MyInterpreter · Legal
Personal Data Declaration
Draft v1 — 2026-10-15 — pending legal review
Version 1 · Takes effect when MyInterpreter is released (not yet in effect)
This declaration lists every kind of personal data MyInterpreter handles: what it is, why, where it is kept, for how long, who else receives it and whether you can say no. It also maps that list to the privacy label on the App Store and to the Data safety section on Google Play. It complements the Privacy Policy; if they ever differ, the Privacy Policy prevails.
1. What never leaves your phone
Stays on your phone — we never receive it
- Your voice signature (biometric voiceprint) and the recording used to create it.
- Call audio when there is no conversation record — only the translated text of each phrase goes to the other phone.
- Ambient audio in listen mode, processed and discarded right away, never recorded.
- The raw microphone audio — even with a record, only the clean clip of your own voice is kept.
- The private signing key in the phone's secure chip.
- Your contacts list and profile preferences.
2. Inventory of personal data
Each line is one kind of data. Where it is stored: green = your phone only; violet = phone to phone, never on our servers; grey = our cloud in the United States (Google Cloud, Firebase and MongoDB Atlas). The legal bases for each use are in section 5 of the Privacy Policy.
| Data | Examples | Purpose | Where it is stored | Retention | Shared with | Required? |
|---|---|---|---|---|---|---|
| Account | Name, email, optional phone number, password (held by Firebase; never readable by us) | Create and protect your account; let contacts find you by email; account emails | Our cloud (US) | While the account exists; deleted within 30 days of account deletion (backups within 90 days) | Google (Firebase Authentication), MongoDB Atlas, Microsoft 365 (emails) | Required (phone optional) |
| Profile preferences | Language, interpreter voice (female/male), speech rate | Speak your translation the way you chose | Your phone; sent to the other phone at the start of each call | Until you change them or remove the app | The other participant's phone, during calls | Required |
| Contacts you add | Name, email and account ID of people you save | Call and chat with them | Your phone only (email lookup is checked in real time and not stored) | Until you remove them or the app | No one | Optional |
| Push token | Firebase Cloud Messaging token for the MyInterpreter app | Ring for calls; notify new messages | Our cloud (US) | Until you sign out, the token changes or the account is deleted | Google (Firebase Cloud Messaging), delivered through Apple Push Notification service | Required to ring |
| Call record | Caller and callee IDs and names, times, duration, languages, voices, engine, status, end reason, record level | Call history for both participants | Our cloud (US) | 24 months, or until account deletion | The other participant; Google Cloud, MongoDB Atlas | Required |
| Connection setup | WebRTC offer/answer, which contains network addresses | Connect the two phones directly | Our cloud, only while the call is set up | Erased when the call ends | The other participant's phone; a STUN server sees your IP address | Required |
| Live call audio | Microphone audio during a call | Echo cancellation, voice check, speech recognition, translation | Your phone only | Discarded after each phrase | No one | Required for calls (processed on the phone) |
| Live translated phrases | Translated text of each phrase, language, chosen voice | Let the other phone speak the translation | Phone to phone, encrypted; never on our servers | Not stored | The other participant's phone only | Required for calls |
| Conversation record | Per phrase: speaker, device, languages, original text, translation, times, fingerprints, engines, similarity score. Text + audio: the clean original clip and the audio the listener heard. Certified: chain, device signatures, server stamp (time, IP, network), seal, RFC 3161 token, Bitcoin anchor. Each participant's signed acceptance | Review what was said and heard; prove integrity, time, origin and consent | Our cloud (US); audio in a private vault | 30 days, 1 year, 5 years or legal hold, as both accepted | The other participant; Google Cloud, MongoDB Atlas; FreeTSA and OpenTimestamps receive fingerprints only | Optional — both must accept |
| Doubts about a phrase | Your note, the other participant's answer, status | Clear up a doubt without touching the sealed record | Our cloud (US) | Same as the record | The other participant; Google Cloud, MongoDB Atlas | Optional |
| Chat messages | Text, translations beside the original, reactions, read receipts, presence | Deliver and translate messages | Our cloud (US) | Until deleted; after account deletion, messages you sent stay with recipients unless you deleted them | Conversation members; Google Cloud, MongoDB Atlas | Optional |
