Privacy Policy for Twalkie

Last Updated: July 10, 2026

Introduction

This Privacy Policy describes how Memiri Srl ("we", "our", or "us"), an Italian single-member company with registered office at Via Giovanni Arcangeli, 2 — 56124 Pisa (PI) — Italy, VAT and tax number 02545410504, PEC memirisrl@pec.it, acts as the data controller and collects, uses, and protects your personal information when you use the Twalkie Italian language learning application (the "App" or "Twalkie").

We are committed to protecting your privacy and ensuring transparency about our data practices. This policy complies with the General Data Protection Regulation (GDPR), the Italian Personal Data Protection Code (D.Lgs. 196/2003 as amended), and other applicable data protection laws.

Legal Bases for Processing (GDPR Article 6)

Under GDPR, we must have a lawful basis for every processing activity. We rely on the following legal bases:

Processing Activity	Legal Basis
Providing the app and syncing your learning progress	Contract performance — Art. 6(1)(b) GDPR: processing is necessary to deliver the service you requested
Creating and maintaining the temporary Firebase account required for guest access	Contract performance — Art. 6(1)(b) GDPR: necessary to authenticate app requests and provide the guest service
Managing your Apple App Store subscription and verifying App Store purchases	Contract performance — Art. 6(1)(b) GDPR
Verifying subscription status and managing access to premium features	Contract performance — Art. 6(1)(b) GDPR: necessary to verify and grant or restrict access to premium content during the active subscription period
Security, fraud prevention, and service integrity	Legitimate interest — Art. 6(1)(f) GDPR: our legitimate interest in protecting users and the service
Recording legal acceptance	Legitimate interest — Art. 6(1)(f) GDPR: documenting the applicable agreement and preserving evidence for legal claims

We do not rely on consent as the legal basis for any core processing activity. Where we collect optional data (e.g. display name), you may withdraw or delete it at any time without affecting core service delivery.

Information We Collect

1. Account Information

When you use Twalkie, we collect:

Authentication Data: When you sign in with Apple, we receive a unique user identifier from Apple. We do not receive your email address unless you explicitly choose to share it.
Guest Authentication Data: If you use the app without Sign in with Apple, Firebase creates a temporary anonymous account and user identifier. This is a cloud authentication account even though guest learning progress remains local.
Display Name: Optional name you provide for personalization within the app.
Purchase UUID: A unique identifier generated to link your Apple subscription purchases to your account.
Legal Acceptance Record: The accepted Terms and acknowledged Privacy Policy versions, acceptance time and locale. The single acceptance statement confirms either independent eligibility or parent/legal-guardian capacity, but we do not record which alternative applied and do not ask for the child's date of birth through this process.

2. Learning Progress Data

To provide our language learning service, we collect and store:

Lesson Progress: Information about which lessons and sections you've completed, your progress percentage, and completion timestamps.
Message Progress: Records of which messages you've interacted with, interaction counts, and completion status.
Journey Progress: Your current position in learning journeys, paths taken, branch decisions, and completion status.
Steps/Rewards: Information about steps earned and journey unlocks as part of the gamification system.

3. Subscription Information

If you purchase a subscription through the Apple App Store:

Transaction Data: We receive transaction information from Apple's App Store, including transaction IDs, subscription status, and renewal dates.
Subscription Status: Whether you have an active subscription and its expiration date.
Purchase History: Records of subscription purchases, renewals, and cancellations for account management.

4. Speech Recognition and Audio Processing

For certain language learning exercises, you may choose to practice speaking:

Audio Recording: When you use speaking exercises, the app temporarily records your voice on your device.
Local Processing: All audio processing happens entirely on your iPhone using on-device AI (Whisper speech recognition model).
No Cloud Upload: Your voice recordings are never uploaded to our servers, Firebase, or any cloud service.
Temporary Storage: Audio files are stored only temporarily in your device's local storage for immediate transcription.
Transcription Only: Only the text transcription of your speech is retained for exercise feedback. The audio recording itself is not saved.
Microphone Permission: The app requires microphone access only for speaking exercises, which you can enable or disable in iOS Settings.

Important Privacy Note: Your spoken audio never leaves your device. All speech-to-text processing is performed locally using an AI model bundled with the app. We have no access to your voice recordings.

