Privacy Policy

What you submit is sent to AI providers

When you press the button, your input text (and any images you attach to a translation or correction request) is sent to Anthropic, our AI provider, to generate the response. Photos you share in rooms are different — they are never sent to an AI provider; see the room-photos section below. A small, fast model call may first classify what kind of help you need. Pronunciation guides may be generated by an additional model call routed through Vercel's AI Gateway.

We do not use your content to train AI models, and our providers process it to produce your response, subject to their own terms.

Video links

If you paste a YouTube or x.com link, our servers fetch the video's public captions or media. When no captions exist, the video is transcribed by Google's Gemini models (via Vercel's AI Gateway): for YouTube, Google reads the video URL directly; for x.com, our server briefly downloads the clip's audio/video (size-capped) and sends those bytes to Google for transcription. We never store the video or audio — only the resulting transcript text and the analyses you request. Video features require an account.

Without an account, your data stays on your device

If you use Let's Tango signed out, your conversation history (up to the 100 most recent entries), drafts, theme, and language settings are stored only in your browser's local storage. Clearing your browser data removes them. To enforce fair daily limits we set an anonymous identifier cookie and count requests against it (or your IP address) in a rate limiter whose counters expire within about 24 hours.

With an account, history and settings sync to our servers

When you sign in (via Clerk), we create a profile keyed to your account that stores your email address. Your conversation history (again capped at the 100 most recent entries — older entries are pruned) and your settings sync to our database, hosted on Supabase, so they are available on any device you sign in from. Images you attach are not uploaded to your synced history — they stay on the device where you used them. Documents you analyze (long texts and video transcripts, plus the per-section analyses you request) are also stored with your account and kept until you ask us to delete them.

Memory & context

If you are signed in and Memory is on, the app automatically extracts helpful details from your conversations — things like who you write to, recurring situations, preferences, and goals — and stores them in our database (Supabase) to personalize future responses. To do that, relevant memories and excerpts from your past conversations may be included in the requests sent to Anthropic when generating a response. If you attach a document (PDF) to a chat, the file is sent to Anthropic to produce a text digest of its contents; we store only that digest with the chat — the document itself is not retained. You control this in Settings: turn Memory off entirely, delete individual memories, or forget them all. Context gathered for a specific chat is stored with that chat and is deleted when you delete the chat.

You can also create a private email address for a chat. Email sent to that address from your own account email is processed: the message text and supported attachments (PDFs and images) are sent to Anthropic to produce a text digest and a short analysis, which are stored with that chat — the raw email and attachments are not retained by us. Mail from any other sender is discarded. You can regenerate or revoke a chat's address at any time, and deleting the chat deletes its address and everything received through it. Inbound mail is delivered to us by Resend, which stores received messages on its side subject to its own terms.

Payments

Billing is not active during the free beta. When subscriptions launch, they will be billed by Stripe through Stripe's hosted checkout. Your card details go directly to Stripe and never touch our servers. We store only what we need to run your subscription: your Stripe customer and subscription IDs, your email, your plan, and its status.

Operational data we keep

Usage counters (how many conversations, image transcriptions, and videosyou've used today) live in a rate limiter (Upstash Redis) with counters that expire within about 24 hours, plus aggregate daily totals for capacity planning. For debugging, production keeps short-lived technical traces of recent requests for up to 7 days — these contain timing and shape metadata and a one-way hash of the input, never the text itself.

Errors and diagnostics are reported to PostHog, including exception messages and stack traces when something breaks. Product analytics (also PostHog) records how features are used — events like "request submitted" — and links them to your account when you are signed in. Our server logs carry technical metadata such as request IDs, timings, and error codes — not the text of your messages.

If you send feedback through the in-app form, your comment, the conversation it refers to, and basic diagnostics are emailed to us via Resend so we can respond and fix problems.

AI requests may be logged to improve quality

While Let's Tango is in beta, the text you send to the AI and the response it generates may be temporarily logged to PostHog, our analytics provider, for 30 days so we can find and fix bad translations. This includes messages translated in Rooms while Rooms is in beta — and because recent room messages travel with each request as translation context, a logged Rooms request can include nearby messages from the same conversation, not just the newest one. Access to this logged content is restricted to the small team working on translation quality; we can switch the logging off across the whole product at any time, and we expect to narrow what is logged as the product matures. As always, we do not use your content to train AI models.

Session replay, and why we collect more while we test

While Let's Tango is in its testing period, session recording (PostHog) is switched on: it captures a playback of how the app was used — taps, scrolling, navigation, timing — with all text and all inputs masked before anything is recorded. Nothing you or anyone else wrote appears in a replay. We watch them to find and fix bugs we couldn't otherwise reproduce.

This is part of a deliberate trade we want to be upfront about: while we are testing with a small group, we collect more than we intend to keep collecting — session replays, the quality logging described above, and the signup signals described below — because seeing clearly when something breaks is how a small service gets good. As the system matures, we are committed to narrowing what we collect. This page will always name the categories of data and the purposes they serve: broad for now, but never vague.

Rooms: what we store, and who can see it

Messages you send in a room are stored in our database (Supabase) together with their translations into each participant's reading language, and stay there until the message or the room is deleted. Each room also stores your in-room profile: your display name, avatar, reading language, and any context saved to help translate well for you. Room invitations work as capability links — anyone holding a valid invite link can join through it, so share one the way you'd share a key; a link can be regenerated to cut off access, and joining through an invite records whose invite it was.

