Privacy
Privacy rights by region
What we collect and keep, and the privacy rights you have in Canada, Quebec, British Columbia, Alberta and the United States, with how to use them.
1. What we collect, who handles it, and how long we keep it
"We" below means Thalovant, which runs the dashboard, the API and the hubs on its own hardware in Montreal, Canada. The "Who else handles it" column names anyone else involved.
| What | Where it comes from and what for | Who else handles it | How long we keep it |
|---|---|---|---|
| Name and email address | You, or your Google or GitHub account if you sign in with one. To run your account and write to you. | Google or GitHub, when you choose to sign in with them | While your account is open |
| Account and device identifiers | An account ID, a connection ID for each phone or device, the hub's site ID and a connection key, so that a phone can reach your hub. The connection uses the manufacturer's name and model on Android, and the model on iPhone, not the personal name you gave your phone. These are not advertising identifiers. | None | While the account and the connection exist. Unpairing removes the connection from the phone; the dashboard lists it until you remove it. |
| Age band and declared region | At signup, your birth month and year and country and region determine eligibility and age-appropriate settings. We keep the resulting teen/adult band and declared region, not the birth month and year. | None | While your account is open |
| Location, only if you allow it | Your phone's last known position, with the city, region and country, sent with each question so answers such as the weather are local. Android gives the app an approximate position. Both apps round latitude and longitude to two decimal places before place-name lookup or transmission; enabling Precise Location in iOS does not remove that rounding. Your time zone and 12- or 24-hour clock are sent even without location permission. Sign-in security records separately use approximate location derived from IP addresses. | The phone's map service (Google on many Android phones, Apple on iPhone) finds the place name; the hub owner can see information sent to their hub as explained in the Privacy Notice, section 5.3 | Phone location is not kept on the Free plan, in anonymous sessions or on children's hubs. On a paid hub, a record that the hub keeps of a question can include the location sent with it, and that record is deleted after 90 days at most. Sign-in records follow the diagnostics row. |
| Questions and answers (in-app messages) | The text you speak or type and the hub's reply. To answer you. | The hub owner and, where applicable, the organisation operating the hub, as explained in the Privacy Notice, section 5.3. For speech, see the next row. | Free plan, anonymous sessions and children's hubs: not kept. Paid hubs you own: up to 90 days, then deleted automatically. The conversation journal is off unless you turn it on, and keeps at most 30 days. The apps also keep a history on your phone only, which you can turn off and delete in Settings. |
| Your voice in the phone apps | Spoken to the phone. Thalovant never receives the sound from these apps. A small model detects the wake word entirely on the phone. After a wake word or when you tap to talk, the phone's own speech service turns the sentence into text. | Android: the phone's speech service, on many phones Google's. iPhone: Apple's speech recognition. Either can use its provider's servers when recognition cannot run on the phone. Both apps offer "Recognise speech on this phone only", off by default; enabling it prevents online fallback and refuses unsupported recognition. It does not control Siri. If you set a second language, the same recording is recognised again in that language. | By us: not stored, since these apps never send it to us. By Google or Apple: under their own terms. |
| Personal memory | Preferences or notes you ask a hub to remember, or add in the dashboard. Memory is disabled for teen accounts and children's profiles. | Access depends on the hub and paired device, as explained in the Privacy Notice, section 2; Thalovant administrators can also see memory | Deleting an item stops its use by hubs, but deleted items, expired items and earlier versions remain in the account and export until account deletion. |
| In-app answer reports | An optional report sends the reason, hub name and host, time, question, answer, note, app version and build, and operating-system version. It contains no account sign-in credentials, but the hub and text can identify a person. A keyed network hash limits abuse. | Thalovant support and its support mailbox; the report is not guaranteed to be anonymous | Text is cleared after 90 days and the network hash after 30 days. The remaining record is deleted 2 years after closure, or after receipt if never closed. Support mailbox copies follow the separate support-communications period in the Privacy Notice. |
| Diagnostics from our servers | IP address, request and error logs, the device and app version, timestamps, sign-in history (with an approximate place from the IP address), and usage counts linked to your account, devices and hubs. App crash reports stay on the phone unless you copy or share them; Apple can also provide crash logs under your Apple sharing settings. Android 1.0.2 disables the wake-word library's third-party telemetry. | Cloudflare, which carries our traffic; Apple for crash reports supplied under your sharing settings | Security and request logs, including IP addresses: up to 30 days. Sign-in history and security alerts: 90 days. Usage counts: erased when the account is deleted. |
| Billing information | Plan, billing country and postal code, payment status and the last digits of your card. We never see a full card number. | Stripe | Contracts: at least 3 years. Tax records: generally six years. |
| Website analytics | Pages viewed, approximate place, device type, only if you accept analytics cookies. Advertising features are turned off. | Google Analytics | No longer than 14 months |
| Radio and news streams | If an answer plays a station, your phone connects to that station's address, so it sees your phone's IP address. Nothing else is sent. | The station | Under that service's terms |
| Camera | Only to scan a setup code. The picture is not saved or sent. | None | Not kept |
The apps also use Google Play's or the App Store's own rating window after you have used them for a while. What you write there goes to that store, not to us.