5. Technical Information

Device and Network Information: Technical identifiers, IP address and request metadata needed to authenticate, operate, secure, and synchronize the service.
Security & Integrity Data: We use Firebase App Check with Apple's App Attest to verify that requests come from a genuine, untampered app. Integrity tokens and related technical metrics are pseudonymous and may be linked to an account or request; we do not use them for advertising or behavioral profiling.
Usage Data: We do not collect analytics or tracking data. Twalkie does not include any analytics SDK.

How We Use Your Information

We use your information solely to:

Provide the Service: Deliver language learning content and track your educational progress.
Sync Across Devices: When signed in with Apple, synchronize your progress across your devices using Firebase.
Manage Subscriptions: Process and manage your Apple App Store subscription purchases.
Restore Progress: Allow you to restore your learning progress when reinstalling the app or using a new device.
Personalize Experience: Customize greetings and learning paths based on your progress (only when signed in).
Support You: Respond to app-related support requests when you contact us.

We do NOT use your information for:

Marketing or advertising
Analytics or behavioral tracking
Sharing with third parties for their marketing purposes
Profiling or automated decision-making

Data Storage and Security

Offline-First Architecture

Twalkie uses an offline-first design:

Local Storage: Your progress is primarily stored locally on your device using SwiftData.
Guest Authentication: Guest learning progress remains local, but Firebase processes the temporary anonymous account and the technical data required to authenticate and secure app requests.
Cloud Sync: When you sign in with Apple, your learning data is synchronized to Firebase Firestore for backup and cross-device access.
On-Device Audio Processing: Voice recordings for speaking exercises are processed entirely on your device using a local AI model. Audio files are never uploaded to any server.

Security Measures

We implement appropriate technical and organizational measures to protect your data:

Firebase Security Rules: Strict access controls ensure users can only access their own data.
Encrypted Transmission: All data transmitted between your device and Firebase uses TLS/SSL encryption.
On-Device Speech Recognition: Voice recordings are processed using a local AI model (Whisper) and never leave your device.
Authentication: Sign in with Apple provides secure, privacy-focused authentication.
No Analytics: Twalkie does not include any analytics tracking, minimizing data collection by design.

Data Location

Your data is stored in:

Firebase/Google Cloud: Firebase Authentication processes account data in the United States. Firestore, Cloud Functions, App Check, and related Firebase services may process data on Google's global infrastructure, subject to the safeguards described below.
Your Device: Local data is stored on your iOS device in the app's secure container.

Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law.

Data Type	Retention Period	Reason
Account and learning progress data (active signed-in account)	Duration of the account	Contract performance
Account and learning progress data (after deletion)	Deleted within 30 days of account deletion request	GDPR Art. 17 erasure right
Subscription status records (transaction ID, expiry date)	Deleted within 30 days of account deletion unless limited retention is required by law or necessary to establish, exercise, or defend legal claims	Service delivery and legal claims; Apple remains responsible for its own fiscal and billing records
Legal acceptance record	Duration of account + 10 years	Evidence of contract acceptance and legal claims management
Guest learning progress	Stored locally; deleted when you clear local data or uninstall the app	Guest progress is not uploaded to Firestore
Firebase anonymous account and related security metadata	Retained while the guest authentication session is active and until the account is linked, deleted, or removed through Firebase or our anonymous-account cleanup processes	Authentication, security, abuse prevention, and account linking
Voice recordings (on-device)	Immediately deleted after transcription	Never leaves your device
Text transcription of speech exercises	Retained as part of learning progress data (see above)	Contract performance

Your Rights (GDPR)

If you are in the European Economic Area (EEA), United Kingdom, or other jurisdictions with data protection laws, you have the following rights:

Right to Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data.
Right to Data Portability: Request your data in a structured, machine-readable format.
Right to Restrict Processing: Request that we limit how we use your data.
Right to Object: Object to our processing of your personal data.
Right to Withdraw Consent: Withdraw consent for data processing at any time.

To exercise these rights, please contact us at dpo@memiri.it with the subject line "GDPR Request" and specify which right you wish to exercise.

Response timeframe: We will respond to your request within 30 days of receipt. For complex or multiple requests, we may extend this period by a further 60 days, in which case we will notify you of the extension within the first 30 days and explain the reason.

