Privacy Policy

Overview

HEYLINGO OÜ operates Another Voice. This policy explains what data we process, why we process it, who receives it, how long we keep it, and what choices you have.

Another Voice neither sells personal information nor shows third-party ads. In enabled iOS builds, Apple's App Tracking Transparency (ATT) prompt is shown directly, without a separate Another Voice explanation. Meta measurement starts only after the ATT response. If ATT is denied, ad or device identifiers and RevenueCat purchase attribution stay off; limited activation and parent-funnel events may continue until disabled in Account. On Android, the in-app measurement choice remains the initial gate. A fresh guest installation can reach its gate before account sign-in; the app does not verify an adult account or show a neutral age gate. Measurement is suspended in known restricted-child sessions and excludes Home, Board, AAC, child-profile, or Parent Insights activity.

1. Information We Collect

The information processed depends on the features you choose to use:

• Account information: Your name, email address, account identifier, authentication status, app language, and account type.
• App installation information: The app creates a random Another Voice installation identifier used for account bootstrap, request idempotency, anti-abuse controls, authentication, and security. Optional child-device access also uses an installation secret to authenticate, list, renew, and revoke that access. These values may be linked to the relevant account or child, are not advertising identifiers, and are not used for advertising or tracking.
• Profiles and user content: Child profile names and settings, communication boards, tiles, labels, symbols, photos, saved phrases, communication history, and sharing or login codes you create.
• Purchase information: Product identifiers, purchase and entitlement status, and restore information. The App Store or Google Play processes payment-card details; Another Voice does not receive your full payment-card number.
• Meta advertising measurement: iOS waits for ATT before fresh-guest activation, completed parent registration, purchase-option views, or checkout events. ATT authorization permits ad or device identifiers and RevenueCat attribution; denial leaves these off, though limited activation and funnel events may continue until disabled in Account. Android requires the in-app choice. Events can include a Meta app identifier, permitted device identifier, product, price, and currency. RevenueCat may send verified non-renewing purchase attribution. Child profile details or counts, boards, tiles, words, sentences, AAC activity, Parent Insights, and Home or Board activity are not Meta events.
• Usage information: Product interaction needed to provide features such as board history, heatmaps, synchronization, offline readiness, and account or license state.
• Parent Insights summaries and examples: When an authorized adult enables supported Insights collection, child-device board use can be summarized by day using counts such as board visits, speech-button selections, spoken-message and message-length groups, navigation actions, Vocabulary Level context, and board-layout heatmap totals. These summaries use random child, installation, board, revision, and speech-button identifiers to connect the activity to the right records. Parent Insights may also show examples of repeated multi-word messages, including message words, inside the private adult view. A therapist needs separate permission from the family to see message words. Text entered into symbol search is not added to Parent Insights; symbol search remains the separate feature described below.
• Support information: The subject, message, reply email, and any diagnostics you explicitly choose to attach, such as app version, device model, operating-system version, app language, current page, account type, and selected app settings.
• Symbol searches: Search words are sent through Another Voice to Freepik to return matching symbols. Search words and results may be retained in a shared cache without your account identifier so repeated searches can be served efficiently.
• Locally processed speech data: Downloaded text-to-speech voice models and generated speech audio remain on the device. Another Voice does not require microphone recordings for text-to-speech playback.

2. How We Use Your Information

We process this information to:

• Create and authenticate accounts and child-device access.
• Provide, personalize, synchronize, back up, restore, and secure communication boards and settings.
• Provide offline voices, board images, history, heatmaps, sharing, and support.
• Provide Parent Insights using daily board-use summaries and repeated multi-word message examples inside the private adult view, while excluding text entered into symbol search.
• Process and restore purchases and maintain license entitlements.
• Measure acquisition, parent purchase-funnel interactions, and verified purchase attribution under the platform controls below. Measurement is not required for AAC, account, or purchase functionality.
• Investigate technical problems, prevent abuse, improve reliability, and respond to requests you send us.
• Comply with legal, accounting, security, and dispute-resolution obligations.

3. Service Providers and Disclosures

We disclose information only when needed to provide a feature you request, operate the service, or meet a legal obligation. Relevant recipients include:

• Hosting and email providers that process account, board, upload, and support data on our behalf.
• Apple and Google for authentication, store purchases, restoration, and distribution.
• RevenueCat for purchases and entitlements. Another Voice supplies its account identifier for restoration. With iOS ATT authorization or accepted Android measurement, RevenueCat may receive permitted Meta and device identifiers and send attribution to Meta.
• Meta, in enabled builds. iOS starts after ATT responds; denial leaves ad or device identifiers and RevenueCat attribution off but may allow limited activation and funnel events. Android requires the in-app choice. Meta may receive the events above, permitted identifiers, and RevenueCat-verified purchase attribution, but no child or AAC content.
• Freepik when you run a symbol search. The search words are sent to Freepik to return matching symbols; Another Voice does not send your account profile with the query.
• remove.bg, operated by Canva Austria GmbH, only when you explicitly choose background removal. The selected image is sent for that purpose after a disclosure and confirmation in the app. The processed result may then be stored with your board content.
• Authorities or other parties when disclosure is required by law or is reasonably necessary to protect users, HEYLINGO OÜ, or the service from fraud, abuse, or security threats.

