TaleWalk
On this page
1.Who we are
TaleWalk (the "Service") is operated by CoreSpring HK Limited, a company incorporated in Hong Kong SAR, with its registered office at Room 1006, 10/F, Po Yip Building, 23 Hing Yip Street, Kwun Tong, Kowloon, Hong Kong ("CoreSpring", "we", "us"). This Privacy Policy explains what personal data we collect when you use the TaleWalk website at talewalk.com and the TaleWalk iOS application (together, the "Service"), how we use it, and the choices you have.
TaleWalk's interactive features, accounts and purchases are available in the iOS app. talewalk.com is a static information website with no account system, sign-in or purchases.
Questions or requests about your data: [email protected].
2.Data we collect
2.1 Data you give us
- Account data. You can sign in only with Apple or Google. We receive a stable user identifier and the account information made available through your authorisation. Apple may provide your email address, including an Apple private relay email address, and your name; Apple provides your name only on your first authorisation, and we save it at that time. We never receive your password for third-party sign-in. Information we receive from Google is limited to your email address, name, profile picture and account identifier. We use it to create and identify your account and to pre-fill your display name and avatar, which you can change at any time in your profile. It is never used for advertising, sold, or shared with third parties other than service providers acting on our behalf.
- Content you create. Worlds (role-playing scripts containing characters, a player character and an opening), stories, characters, messages you send to characters, memories and choices you make inside a story, and any text or images you upload. This includes the sentence or form you use to create a world, cover-generation descriptions and comments. This content is the core of the Service and is stored so you can return to it. We also record your likes, favourites and follows to provide community features.
- Support messages. Anything you send to [email protected].
2.2 Data collected automatically
- Usage data. Which stories you open, how long you read, features you use and performance metrics. We use our own event reporting, which sends events to our own servers, and currently do not integrate third-party analytics SDKs. Crash reports are provided through Apple only if you enable sharing with app developers in your iOS settings.
- Device data. Device model, operating system version, app version, language, time zone, IP address and coarse location derived from it (country or region). We also use device identifiers for reward limits and fraud prevention, as described in Section 2.6.
- Advertising identifiers. On iOS, the Identifier for Advertisers (IDFA) is only accessed if you allow tracking in the App Tracking Transparency prompt. Without your permission we only use non-personalised advertising. Section 4 explains what the tracking permission means and how to change it.
- Website language preference. The website can remember the language you select using your browser's local storage, as described in Section 9.
2.3 Data from third parties
- Purchase records. When you buy a subscription or in-app item, Apple tells us what you bought, when, and whether it is still active. We never receive your full card number.
- Rewarded-video verification. We receive server-to-server callbacks from the advertising platform to verify whether you completed a rewarded video and qualify for credits.
2.4 Public content and community
Worlds you publish, your nickname and profile picture, comments, likes and following relationships are visible to other users. Private worlds are visible only to you. We store favourites to make your saved worlds available to you.
Worlds, comments and AI output undergo automated content moderation. The results may cause content to be rejected or removed. If you disagree with an automated moderation decision, you can appeal by emailing [email protected], and a person will review your appeal.
2.5 Notifications
If you allow notifications, we store your device's push notification token to send notifications such as replies to comments, new publications from authors you follow and moderation results. You can turn notifications off in your device's system settings.
2.6 Rewards, credits and fraud prevention
We record credits issued, spent and expired, including credits associated with subscriptions, purchases, rewarded videos, daily check-ins and friend invitations. Rewarded-video completion is verified through the advertising platform's server-to-server callback. To prevent reward abuse, we use device identifiers, IP addresses and account behaviour to set daily limits and identify unusual activity.
2.7 Invitation attribution
If you install the app through an invitation link, we may read an invitation code from the clipboard once on the first launch; iOS will show a system prompt. We combine this with coarse IP matching to attribute the invitation to the inviter. We do not read other clipboard content.