Identity verification: To protect your privacy and prevent unauthorised access to your data, we may ask you to verify your identity before fulfilling a request (e.g., by confirming your Apple ID email or the anonymous user ID shown in the app). We cannot fulfil requests where we cannot reasonably verify the identity of the requester.

No fees: Exercising your rights is free of charge. If requests are manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act, in accordance with GDPR Art. 12(5).

Children's Privacy

Users who meet the applicable minimum age may use Twalkie independently, subject to any authorization required before the age of majority. In Italy, the age of digital consent is 14.

A child below the applicable minimum age may use Twalkie only through a parent- or legal-guardian-controlled account, under direct supervision, after the adult reviews the legal documents and selects the single acceptance statement covering parent/legal-guardian capacity. We do not record which eligibility alternative applied and do not collect the child's date of birth through this process.

Some jurisdictions require additional age assurance or verifiable parental consent. Where such a requirement applies and Twalkie does not yet provide the required verification method, the child may not use the affected online features. Parents and guardians may contact dpo@memiri.it to access, correct, or delete data associated with supervised use or to report unsupervised use.

Third-Party Services

Twalkie uses the following third-party services:

Firebase (Google LLC)

Purpose: Authentication, cloud data synchronization, cloud functions for subscription management, and app integrity verification (App Check).
Data Shared: User ID, progress data, subscription status, and device integrity metrics.
Privacy Policy: https://firebase.google.com/support/privacy
Role and Safeguards: Google generally acts as our processor for customer data under the applicable Firebase data-processing terms. Memiri Srl remains responsible for its obligations as controller.

Apple App Store / Sign in with Apple

Purpose: Authentication, App Store subscription purchases, and transaction processing.
Data Shared: Apple user identifier, transaction data.
Privacy Policy: https://www.apple.com/legal/privacy/
Data Minimization: Sign in with Apple provides privacy-focused authentication with minimal data sharing.

We do not use any analytics services, advertising networks, or other tracking services.

International Data Transfers

Memiri Srl is based in Italy (EEA). Firebase Authentication processes signed-in and guest authentication data in the United States. Firestore, Cloud Functions, App Check, and related services may process data in the United States and other countries outside the EEA even when guest learning progress remains local.

Such transfers are lawful because:

EU–U.S. Data Privacy Framework: Google LLC is certified under the EU–U.S. Data Privacy Framework (adequacy decision of 10 July 2023).
Standard Contractual Clauses (SCCs): Google provides EU SCCs (Commission Implementing Decision 2021/914) as a supplementary safeguard.
UK Transfers: Where UK data-protection law applies, transfers rely on an applicable UK adequacy regulation, the UK Extension to the Data Privacy Framework, or the UK International Data Transfer Addendum or another valid safeguard included in the provider terms.

We apply the contractual and technical safeguards required for the relevant transfer. You may request information about the applicable safeguards by contacting us at dpo@memiri.it.

Cookies and Tracking

Twalkie (the iOS app) does not use cookies or tracking technologies. The app does not include any analytics tracking, ensuring maximum privacy by design.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

Updating the "Last Updated" date at the top of this policy
Displaying a notice in the app (for material changes)
Requesting renewed agreement to the Terms where a contractual change requires it

This Privacy Policy is a transparency notice, not a request for consent to all processing. A policy update does not create a new legal basis for processing merely because you continue using Twalkie. Where processing requires consent, we will request it separately.

Privacy Contact

For GDPR-related inquiries, you may contact our privacy contact at the contact information below.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

Email: dpo@memiri.it

PEC: memirisrl@pec.it

Mailing Address: Via Giovanni Arcangeli, 2 — 56124 Pisa (PI) — Italy

For GDPR-specific requests (access, deletion, portability, etc.), please include "GDPR Request" in your subject line and specify which right you wish to exercise.

Supervisory Authority

If you are located in the EEA or UK and believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection supervisory authority.

As Memiri Srl is established in Italy, our lead supervisory authority is:

Garante per la Protezione dei Dati Personali Piazza Venezia 11 — 00187 Roma — Italy Website: www.gpdp.it Email: garante@gpdp.it

If you are located in another EEA member state or in the UK, you may alternatively contact your local authority. A list of EEA supervisory authorities is available at edpb.europa.eu. For the UK: ico.org.uk.