We require service providers to process information only for the relevant service and subject to applicable privacy and security obligations.

4. Data Retention

Account information, profiles, boards, history, settings, and uploaded content are retained while your account is active so the service can synchronize and restore them. Support messages and consented diagnostics are retained while needed to resolve and follow up on the request. Purchase and transaction records may be retained where required for accounting, fraud prevention, legal compliance, or dispute resolution.

When an account deletion is confirmed, Another Voice removes the account and associated active-service data, including child profiles, boards, tiles, history, and uploaded content. Limited records may be retained only when required by law, for security or fraud prevention, or to establish or defend legal claims. Residual copies in protected backups expire through the normal backup lifecycle and are not used for ordinary product operation.

The random Another Voice app installation identifier remains in app storage across ordinary account sign-outs. This continuity prevents repeated guest or trial bootstrap and supports request idempotency, anti-abuse controls, and security. It is replaced when the app storage is removed or the app is reinstalled. For guest records, the server retains only a purpose-specific HMAC of this identifier rather than the raw value, and clears the account link when the guest is converted to a verified account or the applicable account lifecycle removes it.

A child-device installation identifier remains on that installation across ordinary child-session sign-outs so the installation can be recognized and secured when it reconnects. It is replaced at the app-install boundary, and its server association is revoked or removed when the installation, child access, or related account is deleted.

Parent Insights information may remain in temporary retry storage on a child device or in its browser while offline or when an upload is interrupted. Daily summary counts can remain there for up to 13 months. Repeated-message wording remains only while waiting to upload; after a successful upload it is removed after that local day ends, and any unsent copy is removed after 12 months. Another Voice retains daily Insights summaries and repeated-message examples for 12 months, subject to any applicable legal hold. Text entered into symbol search and legacy exact-message analytics are not added to these retry stores. Available Insights deletion controls, child-access revocation, account deletion, clearing app or website data, or the normal retention process remove the applicable copies.

Downloaded voice models, generated speech files, and cached board images are stored on the device. App controls remove specific content where offered, and uninstalling the app removes the remaining local downloads.

Apple retains the iOS ATT decision. Another Voice retains its measurement setting and Android choice. Disabling it stops future Meta events and identifier sharing; it does not recall data already transferred. Meta and RevenueCat retain earlier data under their settings, legal duties, and privacy terms.

5. Security

We use technical and organizational measures designed to protect information in transit and at rest, restrict access, and authenticate account operations. No method of transmission or storage can be guaranteed completely secure.

6. Your Rights

Depending on where you live, you may have rights to access, correct, export, restrict, object to, or delete personal information, and to withdraw consent where processing relies on consent.

You can delete an eligible account from Account settings in the app. You can also request deletion without reinstalling the app at avoice.cloud/delete-account.html. For other requests, contact [email protected]. We may need to verify your identity before completing a request.

• Background removal is optional. Canceling its disclosure means the selected image is not sent to remove.bg.
• Attaching diagnostics to a support message is optional and requires a separate choice.
• An authorized adult can enable or stop future Parent Insights collection separately for each child and can erase that child's existing Insights history. Stopping collection does not erase existing summaries unless the adult separately chooses erasure.
• On iOS, ATT controls ad or device identifiers and RevenueCat attribution. Denial alone may not stop limited Meta activation and funnel events; disabling Advertising measurement in Account stops all future Meta events and identifier sharing. Android uses the in-app choice and Account setting; ATT does not govern Android. AAC, account, and purchase features remain available.
• You may change or remove uploaded content using available app controls. Uninstalling the app removes remaining local downloaded resources.

Request account deletion

7. Children's Privacy

A parent, guardian, or other authorized adult creates and manages child profiles and decides which content and optional features to use. Child-device access does not require the child to provide an email address. We do not use child data for advertising or tracking.

Meta measurement has no verified-adult login or neutral age gate: a fresh guest can reach iOS ATT or the Android choice before sign-in. iOS denial leaves ad or device identifiers and RevenueCat attribution off but may allow limited activation and funnel events. Known restricted-child sessions cannot use measurement. Home, Board, AAC, child-profile, and Parent Insights activity and content are never event data.

If you believe child information was provided without appropriate authority, contact [email protected] so we can investigate and remove it where required.

8. International Processing

HEYLINGO OÜ is established in Estonia. Service providers may process information in other countries. Where required, we use appropriate contractual or legal safeguards for international transfers.

9. Changes to This Privacy Policy

We may update this Privacy Policy as the service or legal requirements change. We will publish the revised policy with a new effective date and provide additional notice when a material change requires it.

10. Contact Us

For privacy questions, concerns, or data-rights requests, contact: