Privacy Policy

TaleWalk (the "Service") is operated by CoreSpring HK Limited, a company incorporated in Hong Kong SAR, with its registered office at Room 1006, 10/F, Po Yip Building, 23 Hing Yip Street, Kwun Tong, Kowloon, Hong Kong ("CoreSpring", "we", "us"). This Privacy Policy explains what personal data we collect when you use the TaleWalk iOS application, TaleWalk web services and the public website at talewalk.com (together, the "Service"), how we use it, and the choices you have.

TaleWalk provides account-based features in its iOS app and web services. The public information pages at talewalk.com, including this Privacy Policy, can be viewed without signing in. Features and purchase options may differ by platform; Section 9 explains our website and web services.

TaleWalk is not offered in mainland China and is not intended for persons located in mainland China; we do not knowingly collect personal data from persons in mainland China.

Questions or requests about your data: privacy@talewalk.com.

2.1 Data you give us

• Account data. You can sign in only with Apple or Google. We receive a stable user identifier and the account information made available through your authorisation. Apple may provide your email address, including an Apple private relay email address, and your name; Apple provides your name only on your first authorisation, and we save it at that time. We never receive your password for third-party sign-in. Information we receive from Google is limited to your email address, name, profile picture and account identifier. We use it to create and identify your account and to pre-fill your display name and avatar, which you can change at any time in your profile. It is never used for advertising, sold, or shared with third parties other than service providers acting on our behalf. See Section 2.7 for more about Google user data. Providing account data is necessary to create an account; the other data described in this Section is provided voluntarily, and if you do not provide it the related feature will not work.
• Content you create. Worlds (role-playing scripts containing characters, a player character and an opening), stories, characters, messages you send to characters, memories and choices you make inside a story, and any text or images you upload. This includes the sentence or form you use to create a world, cover-generation descriptions and comments. This content is the core of the Service and is stored so you can return to it. Please do not include sensitive information (such as health, sexual life or orientation, religion or political opinions) in your messages. If you choose to include such information in a story, we process it only to generate the content you request and on the basis of your explicit consent given by sending the message; you can delete the story or your account at any time. We also record your likes, favourites and follows to provide community features.
• Support messages. Anything you send to support@talewalk.com.

2.2 Data collected automatically

• Usage data. Which stories you open, how long you read, features you use and performance metrics. We use our own event reporting, which sends events to our own servers, and currently do not integrate third-party analytics SDKs. Crash reports are provided through Apple only if you enable sharing with app developers in your iOS settings.
• Device data. Device model, operating system version, app version, language, time zone, IP address and coarse location derived from it (country or region). We also use device identifiers for reward limits and fraud prevention, as described in Section 2.6.
• Advertising identifiers. On iOS, the Identifier for Advertisers (IDFA) is only accessed if you allow tracking in the App Tracking Transparency prompt. Without your permission we only use non-personalised advertising. Section 4 explains what the tracking permission means and how to change it.
• Website language preference. The website can remember the language you select using your browser's local storage, as described in Section 9.

2.3 Data from third parties

• Purchase records. When you buy a subscription or in-app item, Apple tells us what you bought, when, and whether it is still active. We never receive your full card number.
• Rewarded-video verification. We receive server-to-server callbacks from the advertising platform to verify whether you completed a rewarded video and qualify for Sphene.

2.4 Public content and community

Worlds you publish, your nickname and profile picture, comments, likes and following relationships are visible to other users. Private worlds are visible only to you. We store favourites to make your saved worlds available to you.

We use content moderation measures to address content that violates our rules. Content may be rejected or removed. If you disagree with a moderation decision, you can appeal by emailing support@talewalk.com, and a person will review your appeal.

2.5 Notifications

If you allow notifications, we store your device's push notification token to send notifications such as replies to comments, new publications from authors you follow and moderation results. You can turn notifications off in your device's system settings.

Marketing messages, if any, are sent only with your consent as required by Part 6A of the Personal Data (Privacy) Ordinance, and you can opt out at any time.

2.6 Rewards, Sphene and fraud prevention

We record Sphene (our consumable virtual currency) issued, spent and expired, including Sphene associated with subscriptions, purchases, rewarded videos and promotions. Rewarded-video completion is verified through the advertising platform's server-to-server callback. To prevent reward abuse, we use device identifiers, IP addresses and account behaviour to set daily limits and identify unusual activity.

2.7 Google user data

When you sign in with Google, we request only basic profile access through the openid, email and profile scopes. We receive your name, email address, profile picture and Google account identifier. We use this information to create and identify your TaleWalk account, authenticate your sign-in and pre-fill your display name and avatar. You can change your display name and avatar in your profile; their visibility is described in Section 2.4.

