Privacy Policy

1. Who we are

WhaleSay is operated by Jordon de Hoog from Ontario, Canada, who is the data controller responsible for your personal information. This policy covers both the WhaleSay app (Android, iOS, and web) and this website.

2. Information we collect

• Text you submit. The phrases you ask WhaleSay to translate.
• Microphone audio. On iOS and Android, speak-to-translate is transcribed to text directly on your device — the recorded audio never leaves it, and is discarded as soon as it is transcribed. On the web, where on-device transcription isn’t available, the audio is sent to be transcribed into text, then discarded. We only listen when you start a voice translation.
• Device and app identifiers. An anonymous identifier we assign to your install, plus app version and platform (Android, iOS, or web).
• Purchase and subscription data. Entitlement and transaction records from our payments partner (which whales you have unlocked, subscription status). We never see your full card details.
• Usage and technical data. Request metadata, aggregate usage analytics, and crash logs used to operate, secure, and improve the service. Your IP address is used only transiently to rate-limit requests and protect the service from abuse — it is not written to our durable logs. Like any internet service, our hosting provider sees your IP at the network layer to deliver and protect each request.

3. How we use your information

• To produce your whale translation and the accompanying generated audio.
• To operate, maintain, secure, and improve the service.
• To process purchases and confirm which features you have access to.
• To understand aggregate usage and diagnose problems.
• To comply with legal obligations and enforce our terms.

4. Cookies and on-device storage

This website uses no cookies, no third-party analytics, and no advertising or tracking technologies. The WhaleSay app stores the anonymous install identifier locally on your device so it can recognise your install between sessions; you can clear it by uninstalling the app or clearing its data. We do not use cookies or cross-site tracking to build a profile of you.

5. Service providers

We rely on a small number of processors to run WhaleSay. They handle data only to provide their service to us, each under its own privacy policy:

• Cloudflare: hosting, compute, storage, and analytics. Your text is processed within Cloudflare. On the web only, where speech can’t be transcribed on-device, your microphone audio is sent to Cloudflare for transcription via Workers AI (Whisper); on iOS and Android this never happens.
• RevenueCat: manages in-app purchases and subscription entitlements.
• ElevenLabs: generates higher-fidelity whale audio, used only when a subscriber uses that audio engine.
• Apple App Store and Google Play: process payments for purchases and subscriptions.

We do not sell your personal information.

6. Data retention

We keep data only as long as it is useful for the purpose it was collected, then delete it:

• Generated whale audio is removed from storage after 30 days.
• Per-request logs (which may include your anonymous identifier) are kept about 30 days for security and debugging.
• Diagnostic logs — errors, vendor calls, speech-to-text and job records — are kept about 90 days.
• Administrative audit records are kept for up to 12 months.
• Purchase records are kept as long as needed for the purchase relationship and to meet legal and accounting requirements.

7. Accounts and deletion

WhaleSay has no username or password. You are identified only by the anonymous identifier assigned to your install. You can ask us to delete the data tied to your usage at any time by emailing privacy@whalesay.app. See our Data & deletion page for the steps.

8. Children

WhaleSay is intended for a general audience and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact us and we will delete it.

9. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to withdraw consent. We honour requests under Canada’s PIPEDA, the EU/UK GDPR, and the California CCPA, among others. To exercise any of these rights, email privacy@whalesay.app.

Where the GDPR applies, our legal bases for processing are: performing the service you ask for (your translations and purchases), our legitimate interest in keeping the service secure and working, and your consent for microphone access. If you are in the EU or UK, you also have the right to lodge a complaint with your local data protection authority.

10. International transfers

Our providers operate globally, including in the United States. When your information is processed outside your country, we rely on the safeguards those providers maintain for cross-border transfers.

11. Security

We use reasonable technical and organizational measures to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal information, we will notify affected users and the relevant authorities without undue delay, as required by applicable law.

12. Legal disclosures

We may disclose your information when we believe in good faith that it is necessary to comply with the law or a valid legal request, to enforce our terms, or to protect the rights, safety, or property of our users, the public, or WhaleSay. We do not otherwise share your personal information except with the service providers listed above.

13. Changes to this policy

We may update this policy as the app evolves. When we do, we will revise the effective date above and, for material changes, provide a more prominent notice.

14. Contact

Questions about your privacy, or want to exercise a right? Email privacy@whalesay.app. WhaleSay is operated by Jordon de Hoog from Ontario, Canada.