Privacy Policy for Talefall — Audiobook Player

Effective Date: October 22, 2026

Controller: OWN PLACE LLC, a Washington limited liability company, 7707 NE 141st St, Kirkland, WA 98034-5321, USA. Email: contact@ownplace.net. Telephone: +1 (213) 524-8012. App: Talefall — Audiobook Player (the “App”), bundle identifier com.anisimov.audiobooks, for iPhone.

Talefall is first of all an audiobook player and reader that works with your own files on your own device. The player does not upload your library. The optional, paid Talefall Subscription adds two server features, both in the App’s Create tab (together, the “Service”):

• Book from an Idea: you describe an idea; our service writes a book (a Story, an Explainer, or a How-to guide) with a third-party AI model and narrates it with our own narrator model.
• Narrate My Text in the Talefall voice: our narrator model reads aloud a text book you already have.

Since App version 1.3.2 the player and reader need no purchase. Without a subscription you can also order one AI book of about 15 minutes on us (the “first book on us”, Section 6.1A); it uses the same Service.

This Policy explains what leaves your device when you use those features, where it goes, why, and how long it is kept, and what never leaves your device. Companion documents that are part of our privacy disclosures:

• Consumer Health Data Privacy Policy: https://ownplace.net/talefall/health-data (also linked from the home page of ownplace.net)
• AI Safety and Content Policy: https://ownplace.net/talefall/ai-safety
• Supported Territories: https://ownplace.net/talefall/ai-studio-territories

This Policy is published in English, Russian, and Spanish, the languages of the App. If a translation conflicts with the English version, the English version controls, without limiting mandatory rights under the law where you live.

1. Who We Are and How to Contact Us

• Controller: OWN PLACE LLC, 7707 NE 141st St, Kirkland, WA 98034-5321, USA. We have no affiliates.
• Privacy questions and requests: contact@ownplace.net or +1 (213) 524-8012 (Section 10).

2. Summary

• No accounts. No registration, login, or password. We do not know your name, email, or Apple ID unless you write to us.
• The player is local. Your audio files, text books, library, positions, bookmarks, notes, statistics, and settings stay on your device and in your own iCloud or device backups.
• If you do not use the Service, none of your library content is sent to us. The App still contacts Apple; the Internet Archive, automatically, for the cover images of the suggested classics while that shelf is shown on the My Books page (U.S. storefront only); and, when you open them, the catalog providers (Section 5).
• The Service is optional. When you order a book, your idea goes to our service on Modal (USA). Our server first checks it for personal and sensitive data and for prohibited content. To write the book, it is then sent to AI providers on the conditions of the AI-provider permission you gave. Under the current permission (version 2026-10-14.1): OpenAI (OpenAI OpCo, LLC) is the only external AI model provider we use directly for these orders, through the OpenAI API under our own contract and data processing addendum with OpenAI; we do not route these orders through OpenRouter or another AI gateway; OpenAI may process content through its published affiliates and subprocessors under its DPA, and our hosting provider Modal also processes order content (Section 6.3.3); no model training, no sale and no advertising use; content is used only for the requested service, support, security, abuse prevention and legal compliance; processing and access by authorized OpenAI staff or contractors may occur in several countries; we do not choose China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia or Venezuela — the countries of concern under the US Department of Justice Data Security Program (28 CFR 202.601, as of October 2026); the information OpenAI publishes names none of these countries, but it is not a complete list of processing locations (Section 6.3.2); OpenAI may keep requests for up to 30 days to provide the service and detect abuse, and longer only where the law requires or to protect against harm, with no single maximum. Today, orders under this permission are written by the GPT-6.1 Sol model in the OpenAI API. Orders placed under earlier permissions keep their routes, which go through OpenRouter (Section 6.3.5). Every recipient, with its countries, retention, caching, human access and exceptions, is listed in Section 6.3. Narration runs on our own narrator model on Modal, and every chapter is checked by our own moderation model on Modal; neither sends the text to another company.
• The rule: no personal data about real people, including you. You confirm this before every book order. For narration of the resulting book, the App reuses that confirmation; for another book without it, the App asks for a separate confirmation before its first narration in the Talefall voice. Our server refuses book ideas (and, in versions using permission 2026-10-14.1, texts for narration) in which it detects personal or sensitive data (Section 6.5). We do not routinely read requests or books; limited human access is described in Section 6.3.
• Our server deletes its working copy of a book when the App confirms that it has saved every chapter. An order without that confirmation expires after seven days and is deleted at the next scheduled cleanup. Whether hours are restored follows the delivery rule in the Terms of Use (Section 4.2). We keep a receipt (times, hours, confirmation records) but not the content. Copies kept by our service providers (for example, Modal’s infrastructure copies for up to seven days), content reports, and materials the law requires us to preserve follow the separate periods in Section 6.4.
• Your subscription is identified by Apple’s signed transaction, not by you (Section 6.1).
• First book on us. Without a subscription you can order one AI book of about 15 minutes. To give it once per Apple Account, the App sends an Apple-signed record of your download of the App, and our server keeps its app transaction identifier with that order and a keyed hash of it to prevent repeat claims (Section 6.1A).
• Usage counters only if you say yes; nothing is sent until you allow them (Section 8).
• “Book ready” notifications only if you allow notifications. The App then sends our service the device’s push-notification token, and Apple delivers the notification and, when a book is ready, a silent signal that lets the App collect the book in the background (Sections 5 and 6.2).
• No tracking, no ads, no advertising identifier, no third-party analytics SDKs. We do not sell personal information or share it for cross-context behavioral advertising; we disclose it only to the recipients described in Section 6.3.

3. Information We Do Not Collect

Through the App we do not ask for, and the App does not send us, your name, email address, phone number, contacts, photos, precise location, browsing history, or advertising identifier; we do not use the advertising identifier. The App sends a push-notification token only as described in Section 5, only if you allow notifications for Talefall (and, if you turn them off, sends it again only to ask us to delete it, repeating the request until our service confirms it). For the first book on us, the App sends the complete Apple-signed record of your download of the App (AppTransaction), including any device-verification values it contains, only for the requests described in Section 6.1A; it contains Apple’s app transaction identifier, which identifies the App’s download on your Apple Account, and may also contain other information supplied by Apple, such as app acquisition and version information and signing dates. We keep only the app transaction identifier and the environment from it. We do not collect your playback history, bookmarks, notes, or highlights, or titles or text from your library unless you deliberately send a text for narration in the Talefall voice. We do not request health information and do not infer anything about your health or other characteristics from what you submit.

If you contact us. If you email contact@ownplace.net, we receive your email address and what you write. We use it only to respond, to handle support, privacy, content, and copyright requests, and to comply with law. We keep correspondence for no longer than 24 months after the last message, and delete it earlier on request, except where we must keep it to document a refund dispute, a content report, a legal claim, or a legal obligation. For consumer health data, we keep it beyond an applicable deletion deadline only where a specific legal obligation or statutory exception requires it. Our email provider, Apple (iCloud Mail), processes this mail to deliver and secure it.

Apple analytics. If you enabled “Share With App Developers” in iOS, Apple may give us aggregated App Store Connect analytics and crash reports through Apple’s developer services. There is no analytics SDK in the App.

On-device technical log. The App keeps a small, size-limited technical log on your device (App version, internal book numbers, step names, error codes, and crash reports from Apple’s MetricKit). It contains no book content and is not sent anywhere.

4. Information Stored Only on Your Device or in Your iCloud

• Your imported audio files and text books, your library, covers, titles, progress, playback and reading positions, bookmarks, highlights, notes, listening statistics, and settings.
• On-device transcription: turning an audiobook into text uses Apple’s speech recognition on the device; the audio and text stay there.
• On-device voice: reading a text aloud with an Apple voice happens on the device and does not use the Service.
• On-device format conversion of audio formats.
• The bundled sample audiobook, which plays without a network connection.
• Trial start date from earlier versions. Versions before 1.3.2 stored a trial start date in the iOS Keychain and the iCloud Key-Value Store. Since version 1.3.2 the player needs no purchase or trial, and the App no longer reads or writes that date. A date already stored is not deleted by the App and may remain; it contains only a date and is not sent to us.
• Your usage-counters answer, and a local copy of your Terms acceptance and AI-provider permission so the App does not ask again unnecessarily.
• Usage-counter bookkeeping (Section 8): whether this is a new installation, the App build, distribution channel and calendar week of the first launch, and the time of the first launch, which the App stores on the device even before you answer the counters question; and, once you allow counters, the milestones already sent or waiting to be sent and the listening time accumulated toward the five-minute milestone. It is sent only as described in Section 8, and only if you allow counters. The first-launch time is never sent.
• Classics shelf: the cached cover images of the suggested classics and whether you hid the shelf or some of its books.
• The time you ordered the first book on us, so that for 8 days the App attaches the record of your download to the requests listed in Section 6.1A.
• Books delivered by the Service, on the device and, if iCloud is available and the save succeeds, in your private iCloud storage, which we cannot access.

5. What Leaves Your Device

Each connection necessarily exposes your IP address and ordinary connection data to the service that receives it. Optional features send nothing until you use them, except the classics shelf covers described in the table.

Before registering for notifications. If you previously allowed Talefall notifications, opening the updated App alone does not trigger initial registration of your push token with our service. At your next book order, the App shows an in-app notice before sending the token. If you do not tap “OK”, the notice appears again at subsequent book orders while notifications remain allowed in iOS. Registration waits until you tap “OK” in that notice and notifications remain allowed in iOS; no repeat iOS notification-permission prompt is required. You can instead choose “Turn off in Settings”; opening Settings or closing the notice does not authorize registration. The App sends the token and the registration data listed in the table to OWN PLACE LLC’s service on Modal (USA). We store the token linked to your subscription identifier and, for a book on us, to your app transaction identifier (Section 6.1A), for the periods described in Section 6.2. For delivery through APNs, we send Apple the token and a standard book-status notification, without your subscription or app transaction identifier or book content. After initial registration, the App may refresh it when you open the App or place an order. You can turn notifications off in iOS Settings; the next time the App is open, it asks our service to delete the token as described in Section 6.2. When the App first asks you to allow notifications at a book order, it explains this processing before the iOS permission request and registers the token only if you allow notifications. Notifications are optional; declining does not prevent ordering or receiving books.

Silent “book ready” signal. From version 1.3.2, when a book is ready, our service also asks Apple to deliver a silent background signal to each registered device whose App can receive it. The signal shows nothing on the screen and contains only the kind “ready” — no book number, title, or content. It lets iOS wake the App briefly (iOS decides whether and when): the App then makes the same requests as when you open it to collect books — it asks our service for your book list, imports the text of a ready book, queues its audio for download, and confirms what it saved — with the same signed records described in this table. If you have allowed usage counters, importing a book during this background collection may also send the “book received” milestone described in Section 8, which contains no book content and no subscription or app transaction identifier. The App sends nothing else in response to the signal.

Third-party policies. Apple: https://www.apple.com/legal/privacy/ · Internet Archive: https://archive.org/about/terms · LibriVox: https://librivox.org/pages/privacy/ · Project Gutenberg: https://www.gutenberg.org/policy/privacy_policy.html · Modal: https://modal.com/legal/privacy-policy · OpenAI API data: https://developers.openai.com/api/docs/guides/your-data · OpenAI enterprise privacy: https://openai.com/enterprise-privacy/ · OpenRouter: https://openrouter.ai/privacy · OpenRouter zero data retention: https://openrouter.ai/docs/guides/features/zdr · Microsoft: https://www.microsoft.com/en-us/privacy/privacystatement · Microsoft Azure data handling for models sold by Azure: https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy · Amazon Web Services: https://aws.amazon.com/privacy/ · Amazon Bedrock data handling: https://docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html and https://docs.aws.amazon.com/bedrock/latest/userguide/abuse-detection.html.

6. The Talefall Subscription’s Server Features

This section applies if you subscribe and use the Service, or if you order the first book on us without a subscription (Section 6.1A). Everything in Sections 6.2–6.7 applies to that book the same way, with the app transaction identifier in place of the subscription identifier where Section 6.1A says so.

6.1 No account — an Apple-signed transaction instead

When you subscribe, Apple gives the App a transaction record signed by Apple. The App attaches it to every Service request. Our server verifies Apple’s signature and reads only the subscription’s original transaction identifier (a number assigned by Apple that stays the same across renewals), the product, the environment, and the expiry and revocation dates. We store the original transaction identifier with your orders, receipts, permission record, reports, and hours balance, and it appears in our logs of hours charged and restored. It contains no name, email, or Apple ID, and Apple does not give us your identity with it, but it is a persistent identifier, so we treat it as personal information. We may associate it with contact details you give us in correspondence.

The App also sends a shared service token, the same in every copy of the App; it is an abuse-control signal, not authentication. Access to your books depends on the Apple-signed transaction (for the first book on us, on the Apple-signed record of your download, Section 6.1A). A random order key lets the server recognize a repeated request as the same order.

6.1A First book on us — an Apple-signed record of your download

If you do not have a subscription, you can order one AI book of about 15 minutes on us. All the conditions of a paid order apply: the Terms of Use, the 18+ confirmation, the AI-provider permission (Section 6.3), the fiction-only confirmation, and our safety checks (Section 6.5). The book is written and narrated on the same routes as a paid order under the current permission. It uses no hours and has no cash value. If the book is not delivered to you (it fails, expires, is stopped by our checks, or you cancel it before you receive it), you may order it again, up to three orders in total; once a first book has been delivered, the offer is used. The number of first books we give each day is limited for everyone; when the day’s limit is reached, nothing is charged and you can try again later.

To offer it once per Apple Account, the App attaches the AppTransaction — a record of your download of the App, signed by Apple — to these requests only:

• when you have no subscription: the check whether the gift is available, book orders, your answer “allow” on the AI-provider permission screen, and content reports;
• for 8 days after your device sent an order for the first book on us, even if you subscribe meanwhile: book orders, your answer “allow”, content reports, the requests that list, download, confirm, cancel, or delete books, and registration of this device for “book ready” notifications — so the gift book still reaches you, a repeated order is not created twice, and withdrawing your permission also stops the gift book;
• always: withdrawing your AI-provider permission, and asking our service to delete this device’s notification token — so that these reach data kept for a gift book ordered from another device or before you reinstalled the App (if the record is unavailable, the App retries later);
• a data deletion request from the App (Section 10), so that data kept under it can be deleted.

The App sends the complete Apple-signed record for verification. Besides the app transaction identifier it may contain other information supplied by Apple, such as app acquisition and version information, signing dates, and device-verification values. Our server verifies Apple’s signature, that the record belongs to Talefall (the App’s bundle and App Store identifiers), and its environment, and our application keeps only the app transaction identifier (a number Apple assigns to your Apple Account’s download of the App; it stays the same after you reinstall) and the environment (Modal’s infrastructure copies of requests follow Section 6.4). We use that identifier, prefixed app:, the way Section 6.1 describes for the subscription identifier: with the gift order, its receipt, your permission record, reports, notification tokens registered for the gift book, the order key records, and our application logs (about one day). It contains no name, email, or Apple ID, but it is a persistent identifier, so we treat it as personal information. No hours balance is kept for it.

To make sure the gift is given only once, we keep a record that it was given (and, if the book was not delivered, that it was given back), keyed by a keyed hash (HMAC) of the identifier rather than the identifier itself, with the book number (a random number that also appears on the order’s receipt) and the time, and a link from the book number to that keyed hash. Before our safety checks screen an attempted gift order, we also record a screening slot under the same keyed hash and the UTC day, to limit repeated attempts; it contains no submitted text and may remain even if the checks reject the order and no book is created. These records are necessary to prevent the gift from being claimed again and to limit abuse; we use them for nothing else.

To keep the daily limit, we also keep records of the day’s gift budget and of the processing of each gift book: which gift books were accepted that day, their reserved, estimated and actual cost, and their processing stages (book numbers, amounts, times; no content).

These records contain no app transaction identifier in readable form and no book content, but they may remain linkable to you through the keyed hash or the book number, so we treat them as personal information. Their retention is described in Section 6.4.

6.2 What our server stores about an order

While an order is in progress: your idea (or, for narration, the text you supplied), book type, language and length, the generated title and chapters, the audio, technical state and times, the original transaction identifier (for the first book on us, the app transaction identifier), and the request identifiers returned by the AI provider (kept 30 days after the order’s delivery or end; Section 6.4). Content is held in Modal’s storage as temporary, encrypted working storage and is kept out of our application logs.

For every order we also keep a receipt that outlives the content: book number, original transaction identifier, times, ordered and delivered length, hours charged or restored, and the outcome. For a book order the receipt also records your per-order confirmation: the version of the confirmation text, the time, and a cryptographic fingerprint (SHA-256) of the idea text — not the text itself.

Service operation records. To apply the delivery rule for hours (Terms of Use, Section 4.2), enforce limits, and avoid processing the same thing twice, our server also keeps the following technical records. They contain no book content.

• Audio transfers: each time our server sends a chapter’s audio file to the App — the book number, the chapter’s file name, the time, and whether the complete file was sent. Deleted when the order ends, or at a later scheduled cleanup if that deletion fails.
• Order closing and hours decision: for an order that ends before the App has confirmed saving every chapter, a record that the order stopped accepting new transfers, with the time and the requested closing status, and the decision whether its hours are restored. Kept as long as the order’s receipt and deleted about one day after the receipt is deleted.
• Permission timestamps: the time our server first received each AI-provider permission or withdrawal sent by the App (Section 6.6), so that a repeated copy of an older answer cannot override a newer one. Kept until your data is deleted at your request.
• Daily limits: counters of orders and content reports per subscription identifier (for the first book on us, per app transaction identifier) and day (Terms of Use, Section 4.4). Deleted at scheduled cleanup once their UTC calendar date is more than two days old, normally about two to three days after creation.
• App Store notifications: identifiers of Apple’s server notifications that we have already processed. Kept for eight days.
• Extra-hours purchases: the link between an extra-hours transaction identifier and the subscription that received its hours, and any Apple refund of that purchase or reversal of such a refund, so that one purchase is credited only once. Kept as long as the hours balance (Section 6.4).
• Deletion safeguards: when an order is deleted at your request, a settlement record links its book number to the subscription identifier so that a late charge for deleted work can be corrected; it is deleted at scheduled cleanup about eight days after it is created. Separate records keep each order’s final status (book number, outcome, and time) and the time of your latest deletion request, linked to a fingerprint of the subscription identifier, so that deleted work cannot resume. These final-status and deletion-time records are kept while needed to stop deleted or cancelled work from resuming and to answer refund and dispute questions about the order, and at the latest until the order’s receipt is deleted, under the receipt-retention rule in Section 6.4 that applies to that order; we review them at least once a year and delete those no longer needed. Requests to delete them earlier are assessed under applicable law.
• Notification tokens: the push-notification token of each device on which you allowed notifications, whether it is a development or production token, whether that device’s App can receive the silent “book ready” signal, and the time the App last sent it, linked to the subscription identifier and, for a book on us, to the app transaction identifier (if you order a book on us and also have a subscription, the token may be linked to both, as two separate registrations). We stop using a token 8 days after the App last sent it (the App sends it again from time to time when you open the App, and when you place an order), and it is deleted at the next scheduled cleanup (normally within 15 minutes; a cleanup that fails is retried). We stop using it at once, and delete it at the next scheduled cleanup or sooner, when Apple reports it invalid, when our service receives the App’s request that follows your turning notifications off (the App sends it the next time it is open and repeats it until it succeeds; until then, iOS itself does not show Talefall notifications), or on a data-deletion request. When our service processes a request to disable notifications, it records a one-way fingerprint (hash) of the token and the server time of revocation, linked to the subscription or app transaction identifier. Each revocation record is kept for 8 days from that server time, plus scheduled cleanup. It prevents registrations whose server-side processing began no later than that revocation from reactivating the token; a data-deletion request deletes it at once. We may retain earlier registration records, including their server timestamps, for up to 8 days each, plus scheduled cleanup. A subscription-level index contains token fingerprints and references to registration records. It is refreshed on registration and removed at cleanup after 8 days without a new registration once its referenced records have been removed. A fulfilled data-deletion request removes this index. We also keep, per order, a technical record that a notification about it was attempted (book number, “ready” or “could not be finished” — and, for the silent signal, “ready, background” — and time; no token and no subscription or app transaction identifier), so the same notification is not sent twice; it is deleted after 8 days, plus scheduled cleanup.

6.3 AI providers, countries & retention

To write books, we send your idea, book settings, and the instructions, plans and draft text produced during generation to AI providers. We do not add account, device or subscription identifiers to these AI requests. Which providers may receive an order, and on what conditions, depends on the version of the AI-provider permission under which the order was placed (Section 6.6). The current version is 2026-10-14.1, described in Sections 6.3.1–6.3.4. Orders placed under the earlier versions 2026-10-08, 2026-10-10.2 and 2026-10-13.1 keep the promises of those versions unchanged (Section 6.3.5).

Current status. Orders under permission 2026-10-14.1 are written by the GPT-6.1 Sol model (gpt-6.1-sol, developed by OpenAI) in the OpenAI API, which we use directly under our own contract and data processing addendum with OpenAI (registry row “OpenAI OpCo, LLC — directly”). OpenAI is the only external AI model provider we use directly for orders under this permission. We do not route these orders through OpenRouter or another AI gateway. OpenAI may process content through its published affiliates and subprocessors under its DPA. Our hosting provider Modal also processes order content as described below. Orders under earlier permissions continue on the routes those permissions named, which go through OpenRouter (Section 6.3.5).

6.3.1 The permission screen (version 2026-10-14.1)

Updated versions of the App show this screen before your first book order, and before your next book order if you answered an earlier permission version.

Title: “Allow AI processing of your book orders?”

Text: “Send your ideas, settings and text to OpenAI to write your books? We use OpenAI’s API directly, under our contract and data processing agreement with OpenAI. OpenAI may use its published affiliates and subprocessors. No model training, no sale, no advertising. Only for the service, support, security, abuse prevention and law. OpenAI may keep requests up to 30 days to provide the service and detect abuse, longer only where the law requires or to protect against harm; no single maximum. Processing and authorized staff or contractor access may occur in several countries; we don’t choose China or other countries of concern under US law; OpenAI’s published information names none there but is incomplete. Fiction only: no real personal or health data. Withdraw in Settings.”