2. Canada: federal law (PIPEDA)
The Personal Information Protection and Electronic Documents Act (PIPEDA) governs how private-sector organisations handle personal information in the course of commercial activity. Where a province has its own law that applies instead, such as Quebec, that law applies; the next sections cover it.
Under PIPEDA you can:
- ask us whether we hold personal information about you, how we use it and to whom we have disclosed it, and ask for access to it;
- ask us to correct anything that is wrong or incomplete;
- withdraw your consent at any time, subject to legal or contractual limits and reasonable notice. Withdrawing may mean we can no longer provide some or all of the service;
- ask how we handle your information, and challenge it.
We answer within 30 days. If answering in time would unreasonably interfere with our activities, we may take up to 30 more days, and we tell you within the first 30 days, with the reason and your right to complain.
If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada.
3. Quebec
Thalovant is based in Montreal, so Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25, applies to us.
Privacy Officer. Our person in charge of the protection of personal information is the Privacy Officer: privacy@thalovant.com, or Privacy Officer, Thalovant Technologies Inc., 2727 rue Saint-Patrick, Montréal, Quebec H3K 0A8, Canada.
Your rights. You can:
- ask for access to the personal information we hold about you, and have it corrected;
- withdraw your consent to our using or sharing your information;
- ask us to stop disseminating your information, or to de-index a link attached to your name, where the law allows;
- ask for the personal information you gave us in a structured, commonly used technological format, for you or for another organisation you name;
- be told of the information used in a decision made exclusively by automated processing. We make no such decisions.
We answer within 30 days. If you are not satisfied, you can complain to the Commission d'accès à l'information du Québec.
Minimum age in Quebec. In Quebec, you must be at least 14 to have a Thalovant account. Quebec law has a parent or guardian give consent for a person under 14, and we have no way to collect that consent. A signup that declares an age below this minimum cannot be completed. A new Google or GitHub sign-in may create a provisional account before the age check; a declined new signup is erased, as explained in section 9.1 of the Privacy Notice. If you live in Quebec and are 14 or over but under the age of majority, you need a parent or guardian's permission to use Thalovant. We rely on you for that permission and do not check it. If you are a parent or guardian and think a child under 14 in Quebec has an account, write to privacy@thalovant.com and we will delete it.
Location and similar technology. The apps send a location only if you allow it in your phone's settings, and they work without it. You can turn it off again at any time in those settings. The apps do not build profiles of you.
Information leaving Quebec. Our hubs and AI models run in Montreal. Some of our service providers handle information outside Quebec and outside Canada: Cloudflare (traffic and email routing), Stripe (payments), GitHub (software downloads) and, only if you accept analytics cookies, Google Analytics, all in the United States or on a global network. Your phone's own speech and place-name services, which are Google's or Apple's, may also process what you send them outside Canada. Before we communicate personal information outside Quebec, we assess whether it will receive adequate protection, as Quebec law requires. The providers are listed on our Subprocessors page.
4. British Columbia, Alberta and the other provinces
British Columbia. The Personal Information Protection Act of British Columbia may apply to personal information we collect from people in that province. Under it you can ask for access to your personal information and for a correction, and we answer within 30 days. You can ask the Office of the Information and Privacy Commissioner for British Columbia to review our answer, or complain to it.
Alberta. The Personal Information Protection Act of Alberta may apply to personal information we collect from people in that province. Under it you can ask for access to your personal information and for a correction, and we answer within 45 days. You can ask the Office of the Information and Privacy Commissioner of Alberta to review our answer, or complain to it.
Everywhere else in Canada. PIPEDA applies (see section 2). We apply the same rights, at the same address, to everyone in Canada.
5. United States
We give the rights below to everyone in the United States, whichever state you live in and whether or not that state's law applies to Thalovant. Write to privacy@thalovant.com. You do not need an account or to be signed in. We may ask you to confirm that you control the email address of the account, and we never ask for your password. You can ask someone to act for you; we may ask for proof that they can.
