Privacy

Google or Apple sign-in

When these options are enabled and you choose one, Google or Apple verifies your identity and Supabase manages your Talkhike session using the identifier and email confirmed by the provider. Your Google or Apple password is not shared with Talkhike. Authorization is limited to sign-in and basic profile information; we do not request your contacts, Gmail, Drive or conversations. If you choose Apple Hide My Email, we use the private address supplied by Apple. A different address may belong to another account and does not automatically merge credits or history. Authorizing a provider sign-in does not accept the Talkhike terms.

Problem reports

If you send a report, we store its category, your optional explanation, app version, language and, if you choose, the related practice. Audio and conversation text are not attached automatically. Authorized staff review reports with enhanced authentication and access logging. The explanation is removed during maintenance after 90 days; metadata supports incident management. Deleting your account deletes your reports.

Data controller

Marcos Jiménez 48990675P C/ Concepción, 59, 41500 Alcalá de Guadaira, Sevilla, España support@talkhike.com

Data and purposes

Email and authentication manage your account; preferences adapt the interface; attempts, results and dates provide history, progress and streaks; credit transactions manage your balance and prevent duplicate charges. Voice, transcripts and your scene description support conversation and automated guidance.

Legal basis

Account and requested service functions need the data necessary to provide them. AI practice requires an explicit choice before sending content. Records retained under a legal obligation are limited to that purpose. The controller must document specific legal bases and security retention periods before production.

Recipients

Supabase provides authentication and storage. OpenAI receives voice for transcription and text for replies and guidance. ElevenLabs receives character reply text to generate speech; that text may reflect what you said. Do not provide sensitive data or information identifying other people. Processor contracts, regions, subprocessors and international transfer safeguards must be verified before production.

Retention

Guided and free practice transcripts and evaluations are stored encrypted until deletion is requested or the account is deleted. Free practice scenarios are also stored encrypted. Authorized staff can consult this content in the administration panel to manage and review practices, with specific permissions, enhanced authentication and access logs. Deleting a practice retains accumulated progress and usage records. Free practices do not expire automatically after 24 hours. Audio is processed temporarily and is not included in history as a recording. This does not mean providers have zero retention: their logs and backups may have different periods, pending contractual verification.

Deletion and a single welcome

After your confirmation, your sign-in account, sessions, conversations, results and progress are erased. A fingerprint of your verified email, protected by a private key, prevents another 15-credit welcome when registering with that address. It is not a plain email or anonymous data: it is a pseudonymous identifier limited to this check and retained while the promotion exists. Technical usage records are detached from the owner and content; unknown reservations are not reported as zero consumption. Legal bases and retention periods for abuse prevention, obligations or claims require final review before production. Technical deletion completion can be checked for 24 hours using a secret receipt saved on your device, removed when verification completes.

Control and rights

Delete practices in My practices and request account deletion in Account. You may exercise access, rectification, erasure, restriction, objection and portability where applicable, and withdraw consent where that is the applicable legal basis, without affecting earlier lawful processing. No waiver of these rights or irrevocable consent is required. You can exercise your rights by emailing support@talkhike.com. We will verify your identity proportionately; we will never ask for your password or sign-in codes. You may complain to the Spanish Data Protection Agency (www.aepd.es). Requests are generally addressed within one month; any lawful extension must be explained.

Permissions and decisions

The microphone is used only in practices you start. End the practice or revoke permission in system settings. Automated guidance can be wrong; it is not a diagnosis and does not make legal or similarly significant decisions about you. We do not show advertising. RevenueCat manages the information needed for purchases and subscriptions when enabled; Google Play processes payment. We do not receive your full card number. Session and preference storage support the functions you request.

Contact