Privacy Policy for Talefall — Audiobook Player

Effective Date: September 4, 2026

Data controller and service provider: OWN PLACE LLC, 7707 NE 141st St, Kirkland, WA 98034-5321, USA. Email: contact@ownplace.net. Telephone: +1 (213) 524-8012. App: Talefall — Audiobook Player (the “App”), bundle identifier com.anisimov.audiobooks.

OWN PLACE LLC (“we,” “us,” or “our”) is a limited liability company organized under the laws of the State of Washington, USA, and is the developer of the App.

Talefall — Audiobook Player is, first of all, an audiobook player that works with your own files, on your own device. The player does not upload your library automatically. Text you explicitly submit for AI Studio narration, and content you choose to include in a report or support request, are exceptions described in this Policy.

Since version 1.3 the App also offers an optional, paid AI Studio: on request, our service writes a work of fiction from your description and reads it aloud in our own narrator voice, or reads aloud a text book you already have. These optional AI Studio functions run on our server; separate on-device writing and narration features are described below. This Policy explains exactly what leaves your device when you use those optional features, where it goes, why, how long it is kept, and what never leaves at all.

Two companion documents are part of our privacy disclosures:

• Consumer Health Data Privacy Policy: https://ownplace.net/talefall/health-data (also linked from our home page and from Settings → Privacy in the App)
• AI Safety and Content Policy: https://ownplace.net/talefall/ai-safety
• Where AI Studio is available (Supported Territories): https://ownplace.net/talefall/ai-studio-territories

This Policy is available in English (primary). The App interface is available in English, Russian, and Spanish. We provide key purchase, permission, safety, and privacy disclosures in the App’s supported languages. If a translation of this Policy is provided and conflicts with the English version, the English version controls; mandatory consumer rights under the law of your residence are not limited by this language-control provision.

1. Who We Are and How to Contact Us

• Developer / data controller: OWN PLACE LLC, 7707 NE 141st St, Kirkland, WA 98034-5321, USA.
• App: Talefall — Audiobook Player, iOS 26 or later, iPhone. Bundle identifier com.anisimov.audiobooks.
• Contact for privacy questions and requests: contact@ownplace.net; telephone +1 (213) 524-8012.
• Requests: email contact@ownplace.net (Section 10). Settings → Privacy → Request Data Deletion in the App prepares that email for you.

2. Plain-Language Summary

• No accounts. There is no registration, no login, no password. We do not know your name, email, or Apple ID.
• The player is local. Your audio files, text books, library, playback positions, bookmarks, notes, statistics, and settings stay on your device (and in your own iCloud/device backups, which you control). The player does not upload your library automatically. Text you explicitly submit for AI Studio narration, and content you choose to include in a report or support request, are exceptions described in this Policy.
• If you do not use AI Studio and do not opt in to usage counters, no player-library content is sent to OWN PLACE LLC. The App may still contact Apple, GitHub Pages, and the catalog providers for the specific functions described in Section 5.
• AI Studio is optional and server-based. If you subscribe and ask us to write or narrate a book, your request (or the text you want narrated) is sent to our service, which runs on infrastructure rented from Modal Labs in the United States. To write the text we use a large language model reached through OpenRouter; to read it aloud we run our own narrator model in our private container on Modal. Before first use of AI Studio, the App presents the Terms screen. Before the first writing-mode order, and again if the provider changes, the App separately asks permission to send writing-mode content to OpenRouter and Meta. Server-based narration does not require permission to send content to OpenRouter or Meta because it is not sent to them; it has its own upload confirmation naming Modal. Details are in Section 6.
• Writing mode is for fiction; narration mode is for your own text without personal data. AI Studio’s writing mode is intended solely to generate fictional entertainment. The server-based narration mode may process only text that you are legally entitled to submit and that does not contain personal or consumer health data about an identifiable real person, including you. Use the on-device voice for text containing such data. Before every order you confirm that the order contains no information about an identifiable real person and no sensitive personal data; an order you flag as containing such data is refused. We do not read your requests or the books, and we do not check them beyond automated safety controls (Section 6.5).
• AI Studio is available only in Supported Territories. The App is not distributed on App Store storefronts of the European Economic Area, the United Kingdom or Switzerland, and AI Studio is not offered to persons located there (Section 14).
• No post-delivery server retention. While an order is being written, narrated, and delivered, its text and audio sit on our server as temporary working storage: encrypted, subject to an application-level time-to-live, and excluded from OWN PLACE LLC’s application logs and crash reports. We do not create separate content backups. “Delivery is confirmed only after the App has durably saved every chapter on the device.” Immediately after confirmed delivery of the final chapter we delete our server copy of the text and the audio; after that the book cannot be restored or re-downloaded from our server. After that, OWN PLACE LLC keeps no ordinary server copy. The copies available to you are on your device and, if the save succeeded, in your iCloud. Limited processor retention and report or legal-preservation exceptions are described below. “If full delivery is not confirmed within seven days after the Service accepts the order, we treat the order as failed, stop further processing, delete all server-side order content, and automatically restore all hours reserved or charged for that order. Chapters already saved on your device remain available.” “We do not retain order content after confirmed delivery, except content you separately submit in a report or support request and content that law requires us to preserve.” This is disclosed before your first order and on the paywall (Section 6.4).
• Your subscription is identified by Apple’s signed transaction, not by you. The App attaches the Apple-signed purchase record of your subscription to each AI Studio request. From it our server reads only the subscription’s original transaction identifier, product identifier, environment, and expiry/revocation dates. This is how we know a request is paid for without knowing who you are.
• Usage counters without identifiers — only if you say yes. On first launch we ask whether the App may send a handful of first-session counters (for example “playback started”, “import failed: m4b”). The default is no. We add no identifier of you or your device to them and store none with them; they are deleted after 90 days. Like any Internet request, the connection that carries them exposes your IP address to our hosting provider’s one-day server log (Section 9), which is why we do not call them absolutely anonymous.
• No tracking, no ads, no cookies set by the App, no analytics SDKs, no advertising identifier. We do not sell or share personal information.

