within 72 hours (in-app + email)
3. Report to Korean Personal Information Protection Commission (if applicable)
4. For EU user impact, report to relevant supervisory authority per GDPR

13. Policy Changes

• We will notify you in-app of any changes to this policy
• Material changes: 30 days advance email notice
• Continued use of the Service after changes constitutes consent

14. Contact

• Email: bryan910508@gmail.com
• Response time: Within 3 business days, no later than 30 days

EU users may contact their local data protection authority. Korean users may also report violations to the Personal Information Dispute Mediation Committee (1833-6972).

Talky © 2026 Yeong-Won Kim. All rights reserved.