| Typing preview | The draft, translated while you type | Let the other person read as you write | Our cloud, for 60 seconds at most | Erased within 60 seconds; never stored as a message | Conversation members | Optional (can be turned off) |
| Voice messages | Audio, transcription, translations | Deliver voice messages in the listener's language | Our cloud (US); audio in a private vault | Until deleted (as chat) | Conversation members; Google Cloud, MongoDB Atlas | Optional |
| Documents | Original file (never altered), extracted text, translated version | Share documents with a translation beside the original | Our cloud (US); files in a private vault | Until deleted (as chat) | Conversation members; Google Cloud, MongoDB Atlas (server translation runs on our own infrastructure) | Optional |
| Voice signature (biometric) | Voiceprint: numbers describing pitch and timbre. The enrollment recording is deleted at once | Cut echo and other voices on your own phone | Your phone only — Keychain, this device only | Until you delete it, sign out or delete the account, or after 12 months without use | No one — we never receive it | Optional · 18+ · explicit consent |
| Listen mode audio | Sound around you (speaker, film) | Translate it into your earphones | Your phone only | Discarded immediately; never recorded | No one | Optional |
| Conference room by QR | Translated text of each phrase, languages, temporary listener ID | Deliver the translation to the room's listeners | Our cloud (US) | Deleted when the room closes (at most 24 hours after the last phrase) | Room listeners; Google Cloud, MongoDB Atlas | Optional |
| Device registration | Device ID, model, OS and app version, ECDSA public key (the private key stays in the secure chip) | Verify signatures on consents and certified records | Our cloud (US) | While the device is registered; copies in certified records stay with them | Participants who download a signed package (public key only) | Required |
| Security logs | IP address, time, account ID, request, errors | Security, abuse prevention, troubleshooting | Our cloud (US) | About 30 days | Google Cloud | Required |
| Call quality numbers | Delay per phrase, echo cuts, similarity scores, discarded phrases — no audio, no text | Tune echo protection and fix problems | Our cloud (US) | With the call record (24 months at most) | Google Cloud, MongoDB Atlas | Required |
| Support requests | Your messages, email address, screenshots | Answer you | Our cloud (US) and email | 2 years after the request is closed | Microsoft 365, Google Cloud, MongoDB Atlas | Optional |
| Purchases (when paid plans launch) | Subscription status, product, dates, store transaction ID — never card data | Give access to paid features | Our cloud (US) | As tax and accounting laws require (up to 7 years) | Apple or Google, who bill you | Optional |
Account
Required (phone optional)Name, email, optional phone number, password (held by Firebase; never readable by us)
Our cloud (US)- Purpose
- Create and protect your account; let contacts find you by email; account emails
- Retention
- While the account exists; deleted within 30 days of account deletion (backups within 90 days)
- Shared with
- Google (Firebase Authentication), MongoDB Atlas, Microsoft 365 (emails)
Profile preferences
RequiredLanguage, interpreter voice (female/male), speech rate
Your phone; sent to the other phone at the start of each call- Purpose
- Speak your translation the way you chose
- Retention
- Until you change them or remove the app
- Shared with
- The other participant's phone, during calls
Contacts you add
OptionalName, email and account ID of people you save
Your phone only (email lookup is checked in real time and not stored)- Purpose
- Call and chat with them
- Retention
- Until you remove them or the app
- Shared with
- No one
Push token
Required to ringFirebase Cloud Messaging token for the MyInterpreter app
Our cloud (US)- Purpose
- Ring for calls; notify new messages
- Retention
- Until you sign out, the token changes or the account is deleted
- Shared with
- Google (Firebase Cloud Messaging), delivered through Apple Push Notification service
Call record
RequiredCaller and callee IDs and names, times, duration, languages, voices, engine, status, end reason, record level
Our cloud (US)- Purpose
- Call history for both participants
- Retention
- 24 months, or until account deletion
- Shared with
- The other participant; Google Cloud, MongoDB Atlas
Connection setup
RequiredWebRTC offer/answer, which contains network addresses
Our cloud, only while the call is set up- Purpose
- Connect the two phones directly
- Retention
- Erased when the call ends
- Shared with
- The other participant's phone; a STUN server sees your IP address
Live call audio
Required for calls (processed on the phone)Microphone audio during a call
Your phone only- Purpose
- Echo cancellation, voice check, speech recognition, translation
- Retention
- Discarded after each phrase
- Shared with
