Privacy policy

Who we are

DuoTalk (the website at duotalk.app and the app at app.duotalk.app) is run by DuoTalk, based in Malaysia. We decide how the personal data described here is used, and we are responsible for it under Malaysia’s Personal Data Protection Act 2010 and, for people in the European Union or the United Kingdom, the GDPR. Contact us at support@duotalk.app.

What we collect and why

What	When	Why
A guest login: a random identifier, with no name or email	The first time you open the app	To let you into rooms and keep your place in them
Your email address, and the name and photo Google shares if you sign in with Google	When you sign in with Google or an emailed link	To keep your account, plan and voice minutes, and to contact you about them
Your nickname and avatar (a random picture, a photo you upload, or one drawn by AI)	When you join a room	To show who is talking
Your messages: what you typed or said as text, its translations, and photos, files, replies, reactions, polls, checklists and whiteboard drawings you share	When you use a room	To deliver them to the people in your room
Room details: topic, date, waiting-room setting, and a scrambled (hashed) copy of the passcode	When you create a room	To run the room the way the host chose
Starred messages	When you star a message	So you can find it again. Only you can see your stars
Lock-screen alert details from your browser, stored encrypted	When you turn on alerts	To tell your phone a message arrived. Alerts show who wrote, never what they said
Plan and payment records: your Stripe customer number, plan, renewal date, amounts and refunds	When you buy a plan	To give you what you paid for, and for tax records
Voice minutes used, and counts of rooms, joins and AI requests	As you use DuoTalk	To apply plan limits, and to understand our costs
Your IP address, kept only as a scrambled (hashed) value for a short time	When you start a free trial room and other limited actions	To stop abuse, such as unlimited free trials
Messages to the team: what you write, your email, the help chat before it, and the page you were on	When you tap “Message the team”	To answer you
Messages flagged by the app for strong language or threats	When the app flags a message	To keep rooms safe. Only flagged messages are reviewed

Some settings, like your nickname, language and voice choices, are saved only in your browser on your device. Clearing your browser’s data removes them.

Voice, translation and AI

When you speak, your recording goes to our server and on to Google’s Gemini AI, which turns it into text and translates it. We do not store recordings; only the text is kept in the room.
If you turn on the phone’s own speech recognition (“Fast”), your browser turns your speech into text itself, using its own speech service (for example Google or Apple), and only the text reaches us.
Typed messages are translated by Gemini too.
Natural AI voices send the translated text to Gemini to be read aloud. On other plans, your phone reads it with its own voice.
AI avatars, AI quizzes, fun facts and the help chat send what you write (and any screenshot you attach to the help chat) to Gemini to produce an answer. Help chats are not stored unless you send them to the team.

Google processes this content under its terms for the Gemini API. AI translation can be wrong; see our Terms of service.

What we do not do

We do not sell or rent your personal data.
We do not show ads, and we do not use advertising or third-party analytics trackers.
We do not read your conversations. Our admin tools show room activity (who joined and when, how many messages), never message text, except messages the app flagged for review.
We do not keep your card details. Stripe handles them.

Services that help us run DuoTalk

These companies process data for us, only to provide their service:

Google Firebase: sign-in and our database (rooms, messages, accounts).
Google Gemini API: understanding speech, translation, AI voices, avatars, quizzes and the help chat.
Vercel: hosts the website and the app, and keeps short technical logs (such as IP addresses) for security.
Stripe: payments, invoices and the billing portal. Stripe is responsible for card data under its own privacy policy.
Cloudflare: relays encrypted video calls when two devices cannot connect directly.
Push services run by your browser’s maker (Google, Apple, Mozilla or Microsoft): deliver lock-screen alerts, which carry no message text.

We may also share information if the law requires it, or to protect people from harm.

Video calls and recordings

Video calls connect your devices directly when they can, and are encrypted. When a direct connection is not possible, the encrypted call passes through Cloudflare’s relay. We do not record calls. If you use “Record session”, the recording is made and saved on your own device; you need the consent of the people you record.

How long we keep things

Messages stay with their room. Members can delete their own messages, and hosts can delete any message. When a room closes or expires, nobody can open it any more. Rooms nobody uses for 90 days close. If someone later starts a new room on a closed room's link, the old room and all its messages are deleted. You can ask us to delete a room you hosted.
Your account is kept until you ask us to delete it.
Payment records are kept for as long as tax law requires (in Malaysia, generally 7 years).
Messages to the team are kept while we help you, and deleted when you ask.
Hashed IP addresses are only used for limits that last a day at most.

How we protect your data

Everything travels encrypted (HTTPS). Database rules let only a room’s members read its messages, and only the server can read accounts, payments and usage. Passcodes are stored as hashes, never as text. Alert details are encrypted. No system is perfectly secure, so we will tell you without delay if a breach affects your data.

Your choices and rights

You can:

use DuoTalk as a guest without giving us your email;
turn off lock-screen alerts, AI voices and other features in Settings;
delete your own messages in a room;
ask for a copy of your personal data, ask us to correct it, or ask us to delete your account and the rooms you hosted;
withdraw your consent, or object to how we use your data.

Write to support@duotalk.app from the email on your account. We answer within 21 days. If you are unhappy with our answer, you can complain to Malaysia’s Personal Data Protection Commissioner, or to the data protection authority where you live.

Children

DuoTalk is not meant for children under 13, and we do not knowingly collect their data. If you think a child has given us personal data, write to us and we will delete it.

Where your data is processed

Our service providers run servers in several countries, including the United States, so your data may be processed outside your country. We use providers that protect personal data with safeguards such as standard contractual clauses.

Changes to this policy

If we change this policy, we will update the date at the top. If a change matters, we will also tell you in the app or by email before it takes effect.

In short