Privacy Policy

Last updated: September 25, 2026

Object Talk is an AI-powered visual intelligence and character entertainment application that lets you
photograph everyday physical objects, plants, packaging, and household items to receive AI-generated
character dialogue, multi-object comedic debates, and Origin Lens visual discoveries. Object Talk operates
using an anonymous app account and does not require an email address, phone number, password, or social sign-in.

Information we process

• Camera Images: Captured on-demand when you actively scan a single object,
launch a multi-object group debate (2 to 4 objects), or explore with Origin Lens. Images are transmitted
securely over TLS 1.3 to our backend and to our AI vision service provider solely to generate the requested
identification, educational provenance, and character dialogue. Images are processed ephemerally in volatile
server memory and discarded immediately upon completion of response streaming. We do not maintain a cloud photo
library of your scans.

• Device & Session Identifiers: A device-derived cryptographic identifier
(salted SHA-256 HMAC hash or secure install UUID) stored in hardware-backed secure storage (iOS Keychain /
Android EncryptedSharedPreferences via Expo SecureStore). Used to issue rotating 30-day JWT authentication tokens,
manage anonymous economy state, and protect against rate-limit abuse or fraud.

• Account & Economy State: Anonymous coin balances (daily allowance and
persistent coins), lifetime progression statistics, daily scan streak records, unlocked secret personas,
referral associations, and store purchase entitlement records.

• Purchase & Transaction Records: Store transaction IDs, order tokens,
and purchase receipts from Google Play processed via RevenueCat to
synchronize Pro subscriptions, manage consumable Day Pass coins, verify entitlements, and process refund clawbacks.

• Crash & Diagnostic Information: Operational error logs, stack traces,
operating system version, device model, and app release version transmitted to Sentry with strict privacy
safeguards (zero personal data, camera captures, or audio recordings transmitted).

Camera and image processing

Object Talk requests camera access solely when you actively capture an object for a scan, debate, or Origin Lens discovery.

We do not monitor your camera in the background, nor do we perform ambient surveillance or continuous video recording.
Images are processed in real time and discarded immediately from volatile server memory upon completion of response
generation. We do not store your camera captures in a cloud photo gallery.

Data stored locally on your device

When you save a scan or Origin Discovery to your Library, the image, origin details, transcript, and pinned status
are stored locally on your device in an on-device SQLite database and local file cache.

• Free Tier: Store up to 15 active memories and 3 keep-forever pins. When your
collection reaches 15 items, new scans automatically replace the oldest unpinned memory.

• Pro Tier: Enjoy unlimited memories and unlimited keep-forever pins. If a Pro
subscription lapses, excess memories remain safe in local SQLite under an archival shield without data deletion.

Your saved Library memories remain exclusively on your device and are never uploaded to our servers as a cloud photo library.
You can delete individual memories, perform batch deletions, or clear all locally stored data at any time via "Delete my data".

Third-party service providers & sub-processors

We share data only with essential technical service providers necessary to operate the application:

• OpenAI (AI Vision, Multimodal Reasoning & Speech Generation):
Processes camera images, text prompts, selected character personas (from 15 total personas), and language
preferences (across 13 supported global languages) in real time to generate character dialogue, Origin Lens
insights, and synthesized speech audio. Under OpenAI API enterprise terms, inputs and outputs are not used to train AI models.

• RevenueCat (In-App Purchases & Entitlements):
Processes anonymous app user IDs and purchase receipts from Google Play
to synchronize Pro subscriptions (1-month, 3-month, 6-month), manage consumable Day Pass coins (120 coins), and verify entitlement status.

• Sentry / Functional Software (Crash Diagnostics):
Processes technical error logs, stack traces, device model, and OS version when an unexpected crash occurs. Sentry is
configured with automated data scrubbing to ensure no personal information is transmitted. Retained for up to 90 days.

• Render & Supabase (Backend & Database Infrastructure):
Render provides encrypted cloud application hosting over TLS; Supabase (PostgreSQL) provides encrypted cloud database
storage with row-level security for anonymous coin balances, two-phase reservation locks, cryptographic device session
tokens, and purchase grant ledgers.

