Legal

Privacy Policy

Effective September 26, 2026

This policy explains what SparrowTalk processes when you use its Android and iOS apps, public website, account library, optional cloud features, subscriptions, and support.

In brief: a verified SparrowTalk account is required. Your Account Library synchronizes through Firebase so it can be restored and used across your devices. Gemini translation and Google Cloud Text-to-Speech are separate optional processing features that you choose after onboarding and can turn off later. We do not sell personal data or use it for targeted advertising.

1. Scope and roles

SparrowTalk is responsible for the personal data it decides to process for the app and website. Apple, Google, Firebase, RevenueCat, Hugging Face, and other service providers may separately act under their own terms for store, authentication, hosting, model-download, or infrastructure services. This policy does not replace those providers’ notices.

2. Information we process

Account and authentication

We process your Firebase account identifier, display name, email or provider address, linked sign-in providers, email-verification status, session and security metadata, and timestamps needed to create, authenticate, secure, and delete your account. Passwords, Apple credentials, and Google credentials are handled by Firebase or the sign-in provider; SparrowTalk does not receive your plaintext password or provider credential.

Account Library and preferences

The Account Library includes files and text you import, document titles and metadata, reading position and progress, learning cards and vocabulary, goals, learning and support languages, cloud-processing preference, and synchronization records. SparrowTalk stores this data in Firebase and Google Cloud for your account. The active device also keeps an offline replica so supported reading can continue without a connection. Device-only selections and settings remain local where they are not part of the Account Library.

Optional contextual translation

If you allow optional cloud processing and request rich translation, SparrowTalk sends the selected word or text, its current and adjacent sentence context when available, the target language, your authenticated account identifier, and quota/security metadata through SparrowTalk’s Firebase Functions to Google’s Gemini service. SparrowTalk does not send an entire document merely to translate one selection. If cloud processing is off, SparrowTalk does not make a Gemini request and uses an available on-device translation path instead.

Optional cloud narration

If you allow optional cloud processing and choose a cloud voice, SparrowTalk sends the text segments to be spoken, voice and language selection, your authenticated account identifier, and quota/security metadata through SparrowTalk’s Firebase Functions to Google Cloud Text-to-Speech. Generated audio is used for requested playback and is not added to your Account Library. Public cloud-voice catalogue metadata may load without sending your document text. If cloud processing is off, cloud voices remain visible but locked and SparrowTalk prevents preview and synthesis requests; system and downloaded neural voices remain available.

On-device language and voice features

Supported translations may run with Google ML Kit on your device. System narration uses operating-system voices. Optional neural voices run on your device after a model download. When you request a model, your device connects to Google or Hugging Face infrastructure; those hosts may receive ordinary connection information such as IP address, request time, device or app agent information, and the requested model file.

Subscriptions and usage allowances

Apple or Google handles checkout and full payment-card information. SparrowTalk and RevenueCat process a pseudonymous app/customer identifier, store, product and offering, entitlement and trial status, purchase-period dates, renewal or billing state, restore and transfer information, store-management link, and usage needed to enforce voice, translation, and learning-card allowances. SparrowTalk does not receive your full payment- card number.

Diagnostics, integrity, and security

Firebase Crashlytics may process crash traces, diagnostic state, app version, device and operating-system information, installation/session identifiers, and timing needed to find and repair failures. We seek to avoid placing document text, passwords, or authentication secrets in diagnostic records. Firebase App Check, Apple App Attest or DeviceCheck, and Google Play Integrity may process app, device, installation, and integrity signals to distinguish genuine app requests from abuse. Server logs may contain account request time, function name, coarse network information, pseudonymous identifiers, and security results.

App usage analytics

Firebase Analytics automatically measures app opens, active users, sessions, screen and feature engagement, approximate region, language, app version, operating-system and device characteristics, and pseudonymous app-instance identifiers. We use these measurements to understand adoption, improve the product, and evaluate reliability. SparrowTalk does not use Analytics for targeted advertising, and the Android app disables advertising-identifier collection and ad-personalization signals. The public website itself does not run Analytics.

Support and deletion requests

If you contact support, we receive the email address, message, headers, and attachments you choose to send. For an external deletion request, we also process the account address and verification correspondence needed to protect the account and document completion.

Public website

Firebase Hosting serves this website and necessarily receives ordinary request information such as IP address, time, requested path, browser agent, and security/network logs. The site contains no advertising tracker, marketing tracker, embedded third-party content, or non-essential cookie feature. We use your browser’s language preferences to choose a website language. If you explicitly select a language, we save only that preference in your browser’s local storage for future visits. It is not used for tracking and can be removed by clearing this website’s browser data.

