Privacy Policy

What you submit is sent to AI providers

When you press the button, your input text (and any photo you take or choose) is sent to Anthropic, our main AI provider, to generate the response. Other AI providers can answer some requests; see The iPhone app below. A small, fast model call may first classify what kind of help you need. Pronunciation guides may be generated by an additional model call routed through Vercel's AI Gateway. A request reaches the AI company directly, through that gateway, or, if those routes fail, through OpenRouter, a fallback router. A router only passes the request on to the company that owns the model, or to Google Cloud or Microsoft Azure running that company's model. Kimi is the one exception; see The iPhone app below.

We do not use your content to train AI models, and our providers process it to produce your response, subject to their own terms.

Withdrawing your consent to AI data sharing

In the iPhone app you can withdraw your consent at any time. Open Settings › Policy and Information › AI data sharing › Stop sharing. After that, the app does not send your content to AI providers, and Live, Ask and Photo stop working until you agree again.

Your account

When you sign in (via Clerk), we create a profile keyed to your account that stores your email address. In the iPhone app, your saved History reaches our servers only through History Sync, described below.

Our operator can see your account activity to help when something goes wrong. That includes your sign-ins, usage counts, app version and device, and any feedback you send.

The iPhone app

You can try the iPhone app without an account. Every answer and Live minute in the free trial is counted against your iPhone, which Apple's App Attest and DeviceCheck services identify to us with an app-specific key and an Apple device token. To keep going after the trial, you create an account. You sign in through Clerk. Clerk keeps your email address and, if you sign in with Apple or Google, the name that comes with it.

The app uses the microphone only while a Live session runs or while you ask by voice in Ask. In both cases your iPhone streams the audio directly to Soniox, our speech provider. Soniox turns the speech into text. In Live it also translates the text between the two languages you pick from the 56 that Live supports. Our servers only give the app a short-lived Soniox access key. The audio never passes through our servers, and we do not store it. Soniox processes it to produce the text, subject to its own terms. If the access key is not available, Ask recognizes your voice on the iPhone instead, and that audio stays on the device.

If you lock your iPhone or open another app during a session, Live keeps listening, so the transcript is complete when you return. While the microphone is on, your iPhone shows its orange microphone dot, and a Live Activity in the Dynamic Island and on the Lock Screen shows that Live is listening. The microphone turns off when you pause or stop the session (the island has a Pause button), when a call or another app interrupts the audio, and when the connection stays down for about a minute. Live also asks after each hour of listening whether to keep going. In the background, it pauses and turns the microphone off after 10 minutes without speech, or when you do not answer that question within 5 minutes.

Nothing from a session is kept unless you tap Save when it ends. One exception: if iOS closes the app while a session is paused in the background, the transcript so far stays only on your iPhone until the next time you open the app, which offers Save or Discard; either choice deletes it. Unlike a saved transcript, that file stays readable while the iPhone is locked, and it is protected until you first unlock the iPhone after a restart. A saved transcript is stored on your iPhone (and in your iPhone's own backups, if you make them), in a file that stays encrypted while the phone is locked. It reaches our servers only through History Sync, described below, as an encrypted copy we cannot read. To remove saved transcripts, open History on the Home screen, and delete one or all of them. Delete Account also removes them, and your saved phrases, from that iPhone.

Photo, Ask, the Share extension, and word breakdowns in Live work like the requests described at the top of this page. The photo you take or choose (made smaller first), the text you type in Ask or the words you said (as text, after speech recognition), the text you share, or the Live line you tap for a breakdown goes through our servers to an AI model provider, which writes the answer. Depending on the feature and on the model we have selected, that provider is Anthropic, OpenAI, Google (Gemini), or Kimi, reached directly, through Vercel's AI Gateway, or, as a fallback, through OpenRouter. Kimi is a model made by Moonshot AI. We run it only on servers in the United States, operated by Baseten, Fireworks, Together AI, Parasail and DeepInfra, and only through Vercel's AI Gateway. Moonshot AI itself does not receive your data. Before the answer is written, the text you type or say in Ask also goes to TypeSafe, which works out what the Ask is about. TypeSafe does not train on it, and may keep it for a limited time under its own terms. We do not save the photos you send; images are left out of our request logs.