3. Information We Do NOT Collect

Through the App we do not ask for, and the App does not send us, your name, email address (unless you write to us), phone number, contacts, photos, precise location, browsing history, device identifiers, or advertising identifiers. We do not collect titles or text from your local library unless you deliberately submit a title or text to AI Studio for server-based narration. We do not collect your playback history, bookmarks, notes, or highlights. We do not request health information and do not infer anything about your health, beliefs, or personal characteristics from anything you submit; see Section 13 and our Consumer Health Data Privacy Policy for what happens if you include such information in an AI Studio request against our rules.

If you contact us voluntarily. If you email contact@ownplace.net, we receive your email address and whatever you include in your message. We use it only to respond, provide support, act on content or copyright reports, protect our legal rights, and comply with legal obligations. We keep support correspondence for no longer than 24 months after the last message in the thread, and delete it earlier on request, except where we must retain it to document a refund dispute, a content report, or to establish, exercise, or defend legal claims. For consumer health data, retention beyond an applicable deletion deadline is permitted only where a specific applicable legal obligation or statutory exception authorizes it. A general interest in defending possible claims does not by itself override that deadline. Our business email is processed by our email service provider solely to deliver and secure mail.

Apple analytics and diagnostics. If you have enabled “Share With App Developers” in iOS settings, Apple may provide us with privacy-protected, aggregated App Store Connect analytics, crash reports, and diagnostics. This arrives through Apple’s developer services, not through any SDK in the App, and we use it only to fix problems. You control this in iOS Settings → Privacy & Security → Analytics & Improvements.

The App keeps a small, size-limited, content-free technical log on your device (App version, pseudonymous book identifiers, step names, error codes, and crash call stacks received from Apple’s MetricKit). It is not transmitted anywhere. Earlier versions of the App offered a “Share diagnostics” button; it has been removed.

4. Information Stored Locally on Your Device or in Your Own iCloud

The following player data is created and stored on your device or in your Apple iCloud account and does not reach OWN PLACE LLC. A downloaded AI Studio book is also stored there, but its content necessarily passed through the Service before delivery as described in Section 6.

• Your imported audio files and text books and your library (covers, titles, authors, progress).
• Playback positions, bookmarks, playback history, and listening statistics.
• Reading positions, highlights, notes, text bookmarks, and reader settings.
• On-device speech recognition. If you turn an audiobook into text, Apple’s speech recognition runs entirely on your device; audio and text stay there.
• On-device format conversion of unsupported audio formats.
• On-device voice. Reading a text book aloud with an Apple system voice happens entirely on your device.
• On-device AI writing. Where Apple Intelligence is available, the App can write a short book using Apple’s on-device model; your request and the text stay on the device.
• App settings (skip step, playback behavior, theme, language, etc.).
• Your evaluation-period start date, stored in the iOS Keychain and the iCloud Key-Value Store so that reinstalling does not restart the evaluation period. It contains only a date.
• Your answer to the usage-counters question (yes/no), stored in App settings.
• A local copy of your AI Studio permission choices (Terms version accepted, AI-provider permission given), so the App does not ask again unnecessarily; the authoritative record is kept on our server (Section 6.6).
• Books created or narrated by AI Studio, once they have been downloaded to your device.

Deleting the App removes its local container but may not remove Keychain items or values already synchronized through the iCloud Key-Value Store; the evaluation-period start date is intentionally designed to survive reinstallation.

5. Information That Leaves Your Device — Feature by Feature

The table lists every network connection the App makes, what is sent, to whom, why, and for how long it is kept. Optional features send nothing until you use them. Like any Internet communication, each request necessarily exposes your IP address and technical connection data to the receiving service.

Third-party privacy policies. These providers operate under their own terms and privacy policies, which we encourage you to review:

• Apple (StoreKit, iCloud, iTunes Search API, App Store Server Notifications): https://www.apple.com/legal/privacy/
• GitHub Pages (hosting of our website and configuration file): https://docs.github.com/site-policy/privacy-policies/github-general-privacy-statement
• Internet Archive (archive.org): https://archive.org/about/terms
• LibriVox (librivox.org): https://librivox.org/pages/privacy/
• Project Gutenberg / Gutendex: https://www.gutenberg.org/policy/privacy_policy.html
• Modal Labs, Inc. (our hosting provider): https://modal.com/legal/privacy-policy — data processing addendum: https://modal.com/legal/dpa — subprocessors: https://trust.modal.com/subprocessors
• OpenRouter, Inc. (language-model gateway): https://openrouter.ai/privacy — subprocessors: https://trust.openrouter.ai
• Meta Platforms, Inc. (provider of the language model reached through OpenRouter): https://www.facebook.com/privacy/policy/ and https://ai.developer.meta.com/legal/terms-of-service

Modal and OpenRouter are bound by written data-processing terms covering confidentiality, security, documented instructions, subprocessors, rights requests, deletion, and incident notification. Meta acts as OpenRouter’s subprocessor under OpenRouter’s applicable flow-down obligations. We require service providers that receive personal data to use it only for the contracted service, apply appropriate security, assist with deletion requests, and provide protection consistent with this Policy. OWN PLACE LLC remains responsible for its selection and use of these service providers. Independent catalog providers, GitHub, and Apple process data under their own terms where they act independently.

6. AI Studio: Server-Based Writing and Narration

This section applies only if you subscribe to AI Studio and use it.

6.1 No account — an Apple-signed transaction instead

There is still no account. When you subscribe, Apple gives the App a transaction record signed by Apple. The App attaches that signed record to every AI Studio request. Our server verifies Apple’s signature and reads from it only: the subscription’s original transaction identifier (a number assigned by Apple that stays the same across renewals and devices), the product identifier, the environment (production or sandbox), and the expiry and revocation dates. The signed record itself is not stored on our server; the original transaction identifier is stored with your orders, your permission records, and your hours ledger as the label of “whose subscription paid for this.”