Under the heading “AI provider” the screen lists:

• OpenAI (OpenAI OpCo, LLC), directly

Link: “AI provider, countries & retention”, which opens this Section 6.3 and works before you decide. Buttons: “Allow AI Processing” and “Not Now”. Below the buttons: ““Not Now” sends no order content to OpenAI. The player and server-based narration remain available.”

In Settings, under the permission switch: “Your ideas, book settings and working text are sent to OpenAI to write your books. No model training. You can turn this permission off.”

The App records a cryptographic fingerprint (SHA-256) of the exact text you were shown together with your decision, and our server accepts an “allow” for this version only with the fingerprint of one of the published English, Russian or Spanish texts.

6.3.2 Conditions of this permission

Under permission 2026-10-14.1 we send order content only on these conditions, as documented in OpenAI’s published terms and documentation linked in the registry (Section 6.3.3) and in our settings described here:

1. One AI model provider, used directly. OpenAI OpCo, LLC (USA) is the only external AI model provider we use directly for orders under this permission, through the OpenAI API (https://api.openai.com/v1/chat/completions) from our own OpenAI organization, under OpenAI’s Data Processing Addendum, which we accepted on October 14, 2026. OpenAI processes the requests as our processor (service provider) under that addendum. We do not route these orders through OpenRouter or another AI gateway, and we do not send them to Microsoft, Amazon Web Services, GLM hosting providers or other AI providers as our own routes. OpenAI may process content through its published affiliates and subprocessors under its DPA, which may include infrastructure providers (registry, OpenAI row). Our hosting provider Modal also processes order content (registry, “Other recipients”).
2. No training, no sale, no advertising. Neither we nor OpenAI use your content to train or improve models: OpenAI states that data sent to its API is not used for training. In our OpenAI organization, sharing of inputs and outputs with OpenAI is disabled, and API call logging is disabled. Your content is not sold and is not used for advertising.
3. Purposes. The content is used only to provide the requested service (writing and delivering your book), for support, security, abuse prevention and legal compliance.
4. Retention. OpenAI may keep API inputs and outputs for up to 30 days to provide its services and identify abuse, and longer only where the law requires or where reasonably necessary to protect its services or others from harm; OpenAI publishes no maximum for such longer retention. Zero Data Retention is not enabled for our organization, so the settings in item 2 do not shorten this period. Every request is sent with store: false, so the Chat Completions API keeps no application state for it, and with prompt caching off (prompt_cache_options in mode explicit without cache points); our test requests to api.openai.com on October 14, 2026 read no cached tokens on a repeated request with these settings (2,615 cached tokens with the default settings). OpenAI deletes what it keeps under its own rules; we cannot verify or force that deletion (Section 6.4). Our own working copy is deleted as described in Section 6.4.
5. Countries. Processing, storage and access by authorized OpenAI staff or contractors may occur in several countries. OpenAI publishes its subprocessors and affiliates with their locations of processing: affiliates in the United States, Ireland, the United Kingdom and Japan; infrastructure in the United States, Canada, European countries, the United Kingdom, Switzerland, Japan, Singapore, South Korea, India, Indonesia, Malaysia, Australia, New Zealand, Brazil, Mexico, South Africa and the United Arab Emirates; content-moderation and support contractors in the United States, Canada and the Philippines; and Cloudflare, at the data center closest to the requester (for our requests, our service in the United States). We have not configured data residency. We do not choose a recipient or route in a country of concern under the US Department of Justice Data Security Program (28 CFR 202.601, as of October 2026: China, including Hong Kong and Macau; Cuba; Iran; North Korea; Russia; Venezuela), and none of the locations OpenAI publishes is in such a country. This is the result of checking published information, not a guarantee: OpenAI’s published information is not a complete list of processing locations. Not published: which of the listed infrastructure locations processes a given request, and where individual OpenAI reviewers work. We rely on OpenAI’s published documents; for processing OpenAI carries out contrary to them, we are responsible within the limits of our selection and supervision of OpenAI and of the obligations that applicable law imposes on us, which this Policy does not limit. Privacy laws and government access rules differ between countries.
6. Limited human access. OpenAI may run automated checks. Authorized OpenAI employees may access content for support, to investigate abuse and to comply with law; specialized contractors only to review for abuse and misuse, under confidentiality obligations (registry, OpenAI row). “Not published” never means “none” or “United States only”.

Changes within these conditions. The OpenAI model used may change within these conditions without asking you again; before such a change we update the registry in Section 6.3.3, including its verification date. Before sending content of orders under this permission to an AI provider other than OpenAI as our own route, or through OpenRouter or another AI gateway, or broadening the purposes, human access or retention beyond these conditions, we update this Policy, notify you in the App and obtain renewed permission; updating this Policy alone does not broaden a permission you gave. Changes to OpenAI’s terms do not automatically expand your permission: we reassess the route, and before any use outside the safeguards disclosed here we ask for a new permission.

If no route qualifies. If the OpenAI API cannot be used on these conditions, we do not accept a book order under this permission: the App says that book writing is temporarily unavailable, no hours are used, and the order is not sent to any other recipient instead. Each accepted order records its route; before every request to OpenAI our server checks that your current decision still covers it. If the route is closed or you withdraw the permission, the order is stopped and its hours are restored (Terms of Use, Section 4.2). Withdrawal does not itself erase copies already lawfully kept by OpenAI under item 4; you may request deletion of our records as described in Section 10.

This permission is not consent to process consumer health data or other sensitive personal data (Section 6.6).

