Privacy Policy for Twalkie

Last Updated: February 25, 2026

Introduction

This Privacy Policy describes how Memiri Srl ("we", "our", or "us"), an Italian company with registered office at Via Giovanni Arcangeli, 2 — 56124 Pisa (PI) — Italy, acts as the data controller and collects, uses, and protects your personal information when you use the Twalkie Italian language learning application.

We are committed to protecting your privacy and ensuring transparency about our data practices. This policy complies with the General Data Protection Regulation (GDPR), the Italian Personal Data Protection Code (D.Lgs. 196/2003 as amended), and other applicable data protection laws.

Legal Bases for Processing (GDPR Article 6)

Under GDPR, we must have a lawful basis for every processing activity. We rely on the following legal bases:

Processing Activity	Legal Basis
Providing the app and syncing your learning progress	Contract performance — Art. 6(1)(b) GDPR: processing is necessary to deliver the service you requested
Managing your subscription and verifying purchases	Contract performance — Art. 6(1)(b) GDPR
Verifying subscription status and managing access to premium features	Contract performance — Art. 6(1)(b) GDPR: necessary to verify and grant or restrict access to premium content during the active subscription period
Security, fraud prevention, and service integrity	Legitimate interest — Art. 6(1)(f) GDPR: our legitimate interest in protecting users and the service
Processing terms acceptance timestamp	Legal obligation / Legitimate interest — Art. 6(1)(c)/(f) GDPR: documenting consent under GDPR Art. 7
Sending waitlist notifications	Consent — Art. 6(1)(a) GDPR: you explicitly opted in to receive launch notifications
Processing feedback and support requests	Legitimate interest — Art. 6(1)(f) GDPR: our legitimate interest in improving our products and assisting users

We do not rely on consent as the legal basis for any core processing activity. Where we collect optional data (e.g. display name), you may withdraw or delete it at any time without affecting core service delivery.

Information We Collect

1. Account Information

When you use Twalkie, we collect:

Authentication Data: When you sign in with Apple, we receive a unique user identifier from Apple. We do not receive your email address unless you explicitly choose to share it.
Anonymous User ID: If you use the app without signing in, we generate an anonymous user identifier for your device.
Display Name: Optional name you provide for personalization within the app.
Purchase UUID: A unique identifier generated to link your Apple subscription purchases to your account.

2. Learning Progress Data

To provide our language learning service, we collect and store:

Lesson Progress: Information about which lessons and sections you've completed, your progress percentage, and completion timestamps.
Message Progress: Records of which messages you've interacted with, interaction counts, and completion status.
Journey Progress: Your current position in learning journeys, paths taken, branch decisions, and completion status.
User Responses: Encrypted responses to exercises and quizzes (stored with client-side encryption for privacy).
Steps/Rewards: Information about steps earned and journey unlocks as part of the gamification system.

3. Subscription Information

If you purchase a subscription:

Transaction Data: We receive transaction information from Apple's App Store, including transaction IDs, subscription status, and renewal dates.
Subscription Status: Whether you have an active subscription and its expiration date.
Purchase History: Records of subscription purchases, renewals, and cancellations for account management.

4. Speech Recognition and Audio Processing

For certain language learning exercises, you may choose to practice speaking:

Audio Recording: When you use speaking exercises, the app temporarily records your voice on your device.
Local Processing: All audio processing happens entirely on your iPhone using on-device AI (Whisper speech recognition model).
No Cloud Upload: Your voice recordings are never uploaded to our servers, Firebase, or any cloud service.
Temporary Storage: Audio files are stored only temporarily in your device's local storage for immediate transcription.
Transcription Only: Only the text transcription of your speech is retained for exercise feedback. The audio recording itself is not saved.
Microphone Permission: The app requires microphone access only for speaking exercises, which you can enable or disable in iOS Settings.

Important Privacy Note: Your spoken audio never leaves your device. All speech-to-text processing is performed locally using an AI model bundled with the app. We have no access to your voice recordings.