The original transaction identifier is a purchase identifier: it contains no name, email, Apple ID, or device identifier. Apple does not provide your identity with the transaction identifier. We may associate it with contact information you voluntarily provide in support or privacy correspondence. Apple can identify you from it, and Apple treats it under Apple’s own privacy policy. Because it is a persistent, subscription-level identifier, we treat it as personal information (a “User ID” in Apple’s App Privacy terminology) and every right in Sections 10–14 applies to it.

The App also sends a shared service token that is the same for every copy of the App. The shared service token is a coarse abuse-control signal and is not user authentication or proof that an unmodified App sent the request. Authorization for subscription data and books depends on successful verification of the Apple-signed transaction. With book orders, the App also sends a random order key that lets the server recognise a repeated request as the same order. The random order key is a pseudonymous order identifier: it does not directly reveal your identity but is linked to the corresponding order while that order exists.

6.2 What our server stores about an order

For each book you order or ask us to narrate, our service keeps one record containing: your request text (for written books) or the text you supplied (for narration), requested length, language, generated title and chapter text, narration file names and durations, technical state and timestamps, the original transaction identifier, the quota window it was charged to, and the seconds of audio charged. Records live in a Modal Labs data store; audio files live on a Modal Labs storage volume. For each writing-mode order, the record also contains the technical request identifiers returned by OpenRouter.

The order text, the generated chapters, the title, and the audio are held as temporary working storage only for the time needed to run and deliver the order: encrypted, subject to an application-level time-to-live, and excluded from OWN PLACE LLC’s application logs and crash reports. We do not create separate content backups. Processor backup copies, if any, are handled as described below. They are deleted as described in Section 6.4 (“no post-delivery server retention”).

Separately, for each subscription we keep the permission records described in Section 6.6, the hours ledger described in Section 6.4, and, if you have reported content or we have had to act on abuse, a note of that action (book identifier, date, reason category, and the resulting restriction, if any).

6.3 Who processes the text, and what they may do with it

Writing mode currently requests meta/muse-spark-1.2 (Muse Spark 1.2 by Meta) through OpenRouter with provider.data_collection="deny". Server-based narration uses VoxCPM2, operated by OWN PLACE LLC in its private container hosted by Modal.

OpenRouter’s standard DPA does not contemplate processing Sensitive Data without the agreement or amendment it specifies. Our prohibition on submitting such data is not a substitute for those contractual requirements.

Your request text and generated books are never used by OWN PLACE LLC to train models, are never sold, and are never shared with anyone other than the processors above for the purpose of producing your book, except as described under “Other disclosures” below.

Human access. Authorized personnel do not routinely read content. Limited review may occur when you request support, report content, submit a legal complaint, or when reasonably necessary to investigate abuse, security incidents, or comply with law.

No real people, no sensitive information — confirmed before every order. AI Studio’s writing mode is intended solely to generate fictional entertainment. The server-based narration mode may process only text that you are legally entitled to submit and that does not contain personal or consumer health data about an identifiable real person, including you. Use the on-device voice for text containing such data. Before every order the App asks you to confirm that the order contains no information about an identifiable real person and no health, biometric, genetic, precise-location, financial-account, or other sensitive personal data (Section 6.6); if you indicate that it does, the App refuses the order and nothing is sent. We do not request such information, do not read requests to look for it, and do not use anything you submit to make inferences about you or anyone else. We do not ask for, and no screen in the App is treated as, consent to process health or other sensitive personal data. A user’s confirmation does not authorize processing of personal or consumer health data. We rely on a requested-service exception only where the applicable law permits it and the specific processing is objectively necessary and proportionate. Otherwise, processing requires a valid legal basis; our current service does not offer a sensitive-data consent option. If such information is present despite your confirmation, it is processed only to write or narrate the book you requested, only by the processors above, and is deleted on the schedule in Section 6.4 or earlier on request; if we become aware that submitted content contains such data, we delete it and may refuse further orders. How consumer health data is handled is set out in our Consumer Health Data Privacy Policy.

Accuracy note. Generated text is produced by a statistical model and may be inaccurate or fabricated even when it sounds confident. Do not rely on it for factual accuracy, and never as medical, legal, financial, or other professional advice.

Other disclosures. We may disclose data when legally required (for example, in response to a valid subpoena or court order, or to report content where the law obliges us to) or as part of a merger, acquisition, financing, reorganization, or sale of assets, subject to applicable notice, purpose-limitation, and data-protection requirements. Where the law allows, we will tell you about a legal demand for your data through a notice in the App or on our website.

6.4 Retention and deletion on the server — no post-delivery server retention

We call this model “no post-delivery server retention.”

Modal may retain Function inputs and outputs for up to seven days under its infrastructure retention policy, independently of deletion from our application storage. The one-day period applies to application and container logs only.