3.How we use your data
| Purpose | Data used | Legal basis (EEA/UK users) |
|---|---|---|
| Provide the Service: sign-in, save and sync your stories, generate story continuations | Account data, content you create, device data | Performance of a contract |
| Generate AI responses, speech and cover images | Your messages and story context, character-reply text and cover descriptions are sent to the relevant providers to generate the requested output (see Section 5) | Performance of a contract |
| Process purchases and manage entitlements | Purchase records, account data | Performance of a contract |
| Show advertising in the free tier | Device data, advertising identifiers (only with consent where required) | Consent, or legitimate interest for non-personalised ads |
| Improve and secure the Service, fix crashes, prevent fraud and abuse | Usage data, device data | Legitimate interest |
| Communicate with you about your account and respond to support; send notifications you enable | Account data, support messages, push notification token | Performance of a contract / legitimate interest; consent for optional push notifications |
| Comply with law and enforce our Terms | Any of the above as required | Legal obligation / legitimate interest |
| Moderate content and review appeals | Worlds, comments, AI output, account data and moderation records | Legitimate interest / legal obligation |
| Provide community features | Published worlds, nickname, profile picture, comments, likes, favourites and following relationships | Performance of a contract |
| Provide rewards, attribute invitations and prevent reward abuse | Rewarded-video verification, credit records, invitation codes, device identifiers, IP addresses and account behaviour | Legitimate interest |
We do not sell your personal data. We do not use the content of your stories or conversations to train AI models.
4.Advertising
The free tier of TaleWalk is supported by advertising served through Google AdMob. Ads may appear as banners on browsing screens, full-screen ads between sessions, and rewarded videos you choose to watch in exchange for credits.
- Google may use device identifiers and your interaction with ads to measure performance and, where you have consented, to personalise ads. Google's use of data is described in the Google advertising privacy page. Google sign-in account information is not used for advertising, as stated in Section 2.1.
- If you are in the European Economic Area, the United Kingdom, Switzerland or certain US states, you will see a consent message before ads are shown. You can change your choice at any time in the app under Settings → Privacy → Ad privacy options.
- On iOS you can also disable tracking in Settings → Privacy & Security → Tracking.
- Subscribers do not see ads.
The App Tracking Transparency prompt asks whether you permit your activity to be linked across other companies' apps and websites for advertising or advertising measurement. If you decline, we do not access your IDFA and show only non-personalised ads. You can withdraw tracking permission in the iOS settings above.
5.AI-generated content
5.1 Story and character generation
Story continuations and character replies are generated by large language models operated by third-party AI providers on our behalf. To generate a reply we send the relevant story context and your recent messages to the provider. Our providers are contractually bound to use this data only to provide the service to us, not to train their models, and to delete it after processing according to their retention terms. We choose providers that offer this commitment.
AI output can be inaccurate, incomplete or unexpected. It is fiction and should not be relied on as advice of any kind.
5.2 Speech and image generation
When you play a character reply as speech, we send the reply text to a speech synthesis provider to generate audio. When you generate a cover, we send your description to an image-generation provider. These providers are subject to the same restrictions described in Section 5.1: they may use the data only to provide services to us, may not use it to train their models, and must delete it after processing according to their retention terms.
6.Who we share data with
- Apple for sign-in, App Store purchases, subscription management and crash reports shared through Apple only when you allow sharing with developers in iOS settings.
- Google (AdMob, and Google sign-in if you use it) for advertising and authentication. Google sign-in account data is used only as described in Section 2.1, not for advertising.
- AI model, speech synthesis and image-generation providers as described in Section 5.
- Cloud hosting and infrastructure providers that store and process data on our behalf.
- Other users who can see your public content and community activity as described in Section 2.4.
- Authorities and other parties when required by law, to protect our rights, or in connection with a merger, acquisition or sale of assets, in which case we will notify you.
All service providers act under written agreements that restrict their use of your data to the services they provide to us. We require third-party service providers receiving personal data, including Google AdMob and AI, speech synthesis and image-generation providers, to provide at least the same level of protection for your data as described in this Privacy Policy.