5. Technical Information

Device Information: Basic device identifiers required for offline-first data synchronization.
Security & Integrity Data: We use Firebase App Check with Apple's App Attest to verify that requests come from a genuine, untampered app. This processes device metrics but does not identify you personally.
Usage Data: We do not collect analytics or tracking data. Twalkie does not include any analytics SDK.

6. Website Forms and Communications

When you interact with our website (memiri.it), we collect:

Waitlist Signups: If you join our waitlist, we collect your email address and optionally your name. This data is used exclusively to notify you when Twalkie becomes available on the App Store.
Feedback and Support: If you submit feedback or contact us for support, we collect your email address, name (optional), and the content of your message to process and respond to your request.

How We Use Your Information

We use your information solely to:

Provide the Service: Deliver language learning content and track your educational progress.
Sync Across Devices: When signed in with Apple, synchronize your progress across your devices using Firebase.
Manage Subscriptions: Process and manage your subscription purchases through Apple's App Store.
Restore Progress: Allow you to restore your learning progress when reinstalling the app or using a new device.
Personalize Experience: Customize greetings and learning paths based on your progress (only when signed in).
Communicate with You: Send you waitlist notifications (if you opted in) or respond to your feedback and support requests.

We do NOT use your information for:

Marketing or advertising
Analytics or behavioral tracking
Sharing with third parties for their marketing purposes
Profiling or automated decision-making

Data Storage and Security

Offline-First Architecture

Twalkie uses an offline-first design:

Local Storage: Your progress is primarily stored locally on your device using SwiftData.
Cloud Sync: When you sign in, your data is synchronized to Firebase Firestore for backup and cross-device access.
Encryption: User responses to exercises are encrypted on your device before being stored or transmitted.
On-Device Audio Processing: Voice recordings for speaking exercises are processed entirely on your device using a local AI model. Audio files are never uploaded to any server.

Security Measures

We implement appropriate technical and organizational measures to protect your data:

Firebase Security Rules: Strict access controls ensure users can only access their own data.
Encrypted Transmission: All data transmitted between your device and Firebase uses TLS/SSL encryption.
Client-Side Encryption: Sensitive response data is encrypted on your device before storage.
On-Device Speech Recognition: Voice recordings are processed using a local AI model (Whisper) and never leave your device.
Authentication: Sign in with Apple provides secure, privacy-focused authentication.
No Analytics: Twalkie does not include any analytics tracking, minimizing data collection by design.

Data Location

Your data is stored in:

Firebase/Google Cloud: Your cloud-synced data is stored in Google Cloud Platform data centers. Google is GDPR-compliant and provides appropriate safeguards for international data transfers.
Your Device: Local data is stored on your iOS device in the app's secure container.

Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law.

Data Type	Retention Period	Reason
Account and learning progress data (active account)	Duration of account + 30 days grace period	Contract performance; allows account recovery
Account and learning progress data (after deletion)	Deleted within 30 days of account deletion request	GDPR Art. 17 erasure right
Subscription status records (transaction ID, expiry date)	Deleted within 30 days of account deletion	Contract performance — Apple Inc. is the merchant of record and retains all fiscal and billing documents; we hold only the minimum status data needed to deliver the service
Terms acceptance timestamp	Duration of account + 10 years	Evidence of consent under GDPR Art. 7
Anonymous (guest) user data	Stored locally on your device only; deleted when you uninstall the app	No cloud processing for anonymous users
Voice recordings (on-device)	Immediately deleted after transcription	Never leaves your device
Text transcription of speech exercises	Retained as part of learning progress data (see above)	Contract performance
Waitlist email addresses	Deleted within 30 days after the app launch notification is sent, or immediately upon request	Consent (Art. 6(1)(a) GDPR)
Feedback and support communications	Retained for 12 months after the issue is resolved	Legitimate interest (Art. 6(1)(f) GDPR) to improve our services and handle follow-up queries

Your Rights (GDPR)

If you are in the European Economic Area (EEA), United Kingdom, or other jurisdictions with data protection laws, you have the following rights:

Right to Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data.
Right to Data Portability: Request your data in a structured, machine-readable format.
Right to Restrict Processing: Request that we limit how we use your data.
Right to Object: Object to our processing of your personal data.
Right to Withdraw Consent: Withdraw consent for data processing at any time.