5.1 California. Under the California Consumer Privacy Act, as amended (CCPA), you can:
- know what personal information we collect, where it comes from, why, and to whom we disclose it, and receive a copy;
- delete the personal information we collected from you, subject to the exceptions in section 6 of the page Delete your account and data;
- correct inaccurate personal information;
- opt out of the sale of your personal information and of its sharing for cross-context behavioural advertising;
- limit the use of sensitive personal information;
- not be treated worse for using these rights.
We confirm your request within 10 business days and answer within 45 days. If we need more time we tell you, and the answer can take up to 45 more days.
Sale and sharing. We do not sell personal information and we do not share it for cross-context behavioural advertising. We have no actual knowledge that we sell or share the personal information of anyone under 16. Our apps contain no advertising. Android 1.0.2 disables telemetry bundled with its wake-word library; the code is still present. Section 11.5 of the Privacy Notice explains the version-specific telemetry findings, including the earlier internal-testing build. On our website, Google Analytics runs only if you accept it, with advertising storage, advertising user data and ad personalisation denied. Because we do not sell or share, we have no "Do Not Sell or Share" link. Should that ever change, we would first get opt-in consent: from you if you are 13 to 15, or from a parent or guardian if you are under 13.
Categories collected, in the last 12 months. Identifiers (name, email address, IP address, account, device and connection IDs); customer records and commercial information (plan and billing); age band and declared region; internet or other electronic network activity (request logs, usage counts, app version); geolocation (in the current phone apps, the phone's last known coordinates rounded to two decimal places before place-name lookup or transmission, plus city, region and country); and user content, including questions, answers, memory items and answer reports. The phone apps send us no audio. Section 1 explains the current phone-app practices; the Privacy Notice covers other clients and the rest of the platform. Those documents describe recipients and retention.
Sensitive personal information. Account sign-in credentials are sensitive personal information under California law. Location and information you include in questions, memory or reports can also be sensitive depending on their detail and context. We use them for the purposes described in the Privacy Notice. You may contact us about applicable rights to limit their use. Coordinate rounding and app-store location labels do not by themselves determine the legal classification of the information.
Do Not Track and Global Privacy Control. Our website does not change how it behaves when your browser sends a Do Not Track signal, because there is no common standard for it. We do not track you across other websites, and we do not allow others to collect information about your activity on our site for advertising. We treat a Global Privacy Control signal as a request to opt out of sale and sharing; since we do neither, it changes nothing in how we process your information. You can turn analytics off at any time with "Cookie settings" at the bottom of every page.
5.2 Virginia, Colorado, Connecticut, Texas, Oregon and other states. Most states with a privacy law let you ask to confirm whether we process your personal data and to access it, to correct it, to delete it, to get a copy you can move to another service, and to opt out of the sale of your data, of targeted advertising and of profiling that has legal or similarly significant effects. We do none of those three things. You use these rights the same way: by email. We answer within 45 days, and can take up to 45 more days if we tell you why and the applicable law permits it. If we say no, we explain why and how to appeal. Reply to our decision to appeal; we answer within 60 days or any shorter deadline required by applicable law, including 45 days under Oregon's privacy law. If we refuse the appeal, we explain how to contact your state's attorney general. State laws can treat precise location as sensitive. The phone apps send device location only after you allow it in your phone's settings, and you can withdraw that permission there; sign-in IP geolocation is separate, as described in section 1.
5.3 Teens and children. Accounts are for people aged 13 and over (14 in Quebec). A teen needs a parent or guardian's permission, which we rely on and do not check. A teen's account is on the Free plan, which keeps no text of what is said, and it has memory turned off. By a teen we mean someone 13 or over (14 in Quebec) who is under the age of majority where they live: 18 in most places, 19 in some provinces and states, 21 in Mississippi. A parent or guardian can ask us to delete a teen's account (see Delete your account and data). Children below the minimum cannot open their own accounts. Child-facing hubs and profiles can still process personal information, including device identifiers and linked crisis-referral records; the Privacy Notice (sections 2 to 4 and 9) describes these practices and the need to assess applicable notice and parental-consent requirements. These age rules do not waive protections that apply to children or teens under applicable law.
6. How to use your rights
Email privacy@thalovant.com, or write to the Privacy Officer, Thalovant Technologies Inc., 2727 rue Saint-Patrick, Montréal, Quebec H3K 0A8, Canada. Say where you live, which right you want to use, and the email address of your account if you have one. If you can sign in, you can also see, export and delete much of your data yourself in the dashboard. Requests are free unless they are manifestly unfounded or excessive. If you use a hub run by an organisation, such as a library or a shop, that organisation decides how your information is used; send your request to it, and we will help it answer.
Version 2026-10-01. Available in English and French. Applicable language rights are preserved. Version française. Questions: support@thalovant.com.