dia
تسجيل الدخول

Your Privacy Matters

We built Dia to help you learn languages through natural conversation. Here's exactly what we do with your data, in plain English.

Effective: November 22, 2025 · Last updated: October 4, 2026

The Simple Version

  • Your conversations are stored to help you learn and improve the experience
  • We use trusted providers (OpenAI, Anthropic, Google, Microsoft Azure, Replicate) to power AI features
  • You can request deletion of your account and linked personal data anytime. See the retention exceptions below.
  • You control whether anonymized data can be used for product improvement

What We Collect

To make Dia work, we need to store some information. Here's exactly what:

When you sign in

Your email and basic profile from Google or Apple Sign-In. We use Supabase Auth, a trusted and secure authentication provider.

Your conversations

Messages you send and Dia's responses. This helps Dia remember your progress and personalize future conversations. You can request account deletion from your account settings anytime.

Your preferences

Language choices, voice preferences, formality settings. Basically the settings that make Dia work the way you want.

Technical stuff (automatic)

Basic technical info like your timezone (to show correct times), error logs (to fix bugs), and rate limits (to prevent abuse). We also collect app-use events to understand which features work and improve reliability. Signed-in events may be linked to your account.

How We Use Your Data

Everything we collect has a purpose. Here's what we do with your information:

  • Make Dia smarter: Your conversations help Dia learn your style, remember context, and personalize responses
  • Generate audio: We create voice messages for your learning experience (stored securely with private URLs)
  • Keep things secure: Monitor for abuse, fix bugs, prevent spam (standard security stuff)
  • Legal compliance: We follow the law and protect both you and us

Analytics & Acquisition Measurement

PostHog and Vercel help us measure app use and diagnose problems. On the website, Google Ads measures sign-ups and purchases and may receive an advertising click identifier, a transaction identifier, and a hashed email address. This can link a conversion to an earlier advertising interaction. Website cookie choices update Google Ads consent signals and PostHog capture. Account-linked product events and operational analytics may still be collected. Google Ads acquisition measurement is disabled in the native apps.

Important: Dia is AI, Not a Human

Dia is a generative AI that creates responses in real-time. Sometimes it might say things that sound insightful about you, but these are AI-generated patterns, not facts. Dia can be wrong.

Don't share sensitive info you wouldn't share with any other AI chatbot. Dia is not a therapist, doctor, or professional advisor. If you're in crisis, please contact emergency services or a qualified professional.

Use common sense. Dia is here to help you learn languages and have interesting conversations. Treat it like you would any AI tool.

Dia may use third-party services for AI processing. These include OpenAI, Anthropic, Google Gemini, Microsoft Azure AI Speech and Replicate, with ElevenLabs and Deepgram as fallbacks. These are the same services that power other popular AI chatbots like ChatGPT and Claude. Your data has the potential to be sent to these services and processed by them, abiding by their privacy policies and terms of service. These partners help us run the service. That's it. If required by law, we may disclose information to authorities.

Who We Share With (And Why)

We work with trusted companies to make Dia work. Here's the complete list:

Authentication & Database

Supabase (industry-standard secure infrastructure)

AI Conversation

Anthropic Claude, Google Gemini, OpenAI: your messages are sent to these services to generate responses

Voice & Audio

Microsoft Azure AI Speech (the voice you hear and the transcription of what you say), OpenAI transcription as a fallback; ElevenLabs and Deepgram only as fallbacks

Pictures

Replicate: a short description of the scene is sent to generate the pictures in your chats

Payments

Stripe (we never see your full card number)

Hosting

Vercel (fast, global infrastructure)

Payments & Billing

Website payments go through Stripe. We never see or store your full credit card number. Stripe handles everything and gives us only basic info like "payment successful" or "subscription active."

You can manage or cancel your subscription anytime through your account settings or the Stripe customer portal.

In the iPhone app, purchases use Apple's App Store. Supported Google Play installations use Play Billing when it is available; other supported Android checkout flows use Stripe. You manage store subscriptions through the relevant store account.

How We Protect Your Data

  • Encryption everywhere: All data is encrypted in transit (TLS) and at rest
  • Private audio URLs: Your generated voice messages use signed URLs that expire
  • Rate limiting: We prevent abuse and spam automatically
  • Minimal access: Only essential services have access to your data, and only what they need

Your Control & Rights

You're in control. Depending on where you live, you have rights including:

  • Access your data: See what we have about you
  • Delete your account: Remove linked conversations, learning records and owned media (Account Settings → Delete Account)
  • Correct mistakes: Update your info if something's wrong
  • Export your data: Take your conversations with you
  • Lodge a complaint: Contact your local data protection authority if you have concerns

How Long We Keep Your Data

  • Conversations: Kept while you have an account to support your learning. Account-linked chat, call and tutor records are erased when account deletion completes.
  • Audio files: Account-owned recordings and generated audio are removed with account deletion. Delivery caches may take time to refresh; copies already downloaded outside the app may remain.
  • Error logs: Account-linked error logs are removed with account deletion. Diagnostics without an account link may remain.
  • Older shared media: Some legacy files and provider records lack reliable account ownership information and cannot be included in automatic account erasure. Contact us about these records.
  • Financial records: Payment and subscription records may be retained for accounting and legal obligations. Account deletion does not cancel a subscription managed by Apple, Google or Stripe.
  • Interrupted deletion: If storage or a provider is unavailable, deletion remains pending for retry. We confirm completion only after tracked data removal and account deletion succeed.

Model Improvement

  • Product improvement: When you make language errors that Dia corrects (for example, "Hola, me llamo es Sarah" → "Hola, me llamo Sarah"), we may use those anonymized corrections to improve our language models. Before we use any correction, we remove your name, location, and any personal details. For example, that correction is kept as "Hola, me llamo es [redacted]" → "Hola, me llamo [redacted]" (only the grammatical pattern is kept). You choose when you first use Dia (opt in or opt out), and you can change your choice anytime from Preferences.
  • Your control: You can change your consent preferences at any time from Preferences. Every consent decision is logged with a timestamp and policy version, and you can ask us for your consent history at any time. We store these logs to comply with GDPR Article 7 (evidence of consent).
  • Legal basis: For product improvement, we rely on explicit consent (GDPR Article 6(1)(a)). You give or refuse this choice when you first use Dia, and you can withdraw consent anytime.

Other Important Details

  • International transfers: Your info may be processed in other countries where our service partners are based. We use Standard Contractual Clauses and take legal steps to safeguard your data. Dia has a signed Data Processing Agreement (DPA) with Supabase, our database provider, which includes Standard Contractual Clauses (SCCs) to ensure GDPR-compliant data transfers to the United States.
  • Children's privacy: Dia isn't for children under 13. We never knowingly collect info from kids.
  • Your rights (GDPR, CCPA, etc.): We honor privacy laws like GDPR/CCPA. Our legal bases: contract (running the app), legitimate interest (security & improvements), and consent (optional features).

Updates to This Policy

We may update this policy occasionally. If we make big changes, we'll update the "Last updated" date at the top. We recommend checking back periodically.

Contact

For general questions or concerns about this policy, please contact: contact@talktodia.com