• Temporary working storage. The order text, the generated chapters, the title, and the audio are stored on Modal as temporary working storage only for the time needed to run the order and deliver it: encrypted, subject to an application-level time-to-live, and excluded from OWN PLACE LLC’s application logs and crash reports. We do not create separate content backups. Processor backup copies, if any, are handled as described below.
• What counts as delivery. “Delivery is confirmed only after the App has durably saved every chapter on the device.” A successful network download is not by itself delivery.
• Deletion after delivery. Immediately after delivery of the final chapter is confirmed, OWN PLACE LLC deletes its server copy of the order — text and audio alike. OWN PLACE LLC cannot recover or re-deliver the book from its server after deletion; the App may still restore the user’s own saved iCloud copy. This is disclosed to you before your first order and on the paywall.
• If delivery is never confirmed. “If full delivery is not confirmed within seven days after the Service accepts the order, we treat the order as failed, stop further processing, delete all server-side order content, and automatically restore all hours reserved or charged for that order. Chapters already saved on your device remain available.”
• Deleting sooner. Content is deleted sooner if you delete the book in the App (the App sends a delete request to the service; if the phone is offline the request is retried later) or when you ask us (Section 10).
• Exceptions. “We do not retain order content after confirmed delivery, except content you separately submit in a report or support request and content that law requires us to preserve.” This covers content reports and copyright disputes, reports required under 18 U.S.C. § 2258A, and lawful preservation demands. When we obtain actual knowledge of facts or circumstances triggering 18 U.S.C. §2258A, including apparent covered child sexual exploitation, child sex trafficking, or online enticement, we report to NCMEC as soon as reasonably possible. We preserve report materials for one year after submission and longer where legally required, using the legally required security safeguards. Preserved report materials are held under a legal hold excluded from ordinary automatic deletion. For consumer health data, retention beyond an applicable deletion deadline is permitted only where a specific applicable legal obligation or statutory exception authorizes it. A general interest in defending possible claims does not by itself override that deadline. This applies equally to excerpts contained in content reports and in email correspondence.
• Your own copy. “After delivery, Talefall saves the book on this device and, if iCloud is available and the save succeeds, in your private iCloud storage. OWN PLACE LLC deletes its server copy after the final chapter has been saved on this device and cannot restore it. If iCloud is unavailable or full, export your own backup before deleting the App.” The App stores the copy through Apple’s iCloud service under your Apple account. OWN PLACE LLC does not access or control that copy. Access to your saved copy does not depend on an active subscription, and it is not “cloud storage” offered as a subscription benefit. You can also export a book manually with Export to Files. A privacy deletion request addressed to us does not delete your own iCloud copy; the delete-book button in the App offers to remove the local and the iCloud copy.
• Deletion while an order is running. If you request deletion while an order is queued, being written, or being narrated, we stop further processing as soon as technically possible, delete our working content, and restore the affected hours under Terms Section 4.2. After confirmed delivery we no longer hold identifiers that would let us locate any residual processor copy of your order. Requests are sent with a routing setting that excludes providers that retain or train on content; any limited retention by OpenRouter or the model provider for abuse prevention, security, billing, or legal compliance ends under their own retention periods. If you request deletion while an order is active, we cancel the order and notify OpenRouter with the identifiers we still hold. After delivery we confirm to you that the server copy has already been deleted; the hours ledger is handled separately below.
• Hours ledger (per original transaction identifier: seconds of audio charged per order, quota window, purchased extra hours by Apple transaction identifier, restored hours) and subscription-notification records received from Apple (event type, expiry, revocation) are retained for seven years after the last related financial event, then deleted or irreversibly aggregated. They contain no name and no book content.
• Permission records (Section 6.6) — containing only the document or permission version, the time, and the original transaction identifier — are retained with the hours ledger for the same period, because they document the basis on which paid work was done.
• Deletion-request records. When we fulfil a deletion request we keep a minimal record of the request itself (date, a keyed hash of the original transaction identifier — not the identifier itself — and what was deleted; no content) for two years as evidence that we complied.
• Content reports and enforcement notes are kept for up to 24 months after resolution, longer only for legal claims or where the law requires preservation.
• Read-aloud passages (Section 5, “read a passage aloud”) are not retained in our application storage.
• Backups. We do not create separate content backups, and Modal’s storage is not separately archived by us. Where a processor keeps backup copies, they expire on that processor’s next scheduled expiration cycle after deletion and, for Washington consumer health data, no later than six months after an authenticated request. Modal application and container logs expire after one day; Modal may retain Function inputs and outputs for up to seven days under its infrastructure retention policy, independently of deletion from our application storage.

6.5 Content limits and safety controls

The language model has no access to your library, your other books, or anything on your device. It sees only the request you typed and what it generated for that order.

We use automated input and output safety controls designed to block prohibited content, including sexual content involving minors, pornographic content, credible threats, terrorist or extremist material, trafficking, self-harm instructions, instructions facilitating serious wrongdoing, targeted harassment, and unlawful exploitation. The model provider may apply its own safeguards under its current service configuration; we do not rely on those safeguards as a substitute for our controls. These controls are automated. The safety controls evaluate submitted text for prohibited content categories, including self-harm instructions. They are not used to infer or create a record of any person’s health status or to build a profile; only the enforcement metadata described in this Policy is retained. Report content submits the report directly through the App. If submission fails, the App offers email to contact@ownplace.net as a fallback method. We review and respond to all content reports in a timely manner. Reports involving child exploitation, credible threats, or imminent harm receive immediate priority. If an investigation requires additional time, we inform the reporter through the available reporting channel. Where server content appears unlawful we restrict access to it immediately; we may block a subscription identifier from further use for serious or repeated violations, and report apparent child sexual exploitation to the NCMEC CyberTipline as the law requires. The full rules, enforcement steps, and appeal process are in our AI Safety and Content Policy.

6.6 Permission screens, the per-order confirmation, and what we record

Before first use of AI Studio, the App presents the Terms screen. Before the first writing-mode order, and again if the provider changes, the App separately asks permission to send writing-mode content to OpenRouter and Meta. Server-based narration does not require permission to send content to OpenRouter or Meta because it is not sent to them. No order content is sent to our service until you have completed the screens that apply to that mode.

1. Terms screen (before first use of AI Studio) — a separate “I Agree” action. You accept the Terms of Use, acknowledge this Policy, confirm that you are 18 or older, and confirm the rule: AI Studio’s writing mode is intended solely to generate fictional entertainment. The server-based narration mode may process only text that you are legally entitled to submit and that does not contain personal or consumer health data about an identifiable real person, including you. Use the on-device voice for text containing such data.
2. AI-provider permission screen (before the first writing-mode order; again if the provider changes) — a separate “Allow and Continue” action with the text: “Allow content from my AI Studio writing-mode orders to be sent to OpenRouter and Meta in the United States until I withdraw this permission or the provider changes. OpenRouter and Meta process writing-mode content to generate the requested text. Requests are sent using a setting that restricts routing to providers that state they do not use content for training or routine retention. This is not a zero-retention guarantee; limited retention may occur for abuse prevention, security, billing, or legal compliance.” The screen provides “Allow and Continue” and “Don’t Allow” actions. Choosing “Don’t Allow” sends no content to OpenRouter or Meta and leaves writing mode disabled; the player and server-based narration remain available.
3. Narration upload screen (before every server-based narration order) — the text: “Upload this text to OWN PLACE LLC’s service hosted by Modal in the United States for server-based narration. It will not be sent to OpenRouter or Meta.”

Before your first order, and on the paywall, the App also discloses that we keep no server copy after delivery: “Delivery is confirmed only after the App has durably saved every chapter on the device.” Once that has happened we delete our server copy and cannot restore it (Section 6.4).

Before every order the App additionally shows: “I confirm that this order does not contain information about an identifiable real person, including me, and does not contain health, biometric, genetic, precise-location, financial-account, or other sensitive personal data” with the button “Confirm and Continue.” If you indicate that the order does contain such information, the App refuses the order; nothing is sent to our server, and for narration the App points you to the on-device voice. None of these screens asks for consent to process health or other sensitive data, and no tap is treated as such consent.

We record, for the Terms screen and the AI-provider permission screen, only the document or permission version, the time, and the original transaction identifier of the subscription used; the per-order confirmation’s version and time, and the narration upload confirmation’s version and time, are stored as fields of the order record. If we change the model provider or materially change the Terms or this Policy, the App asks again before the next order. You can see the current versions in Settings → Privacy. Withdrawing AI-provider permission disables writing mode only. Server-based narration remains available subject to its separate upload confirmation.

7. Purchases, Subscription, and What We Receive from Apple

All payments are processed by Apple through the App Store. OWN PLACE LLC never receives or stores your payment card details, billing address, or Apple Account credentials. Apple provides us with aggregated sales and financial reports in App Store Connect.

For the one-time player purchase, the App checks entitlement on the device with StoreKit. Nothing about it is sent to our server.

For the AI Studio subscription and extra-hours purchases, in addition to the signed transaction described in Section 6.1, Apple’s App Store Server Notifications send our server a signed message when a subscription is started, renewed, expires, or is refunded or revoked. From it we store the original transaction identifier, the event type, the new expiry date, and the revocation date, if any. We use this solely to open a new monthly quota on renewal and to stop accepting a subscription that Apple has refunded or revoked. For an extra-hours purchase, the App sends the Apple-signed consumable transaction to our server, which verifies it and credits the hours once; we store that transaction’s identifier in the hours ledger so the same purchase is never credited twice. Apple may charge your Apple Account when it approves a purchase, before our server has verified it; see the Terms of Use, Section 4.3, for what happens if crediting is delayed. We do not receive your name, email, or payment details.

8. Usage Counters (optional, off unless you turn them on)

When you allow it, Talefall sends a small set of counters, carrying no identifier of you or your device, describing the steps of a session: that the App was opened, that the library was shown, that the demo book was opened, that playback started, that thirty seconds were played, that the add button was tapped, that an import succeeded or failed, that the trial banner or the purchase screen was shown, and that the App was closed. Each counter carries only its name and the number of seconds since the App was opened; a failed import also carries the file type (for example m4b), never the file name or its location. The batch carries the App version and your device language, and a random number that exists only to group one session’s counters together and is not stored by the service.

These counters never contain what you listen to or read: no book titles, no text, no file names, no paths, no bookmarks or notes. We do not attach a persistent user, subscription, or device identifier to counters and do not attempt to link them to a person; there is no advertising identifier and no account, and Talefall uses no third-party analytics SDK. Our server accepts only the fields listed above and discards anything else without looking at it. Ordinary server logs may temporarily contain an IP address and request timestamp for up to one day (Section 9); analytics storage is segregated from those logs, and we do not join the two. Because of that one-day log we describe the counters as identifier-free rather than absolutely anonymous. The counters are not used to track you across apps or sites, are not shared with anyone, and are deleted after 90 days. We ask once, the default answer is no, and you can change your answer at any time in Settings → Privacy. The counters are not offered to, and are not sent from, devices located in the European Economic Area or the United Kingdom (Section 14).

9. Server Logs and Security Records

Our service on Modal writes technical logs: the IP address from which each request arrived, the request path (which includes pseudonymous book identifiers), status codes, timestamps, the original transaction identifier on quota events, and character/duration counts for narration. Logs contain deletion status and a pseudonymous book identifier, but not the book title or content. For AI Studio purchases and requests, the service also derives the country or sanctions-relevant region from the IP address for the territory and sanctions checks described in Sections 5 and 14; we do not derive the U.S. state. GeoIP is a territorial control and does not by itself establish sanctions eligibility. This is done for legal-compliance and security reasons. This location information is not stored with an order, but it appears in the same log line as the request and, on quota events, alongside the original transaction identifier — which is why Section 18 discloses it as coarse location linked to the subscription identifier. We do not request or collect precise location. Logs do not intentionally contain your request text or book text. Modal Labs retains these logs for one day on our current plan, after which they are gone. Our service also keeps daily counts of refused requests by reason (for example “quota exhausted”, “territory not supported”); these are numbers only, with no identifiers, and are kept for 30 days.