Audio and speech generation

Object Talk does not require microphone access and does not record your voice or background audio.
Microphone permissions are completely disabled and hard-blocked in the application manifest. Spoken audio is
synthesized server-side via text-to-speech AI and streamed to your device for playback. Temporary local audio
cache on your device is automatically cleaned up and garbage-collected.

Purchases and subscriptions

Object Talk offers optional auto-renewing Pro subscriptions (1-Month, 3-Month, 6-Month) and consumable purchases
(Day Pass / Instant 120 Coins) processed through Google Play.

Subscriptions automatically renew unless canceled at least 24 hours before the end of the current billing period.
Subscriptions can be managed or canceled directly in your Google Play Store account settings.

Deleting your Object Talk account does not automatically cancel an active Google Play subscription or issue a refund;
subscription management must be performed through Google Play.

What we do not do

Object Talk:

• does not require an email address, phone number, password, or social sign-in;

• does not sell, rent, or trade personal data to third-party data brokers or advertisers;

• does not request or use microphone / voice recording permissions;

• does not use advertising identifiers (AAID/IDFA) for cross-app tracking or targeted advertising;

• does not store your camera scans in a cloud photo library.

Data retention

We retain data only as long as necessary for legitimate technical, operational, and legal purposes:

• Camera Captures: Discarded from server memory immediately upon completion
of the inference response stream (ephemeral real-time processing).

• Local Library Memories: Preserved on your device in local SQLite storage
until you delete them or clear local data.

• Active Account & Economy Records: Retained in our database while your anonymous
account is active to maintain coin balances, daily allowances, streak milestones, and Pro entitlement status.

• Crash & Diagnostic Logs: Retained in Sentry for standard operational diagnostic
cycles (up to 90 days), containing no personal data.

• Post-Deletion Fraud Prevention: When an account is deleted, active account
records are permanently removed or anonymized. A one-way cryptographic SHA-256 HMAC hash digest of the device hardware
identifier is retained in our deleted device registry solely to prevent fraudulent repeat claims of one-time starter bonuses
and referral rewards, and purchase transaction records are preserved for store compliance, tax accounting, and refund clawback verification.

Delete your data

You can delete your Object Talk account and user data directly from within the app at any time:

1. Open Object Talk > Wallet (tap Coin / Energy balance at the top).

2. Scroll down to Data Privacy and tap "Delete my data".

3. Review the confirmation prompt and confirm.

This immediately invalidates your JWT session token, anonymizes your database record, resets coin balances,
and wipes all on-device Library history, cached thumbnails, and temporary media files.

You may also submit an external deletion request by emailing support@objecttalk.xyz or visiting our
public deletion portal at https://www.objecttalk.xyz/delete.

Children's Privacy

Object Talk is not directed to children under 13 years of age (or the applicable age of digital consent
in your jurisdiction). We do not knowingly collect personal data from children.

Security

We implement industry-standard technical and organizational security measures, including TLS 1.3 encryption in transit,
strict CORS policies, 8MB request payload protections, secure server-side API key isolation (no API secrets stored in the mobile client),
30-day rotating JWT authentication tokens, and hardware-backed credential storage (iOS Keychain / Android EncryptedSharedPreferences via Expo SecureStore).

Your Privacy Rights (GDPR, CCPA/CPRA & DPDP Act)

Depending on your location, you may have specific statutory rights:

• Right to Access / Transparency: You can verify what data is processed under your anonymous identifier.

• Right to Erasure / Deletion: You can delete your account and associated data directly in the app via Wallet > Delete my data.

• Do Not Sell or Share My Personal Information (CCPA/CPRA): Object Talk does not sell or share personal information for cross-context behavioral advertising.

• India DPDP Act Rights: Users in India may exercise their statutory rights to access, correction, and erasure of personal data by contacting our privacy officer at support@objecttalk.xyz.

• Brazil LGPD Rights: Users in Brazil may request confirmation, access, and deletion of their data in accordance with LGPD regulations.

Changes to this policy

We may update this Privacy Policy when our services, data practices, or legal requirements change.
The updated version will be made available within the app and at our canonical privacy-policy URL.

Contact

For privacy inquiries, questions, or data-deletion assistance, contact:

support@objecttalk.xyz

Canonical Privacy Policy:
https://www.objecttalk.xyz/privacy