Rooms are private to their participants, but they are not end-to-end encrypted — like the rest of your synced data, they are stored privately on our infrastructure. That means the site's operator can open a room's content — messages and their translations — when troubleshooting a problem or repairing a bad translation. That access is used for those two purposes only, and we expect to narrow and formalize it as the product matures.

Photos and videos you share in rooms

Photos are prepared on your device before anything is uploaded: the image is re-encoded and resized there, which also strips hidden metadata such as location and camera details — the original photo file never leaves your device. Videos work differently: because phones cannot reliably re-process video in the browser, the original video file (up to 15 MB) is uploaded over an encrypted connection to private storage, where our servers strip hidden metadata such as location, device details, and embedded titles or artwork, generate a small preview image, and then delete the uploaded original — only the cleaned copy is kept, and the original is never shown to anyone. The prepared photo or cleaned video is stored in private storage on Supabase, our database provider. Only current participants of that room can open it: each open re-checks your membership and then serves the file through a private link that expires within about a minute. Like any link, someone it was deliberately passed to could use it during that minute — but links cannot be obtained without being a current member, and there are no permanent public links. We do not run AI, face recognition, or any content scanning on your photos or videos, and captions follow the same translation rules as ordinary messages. Photos and videos are not end-to-end encrypted — like your messages, they are stored privately on our infrastructure. A photo or video stays in its room until the room is deleted; deleting the room removes its media from the app immediately and permanently cuts off access to them. The underlying files are then cleared from storage by a cleanup process we are still rolling out — until it lands, they may persist, inaccessible, for a period after room deletion. You can also delete an individual photo or video you sent from inside the app (room admins can too); deletion removes it from the room immediately and its stored files follow the same cleanup. We will additionally remove any media — or the stored files of a deleted room — on request via the feedback form or support@lets-tango.com.

How you found us

When you first visit, we record how you arrived: the referring site, any campaign tags in the link, and — if you followed an invite link — which user's invite it was. If you create an account, this snapshot is stored with your profile. We use it to understand how people are finding Let's Tango, so we can introduce it to more people who might find it helpful.

If you join a room as a guest through an invite link, you can do so without creating an account or giving us an email address — you only choose a display name and the language you want to read the room in. Guests receive a pseudonymous identifier and, if they later link that room access to an account, that guest activity is merged into the account's analytics history.

Signup attribution and abuse protection

When you create an account, we store how you arrived, including campaign tags, the referring site, and the chain of invites that brought you here, so we can understand how Let's Tango is growing. We may use your country code to provide personalized landing pages. We do not currently create a signup security snapshot or store your region, device and browser traits, or a durable network identifier with your profile.

Before a future security snapshot is enabled, this notice will be updated first. The planned snapshot is limited to country and region, device and browser traits, and a versioned keyed code for a coarse network prefix that cannot be reversed into an address; it will expire after about 30 days. Raw network addresses may then be retained only in a restricted security log for no more than 7 days during an active abuse investigation. Separately, our current fair-use rate limiters briefly count requests by network address. Most counters expire within about a day, and shorter controls expire sooner; they are not kept as activity logs.

Who processes your data

These are the third-party services that touch data, and why:

• Anthropic — generates responses from your submitted content
• Amazon Web Services (Bedrock) — may serve translations as a failover path: the same Claude model through a different provider, pinned to a specific AWS region. We will name the exact region here before that failover is ever switched on.
• Google (Gemini, via Vercel AI Gateway) — transcribes videos without captions
• Clerk — sign-in and account management
• Stripe — payments (card data never reaches us)
• Supabase — our database for synced profiles and history, and private storage for room photos
• Upstash — rate-limit counters and short-lived caches
• PostHog (US) — product analytics, error diagnostics, masked session replay, and (during the beta) quality logging of AI requests and responses
• Cloudflare — will store our encrypted backups (R2) after the operator activates the backup system. Backups will be encrypted on our side before upload, with keys Cloudflare never sees.
• Resend — delivers feedback emails you send us and receives mail sent to chat email addresses
• Vercel — hosting and AI Gateway

Cookies

We use a small number of functional cookies: one that remembers you've seen the welcome page, one anonymous identifier for fair-use limits when signed out, and Clerk's session cookies when you sign in. There are no advertising or cross-site tracking cookies.

Retention and deletion

History is capped at your 100 most recent entries on both your device and our servers; older entries are removed automatically. Conversations with saved context (memories, documents, or a chat email address) are kept beyond that limit until you delete them. Rate-limit counters expire within about a day, and debug traces within 7 days. After the operator activates encrypted backups, nightly snapshots can retain deleted data for up to 30 days and their deduplicated encrypted Storage objects for up to 62 days. The first successful snapshot promoted each month can retain deleted data for up to 365 days, while its deduplicated encrypted Storage objects can remain for up to 731 days before aging out of the backup rotation. Analyzed documents are kept until you ask us to remove them. You can delete individual history entries (or all of them) from inside the app. To delete your account and everything associated with it, contact us at support@lets-tango.com or through the in-app feedback form, and we will remove your synced data.

Changes

If we change how the app handles your data, we'll update this page and the date at the top before the change ships.