10. Your Choices and How to Delete Data

• Player only. If you do not use AI Studio and do not opt in to usage counters, no player-library content is sent to OWN PLACE LLC. You can also turn off online cover lookup (Settings → Covers) and the usage counters (Settings → Privacy).
• Delete a book from the server. Delete it in the App. The App tells the service to delete the server copy (text and audio). If you request deletion while an order is queued, being written, or being narrated, we stop further processing as soon as technically possible, delete our working content, and restore the affected hours under Terms Section 4.2. You do not have to wait for it to finish.
• Automatic deletion. Even if you do nothing, an AI Studio order’s text and audio are deleted from the server immediately after delivery of the final chapter is confirmed, and in any event no later than seven days after the Service accepts the order if full delivery is never confirmed (Section 6.4).
• Delete everything on request — by email. To request access, correction, or deletion, email contact@ownplace.net and include your subscription’s original transaction identifier, if available. We use it to locate records and verify your authority proportionately before disclosing or deleting data. The identifier alone is not proof of authority. Settings → Privacy → Request Data Deletion in the App prepares that email for you with the identifier filled in; the App does not send a deletion request to our service by itself. We delete records eligible for deletion, subject to the limited exceptions described in this Policy. A deletion request also covers active orders: if you request deletion while an order is queued, being written, or being narrated, we stop further processing as soon as technically possible, delete our working content, and restore the affected hours under Terms Section 4.2. After confirmed delivery we no longer hold identifiers that would let us locate any residual processor copy of your order. Requests are sent with a routing setting that excludes providers that retain or train on content; any limited retention by OpenRouter or the model provider for abuse prevention, security, billing, or legal compliance ends under their own retention periods. If you request deletion while an order is active, we cancel the order and notify OpenRouter with the identifiers we still hold. We delete active order data without waiting for generation to finish, delete the permission records, delete order-linked usage entries and non-required ledger details, while retaining only the minimum transaction and balance record necessary to preserve unused purchased extra hours, instruct any processor still able to locate a copy to delete it, and delete backup copies on the next scheduled backup-expiration cycle (for Washington consumer health data, no later than six months after authentication). Where NRS 603A.515 applies, we delete covered data within 30 calendar days after authentication and notify the relevant recipients. Recipients must delete covered data within 30 calendar days after notification, subject to the statute’s backup exception. We may retain narrowly limited billing evidence only where and for as long as required by law or necessary to establish, exercise, or defend legal claims, plus the minimal deletion-request record described in Section 6.4. For consumer health data, retention beyond an applicable deletion deadline is permitted only where a specific applicable legal obligation or statutory exception authorizes it. A general interest in defending possible claims does not by itself override that deadline. Deleting content or consumer health data does not forfeit purchased extra hours. We retain only the minimum entitlement record needed to preserve that balance. If you request deletion of every identifier-linked record and preservation is technically impossible, we will first offer a refund path or obtain your separate confirmation of deletion and forfeiture.
• Your own copy is not affected. A deletion request addressed to us concerns our server-side records. It does not delete the copy of a book saved on your device or the copy the App stores through Apple’s iCloud service under your Apple account; OWN PLACE LLC does not access or control that copy. To remove those, delete the book in the App — the delete-book button offers to remove the local and the iCloud copy.
• How we verify you. Email alone is not sufficient to obtain a copy of content or delete records unless we complete additional verification proportionate to the request — for example, an Apple receipt for the subscription. We do this so that a leaked identifier cannot be used by someone else to delete or obtain your books. The identifier alone is not proof of authority.
• If you do not use Talefall or hold a subscription. These rights are also available to individuals whose personal data we process even if they do not use Talefall or hold a subscription. Contact contact@ownplace.net with information reasonably sufficient to locate the data. We verify your identity and authority using an appropriate alternative method and do not require another person’s Apple transaction.
• Access or portability. On the same basis — by email, with verification proportionate to the request — you may ask whether we hold information associated with your subscription and receive a copy of the information that still exists, together with the processors that received order content. Because ordinary order content is deleted after delivery, we cannot provide content or order records that have already been deleted.
• Correction. You may ask us to correct inaccurate personal information we still hold about you. Because order content is free text you wrote and we do not alter it, correction normally takes the form of deleting the order or replacing it with a new one at your request; for ledger or permission records that still exist we correct the record itself. We cannot correct records that have already been deleted. We will tell you what we did.
• Report content is not a privacy request, but it is submitted the same way: directly from the App, with email to contact@ownplace.net as a fallback (Section 6.5).
• Withdraw permission. You may withdraw your permission to the transfer of writing-mode content to our AI providers at any time in Settings → Privacy; the App will not place new writing-mode orders until you grant permission again. Withdrawing AI-provider permission disables writing mode only. Server-based narration remains available subject to its separate upload confirmation. Withdrawal does not affect processing that already happened, and you can delete the resulting books as described above.
• Ask us to stop collecting consumer health data. You may separately request that we cease collecting, sharing, or selling your consumer health data. This request is not limited to writing mode. Withdrawing AI-provider permission also stops further transfers under that permission for active writing orders as soon as technically possible; processing already completed cannot be undone.
• Cancel the subscription at any time in iOS Settings → Apple Account → Subscriptions. Cancelling does not by itself delete the remaining ledger, permission, report, enforcement, or active-order records described in this Policy; use the steps above.
• Deleting the App removes its local container. Because we keep no server copy of a delivered book (Section 6.4), a book you delete this way cannot be restored by us. If iCloud is unavailable or full, export your own backup with Export to Files before deleting the App.

We respond without undue delay and within 45 calendar days after receiving your request. Verification does not restart this period. We may extend it once by 45 days where permitted, explaining the extension within the initial period. Where the CCPA applies, we acknowledge receipt within 10 business days. Shorter statutory deletion deadlines remain applicable. If we decline a request, you may appeal by replying to our response within 45 days; we answer appeals in writing within 45 days and, where the law provides, tell you how to contact your state’s Attorney General.

11. Children’s Privacy (COPPA) and Age Rating

The App’s player is a general-audience audiobook player. It is not directed to children under 13, and we do not knowingly collect any personal information from children. If we obtain actual knowledge that personal information was submitted by a child under 13, we will stop processing it, delete it promptly, and will not use the information except as permitted to respond to or protect the child. Parents may contact us at contact@ownplace.net.

Because the App also offers AI Studio — which can generate unpredictable, user-directed text and narration that we do not review before it reaches you — the App is rated 18+ on the App Store as a whole (the rating reflects the App as a package, not the player by itself), and AI Studio is not intended for use by minors. Before the first AI Studio order the App asks you to confirm that you are at least 18. See Terms of Use, Section 2, for the App’s age requirement.

