# Privacy policy

> Talklio collects as little as possible and deletes it fast. We never ask for your phone number or email, we can't read your messages because they're end-to-end encrypted, messages are deleted after 24 hours, and every space is deleted after 30 days. We don't sell data, show ads or use tracking cookies.

This policy explains what information Talklio ("we", "us") handles when you use talklio.app, and why. We've tried to write it the way we'd want it explained to us.

## Who we are

Talklio is operated from the United Kingdom. For anything about privacy, email [hello@talklio.app](mailto:hello@talklio.app). We're the data controller for the information described here.

## What we don't collect

- Your phone number, email address or real name
- Your contacts or address book
- The content of your messages, photo captions, photos, voice notes or calls (these are end-to-end encrypted and we can't read them)
- Advertising or tracking identifiers

## What we do handle, and why

| Information | Why we need it | How long we keep it |
| --- | --- | --- |
| Display names and avatar choices in a space | So people can pick their name when they join | Until the space closes (max 30 days) or the person is removed |
| A scrambled version of each password (hashed on your device, then hashed again by us) | To check logins without knowing your password | Until the space closes or the password is changed |
| Encrypted messages, photos and voice notes | To deliver them to the other person | 24 hours from sending |
| Message details: sender, chat, time, size, reactions, highlights, edits | To show the conversation correctly | 24 hours from sending |
| Online status, last seen time and read receipts | So you know when someone's around and has seen your message | Until the space closes |
| Call records (who called, when, how long) | To connect calls and show call history in the chat | 24 hours |
| Push notification addresses for your device | To send you notifications if you turn them on | Until you turn them off, log out, or the space closes |
| A hashed version of your IP address | To stop abuse (for example, too many spaces or logins from one network) | Up to 2 hours |
| Reports you send us, including any text you choose to include | To investigate abuse and keep people safe | Up to 90 days |
| Saved spaces, your login token and settings on your own device | So you stay logged in and the app remembers your preferences | Until you log out or clear your browser data. This stays on your device; we don't receive it |

On our public pages (not inside chats), we may use privacy-friendly, cookieless analytics that count visits in aggregate. It doesn't track you across sites or build a profile of you.

## Our legal basis

Under UK and EU data protection law, we rely on:

- **performing our contract with you** (running the chat service you've asked to use)
- **our legitimate interests** in keeping the service secure and free from abuse, and in understanding how many people visit our pages
- **legal obligations**, where we must act on or report certain illegal content

## Who helps us run Talklio

We use a small number of trusted providers. They process data only on our instructions:

- **Cloudflare** runs our chat servers, stores encrypted messages for up to 24 hours, and relays calls when a direct connection isn't possible. Cloudflare operates globally, so data may be processed outside the UK, under appropriate safeguards.
- **Vercel** hosts our website.
- **Apple, Google and Mozilla** deliver push notifications if you turn them on. Notification content is encrypted and only says things like "New message".

We don't sell or rent anyone's information, and we don't share it with advertisers.

## Children

Talklio is only for people aged 18 and over. If we find out a space involves a child, we delete it.

## Your rights

Depending on where you live, you may have the right to access, correct, delete or object to the use of your personal information, and to complain to a data protection authority. In the UK that's the [Information Commissioner's Office](https://ico.org.uk/).

In practice, most Talklio data deletes itself within 24 hours. You can also:

- delete any message you sent, at any time
- leave a space (guests) or delete a whole space (owners), which removes the data immediately
- log out on any device, which removes your saved login from that device

Because we don't know who you are, we may not be able to link a request to specific data unless you can show us the space you were in. Email [hello@talklio.app](mailto:hello@talklio.app) and we'll do our best.

## Security

We protect data with end-to-end encryption, encrypted connections, client-side password hashing and short retention. Our [security page](/security) explains the details, including the limits.

## Changes to this policy

If we change this policy in a meaningful way, we'll update the date at the top and, where it matters, explain the change on this page.

---
Source: https://talklio.app/privacy · Updated 2026-10-10