When you play an answer aloud in Ask, the text of that line goes through our servers to a text-to-speech provider, ElevenLabs, which returns the audio. If ElevenLabs is unavailable, Microsoft Azure, Google, or OpenAI may speak the line instead. We keep each spoken clip in shared storage (Vercel Blob) so the same line does not need to be generated again. A clip is saved under a secret name that cannot be guessed, and it is not linked to your account.

“Help improve translations” is a switch in Settings. It is off unless you turn it on. While it is on, we keep the text you ask in Ask and the answer you get for 30 days, so we can test and improve translations. Before we keep it, we remove email addresses, phone numbers, card numbers, and links. After 30 days we delete it, though encrypted backups can retain deleted data for longer, as described under Retention and deletion. We do not use it to train AI models. You can turn the switch off at any time: from then on we keep no new text. Text we already kept is deleted when its 30 days end, or when you delete your account.

The app sends usage and performance events to PostHog, tagged as coming from iOS: for example, when a session starts and ends, how long it ran, which display and listening settings you use, and how smoothly the app ran. These events are linked to your account. They never contain your audio or the words of your conversations. PostHog records the IP address the events come from and an approximate location based on it. The iPhone app does not use session replay or automatic tap tracking.

History Sync

History Sync is part of Plus. In the iPhone app it is called Cloud Sync (Settings › Account › Cloud Sync). When it is on for your account, your iPhone encrypts your saved transcripts, your Ask and Photo history (the answers and follow-up questions, not the photo itself) and your starred words, and uploads the encrypted copies to our database (Supabase). Your other iPhones can then open them, and you can get your History back on a new iPhone.

The key is called the Sync Key. Your iPhone makes it and keeps it in iCloud Keychain, and it is never sent to us. We cannot read what you sync, and neither can Supabase. We can see only the type of each item, when it was made and changed, its size, whether it is deleted, and the platform and model of the devices that sync.

A Spare Key is 24 words that you write on paper. It opens your synced History on a new iPhone. The app asks you to make one first when iCloud may be off on your iPhone. We keep only a copy of your Sync Key that those words unlock. If you lose every iPhone that holds the Sync Key and the Spare Key, nobody can open your synced History, not even us. The History on each iPhone stays on that iPhone.

The encryption covers the copy we store. Live, Ask and Photo still send what you submit to our servers and AI providers to produce your answer, as described above.

A deleted item waits in the Recycle Bin for 30 days. Then it is removed from your iPhone and from our servers. An unstarred word stays in the encrypted copy until the copy is erased. Remove a device in Cloud Sync to stop it syncing; it keeps its History. Delete Account erases your encrypted copy and that key copy. If your Plus ends, we erase the encrypted copy after 90 days, and the History on your iPhone stays. Encrypted backups can retain deleted data for longer, as described under Retention and deletion.

Payments

In the iPhone app, Plus is bought with Apple In-App Purchase. Apple takes the payment, and your card details never reach us. Our servers check the signed purchase record that Apple sends and keep what we need to run your subscription: the purchase and transaction IDs, the plan, its dates, whether it renews, and its status. You manage or cancel it in your Apple Account settings.

Operational data we keep

Usage counters (how much Live, Ask and Photo you've used today) live in a rate limiter (Upstash Redis) with counters that expire within about 24 hours, plus aggregate daily totals for capacity planning. For debugging, production keeps short-lived technical traces of recent requests from the iPhone app for up to 7 days. They contain the least data necessary to provide and improve the app.

Errors and diagnostics are reported to PostHog, including exception messages and stack traces when something breaks. Product analytics (also PostHog) records how features are used — events like "request submitted" — and links them to your account when you are signed in. For the iPhone app, our server logs likewise contain the least data necessary to provide and improve the app, such as request IDs, timings, and error codes.

If you send feedback through the in-app form, your comment, the conversation it refers to, and basic diagnostics are emailed to us via Resend so we can respond and fix problems.

AI requests may be logged to improve quality

PostHog, our analytics provider, records a technical entry for each AI request from the iPhone app: which model answered, token counts, timing, cost, and request IDs. By default that entry does not contain the text you sent or the response. We can switch on fuller logging, which also stores the text of the request and the response so we can find and fix bad translations. Photos and other files are never included, and some requests, such as support-request screening, are always kept out. PostHog keeps logged text under its own retention setting; we do not set a shorter deletion period for it. When you delete your account, we ask PostHog to delete the events linked to it. Access to this logged content is restricted to the small team working on translation quality; we can switch the logging off for the iPhone app at any time. Ask on the iPhone is never part of fuller logging; its text is kept only as described under “Help improve translations” above. As always, we do not use your content to train AI models.

