Privacy Policy

Last Updated & Effective: November 1, 2026

Welcome to TALKme (https://talkme.online). TALKme is a real-time presence, voice lounge, and private messaging platform designed with privacy, intimacy, and security at its core. This Privacy Policy describes how we collect, use, store, process, and protect your information when you access or use our website, mobile application, voice rooms, direct messaging services, and integrations.

1. Information We Collect

We believe in minimal data collection. We only collect information strictly required to authenticate your account, operate live rooms, route real-time calls, and safeguard our community:

• Account Credentials: Email address (used as your unique sign-in identifier), username, chosen display name, avatar selections, and password stored strictly as a salted scrypt cryptographic hash.
• Direct Messages & Lounge Chats: Text messages, shared images, voice notes, timestamps, sender IDs, and recipient IDs. Private direct messages are protected by an encrypted server archive (AES-256-GCM) and our proprietary 30-second offline photo privacy blur layer.
• 24-Hour Disappearing Stories: Media files (photos and videos) and captions that you voluntarily upload to your Story. All story assets automatically expire and are permanently purged after 24 hours.
• Social Connections & Streaks: Mutual friend connections, pending friend requests, daily login streaks, and streak shield recovery logs.
• Live Presence & Real-Time Vibe: Transient online indicators, room presence, typing statuses, and mood check-ins (e.g., "Vibing", "Chilling"). These exist only in temporary server memory and are wiped immediately upon disconnecting.
• Push Notification Subscriptions: Browser-generated Web Push / Firebase Cloud Messaging (FCM) device subscription tokens when you opt-in to receive alerts for direct messages, incoming calls, or room mentions.
• WebRTC Calling Data: Session Initiation Protocol (SIP) / WebRTC signaling data required for establishing peer-to-peer voice and video calls between mutual friends. We do not record, listen to, or store your voice or video calls.

2. YouTube API Services & Third-Party Video/Audio Content

TALKme features shared interactive music and audio playback in Voice Lounges powered by the YouTube Data API v3 and Google developer tools:

• Data Accessed: When users search for tracks or add songs to the Voice Lounge Shared Queue, TALKme queries the YouTube Data API to retrieve public metadata including video titles, channel names, video IDs, media durations, and thumbnail graphics.
• No Personal YouTube Profile Collection: TALKme does not access, harvest, or store your private YouTube watch history, personal YouTube playlists, or Google account passwords.
• Storage & Retention of YouTube Data: Public track metadata retrieved from the YouTube API is cached ephemerally in active memory only for the duration of the lounge session to ensure smooth queue transitions without audio latency. It is not permanently stored or indexed in long-term databases.
• Compliance with YouTube Policies: TALKme adheres strictly to the YouTube API Services Developer Policies. TALKme does not sell YouTube data, transfer YouTube content to advertising brokers, or use background downloading of content outside permitted streaming frameworks.
• Revoking Access: In addition to our internal settings, users can manage or revoke authorized third-party access at any time through the Google Security Settings Permissions Portal.

3. How We Use Your Information

Your information is used strictly to power TALKme's core services:

• To authenticate your identity, prevent unauthorized access, and manage user sessions.
• To deliver real-time chat messages, voice rooms, game lobbies, and friend interactions.
• To send you push notifications for direct messages and live incoming calls (which you can disable at any time on your device).
• To maintain social streaks, streak shields, and interactive lounge gamification.
• To protect community safety: automated safety filters and authorized administrators may review reported messages and public room posts to prevent harassment, child exploitation, hate speech, and spam.

4. Data Storage, Security & Encryption

Active user presence and room states reside in volatile memory and terminate when sessions close. Media assets (such as profile pictures and 24-hour stories) are hosted on high-performance Cloudflare R2 edge storage with strict access control and lifecycle policies.

5. Cookies & Local Client Storage

TALKme uses minimal, privacy-centric browser storage mechanisms:

• Session Cookies: A secure, HttpOnly, SameSite=Strict cookie is set upon sign-in to securely authenticate your WebSocket connections and API calls.
• Local Storage: Used exclusively on your local device to store non-identifying client preferences (such as dark/light theme, mute status, audio volume, and offline game state).
• Zero Advertising Trackers: We do not employ third-party tracking pixels, advertising identifiers, fingerprinting scripts, or data brokers. We do not sell, rent, or monetize your personal information.

6. Third-Party Service Providers

We work with trusted infrastructure partners to operate TALKme securely:

• Google LLC: YouTube API Services (Google Privacy Policy), Firebase Authentication, and Firebase Cloud Messaging (FCM).
• Cloudflare, Inc.: Global CDN edge routing, DDoS shielding, and Cloudflare R2 object storage for user media.
• WebRTC Infrastructure: Standard STUN/TURN traversal servers for direct peer-to-peer audio and video routing.

7. Account Deletion & Data Rights (GDPR / CCPA / DPDP)

You have full ownership of your data under international privacy laws including GDPR (EU), CCPA/CPRA (California), and the Digital Personal Data Protection Act (India):

• Right to Deletion (Right to Be Forgotten): You can permanently delete your TALKme account at any time from your in-app profile settings, or by visiting our dedicated Account Deletion Page.
• What Happens Upon Deletion: Your user profile, password hash, email association, friend connections, call logs, active stories, and all associated direct messages are permanently erased from our active database and server archives.
• Right to Access & Portability: You may request a machine-readable summary of your account data by contacting our privacy officer.

8. Children's Privacy

TALKme is strictly intended for individuals who are at least 13 years old (or 16 years old where required by local laws in the EU and other jurisdictions). We do not knowingly collect or solicit personal information from children under 13. If we learn that an account belongs to an underage user, the account and its data will be promptly terminated.

9. Policy Updates

We may update this Privacy Policy periodically to reflect new features, infrastructure changes, or legal obligations. When changes are made, the "Last Updated" date at the top of this document will be revised. Continued use of TALKme following updates signifies your acceptance of the revised terms.

10. Contact Us

For any privacy inquiries, data subject requests, or questions regarding our use of YouTube API Services, please reach out directly to our Data Protection Officer:

TALKme Privacy Team
Email: [email protected]
Website: https://talkme.online