We store this information as part of your account data on our servers. We retain and delete it under Section 8, including the 30-day account-restoration period and the limited record-retention exceptions described there. We do not sell Google sign-in data, use it for advertising or use it to train AI models. We share it only with service providers acting on our behalf to operate the Service, subject to the restrictions in Section 6.

You can request deletion of your account and associated Google sign-in data in the iOS app under Settings → Account → Delete account, or by emailing privacy@talewalk.com, as described in Section 10. You can also remove TaleWalk's access in your Google Account connections. Removing access does not itself delete your TaleWalk account or data already stored by us; use the account-deletion methods above to request deletion.

TaleWalk's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell your personal data. We do not use the content of your stories or conversations to train AI models.

The free tier of TaleWalk is supported by advertising served through Google AdMob. Ads may appear as banners on browsing screens and as rewarded videos you choose to watch in exchange for Sphene.

• Google may use device identifiers and your interaction with ads to measure performance and, where you have consented, to personalise ads. Google's use of data is described in the Google advertising privacy page. Google sign-in account information is not used for advertising, as stated in Section 2.1.
• If you are in the European Economic Area, the United Kingdom, Switzerland or certain US states, you will see a consent message before ads are shown. You can change your choice at any time in the app under Settings → Privacy → Ad privacy options.
• On iOS you can also disable tracking in Settings → Privacy & Security → Tracking.
• Subscribers do not see ads.

The App Tracking Transparency prompt asks whether you permit your activity to be linked across other companies' apps and websites for advertising or advertising measurement. If you decline, we do not access your IDFA and show only non-personalised ads. You can withdraw tracking permission in the iOS settings above.

5.1 Story and character generation

Story continuations and character replies are generated by large language models operated by third-party AI providers on our behalf. To generate a reply we send the relevant story context and your recent messages to the provider. We only send your data to providers whose terms, or our agreement with them, restrict its use to providing the service to us and do not allow it to be used to train their models, and we enable any available settings that opt out of training and minimise retention. Each provider, where it processes your data and how long it keeps it are listed in Section 7.

AI output can be inaccurate, incomplete or unexpected. It is fiction and should not be relied on as advice of any kind.

5.2 Speech, image and video generation

When you play a character reply as speech, we send the reply text and the selected voice to a speech-synthesis provider (MiniMax) to generate audio. When you generate a cover or character image, we send your description and any reference image you choose to an image-generation provider (OpenAI). When you generate a short video, we send your description, the relevant character and world settings and any reference image to a video-generation provider (ByteDance's Seedance model, provided through Volcano Engine / BytePlus). Generated images, audio and video are stored with your content (Section 8) so you can view them again. These providers are subject to the same restrictions described in Section 5.1. Generated media is fiction produced by automated systems; do not present it as a real recording or as a real person.

• Apple for sign-in, App Store purchases, subscription management, push notifications and crash reports shared through Apple only when you allow sharing with developers in iOS settings.
• Google (AdMob, and Google sign-in if you use it) for advertising and authentication. Google sign-in account data is used only as described in Section 2.1, not for advertising.
• AI providers: the large-language-model providers that generate story text, OpenAI (image generation), ByteDance / Volcano Engine (Seedance video generation) and MiniMax (speech synthesis), as described in Section 5.
• Alibaba Cloud, which provides the object storage where images, audio and video you upload or generate are stored.
• Cloudflare, which hosts and protects talewalk.com and routes email sent to our @talewalk.com addresses.
• Other users who can see your public content and community activity as described in Section 2.4.
• Authorities and other parties when required by law, to protect our rights, or in connection with a merger, acquisition or sale of assets, in which case we will notify you.

Service providers process your data only under written terms that restrict their use of your data to the services they provide to us, and we require them to provide at least the same level of protection for your data as described in this Privacy Policy. Section 7 lists each provider, what we send, where it is processed and how long it is kept.

Our event reporting goes to our own servers; we currently do not integrate third-party analytics SDKs.

We are based in Hong Kong. The providers below process your data on our behalf, so your data may be processed outside your country of residence, including but not limited to the United States and Singapore and, for video and speech generation depending on the API region we use, mainland China. Transfers take place at the moment you use the relevant feature (for example when you send a message or generate an image), by encrypted transmission, and the provider uses the data only for the purpose shown.

Where the law of your country requires safeguards for international transfers, we rely on the European Commission's standard contractual clauses (with the UK Addendum where applicable) or on the equivalent data-processing terms offered by the provider, and we assess the destination before we transfer. You can request a summary of the safeguards that apply to you at privacy@talewalk.com.

