Privacy policy
Talklio collects as little as possible and deletes it fast. We never ask for your phone number or email, we can't read your messages because they're end-to-end encrypted, messages are deleted after 24 hours, and every space is deleted after 30 days. We don't sell data, show ads or use tracking cookies.
This policy explains what information Talklio ("we", "us") handles when you use talklio.app, and why. We've tried to write it the way we'd want it explained to us.
Who we are
Talklio is operated from the United Kingdom. For anything about privacy, email hello@talklio.app. We're the data controller for the information described here.
What we don't collect
- Your phone number, email address or real name
- Your contacts or address book
- The content of your messages, photo captions, photos, voice notes or calls (these are end-to-end encrypted and we can't read them)
- Advertising or tracking identifiers
What we do handle, and why
| Information | Why we need it | How long we keep it |
|---|---|---|
| Display names and avatar choices in a space | So people can pick their name when they join | Until the space closes (max 30 days) or the person is removed |
| A scrambled version of each password (hashed on your device, then hashed again by us) | To check logins without knowing your password | Until the space closes or the password is changed |
| Encrypted messages, photos and voice notes | To deliver them to the other person | 24 hours from sending |
| Message details: sender, chat, time, size, reactions, highlights, edits | To show the conversation correctly | 24 hours from sending |
| Online status, last seen time and read receipts | So you know when someone's around and has seen your message | Until the space closes |
| Call records (who called, when, how long) | To connect calls and show call history in the chat | 24 hours |
| Push notification addresses for your device | To send you notifications if you turn them on | Until you turn them off, log out, or the space closes |
| A hashed version of your IP address | To stop abuse (for example, too many spaces or logins from one network) | Up to 2 hours |
| Reports you send us, including any text you choose to include | To investigate abuse and keep people safe | Up to 90 days |
| Saved spaces, your login token and settings on your own device | So you stay logged in and the app remembers your preferences | Until you log out or clear your browser data. This stays on your device; we don't receive it |
On our public pages (not inside chats), we may use privacy-friendly, cookieless analytics that count visits in aggregate. It doesn't track you across sites or build a profile of you.
Our legal basis
Under UK and EU data protection law, we rely on:
- performing our contract with you (running the chat service you've asked to use)
- our legitimate interests in keeping the service secure and free from abuse, and in understanding how many people visit our pages
- legal obligations, where we must act on or report certain illegal content
Who helps us run Talklio
We use a small number of trusted providers. They process data only on our instructions:
- Cloudflare runs our chat servers, stores encrypted messages for up to 24 hours, and relays calls when a direct connection isn't possible. Cloudflare operates globally, so data may be processed outside the UK, under appropriate safeguards.
- Vercel hosts our website.
- Apple, Google and Mozilla deliver push notifications if you turn them on. Notification content is encrypted and only says things like "New message".
We don't sell or rent anyone's information, and we don't share it with advertisers.
Children
Talklio is only for people aged 18 and over. If we find out a space involves a child, we delete it.
Your rights
Depending on where you live, you may have the right to access, correct, delete or object to the use of your personal information, and to complain to a data protection authority. In the UK that's the Information Commissioner's Office.
In practice, most Talklio data deletes itself within 24 hours. You can also:
- delete any message you sent, at any time
- leave a space (guests) or delete a whole space (owners), which removes the data immediately
- log out on any device, which removes your saved login from that device
Because we don't know who you are, we may not be able to link a request to specific data unless you can show us the space you were in. Email hello@talklio.app and we'll do our best.
Security
We protect data with end-to-end encryption, encrypted connections, client-side password hashing and short retention. Our security page explains the details, including the limits.
Changes to this policy
If we change this policy in a meaningful way, we'll update the date at the top and, where it matters, explain the change on this page.
Sources
- Information Commissioner's Office ico.org.uk