- No one
Live translated phrases
Required for callsTranslated text of each phrase, language, chosen voice
Phone to phone, encrypted; never on our servers- Purpose
- Let the other phone speak the translation
- Retention
- Not stored
- Shared with
- The other participant's phone only
Conversation record
Optional — both must acceptPer phrase: speaker, device, languages, original text, translation, times, fingerprints, engines, similarity score. Text + audio: the clean original clip and the audio the listener heard. Certified: chain, device signatures, server stamp (time, IP, network), seal, RFC 3161 token, Bitcoin anchor. Each participant's signed acceptance
Our cloud (US); audio in a private vault- Purpose
- Review what was said and heard; prove integrity, time, origin and consent
- Retention
- 30 days, 1 year, 5 years or legal hold, as both accepted
- Shared with
- The other participant; Google Cloud, MongoDB Atlas; FreeTSA and OpenTimestamps receive fingerprints only
Doubts about a phrase
OptionalYour note, the other participant's answer, status
Our cloud (US)- Purpose
- Clear up a doubt without touching the sealed record
- Retention
- Same as the record
- Shared with
- The other participant; Google Cloud, MongoDB Atlas
Chat messages
OptionalText, translations beside the original, reactions, read receipts, presence
Our cloud (US)- Purpose
- Deliver and translate messages
- Retention
- Until deleted; after account deletion, messages you sent stay with recipients unless you deleted them
- Shared with
- Conversation members; Google Cloud, MongoDB Atlas
Typing preview
Optional (can be turned off)The draft, translated while you type
Our cloud, for 60 seconds at most- Purpose
- Let the other person read as you write
- Retention
- Erased within 60 seconds; never stored as a message
- Shared with
- Conversation members
Voice messages
OptionalAudio, transcription, translations
Our cloud (US); audio in a private vault- Purpose
- Deliver voice messages in the listener's language
- Retention
- Until deleted (as chat)
- Shared with
- Conversation members; Google Cloud, MongoDB Atlas
Documents
OptionalOriginal file (never altered), extracted text, translated version
Our cloud (US); files in a private vault- Purpose
- Share documents with a translation beside the original
- Retention
- Until deleted (as chat)
- Shared with
- Conversation members; Google Cloud, MongoDB Atlas (server translation runs on our own infrastructure)
Voice signature (biometric)
Optional · 18+ · explicit consentVoiceprint: numbers describing pitch and timbre. The enrollment recording is deleted at once
Your phone only — Keychain, this device only- Purpose
- Cut echo and other voices on your own phone
- Retention
- Until you delete it, sign out or delete the account, or after 12 months without use
- Shared with
- No one — we never receive it
Listen mode audio
OptionalSound around you (speaker, film)
Your phone only- Purpose
- Translate it into your earphones
- Retention
- Discarded immediately; never recorded
- Shared with
- No one
Conference room by QR
OptionalTranslated text of each phrase, languages, temporary listener ID
Our cloud (US)- Purpose
- Deliver the translation to the room's listeners
- Retention
- Deleted when the room closes (at most 24 hours after the last phrase)
- Shared with
- Room listeners; Google Cloud, MongoDB Atlas
Device registration
RequiredDevice ID, model, OS and app version, ECDSA public key (the private key stays in the secure chip)
Our cloud (US)- Purpose
- Verify signatures on consents and certified records
- Retention
- While the device is registered; copies in certified records stay with them
- Shared with
- Participants who download a signed package (public key only)
Security logs
RequiredIP address, time, account ID, request, errors
Our cloud (US)- Purpose
- Security, abuse prevention, troubleshooting
- Retention
- About 30 days
- Shared with
- Google Cloud
Call quality numbers
RequiredDelay per phrase, echo cuts, similarity scores, discarded phrases — no audio, no text
Our cloud (US)- Purpose
- Tune echo protection and fix problems
- Retention
- With the call record (24 months at most)
- Shared with
- Google Cloud, MongoDB Atlas
Support requests
OptionalYour messages, email address, screenshots
Our cloud (US) and email- Purpose
- Answer you
- Retention
- 2 years after the request is closed
- Shared with
- Microsoft 365, Google Cloud, MongoDB Atlas
Purchases (when paid plans launch)
OptionalSubscription status, product, dates, store transaction ID — never card data
Our cloud (US)- Purpose
- Give access to paid features
- Retention
- As tax and accounting laws require (up to 7 years)
- Shared with
- Apple or Google, who bill you
3. App Store privacy label
How we answer Apple's privacy questions (App Store Connect › App Privacy). Under Apple's definitions, data processed only on the device is not "collected", which is why the voice signature, live call audio and listen-mode audio do not appear.
