Privacy Policy

TooTalk ("we", "our", "us") respects your privacy. This Privacy Policy explains what information we collect, how we use it, and the choices you have. TooTalk is built to be private by design: your chats are end-to-end encrypted and your data lives primarily on your own device.

Effective date: September 23, 2026

1. Information We Collect

• Account information: your email address, display name, username, "about" text, and profile photo. If you sign in with Google, we receive your name, email, and photo from Google.
• Optional phone number: if you enable contact discovery, we store only a one-way hashed (irreversible) form of your phone number so contacts can find you. We never store your raw phone number. You can hide your number from everyone in Settings, Privacy.
• Messages and media: TooTalk is local-first and end-to-end encrypted. Text, photos, voice notes, videos, documents and GIFs you send are encrypted on your device. Our servers only relay encrypted content until it is delivered, then delete it. We cannot read your messages.
• Camera, microphone and photos: with your permission we use your camera and microphone to take photos, record voice notes, and make voice and video calls, and your photo library to attach media. This is used only to create the message you choose to send.
• Location and live location: only when you tap "Location" or "Live location" do we read your device location to build that message. Live location sends periodic updates for the duration you pick (for example 10 minutes, 1 hour, 2 hours or 8 hours) and stops automatically when it expires, or immediately when you tap Stop. We never track your location in the background.
• Contacts: only when you tap "Share contact" do we open your device contact picker, and we access only the single contact you select.
• Voice and video calls: calls are peer-to-peer and encrypted. We process the technical signalling needed to connect a call. We do not record calls.
• Status (stories): statuses you post are delivered to the audience you choose and are automatically deleted after 24 hours, both from our servers and from your device. We record who viewed your status so we can show you the viewer list.
• Channels and feed posts: content you publish to a channel or to the public feed is, by design, visible to other people. Do not post anything there that you want to keep private.
• Notifications token: a push token so we can deliver message and call alerts.
• GIF search: when you search for GIFs, your search text is sent to GIPHY to return results.
• Advertising data: advertising identifiers and related data, as described in the Advertising section below.
• Subscription status: if you buy the ad-free subscription, we store the fact that your account has an active subscription. Payment is handled entirely by Google Play. We never see or store your card or bank details.
• Technical and usage data: app version, device type and identifiers, and limited diagnostics needed to operate and secure the service.

2. How We Use Information

• To provide and maintain the service: sign-in, messaging, calls, status, channels and feed.
• To deliver notifications for messages and calls.
• To let contacts who already use TooTalk find you, if you enable contact discovery.
• To show ads, and to stop showing ads if you have an active ad-free subscription.
• To keep the service safe: prevent spam, abuse and illegal content, and enforce our Terms.
• To comply with legal obligations.

We do not sell your personal information.

3. Permissions We Request

TooTalk asks for permissions only for features you use, and only when you use them:

• Camera: to take photos and for video calls.
• Microphone: to record voice notes and for voice and video calls.
• Photos and media: to attach images and documents you choose.
• Location: to send your location or live location when you choose to.
• Contacts: to let you pick a contact to share.
• Notifications: to alert you about messages and calls.

You can change or revoke any permission at any time in your device settings.

4. End-to-End Encryption

Your one-to-one and group messages are encrypted end-to-end using modern cryptography (X25519 key exchange with ChaCha20-Poly1305). The keys stay on your devices. Neither we nor anyone else can read the contents of your messages.

Please note that content you deliberately publish in public places, such as the public feed or a channel, is not private and is visible to others.

5. How Your Data Is Stored

• On your device: your chats, media, call history, settings and saved items are stored locally on your phone.
• Backup: if you turn on backup, a copy is stored in your own Google Drive account, which we cannot read.
• On our servers: only what is needed to run the service, such as your profile, hashed phone number (if enabled), push token, undelivered encrypted messages, public feed and channel content, and statuses for up to 24 hours.
• When you delete a message, chat, status or post in the app, the underlying media file is also deleted from your device so it does not linger in storage or in your backup.

6. Sharing and Third-Party Services

We share data only with the service providers needed to run TooTalk:

• Google Firebase: authentication and push notifications.
• Cloudflare: our backend, database and call relay infrastructure.
• Google AdMob: advertising, as described below.
• Google Play Billing: subscription purchases.
• GIPHY: only the text you type when searching for GIFs.
• OpenStreetMap: map previews for location messages.

We may disclose information if required by law, or to protect the rights, safety and property of our users or the public.

7. Advertising (Google AdMob)

TooTalk is free to use and is supported by ads. We use Google AdMob to show ads in the chat list, the feed, the channels list, between statuses, on app open and after a completed call. We do not show ads inside your private conversations.

• AdMob may use advertising identifiers and similar technologies to deliver and measure ads.
• Where required by law, for example in the EEA and the UK, we show a consent form before serving personalised ads. You can change your choice at any time in Settings, Privacy, "Ad privacy options".
• We do not share your messages, contacts or media with advertisers. We cannot, because they are encrypted.
• You can remove ads entirely by purchasing the ad-free subscription. See the Terms of Service for details.

Google's own practices are described in Google's Privacy Policy and in "How Google uses information from sites or apps that use our services".

8. Data Retention

• Encrypted messages awaiting delivery: deleted from our servers once delivered.
• Statuses: deleted automatically after 24 hours.
• Account data: kept while your account is active.
• If you delete your account, we delete your account data from our servers. Some limited records may be retained where required by law, or to prevent fraud and abuse.

9. Your Rights and Choices

• Access and correction: you can view and edit your profile in the app at any time.
• Deletion: you can delete your account and data from Settings, Account, Delete account, or by following the Account and Data Deletion page.
• Privacy controls: you can control who sees your last seen, profile photo, about and status, and who can message you, and you can hide your phone number and email from everyone.
• Ads: you can change your consent choices, or remove ads with the ad-free subscription.
• Blocking: you can block any user, which prevents them from messaging or calling you.

10. Children's Privacy

TooTalk is not directed to children under 13, or the minimum age required in your country. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us at iftikhar.digitalmarketer@gmail.com and we will delete it. See also our Child Safety Policy.

11. Security

We use end-to-end encryption, encrypted transport (HTTPS and WSS), authenticated API access, and server-side abuse controls. No method of transmission or storage is perfectly secure, but we work hard to protect your data.

12. International Transfers

Our service providers may process data in countries other than yours. Where that happens, we rely on appropriate safeguards for international transfers.

13. Changes and Contact

We may update this policy from time to time. Material changes will be announced in the app or on this page, and the effective date above will be updated.

Questions or requests: iftikhar.digitalmarketer@gmail.com