3. Purposes and legal bases

Provide the service and perform our contract: authenticate your account, synchronize the Account Library, import and play content, preserve progress, provide learning features, administer subscriptions, and respond to service requests.
Your choice or consent where required: enable optional Gemini and cloud voice processing after a clear decision. You may withdraw that choice in Profile at any time for future requests.
Legitimate interests: secure accounts, prevent abuse and fraud, measure app adoption and engagement, diagnose failures, operate reliable infrastructure, and protect SparrowTalk and its readers, balanced against your rights.
Legal obligations and claims: comply with lawful requests, tax/accounting duties, consumer rules, and establish, exercise, or defend legal claims.

Where local law requires a different legal basis, we rely on the basis permitted there and provide any additional notice or choice that law requires.

4. Providers, recipients, and international transfers

We share information only as needed with these categories and providers:

Google, Firebase, and Google Cloud for authentication, database and file storage, synchronization, Functions, app analytics, app integrity, diagnostics, hosting, Gemini processing, ML Kit downloads, and cloud narration.
Apple for Sign in with Apple, App Store distribution, purchases, subscription management, integrity services, and platform voices.
Google Play for distribution, purchases, subscription management, integrity services, and platform components.
RevenueCat for subscription entitlement, offering, purchase-period, restore/transfer, webhook, and customer-record processing.
Hugging Face when you request an optional neural voice-model download.
Professional advisers, authorities, or transaction parties where reasonably necessary for law, safety, claims, or a legitimate business transfer subject to appropriate safeguards.

These providers may process data in countries other than yours. Depending on the countries involved, transfers rely on adequacy decisions, contractual safeguards, provider data- protection terms, or another lawful mechanism. Provider infrastructure can change, so we do not promise that all processing stays in one country.

5. Retention and deletion

Account and Account Library data is kept while your account is active and then deleted through the account-deletion workflow, subject to backup propagation and narrow legal/security exceptions.
Local account replicas remain on the active device until sign-out, account deletion, app data removal, or uninstall triggers their removal under the applicable flow.
Optional cloud request content and generated audio are handled ephemerally by SparrowTalk’s service; provider operational, safety, and abuse records follow the provider terms applicable to the service.
Firebase Crashlytics diagnostic event data is generally retained for up to 90 days, while de-identified or aggregated reliability results may be kept longer.
Subscription entitlement and usage records are kept while needed to provide access, prevent duplicate allowances or fraud, reconcile purchases, and meet legal obligations. Apple and Google retain store transaction records under their own rules.
Support and verified deletion correspondence is kept only as long as reasonably needed to answer the request, document completion, handle disputes, and meet legal duties.
A narrowly scoped deletion/security fence may remain briefly to reject late account writes, then expires. Provider backups and logs may take additional time to cycle out.

Account deletion removes the Firebase Authentication identity, Account Library and stored documents, reading and learning data, account preferences, SparrowTalk subscription access projection, queued RevenueCat customer record, and the active device’s account replica. Store-controlled purchase and transaction records are not deleted by SparrowTalk. Read the complete account-deletion process before proceeding.

6. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, receive portable data, withdraw consent or another optional choice, and complain to a data-protection or consumer authority. These rights can be limited by law and may require identity verification.

Change optional cloud processing at any time from Profile. Withdrawal affects future requests; it cannot recall text already submitted for an active request.
Delete individual documents and learning content in the app where available.
Delete your account in the app or submit a verified external request.
Manage or cancel an Apple or Google subscription through that store.
Email support.sparrowtalk@gmail.com for an access, correction, deletion, restriction, objection, portability, or other privacy request.

If you are in the European Economic Area, United Kingdom, or another jurisdiction with a supervisory authority, you may lodge a complaint with the authority where you live or work. We encourage you to contact us first so we can try to resolve the issue.

7. Security

SparrowTalk uses encrypted transport, authenticated Firebase rules and Functions, platform-backed app-integrity checks, account-scoped storage, limited provider access, and deletion fences. No service can guarantee absolute security. Protect your email/provider account and device, and contact support if you suspect unauthorized access. Never send a password, one-time code, provider credential, or authentication token to support.

8. Age eligibility

SparrowTalk is intended for people who are 13 or older. It is not directed to children under 13. If the law where a younger person lives sets a higher age for making privacy choices independently, they may use SparrowTalk only with the authorization that law requires from a parent or guardian. SparrowTalk does not claim to operate an age- or parental-verification system. Contact us if you believe an ineligible child created an account so we can investigate and take appropriate action.

9. Changes to this policy

We may update this policy when SparrowTalk, its providers, or legal requirements change. We will change the effective date and provide any additional notice required by law. A material change to optional cloud processing may require a new in-app decision before those cloud features resume.

10. Contact

Privacy requests and questions can be sent to support.sparrowtalk@gmail.com.

Provider privacy information

SparrowTalk is operated by Andrii Afanasenko.