Privacy Policy

The short version. We collect almost nothing. Your conversations with Mr. Whitmore are stored only on your device — not on our servers. The text of each message you send transits a small proxy server we run, and is processed by a language model on our behalf to generate a reply, but we do not log or retain the content. We have no analytics, no advertising, no third-party SDKs in the app, no user accounts, and we never see your payment information.

If that's all you need to know, the rest is detail required by the App Store, the GDPR, and the CCPA.

1. Who we are

This service is operated by Alexander Knigge, an independent developer (the "Operator", "we", "us"). For privacy-related correspondence, contact kingthecole2002@gmail.com.

For the purposes of the EU General Data Protection Regulation (GDPR), the Operator is the data controller for any limited personal data processed in connection with the Talk to the Past iOS app and the talktothepast.com website (the "Service").

2. What we process — and what we don't

2.1 On your device (not transmitted to us)

The app stores the conversations you have with the AI correspondent locally on your device using Apple's SwiftData framework. We do not copy these conversations to our servers. They live with you, in the app's container, and are removed when you delete the conversation or uninstall the app.

We do not access your contacts, photos, microphone, location, calendar, or any other on-device data. The app's Info.plist declares no usage descriptions for any of these.

2.2 In transit (handled but not stored)

When you send a dispatch, the following is transmitted from your device to our infrastructure:

• The text of the new message you've written.
• The text of the prior turns of that same conversation, so the model can respond in context. The number of prior turns sent depends on the conversation length and any compaction the app applies.
• A short system instruction describing the correspondent's character.
• Standard network metadata that any HTTPS request carries (your device's IP address at the moment of the request, a User-Agent string, and an API key embedded in the app).

This data is processed by:

1. A Cloudflare Worker we operate, which authenticates the request and proxies it onward.
2. A Hugging Face Space we operate, which runs the open-source talkie-1930-13b-it language model and returns a generated reply.

We do not log the content of your messages, the model's replies, or any conversation context. The Cloudflare Worker may write standard operational metadata (timestamp, request size, response status code, IP address, country) to its short-lived edge logs for security and rate-limiting purposes; these logs are retained by Cloudflare for no more than 30 days.

2.3 What we do not collect or process

• Your name, email address, postal address, phone number, or other personal identifiers.
• Your Apple ID, App Store username, or device identifiers (IDFA, IDFV).
• Your location, contacts, photos, calendar, microphone, or camera.
• Analytics or telemetry. The iOS binary contains no analytics, crash-reporting, or attribution SDKs.
• Cookies on the website. The marketing site is a static HTML site; no tracking cookies are set, no fingerprinting is performed.
• Advertising identifiers. We do not show advertising and do not integrate any advertising network.

3. Generative AI: what to know about Mr. Whitmore's replies

The replies you receive in the app are generated in real time by a large language model. They are not pre-written and are not authored by a human. They may contain factual errors, fabrications, or anachronisms; the character is a fictional construct that speaks only in the voice of an English gentleman writing in 1930.

We do not use your conversations to train or fine-tune any AI model. The text you send is used only to generate the immediate reply, and is discarded by our infrastructure after the response is returned. The model's weights are static — they do not change based on your inputs.

You should not rely on the app's output as factual, professional, medical, legal, financial, or therapeutic advice, and you should not transmit information you would consider sensitive (medical history, financial details, government-issued identifiers, third-party personal data) through the app.

4. Subscriptions and payments

If you choose to upgrade to Talk to the Past Pro, the transaction is processed entirely by Apple via the App Store. We never see your payment instrument, billing address, or Apple ID. The app receives only a verified entitlement (whether you are a current subscriber) from Apple's StoreKit framework. When you cancel via your Apple ID settings, the entitlement expires and we are not involved in cancellation.

5. Third parties

5.1 Cloudflare

Our request-proxy Worker runs on Cloudflare's edge network. Cloudflare may log standard request metadata (IP address, timestamp, country) per its own privacy practices, and may use this data for security purposes (DDoS prevention, bot detection). See Cloudflare's privacy policy. Data is processed in regions globally; we have not configured a specific Cloudflare region.

5.2 Hugging Face

The language model is hosted on Hugging Face's ZeroGPU infrastructure. The text of your message is processed there to generate a reply, then discarded. See Hugging Face's privacy policy. Hugging Face is a US-based company; processing occurs primarily in the United States.

5.3 Apple

Apple processes all subscription transactions and may collect crash reports if you have opted in to share them at the system level. See Apple's privacy policy.

5.4 Vercel (this website only)

The talktothepast.com website is hosted by Vercel. Vercel may log standard request metadata for the website. See Vercel's privacy policy. The iOS app does not communicate with the website.

6. International data transfers

The Cloudflare and Hugging Face providers operate globally with primary processing in the United States. If you use the Service from the European Economic Area, the United Kingdom, or Switzerland, your data (limited to the items in §2.2) will be transferred to and processed in countries outside your jurisdiction, including the United States. We rely on the providers' own contractual safeguards for these transfers, including Standard Contractual Clauses where applicable.

7. Retention

We do not retain your conversation content. Operational metadata at our proxy is retained for no more than 30 days. Logs at our third-party providers (Cloudflare, Hugging Face, Apple, Vercel) are retained per their respective practices.

8. Your rights

8.1 Rights under GDPR (EEA, UK, Switzerland)

If the GDPR applies to you, you have the rights to access, rectify, erase, restrict, or object to the processing of your personal data, as well as the right to data portability and the right to lodge a complaint with your supervisory authority. Because we hold no identifiable personal data tied to you (we have no account, no email, no name), most of these rights have no data to act upon. To request anything within scope, email us and we will respond within 30 days.

8.2 Rights under CCPA / CPRA (California)

If you are a California resident, you have the right to know what personal information we collect and how we use it (this Policy), the right to delete it, the right to correct it, and the right not to be discriminated against for exercising those rights. We do not sell or share your personal information with third parties for cross-context behavioural advertising. We have no "Do Not Sell or Share My Personal Information" link to provide because we do not engage in those activities.

8.3 How to exercise your rights

Email kingthecole2002@gmail.com. Identify the right you wish to exercise and provide enough context to locate any data we may hold (which, in nearly all cases, will be none). We will respond within 30 days.

9. Children

Talk to the Past is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has used the Service, we will take reasonable steps to delete any data we may hold. Parents and guardians who believe their child has used the app may contact us.

10. Security

The connection between the app and the Cloudflare Worker is encrypted via TLS. The connection between the Worker and the Hugging Face Space is also encrypted via TLS. The shared API key authenticating the app to the Worker is embedded in the app binary; this is a known limitation of standalone iOS apps that do not require user accounts, and the key is rotatable.

No system can be guaranteed perfectly secure. We do not guarantee that data in transit will be free from unauthorised interception, but we use industry-standard transport encryption.

11. Changes to this Policy

We may update this Policy from time to time. If a change materially affects how we process your data, we will update the effective date above and, where appropriate, notify users through the app or this website. Minor clarifications may be made without explicit notice. The current version of this Policy is always available at talktothepast.com/privacy.

12. Contact

For privacy questions, data-rights requests, or anything else covered by this Policy, contact:

Alexander Knigge
kingthecole2002@gmail.com