6.3.3 Recipients registry

Verified against the providers’ official documents on October 13–14, 2026. The entity, contract, settings and terms of OpenAI, the only external AI model provider we use directly under permission 2026-10-14.1 (it may process content through its published affiliates and subprocessors), were checked on October 14, 2026. Every other row applies only to orders placed under earlier permissions, or to no permission, as stated in that row. “Not published” means that we found no published statement; it is not a statement that the practice does not exist.

Other recipients (not AI providers):

6.3.4 Which recipients each permission version uses

6.3.5 Earlier permissions (2026-10-08, 2026-10-10.2 and 2026-10-13.1)

Orders placed under an earlier permission are processed only as that permission promised. This edition does not broaden them, and the conditions in Section 6.3.2 do not apply to them. Updated versions of the App ask everyone who answered an earlier permission to answer the current screen before their next book order; older versions continue using the routes described below.

Permission 2026-10-08 (App version 1.3) named OpenRouter and the GLM hosting providers. Orders under it are sent only to the GLM model through OpenRouter, restricted to the hosting providers listed in the registry above, which OpenRouter lists as headquartered in the United States and as zero data retention.

Permission 2026-10-10.2 (earlier test versions of the App). Its screen read:

Title: “Allow AI processing of your book orders?”

Text: “I allow Talefall to send my ideas, book settings and working text to Amazon Web Services (Amazon Bedrock, US regions) or through OpenRouter to AI hosts, including Microsoft Azure, to write my books. OpenRouter uses US-headquartered hosts; US-only processing is not guaranteed. Providers commit not to train on this content. OpenRouter uses zero-retention routes; AWS may retain content flagged for abuse for up to 30 days. Models and recipients: Privacy Policy. Permission covers future orders until withdrawn in Settings.”

Buttons: “Allow and Continue” and “Not Now”. Link: “Privacy Policy · AI providers”. Below the buttons: ““Not Now” sends no order content to these AI providers. The player and server-based narration remain available.”

Under this permission, OpenRouter routes are restricted to approved endpoints with zero data retention and no training on request or response content, operated by providers listed by OpenRouter as headquartered in the United States. This does not guarantee processing exclusively in the United States. Bedrock inference would be restricted to AWS Regions in the United States. What zero data retention means: the provider processes the request and returns the answer without saving the request or the answer afterwards; it does not cover limited operational metadata or brief in-memory processing. Zero data retention is OpenRouter’s classification and the providers’ commitment, not a guarantee from us. The routes are:

• GLM route — currently used for all orders under this permission: the GLM-5.3 model, developed by Z.ai, reached through OpenRouter using the model identifier z-ai/glm-5.3, with requests restricted to the hosting providers listed in the registry above. Within this route, requests for the same order may be processed by different listed hosting providers.
• Azure route — currently switched off for this permission: the GPT-6 Luna model, developed by OpenAI, run by Microsoft Azure and reached through OpenRouter (openai/gpt-6-luna), restricted to the single endpoint azure/us (only: ["azure/us"], allow_fallbacks: false, zdr: true, data_collection: deny). For this permission we would switch it on only while OpenRouter classifies this endpoint as zero data retention: while it is switched on, our server regularly checks OpenRouter’s public list of zero-data-retention endpoints (openrouter.ai/api/v1/endpoints/zdr), which must include this model on azure/us, list the endpoint as available, and list Azure as headquartered in the United States. If the latest check is negative, could not be completed, or is more than 24 hours old, the route is closed for this permission: new orders use the GLM route, and orders already assigned to the Azure route that are still being written are stopped and their hours restored. We have not independently verified which abuse-monitoring mode Microsoft applies to this endpoint (see the Microsoft row above) and do not state that storage of flagged content or its review by Microsoft employees is excluded.
• Amazon Bedrock — not enabled. No order is sent to Amazon Web Services. We would enable it for this permission only in AWS Regions in the United States, only for models whose AWS terms meet the conditions above (no training, no sharing with the model provider, no content retention by default, retention of flagged content for no more than 30 days, and no additional provider human review), and only after updating this registry and our data-protection assessment (Consumer Health Data Privacy Policy, A9).

Each order keeps the route assigned when it was accepted; it is not switched between the Azure and GLM routes while being written.

Permission 2026-10-13.1 (test versions of the App, October 13–14, 2026). Under it, orders are written by GPT-6 Luna and, since October 14, 2026, by GPT-6.1 Sol on the same Microsoft Azure endpoint (Microsoft row); OpenAI and the Sol routes through OpenAI and Amazon Bedrock are not used under it. Its screen read:

Title: “Allow AI processing of your book orders?”

Text: “Send your ideas, settings and text to the AI providers below to write your books? No model training. Providers may perform service operations, including OpenRouter’s anonymous topic classification for reporting and model rankings. Processing and authorized staff access may occur outside the US. Providers may cache content or retain it for abuse prevention, security or legal requirements; some maximum periods and reviewer countries are not published. Provider safeguards and exceptions are in the Privacy Policy. Fiction only, 18+: no real personal or health data. Withdraw in Settings.”

Under the heading “AI providers” the screen lists:

• OpenRouter and the model providers it routes to
• Amazon Web Services (Amazon Bedrock)
• Microsoft (Azure)
• Google (Google Cloud, Vertex AI)
• Anthropic
• OpenAI

Link: “AI providers, countries & retention”, which opens this Section 6.3 and works before you decide. Buttons: “Allow AI Processing” and “Not Now”. Below the buttons: ““Not Now” sends no order content to AI providers. The player and server-based narration remain available.”

In Settings, under the permission switch: “Your ideas, book settings and working text are sent to the AI providers listed in the Privacy Policy to write your books. No model training. You can turn this permission off.”

