Privacy Policy

1. Who we are

WhaleSay is operated by Jordon de Hoog from Ontario, Canada, who is the data controller responsible for your personal information. This policy covers both the WhaleSay app (Android, iOS, and web) and this website.

2. Information we collect

• Text you submit. The phrases you ask WhaleSay to translate.
• Microphone audio. We record only while you are actively speaking a translation. On iOS and Android, your audio is handed to your device’s built-in speech recognition (Apple’s Speech framework on iOS, Google’s recognizer on Android), which converts it to text under Apple’s or Google’s own privacy policy — WhaleSay never receives, stores, or uploads that audio. On the web, where no built-in recognizer exists, the audio is sent to our hosting provider (Cloudflare) to be transcribed, then discarded. Either way we keep only the resulting text, and only while you are translating.
• Device and app identifiers. An anonymous identifier we assign to your install, plus app version and platform (Android, iOS, or web).
• Purchase and subscription data. Entitlement and transaction records from our payments partner (which whales you have unlocked, subscription status). We never see your full card details.
• Usage and technical data. Request metadata, aggregate usage analytics, and crash logs used to operate, secure, and improve the service. Your IP address is used only transiently to rate-limit requests and protect the service from abuse — it is not written to our durable logs. Like any internet service, our hosting provider sees your IP at the network layer to deliver and protect each request.

3. How we use your information

• To produce your whale translation and the accompanying generated audio.
• To operate, maintain, secure, and improve the service.
• To process purchases and confirm which features you have access to.
• To understand aggregate usage and diagnose problems.
• To comply with legal obligations and enforce our terms.

4. Cookies and on-device storage

This website uses no cookies, no third-party analytics, and no advertising or tracking technologies. The WhaleSay app stores the anonymous install identifier locally on your device so it can recognise your install between sessions; you can clear it by uninstalling the app or clearing its data. We do not use cookies or cross-site tracking to build a profile of you.

5. Service providers

We rely on a small number of processors to run WhaleSay. They handle data only to provide their service to us, each under its own privacy policy:

• Cloudflare: hosting, compute, storage, and analytics. Your text is processed within Cloudflare. On the web only, where there is no built-in speech recognizer, your microphone audio is sent to Cloudflare for transcription via Workers AI (Whisper). On iOS and Android this never happens — the app does not send your audio to Cloudflare or any other AI transcription service.
• Apple and Google speech recognition: on iOS and Android, your spoken audio is transcribed by the operating system’s own built-in speech recognition (Apple’s Speech framework / Google’s speech services), under each platform’s privacy policy and the microphone permission you grant. WhaleSay never receives the raw audio — only the text it returns.
• RevenueCat: manages in-app purchases and subscription entitlements.
• ElevenLabs: generates the higher-fidelity whale audio for subscribers. We send it only a short, computer-generated sound description (for example, “deep underwater whale vocalization”) derived from the whale dialect — never your words, your voice, or any other personal data.
• Apple App Store and Google Play: process payments for purchases and subscriptions.

We do not sell your personal information.

6. Data retention

We keep data only as long as it is useful for the purpose it was collected, then delete it:

• The text you translate is kept with your history for up to 90 days, then deleted — ask us and we’ll remove it sooner.
• Voice recordings are not kept. Speech is transcribed to text and the recording is discarded immediately. On iOS and Android the device’s own speech recognition does the transcription, so WhaleSay never receives or stores the audio.
• Generated whale audio contains no personal information — it is whale sounds, not your voice — so we may retain it to power your history, shared links, and instant repeat translations. It is never linked to your identity.
• Per-request logs (which may include your anonymous identifier) are kept about 30 days for security and debugging.
• Diagnostic logs — errors, vendor calls, speech-to-text and job records — are kept about 90 days.
• Administrative audit records are kept for up to 12 months.
• Purchase records are kept as long as needed for the purchase relationship and to meet legal and accounting requirements.

7. Accounts and deletion

WhaleSay has no username or password. You are identified only by the anonymous identifier assigned to your install. You can ask us to delete the data tied to your usage at any time by emailing privacy@whalesay.app. See our Data & deletion page for the steps.

8. Children

WhaleSay is intended for a general audience and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact us and we will delete it.

9. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to withdraw consent. We honour requests under Canada’s PIPEDA, the EU/UK GDPR, and the California CCPA, among others. To exercise any of these rights, email privacy@whalesay.app.

Where the GDPR applies, our legal bases for processing are: performing the service you ask for (your translations and purchases), our legitimate interest in keeping the service secure and working, and your consent for microphone access. If you are in the EU or UK, you also have the right to lodge a complaint with your local data protection authority.

10. International transfers

Our providers operate globally, including in the United States. When your information is processed outside your country, we rely on the safeguards those providers maintain for cross-border transfers.

11. Security

We use reasonable technical and organizational measures to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal information, we will notify affected users and the relevant authorities without undue delay, as required by applicable law.

12. Legal disclosures

We may disclose your information when we believe in good faith that it is necessary to comply with the law or a valid legal request, to enforce our terms, or to protect the rights, safety, or property of our users, the public, or WhaleSay. We do not otherwise share your personal information except with the service providers listed above.

13. Changes to this policy

We may update this policy as the app evolves. When we do, we will revise the effective date above and, for material changes, provide a more prominent notice.

14. Contact

Questions about your privacy, or want to exercise a right? Email privacy@whalesay.app. WhaleSay is operated by Jordon de Hoog from Ontario, Canada.