Privacy policy

Who is responsible

The controller is 安之, a private individual in Zurich, Switzerland (“we”). You can reach us at hello@tinglang.app, or at support@tinglang.app for help with your account.

We follow the Swiss Federal Act on Data Protection (FADP) and, where it applies to people in the EU or EEA, the General Data Protection Regulation (GDPR).

The Tinglang app

• Everything you capture in the app (captions, translations, recordings, courses, practice and review history, settings) is stored in one folder on your Mac. It is not sent to us. The app has no analytics.
• Speech recognition and translation run on your Mac with Apple's frameworks. The first time, macOS may download speech or translation assets from Apple; it asks you first, and Apple's privacy policy applies.
• If you sign in from the app, it connects to api.tinglang.app to read your account and plan. Signing in from the app is optional; nothing you captured is sent.
• If you add an AI provider and generate an AI course, the app sends the transcript's text to that provider, only after you confirm the host it goes to. Your API key stays on your Mac and is sent only to that provider. The provider's own terms and privacy policy apply.
• YouTube clips play in YouTube's official embedded player, which connects to Google; Google's privacy policy applies.

Your account

When you create an account we store your email address and, if you sign in with Google or GitHub, the name and profile picture they share with us. Sign-in is provided by Supabase (Supabase, Inc.); our Supabase project stores its data in Sydney, Australia. For security, Supabase keeps records of sign-ins and active sessions (time, IP address, browser).

If you subscribe to Pro, we also store your plan, its status and billing period, and the customer and subscription IDs Stripe gives us. When the official cloud service launches, we will record how much of your monthly allowance you use.

Payments

Payments are processed by Stripe. You enter your payment details on Stripe's pages; we never see your full card number. Stripe processes payment data, including for fraud prevention, under its own privacy policy. Stripe sends us the payment and subscription status and, for invoices, the billing details you give it.

Email

Sign-in codes and service emails are sent through Resend (Resend, Inc., USA), which processes your email address and the message to deliver it.

Mail you send to support@tinglang.app or hello@tinglang.app is forwarded by Cloudflare to our mailbox at Google (Gmail). We use your address and message to reply, and keep the correspondence as long as that takes.

This website

Hosting. The website and api.tinglang.app run on Cloudflare (Cloudflare, Inc., USA). To deliver pages and keep the service secure, Cloudflare processes technical data such as your IP address, browser type, the page requested and the time of the request.

Analytics. We use Cloudflare Web Analytics to count visits. It does not use cookies, does not fingerprint you and does not track you across sites. It records the page you visited, the site that referred you, your browser, operating system and device type, and an approximate country derived from your IP address. We only see aggregate figures.

Cookies and local storage. The site sets one cookie, NEXT_LOCALE, which remembers the language of the last page you opened for the browser session. When you sign in, your session is kept in your browser's local storage so you stay signed in. Your choice of light or dark appearance is kept there too. None of these are used for tracking or shared with anyone.

Fonts are served from this website; your browser does not contact Google Fonts.

Why we process data

We process account and payment data to provide the account and the subscription you asked for (GDPR Art. 6(1)(b)), keep payment records because accounting law requires it (Art. 6(1)(c)), and process technical and analytics data to run the site securely and understand how it is used, which is our legitimate interest (Art. 6(1)(f)). We do not sell personal data or use it for advertising.

Where data is processed

Cloudflare, Resend and Stripe may process data in the United States and other countries; Supabase stores our account data in Australia. Where data leaves Switzerland or the EEA, it is protected by the safeguards these providers offer, such as standard contractual clauses in their data processing agreements or certification under the Swiss-U.S. and EU-U.S. Data Privacy Frameworks.

How long data is kept

Account data is kept while your account exists and deleted within 30 days after you ask us to delete the account. Payment and invoice records are kept for ten years, as Swiss accounting law requires. Aggregate analytics are kept for as long as the Cloudflare account exists. Cloudflare and Supabase keep technical logs for a limited time under their own rules. Emails are deleted once they are no longer needed.

Your rights

You can ask for access to your personal data, and for it to be corrected, deleted, restricted or handed over in a portable format; you can object to processing and withdraw any consent you gave. To delete your account, write to support@tinglang.app from the address you signed up with. For anything else, write to hello@tinglang.app.

You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU or EEA, to your local data protection authority.

Cloud services

Official cloud transcription and AI courses aren't available yet. Before they launch, this policy will be updated to say what they process.

Changes

We'll post changes on this page and update the date at the top. If a change matters for your account, we'll also tell you by email.