How you found us

The first time the iPhone app opens, it asks Apple's AdServices which Apple Search Ads campaign led to the install. We store Apple's answer for that install: the campaign, ad group, keyword and ad IDs, the country, and the date of the click. We use it to measure our ads. We do not use it to track you across other companies' apps or websites, and it is erased when you delete your account.

The iPhone app also reports how far each install has gone (opened, finished setup, used a feature, signed in, bought Plus) as one number, through Apple's ad measurement (SKAdNetwork and AdAttributionKit). Apple passes that number to the ad network that showed the ad, and a copy to us, with no ID for you or your iPhone. It can only be counted per ad campaign.

Abuse protection

For the iPhone app, we do not currently create a signup security snapshot or store your region, device and browser traits, or a durable network identifier with your profile.

Our fair-use rate limiters briefly count requests by network address. Most counters expire within about a day, and shorter controls expire sooner; they are not kept as activity logs.

Who processes your data

These are the third-party services that touch data in the iPhone app, and why:

• Anthropic — generates responses from your submitted content
• OpenAI, Google (Gemini), and Kimi (a Moonshot AI model) — can also generate answers in Ask, Photo, the Share extension, and Live word breakdowns, directly or through Vercel AI Gateway, depending on the feature and the model we have selected
• Baseten, Fireworks, Together AI, Parasail and DeepInfra — run the Kimi model for us on servers in the United States. Moonshot AI itself does not receive your data.
• Microsoft Azure and Google Cloud (Vertex AI) — can run Anthropic, OpenAI and Google models for our routers, on those companies' behalf
• ElevenLabs — speaks answers aloud in Ask (Google and OpenAI text-to-speech are backups too)
• Microsoft (Azure Speech) — speaks answers aloud in Ask when ElevenLabs is unavailable
• TypeSafe — works out what an Ask on the iPhone is about, before the answer is written. TypeSafe does not train on it, and may keep it for a limited time under its own terms.
• Soniox — turns speech into text in Live and in Ask by voice, and translates it during Live sessions
• Clerk — sign-in and account management
• Apple — In-App Purchase billing and subscription status, App Attest and DeviceCheck to recognize an iPhone in the free trial, and iCloud Keychain to keep your History Sync key
• Supabase — for the iPhone app, our database for accounts and for the encrypted copies of History Sync
• Upstash — rate-limit counters and short-lived caches
• Inngest — runs our background jobs for the iPhone app, such as account deletion. For those jobs the data is mostly internal IDs and does not carry photos or your AI requests.
• PostHog (US) — product analytics, error diagnostics, and quality logging of AI requests and responses
• Cloudflare — stores our encrypted backups (R2). Backups are encrypted on our side before upload, with keys Cloudflare never sees.
• Resend — delivers the feedback emails you send us
• Vercel — hosting, AI Gateway (our main router for AI requests), and storage for spoken clips
• OpenRouter — fallback router: passes an AI request to the model company when the main route fails

Retention and deletion

Rate-limit counters expire within about a day, and debug traces within 7 days. AI usage records linked to an account are kept for up to 180 days, and the link to the account is removed when the account is deleted. Nightly backup snapshots can retain deleted data for up to 30 days and their deduplicated encrypted Storage objects for up to 62 days. The first successful snapshot promoted each month can retain deleted data for up to 365 days, while its deduplicated encrypted Storage objects can remain for up to 731 days before aging out of the backup rotation. You can delete individual history entries (or all of them) from inside the app. To delete your account in the iPhone app, open Account › Delete Account: the account is locked immediately and deleted with its data within 30 days.

This website

The lets-tango.com website uses cookies and PostHog analytics, including session replays with all text and inputs masked. It also measures ad conversions for Google and Meta, which can send them a click ID, your browser's user-agent string and, for signed-in visitors, a hashed (one-way encoded) form of your email address.

Children

Let's Tango is not directed to children under 13, and we do not knowingly collect personal data from them. If you think a child under 13 has given us personal data, email support@lets-tango.com and we will delete it. A parent or guardian can ask us to delete a child's data at any time.

Changes

If we change how the app handles your data, we'll update this page and the date at the top before the change ships.