You can refuse a transfer by not using the feature that requires it or by deleting your account; the effect is that the feature, or the Service, will not be available to you. If you are in Japan, we will provide on request information about the personal-data protection framework of each destination country and the measures taken by the provider.

• Account and content: for as long as your account exists. When you request account deletion, the account enters a 30-day retention period. Signing in during that period restores your account. After 30 days, your account and content, including your stories, worlds, messages, comments and profile, are permanently deleted, except where we must keep records for legal, tax or fraud-prevention purposes. See Section 10 for deletion methods.
• Sphene and purchase records: 7 years, as required by Hong Kong accounting law.
• Usage and crash data: up to 14 months, then deleted or aggregated.
• AI processing data: retained by providers only as long as needed to generate the reply, speech, image or video, subject to the retention terms listed in Section 7; generated media you keep is stored with your content.
• Push notification tokens: until you turn off notifications or delete your account.
• Moderation records: until 90 days after the content is deleted, or longer where we must preserve records for a report to authorities or for legal proceedings.

The public information pages at talewalk.com, including the homepage and legal documents, can be viewed without signing in or making a purchase. These pages do not use third-party analytics. TaleWalk's web application has account sign-in and is also covered by this Privacy Policy. Web services may offer purchases in the future; before introducing them, we will update this policy to describe the applicable payment providers and the data they process.

The web application may use cookies or browser storage to maintain your signed-in session and remember preferences needed for its features. Blocking or clearing this storage may require you to sign in again or affect those features.

When you choose a language on the public information pages, the website stores that preference in your browser's local storage so it can remember your choice. The locally stored preference is not uploaded separately and is not used for tracking. If a page URL contains a language parameter, that parameter may be included in the normal request for the page. You can remove it by clearing the site's data in your browser settings.

The landing page at talewalk.com/app, which opens the app or the App Store from a shared link, keeps a random visit identifier in your browser's session storage for the duration of the visit and passes the parameters contained in the link you opened (such as the sharing source, share identifier and campaign identifier) to the app so that we can attribute the visit; these parameters do not identify you by name and are not shared with third parties.

The public information and sharing pages are served through Cloudflare, which processes your IP address and request metadata to deliver and protect the site; your browser may also send network-error reports to Cloudflare. Fonts on these pages are served from talewalk.com itself; these pages do not load fonts or other resources from Google or any other third-party domain.

Subject to applicable law, you may:

• Access the personal data we hold about you and receive a copy.
• Correct inaccurate data.
• Delete your account and data at any time directly in the app under Settings → Account → Delete account, or by emailing privacy@talewalk.com.
• Object to or restrict certain processing, and withdraw consent at any time (this does not affect processing before withdrawal).
• Receive your data in a portable format.
• Lodge a complaint with a supervisory authority. In Hong Kong this is the Office of the Privacy Commissioner for Personal Data (PCPD). EEA and UK users may contact their local data protection authority.

After a deletion request, your account enters a 30-day retention period. You can restore it by signing in during those 30 days; after that period it is permanently deleted, subject to the limited record-retention exceptions in Section 8. When you request deletion of an account using Apple sign-in, we also revoke its Apple authorisation.

You can withdraw advertising consent through Settings → Privacy → Ad privacy options in the app, withdraw tracking permission through iOS Settings → Privacy & Security → Tracking, and turn off notifications in your device's system settings.

To exercise any right, email privacy@talewalk.com. We respond within 40 days as required by the Hong Kong Personal Data (Privacy) Ordinance, and sooner where other laws require.

US state residents. Showing personalised ads may be considered "sharing" or "targeted advertising" under some state laws. You can opt out through the consent message in the app or by disabling tracking on your device. We do not knowingly sell personal data and we do not discriminate against you for exercising your rights.

The Service is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with data, contact us and we will delete it.

We protect data with encryption in transit (TLS), access controls and regular review of our providers. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and the relevant authorities as required by law.

The Service may contain links to websites or services we do not operate, including Apple and Google. Their privacy practices are governed by their own policies, which we encourage you to read.

This Privacy Policy is written in English. Translations are provided for convenience only. If there is any inconsistency between the English version and a translation, the English version prevails.

We may update this Privacy Policy from time to time. We will post the new version here with a new effective date, and for material changes we will notify you in the app or by email before they take effect.

CoreSpring HK Limited
Room 1006, 10/F, Po Yip Building, 23 Hing Yip Street, Kwun Tong, Kowloon, Hong Kong
Privacy: privacy@talewalk.com
Support: support@talewalk.com
Legal: legal@talewalk.com