12. Your Rights — California (CCPA/CPRA)

To the extent the CCPA applies to OWN PLACE LLC, California residents have the rights described below. Even where it does not apply, we voluntarily accept access, correction, and deletion requests as described in this Policy, subject to verification and lawful retention exceptions.

We do not sell or “share” (as those terms are defined in the CCPA/CPRA) personal information, do not use it for cross-context behavioral advertising, and do not use or disclose sensitive personal information for purposes that require a right to limit. In the preceding 12 months we have collected the categories of personal information described in Sections 5–9 (identifiers limited to a purchase identifier and IP address; commercial information about subscription status and hours used; user-generated content in the form of AI Studio requests and narrated text, and, for writing-mode orders, the OpenRouter request identifiers described in Section 6.2; Internet activity limited to optional identifier-free counters; country or sanctions-relevant region inferred from IP for the territory and sanctions checks) for the business purposes stated there, and disclosed them only to the service providers listed in Section 6.3. We also collect contact information and correspondence voluntarily supplied in support, privacy, and content-report requests, and disclose them to our business email provider for delivery, storage, and security.

California residents have the rights to know/access, delete, correct, opt out of sale or sharing (not applicable — we do neither), and limit use of sensitive personal information (not applicable), with a right to non-discrimination. Exercise them by emailing contact@ownplace.net (Section 10); Settings → Privacy → Request Data Deletion in the App prepares that email for you. We verify requests as described in Section 10 and respond within the time allowed by law, and where the CCPA applies, we acknowledge receipt within 10 business days. An authorized agent may submit a request on your behalf with written permission.

13. Washington State and Other US States; Consumer Health Data

This Policy and the App are governed by the laws of the State of Washington.

Consumer health data. AI Studio is not a health service. Its writing mode is intended solely to generate fictional entertainment, its narration mode may process only text without personal or consumer health data about an identifiable real person, and before every order you confirm that the order contains none. A request may nevertheless contain consumer health data if you include information about an identifiable person’s physical or mental health, including your own. We do not request, read, infer from, sell, or share such data; if it is present, it is processed only to write or narrate the book you requested, by the processors in Section 6.3, and deleted on the schedule in Section 6.4 or earlier on request. A user’s confirmation does not authorize processing of personal or consumer health data. We rely on a requested-service exception only where the applicable law permits it and the specific processing is objectively necessary and proportionate. Otherwise, processing requires a valid legal basis; our current service does not offer a sensitive-data consent option. We do not rely on that exception for consumer health data about another person. Third-party consumer health data is prohibited; when detected, processing stops and the data is deleted. We do not establish geofences around health-care facilities and do not use location data to identify or infer visits to health-care facilities. Country- and region-level GeoIP checks are used solely for territorial and sanctions compliance.

We do not use submitted text to identify, infer, or determine any consumer’s health status; we process it only to generate or narrate the work the user requested.

Because Washington’s My Health My Data Act (Chapter 19.373 RCW), Nevada SB 370, and the Connecticut Data Privacy Act may treat such information as consumer health data, we publish a separate Consumer Health Data Privacy Policy containing the information those laws require, including the categories collected, sources, purposes, processors, your rights (access, correction, deletion, appeal), and how to contact us; it is linked prominently from our home page and from Settings → Privacy in the App: https://ownplace.net/talefall/health-data. Our rules for AI Studio content, the safety controls, reporting, and appeals are in a separate document: https://ownplace.net/talefall/ai-safety.

Sensitive data generally. We do not process sensitive personal information to make inferences about you, and we do not profile you.

Other US states. Residents of states with comprehensive privacy laws (for example Colorado, Connecticut, Oregon, Texas, Virginia) may have rights to access, correct, delete, or obtain a copy of personal information and to opt out of targeted advertising, sale, or profiling. We do none of the latter three. Send requests through the App (Section 10) or to contact@ownplace.net; if we decline a request you may appeal by replying to our response, and we will answer the appeal in writing.

14. European Economic Area, United Kingdom, and Switzerland; Territorial Limits

The App is not distributed on App Store storefronts of the European Economic Area, the United Kingdom or Switzerland, and AI Studio is not offered to persons located there. AI Studio — including its subscription, extra-hours purchases, book writing, server-based narration, read-aloud requests, and collection of server-generated books — is not offered to, and may not be purchased or used by, any person while that person is physically located in those territories. AI Studio is also unavailable in the other countries and regions identified in the App and at https://ownplace.net/talefall/ai-studio-territories.

AI Studio requires physical presence in a Supported Territory. Purchases also require availability in the current App Store storefront. These checks apply to new subscriptions, top-ups, and Service requests. An existing subscription may continue to renew through Apple while you are outside a Supported Territory unless you cancel it; unused monthly hours still expire. This restriction is based on the person’s physical location when a purchase, top-up, or AI Studio request is made. It is not based on citizenship, residence, or the country or region of the person’s Apple Account. Availability of a product in an App Store storefront does not by itself establish eligibility to use AI Studio.

To enforce this restriction, the App and Service may use the country or region of the current App Store storefront and the country-level location inferred from the IP address of a purchase, top-up, or Service request. We do not request or collect precise GPS location for this purpose. If either check indicates an unavailable territory, the request is refused before generation begins, no order is created, no text is sent to OpenRouter or a model provider, and no hours are charged. Independently of the country check, the Service refuses requests originating from the Crimea region and the so-called Donetsk People’s Republic and Luhansk People’s Republic regions of Ukraine, as defined by OFAC, and any other region later designated as a Covered Region (Terms of Use, Section 7). GeoIP is a territorial control and does not by itself establish sanctions eligibility. As described in Section 9, the hosting provider may retain the IP address, the country inferred from it, and the request path in a security log for one day.

A subscription purchased in a supported territory does not authorize use of AI Studio while the subscriber is physically located in an unavailable territory. During that time, the local audiobook player and books already downloaded to the device remain available, and any unused extra-hours balance remains recorded for later use from a supported territory.