Under this permission, routes had to meet these conditions (they are unchanged for orders placed under it):

Under permission 2026-10-13.1 we send order content only through a route whose provider terms and documentation, as published and linked in the registry (the registry in Section 6.3.3), meet all of these conditions:

1. Purposes and no training. The content is used only to write the book you ordered and for the providers’ operation of their services — including OpenRouter’s anonymous topic classification for reporting and model rankings (registry, OpenRouter row) — for security, for abuse prevention, and to comply with law. Neither we nor the recipients use it to train models; every route requires a documented no-training commitment. Training and data-sharing options available to us are off (for OpenRouter: data_collection: deny, optional prompt logging off, and OpenRouter’s use of inputs and outputs off).
2. Caching and retention only for these purposes. Providers may cache content, or retain it for abuse prevention, security or legal requirements; no other retention is allowed. Every retention and caching limit that a provider publishes applies. Where a provider publishes no maximum period — for technical caching or for content flagged for abuse review — the registry says so.
3. Automated checks and limited human access. Providers may run automated checks. Authorized provider staff may access content to investigate suspected abuse, provide necessary technical support, or comply with law. OpenRouter also permits access by personnel performing its routing service in accordance with its agreement, limited to the service purposes described in item 1. Each recipient’s documented access restrictions are listed in the registry in Section 6.3.3.
4. Countries. Processing, storage and access by authorized provider staff may occur outside the United States. For each recipient the registry lists the countries the provider publishes, and says “not published” where it publishes none.
5. Recipients. Only the recipients named on the permission screen. We check the whole chain of recipients of each route, including OpenRouter and every provider it routes to.
6. How a route is assessed. We assess each route against the provider terms and documentation linked in the registry. An unpublished location of human reviewers, or an unpublished maximum period for technical caching or for retention of flagged content, does not disqualify a route if the registry expressly discloses that uncertainty and this permission covers it; the registry names the source of each such exception. “Not published” never means “none” or “United States only”. The other conditions always apply: a documented no-training commitment; only the purposes in item 1; every published retention limit; the recipient chain; and the scope of human access in item 3.

Changes within these conditions. Providers and models may change within these conditions without asking you again. Before such a change we update the registry in Section 6.3.3, including its verification date. Broadening the purposes, human access or retention beyond these conditions requires a new permission version and your renewed explicit permission; updating this Policy alone does not broaden a permission you gave. Changes to a provider’s terms do not automatically expand your permission: we reassess the route against these conditions, and before any use outside the safeguards disclosed here we ask for a new permission.

If no route qualifies. If no route that meets these conditions is open, we do not accept a book order under this permission: the App says that book writing is temporarily unavailable, no hours are used, and the order is not sent to any other recipient instead. Each accepted order records its route; before and during writing our server checks that your current decision still covers it. If the route is closed or you withdraw the permission, the order is stopped and its hours are restored (Terms of Use, Section 4.2).

This permission is not consent to process consumer health data or other sensitive personal data (Section 6.6).

OpenRouter’s anonymous topic classification. From the publication of this edition we disclose this classification for every permission version. The anonymous topic classification described in the OpenRouter row of the registry is part of how OpenRouter operates its routing service and applies to requests through OpenRouter, that is, to requests under these earlier permissions; the screens of 2026-10-08 and 2026-10-10.2 did not mention it. Orders under the current permission 2026-10-14.1 do not go through OpenRouter, and this classification does not apply to them. It is not model training: OpenRouter states that it classifies a small anonymous sample of prompts with a zero-data-retention model, keeps only the anonymous category for its reporting and model rankings, does not store the text and does not link it to any account, provided that OpenRouter’s use of inputs and outputs is off, as it is for our account. We disclose it here so that you can decide: you can withdraw the permission at any time in Settings, which stops further AI calls and restores the hours of unfinished orders (Terms of Use, Section 4.2); and updated versions of the App ask you to answer the current screen before your next book order, after which your new orders go to OpenAI directly, not through OpenRouter. This disclosure describes OpenRouter’s practice. It does not itself authorize topic classification under an earlier permission or broaden that permission.

6.3.6 Contracts, sharing, and human access

Contracts and sensitive data. For orders under permission 2026-10-14.1 we have a direct contract with OpenAI: our own OpenAI organization and OpenAI’s Data Processing Addendum, accepted on October 14, 2026, under which OpenAI is our processor (service provider). OpenAI acts as our processor for Customer Data covered by our DPA, including sensitive data unexpectedly included in unstructured text. This contractual protection does not itself authorize collection or disclosure under consumer health data laws. We prohibit such submissions and apply the prevention and deletion procedures in Sections 6.4 and 6.5 and in the Consumer Health Data Privacy Policy (A3 and A5). For orders under earlier permissions, our agreement with OpenRouter is its standard data processing addendum, which excludes sensitive data; Microsoft and the GLM hosting providers process those requests as OpenRouter’s providers, and we have no contract of our own with them. For Amazon Bedrock used directly (not enabled today), our agreement with Amazon Web Services is its standard customer agreement with the AWS Data Processing Addendum. We do not route orders to Google or Anthropic as AI model providers. Google may process content as an OpenAI subprocessor. For those earlier routes we do not rely on any of these, or on any other provider contract, to authorize the processing of sensitive data. We therefore prohibit sending personal or sensitive data in requests and filter for it (Section 6.5); we do not claim any contractual protection for sensitive data that we do not have. Narration and moderation run on our own models at Modal.

We never use your requests or books to train models, never sell them, and share them with no one other than the recipients above, except as required by law (for example, a valid court order or a mandatory report) or in a merger or sale of the business, subject to applicable law. Where the law allows, we will tell you about a legal demand for your data.

Human access at OWN PLACE LLC. Nobody at OWN PLACE LLC routinely reads requests or books. Specific content may be reviewed when you contact support, report content, or submit a legal complaint, or when reasonably necessary to investigate abuse or a security incident or to comply with law. Human access by providers’ staff is described in the registry above.