Our event reporting goes to our own servers; we currently do not integrate third-party analytics SDKs.
7.International transfers
We are based in Hong Kong and use service providers in the United States, the European Union and other countries. Where required, transfers are protected by standard contractual clauses or equivalent safeguards. By using the Service you understand that your data may be processed outside your country of residence.
8.How long we keep data
- Account and content: for as long as your account exists. When you request account deletion, the account enters a 30-day retention period. Signing in during that period restores your account. After 30 days, your account and content, including your stories, worlds, messages, comments and profile, are permanently deleted, except where we must keep records for legal, tax or fraud-prevention purposes. See Section 10 for deletion methods.
- Credit and purchase records: 7 years, as required by Hong Kong accounting law.
- Usage and crash data: up to 14 months, then deleted or aggregated.
- AI processing data: retained by providers only as long as needed to generate the reply, speech or image, subject to their published limits.
- Push notification tokens: until you turn off notifications or delete your account.
- Moderation records: until 90 days after the content is deleted.
9.The website and browser storage
talewalk.com is a static information website. It has no account system, sign-in or purchases, sets no cookies and uses no third-party analytics. If this changes, we will update this Privacy Policy.
When you choose a language, the website stores that preference in your browser's local storage so it can remember your choice. The locally stored preference is not uploaded separately and is not used for tracking. If a page URL contains a language parameter, that parameter may be included in the normal request for the page. You can remove it by clearing the site's data in your browser settings.
The website loads fonts from Google Fonts. When your browser requests these fonts, Google receives your IP address and the connection information needed to serve the font files. This request is used to display the website's typography.
10.Your rights
Subject to applicable law, you may:
- Access the personal data we hold about you and receive a copy.
- Correct inaccurate data.
- Delete your account and data at any time directly in the app under Settings → Account → Delete account, or by emailing [email protected].
- Object to or restrict certain processing, and withdraw consent at any time (this does not affect processing before withdrawal).
- Receive your data in a portable format.
- Lodge a complaint with a supervisory authority. In Hong Kong this is the Office of the Privacy Commissioner for Personal Data (PCPD). EEA and UK users may contact their local data protection authority.
After a deletion request, your account enters a 30-day retention period. You can restore it by signing in during those 30 days; after that period it is permanently deleted, subject to the limited record-retention exceptions in Section 8. When you request deletion of an account using Apple sign-in, we also revoke its Apple authorisation.
You can withdraw advertising consent through Settings → Privacy → Ad privacy options in the app, withdraw tracking permission through iOS Settings → Privacy & Security → Tracking, and turn off notifications in your device's system settings.
To exercise any right, email [email protected]. We respond within 40 days as required by the Hong Kong Personal Data (Privacy) Ordinance, and sooner where other laws require.
US state residents. Showing personalised ads may be considered "sharing" or "targeted advertising" under some state laws. You can opt out through the consent message in the app or by disabling tracking on your device. We do not knowingly sell personal data and we do not discriminate against you for exercising your rights.
11.Children
The Service is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with data, contact us and we will delete it.
12.Security
We protect data with encryption in transit (TLS), encryption at rest for stored content, access controls and regular review of our providers. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and the relevant authorities as required by law.
13.Third-party links and services
The Service may contain links to websites or services we do not operate, including Apple and Google. Their privacy practices are governed by their own policies, which we encourage you to read.
14.Language
This Privacy Policy is written in English. Translations are provided for convenience only. If there is any inconsistency between the English version and a translation, the English version prevails.
15.Changes to this policy
We may update this Privacy Policy from time to time. We will post the new version here with a new effective date, and for material changes we will notify you in the app or by email before they take effect.
16.Contact
CoreSpring HK Limited
Room 1006, 10/F, Po Yip Building, 23 Hing Yip Street, Kwun Tong, Kowloon, Hong Kong
Privacy: [email protected]
Support: [email protected]
Legal: [email protected]