To exercise these rights, please contact us at dpo@memiri.it with the subject line "GDPR Request" and specify which right you wish to exercise.

Response timeframe: We will respond to your request within 30 days of receipt. For complex or multiple requests, we may extend this period by a further 60 days, in which case we will notify you of the extension within the first 30 days and explain the reason.

Identity verification: To protect your privacy and prevent unauthorised access to your data, we may ask you to verify your identity before fulfilling a request (e.g., by confirming your Apple ID email or the anonymous user ID shown in the app). We cannot fulfil requests where we cannot reasonably verify the identity of the requester.

No fees: Exercising your rights is free of charge. If requests are manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act, in accordance with GDPR Art. 12(5).

Children's Privacy

Twalkie does not knowingly collect personal information from children under 14 (in Italy) or the applicable age of digital consent in your jurisdiction without parental consent. If you believe we have collected information from a child under this age, please contact us immediately, and we will delete such information.

Third-Party Services

Twalkie uses the following third-party services:

Firebase (Google LLC)

Purpose: Authentication, cloud data synchronization, cloud functions for subscription management, and app integrity verification (App Check).
Data Shared: User ID, progress data, subscription status, and device integrity metrics.
Privacy Policy: https://firebase.google.com/support/privacy
GDPR Compliance: Firebase is GDPR-compliant with EU-U.S. Data Privacy Framework certification.

Apple App Store / Sign in with Apple

Purpose: Authentication, subscription purchases, and transaction processing.
Data Shared: Apple user identifier, transaction data.
Privacy Policy: https://www.apple.com/legal/privacy/
Data Minimization: Sign in with Apple provides privacy-focused authentication with minimal data sharing.

We do not use any analytics services, advertising networks, or other tracking services.

International Data Transfers

Memiri Srl is based in Italy (EEA). When your data is synchronised via Firebase, it may be transferred to and processed in the United States and other countries outside the EEA where Google Cloud Platform operates data centres.

Such transfers are lawful because:

EU–U.S. Data Privacy Framework: Google LLC is certified under the EU–U.S. Data Privacy Framework (adequacy decision of 10 July 2023).
Standard Contractual Clauses (SCCs): Google provides EU SCCs (Commission Implementing Decision 2021/914) as a supplementary safeguard.

Your data receives equivalent protection regardless of where it is processed. You may request a copy of the applicable transfer safeguards by contacting us at dpo@memiri.it.

Cookies and Tracking

Twalkie (the iOS app) does not use cookies or tracking technologies. The app does not include any analytics tracking, ensuring maximum privacy by design.

Our website (memiri.it) uses essential cookies required for basic functionality (such as remembering your language preference). With your explicit consent, we may also use analytics cookies to understand how visitors interact with our site. You can manage your cookie preferences at any time through the cookie banner on our website.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

Updating the "Last Updated" date at the top of this policy
Displaying a notice in the app (for material changes)
Requiring you to accept updated terms (for significant changes affecting your rights)

Your continued use of Twalkie after changes become effective constitutes acceptance of the updated Privacy Policy.

Data Protection Officer

For GDPR-related inquiries, you may contact our data protection representative at the contact information below.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

Email: dpo@memiri.it

Mailing Address: Via Giovanni Arcangeli, 2 — 56124 Pisa (PI) — Italy

For GDPR-specific requests (access, deletion, portability, etc.), please include "GDPR Request" in your subject line and specify which right you wish to exercise.

Supervisory Authority

If you are located in the EEA or UK and believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection supervisory authority.

As Memiri Srl is established in Italy, our lead supervisory authority is:

Garante per la Protezione dei Dati Personali Piazza Venezia 11 — 00187 Roma — Italy Website: www.gpdp.it Email: garante@gpdp.it

If you are located in another EEA member state or in the UK, you may alternatively contact your local authority. A list of EEA supervisory authorities is available at edpb.europa.eu. For the UK: ico.org.uk.