The optional first-session usage counters described in Section 8 are not offered in the EEA or UK. The player library, imported files, reading and listening activity, bookmarks, notes, and playback history remain on the device as described in Sections 3 and 4.

GDPR / UK GDPR. We do not offer the App or AI Studio in, and do not target users in, the European Economic Area, the United Kingdom or Switzerland. If you contact us for support, we process your email address and the information in your message to respond to your request, protect the security of the App, and comply with legal obligations. Where the GDPR or UK GDPR applies to this limited processing, our legal bases are steps taken at your request or performance of a contract, our legitimate interests in providing support and protecting the App, and compliance with legal obligations, as applicable.

Where the GDPR or UK GDPR applies, you may request access, correction, deletion, restriction, or portability of your personal data, object to processing based on legitimate interests, and lodge a complaint with the supervisory authority where you live or work. Send requests to contact@ownplace.net. We do not rely on Article 49(1)(b) GDPR or its UK equivalent for recurring AI Studio transfers from the EEA or United Kingdom; such AI Studio processing is not permitted from those territories.

15. Security

• All connections between the App and our service, and between our service and its processors, use TLS. OpenRouter additionally encrypts stored data with AES-256.
• AI Studio requests must carry a service token and an Apple-signed transaction, which our server verifies against Apple’s root certificate before doing any paid work; the server shows, cancels, and deletes books only for the subscription that ordered them.
• While an order is active or awaiting confirmed delivery, its working record and audio are held temporarily in Modal storage and deleted under Section 6.4; they are accessible only to our service with Modal credentials.
• On your device, keys and the evaluation date are stored in the iOS Keychain. Local files receive the protection provided by iOS, the App’s configured file-protection class, and your device security settings; a device passcode materially improves that protection.
• Wi-Fi Upload uses a session token but transfers over plain HTTP on your local network; use it only on a trusted private network and stop the server when finished.

Honest limits: we are a small company without a dedicated security team; the service token is embedded in the App and could be extracted by a determined person (it does not grant access to anyone else’s books, which require the Apple-signed transaction of the ordering subscription); and no Internet service is perfectly secure. We provide breach notices within the deadlines and by the methods required by applicable law. Where available, we use appropriate contact information. Where substitute notice is legally permitted, we fulfil all applicable substitute-notice requirements; an in-App or website notice alone may not suffice. We also notify the relevant authority where the law requires it.

16. No Tracking, No Cookies, No Advertising

• We do not track you across apps, websites, or services.
• The native App does not set browser cookies. Websites and third-party pages opened outside the App (including our own pages on GitHub Pages and Apple’s pages) may use cookies or similar technologies under their own policies.
• We do not show the App Tracking Transparency (ATT) prompt, because we do not track and do not access the advertising identifier.
• We do not use advertising identifiers (IDFA) or device fingerprints.
• We do not include analytics, advertising, or tracking SDKs. We do not send data for advertising or cross-app tracking. The optional analytics events described in Section 8 are the only product-analytics events that we send to our own service. (Other connections — the App Store, the territory check, the catalogs, GitHub Pages, and AI Studio requests — necessarily create ordinary connection data, as listed in Section 5.)

17. Data Retention Summary

18. App Privacy Label

Our App Store “App Privacy” disclosure reflects this Policy and matches the PrivacyInfo.xcprivacy manifest bundled in the App:

• User ID — the Apple original transaction identifier used as a persistent subscription-level identifier — linked to the user, for App Functionality and fraud prevention.
• Purchase History (subscription status, extra-hours purchases, and hours used) — linked to the user, for App Functionality.
• Other User Content (AI Studio requests and the text you submit for or receive as narration) — linked to the user, for App Functionality.
• Product Interaction (the opt-in identifier-free first-session counters) — not linked to the user, for Analytics.
• Coarse Location — country or sanctions-relevant region inferred from the request IP address — linked where it appears with a subscription identifier, for App Functionality, security, and legal compliance.
• Other Data — IP address, request path, and (for writing-mode orders) the OpenRouter request identifiers stored with the order — linked where the request contains a subscription or book identifier, for App Functionality and security.
• No data is used for tracking, and the App requests no advertising identifier.

“Linked” reflects that these data types are stored together with, or in the same log line as, the subscription’s original transaction identifier. Apple does not provide your identity with the transaction identifier. We may associate it with contact information you voluntarily provide in support or privacy correspondence. Other User Content is disclosed as linked to the user because an order’s text remains on our server while the order runs and for up to seven days if delivery is never confirmed, and because a provider may retain limited records as described in Section 6.3. The country or region derived from the IP address for the territory and sanctions checks is not stored with an order; it exists in the one-day server logs described in Section 9, and is disclosed above for that reason.

19. Changes to This Policy

We may update this Policy to reflect changes to the App, our processors, or applicable law. When we do, we will revise the “Effective Date” above and post the updated Policy at its public URL; previous versions remain available on request. For material changes to how AI Studio data is processed — including a change of model provider — we will show a notice in the App and ask for your affirmative acceptance before the next order. Material changes do not reduce benefits already purchased for the current billing period. Where applicable law requires consent for a change, we will ask for it.

Website forms

Our website, ownplace.net, has two forms: a waitlist form (email address and interface language) and a support form (name, email address, product, and message). Submissions are stored in a Cloudflare D1 database located in the United States. Support messages are also delivered to contact@ownplace.net through Resend, our email delivery provider. To prevent spam, the forms use Cloudflare Turnstile, which may process your IP address and browser signals. We use this data only to reply to you or to notify you about the launch. We keep waitlist entries until the launch notification plus 12 months, and support messages for 24 months. You can request deletion at any time by emailing contact@ownplace.net.

20. Contact

OWN PLACE LLC 7707 NE 141st St, Kirkland, WA 98034-5321, USA Email: contact@ownplace.net Telephone: +1 (213) 524-8012