Data used to track you
None
Data linked to you
Contact Info · User Content · Identifiers · Usage Data · Diagnostics · Purchases
Data not linked to you
None — what we collect is tied to your account
| App Store category | Data type | Collected? | Linked to you | Tracking | Purpose |
|---|---|---|---|---|---|
| Contact Info | Name · Email Address | Yes | Yes | No | App Functionality |
| Contact Info | Phone Number | Yes, if you add it | Yes | No | App Functionality |
| User Content | Audio Data | Yes — voice messages, and recorded clips only when both accept a record. Live call audio and listen-mode audio: not collected | Yes | No | App Functionality |
| User Content | Emails or Text Messages | Yes — chat messages and their translations | Yes | No | App Functionality |
| User Content | Photos or Videos | Yes — photos of documents shared in chat | Yes | No | App Functionality |
| User Content | Customer Support | Yes | Yes | No | App Functionality |
| User Content | Other User Content | Yes — documents, record text and translations, doubts | Yes | No | App Functionality |
| Identifiers | User ID | Yes — account ID | Yes | No | App Functionality |
| Identifiers | Device ID | Yes — push token, device registration and public key | Yes | No | App Functionality |
| Usage Data | Other Usage Data | Yes — call history (who, when, duration, status) | Yes | No | App Functionality |
| Diagnostics | Performance Data | Yes — call quality numbers (no audio, no text) | Yes | No | App Functionality |
| Diagnostics | Other Diagnostic Data | Yes — security logs; server stamp (IP address, network) on certified records | Yes | No | App Functionality |
| Purchases | Purchase History | Yes, once paid plans launch | Yes | No | App Functionality |
| Sensitive Info | Biometric data (voice signature) | No — stays on your phone | — | — | — |
| Contacts | Address book | No — we never read it; contacts you add stay on your phone | — | — | — |
| Location · Financial Info · Health & Fitness · Browsing History · Search History | — | No | — | — | — |
Account deletion is available inside the app (Profile › Account › Delete account), as the App Store requires, and the privacy policy link in App Store Connect points to this policy.
4. Google Play Data safety
How we answer Google Play's Data safety form. Under Google's definitions, sending data to service providers that process it for us, and transfers you start yourself (such as a message to a contact), are not "sharing".
| Play category | Data type | Collected | Shared | Required or optional | Purposes |
|---|---|---|---|---|---|
| Personal info | Name | Yes | No | Required | App functionality, Account management |
| Personal info | Email address | Yes | No | Required | App functionality, Account management, Developer communications |
| Personal info | Phone number | Yes | No | Optional | Account management |
| Personal info | User IDs | Yes | No | Required | App functionality, Account management |
| Messages | Other in-app messages | Yes (typing preview processed ephemerally) | No | Optional | App functionality |
| Photos and videos | Photos | Yes | No | Optional | App functionality |
| Audio | Voice or sound recordings | Yes — voice messages and accepted records only | No | Optional | App functionality |
| Files and docs | Files and docs | Yes | No | Optional | App functionality |
| App activity | Other user-generated content | Yes — record text, translations, doubts | No | Optional | App functionality |
| App activity | Other actions | Yes — call history | No | Required | App functionality |
| App info and performance | Diagnostics | Yes — call quality numbers | No | Required | App functionality, Analytics |
| App info and performance | Other app performance data | Yes — security logs | No | Required | Fraud prevention, security, and compliance |
| Device or other IDs | Device or other IDs | Yes — push token, device registration | No | Required | App functionality; Fraud prevention, security, and compliance |
| Financial info | Purchase history | Yes, once paid plans launch | No | Optional | App functionality |
| Location · Contacts · Health and fitness · Web browsing · Calendar | — | No | No | — | — |
Security practices
- Data is encrypted in transit: Yes (TLS to our servers; DTLS between the two phones).
- You can request that data be deleted: Yes — in the app (Profile › Account › Delete account) and on the web, without reinstalling the app: how to delete your account or email privacy@socialdna.app.
- Families policy: not applicable — MyInterpreter is not directed to children (minimum age 16).
- Independent security review: not yet.
5. Special categories and consents
| Topic | Laws we designed for | What MyInterpreter does |
|---|---|---|
| Biometric data (voice signature) | Illinois BIPA, Texas CUBI, Washington RCW 19.375 and My Health My Data Act, Colorado Privacy Act, GDPR Art. 9, LGPD Art. 11, CCPA (sensitive personal information) | Kept only on the phone; separate explicit consent; 18+; written retention and destruction schedule (Privacy Policy §11) |
| Recording of conversations | US all-party consent states, federal and state wiretap laws, GDPR, LGPD | Nothing recorded by default; a record needs both participants' acceptance, signed by each phone |
| Contents of communications | CCPA (sensitive personal information), ECPA | Readable only by participants; staff access only on request, by law or for serious abuse |
| AI-generated voice and translation | AI transparency rules (for example the EU AI Act) | Both participants are told at answer; synthetic voice, never a clone; not a sworn translation |
| Children | COPPA, GDPR Art. 8, LGPD Art. 14 | Minimum age 16; voice signature, certified records and purchases 18+ |
6. Your choices and requests
- Turn conversation records off, or choose the level and retention: Profile › Conversation record.
- Turn off the typing preview: Profile › Chat › Show while I type.
- Delete your voice signature: Profile › Voice signature › Delete.
- Download your data or delete your account: Profile › Privacy & data.
- Anything else: privacy@socialdna.app. Your rights and deadlines are in section 14 of the Privacy Policy.
Controller: SocialDNA Systems LLC, Virginia, USA.