6.4 Retention and deletion of our working copy

• Working content (idea or narration text, generated chapters, title, audio) is held only while the order is produced and delivered.
• AI-provider request identifiers (no text) are kept for 30 days after the order’s delivery or end, so that a deletion request can be passed on to the recipients, and then deleted.
• Deletion after the App saves the book. We delete our server copy of the text and audio immediately after the App confirms that it has saved every chapter on your device. We cannot restore or re-deliver the book after that. The App’s saved confirmation triggers deletion, but it is not the only way a chapter can count as delivered for restoring hours: under the delivery rule in the Terms of Use (Section 4.2), a chapter also counts as delivered when our server has sent its complete audio file in response to a request made with the subscription that placed the order.
• If the App has not confirmed saving every chapter within seven days after the Service accepted the order, the order expires: at the next scheduled cleanup, normally within 15 minutes, we delete all order content from our working storage; a cleanup that fails is retried. If any chapter was not delivered, all hours reserved or charged for the order are restored; if every chapter was delivered, expiry restores no hours.
• Subscription expiry and existing orders. A book ordered and paid for with hours while your subscription was active remains available for delivery after the subscription expires, provided the subscription has not been refunded or revoked. You can still view the order list, download the book, confirm delivery, and delete or cancel the order using the same subscription. Expiry alone does not cancel the order or restore its hours. New orders and new requests that use hours require an active subscription. The existing seven-day delivery deadline and the rules for deletion and restoration of hours continue to apply; expiry does not restart that deadline. Since App version 1.3.2, listening and reading in the App require no purchase.
• Deleting or cancelling a book in the App sends a delete request to the service (retried later if you are offline); a running order is stopped. Its hours are restored if any chapter was not delivered (Terms of Use, Section 4.2).
• Receipts, permission records, and the hours balance (Sections 6.2 and 6.6) are kept for seven years after the last related financial event, because they document paid work and charges, then deleted or irreversibly aggregated. They contain no book content. Receipts of the first book on us, which involves no payment, and its permission records are keyed by the app transaction identifier. We keep them to document delivery and the permission applied to the order and to resolve related disputes, for seven years after the order ends (a permission record not followed by an accepted order: seven years after the recorded decision), and delete them at our next annual retention review after that period, unless a lawful exception such as an open dispute or a legal hold applies. Earlier deletion requests are handled under Section 10.
• First book on us records (Section 6.1A; no content and no identifier in readable form, but linkable to you through the keyed hash or book number):
  • the keyed-hash records that the gift was given or given back, the links from book numbers to them, per-book gift cost totals (book number, cost, date), and the record that a day’s gift budget was used up are kept while we offer the first book on us: the gift-grant and return records and their links prevent repeat claims, and the cost totals and budget-stop records support gift-budget control and reconciliation. After the offer ends we delete them within 12 months, except records of a gift book still being produced or delivered. We review the continued need for each of these categories at least once a year and delete records no longer needed earlier;
  • screening slots (keyed hash, UTC day, time) and the detailed daily budget and processing records (book numbers, amounts, stages, times) are not kept current by us and are removed automatically by our storage about seven days after they were last read or written; a daily budget journal is kept current for its first ten days, so it is normally removed about seventeen days after its day.
• Service operation records (Section 6.2) are kept for the periods stated there.
• Content reports are kept for 12 months after submission, separately from books. Blocks of a subscription, with the reason category and related book number, are kept while the block lasts and for 12 months after it ends.
• Materials preserved for a report under 18 U.S.C. § 2258A are kept one year after submission, or longer where the law requires, under a legal hold.
• Deletion-request records (date, a keyed hash of the transaction identifier, and what was deleted; no content) are kept for two years as evidence that we complied.
• Copies kept by service providers. Modal may keep function inputs and outputs for up to seven days under its infrastructure retention policy. For orders under earlier permissions, OpenRouter keeps request metadata without content (for example, model, token counts, cost and latency) for our account. We add no identifier of you to AI requests. While we keep the provider request identifiers (30 days, above), they let us match that metadata to an order; after they are deleted we no longer hold a direct link from it to you, although dates, receipts or the provider’s own records might still allow a match. For this metadata OpenRouter publishes no fixed period; OpenRouter keeps personal information as long as reasonably necessary for its business purposes and its legal, regulatory and accounting obligations, and then deletes or de-identifies it (OpenRouter Privacy Policy, Section 7). It uses the metadata for reporting, billing, security and legal compliance. The AI provider that processed an order may keep content only as stated for it in the registry in Section 6.3.3 — for example, OpenAI (directly, for orders under 2026-10-14.1) up to 30 days, and longer only where the law requires or to protect against harm, with no published maximum; for earlier permissions, Microsoft content flagged by abuse monitoring. Providers delete these copies under their own rules, subject to the requirements and deadlines of applicable law; we cannot access them directly and cannot verify their deletion. While an order is active, a deletion request cancels it.

How we ask recipients to delete. We keep the request identifiers of AI providers for each order (for orders under 2026-10-14.1, OpenAI’s chatcmpl-… identifiers; for earlier permissions, OpenRouter’s generation identifiers; no text and no subscription identifier) for 30 days after the order’s delivery or end, then delete them. When you ask us to delete your data, or we learn that an order contains consumer health data, we first record — before we delete the order — a deletion request for each recipient that received it: the recipient, the route, the dates of the order and any request identifiers we still hold, without content and without your subscription identifier. For an order under permission 2026-10-14.1 we send it directly to OpenAI, our processor under its data processing addendum, through OpenAI’s published privacy request or support channel, with the request identifiers and the time window, asking it to delete what it holds. We also request deletion from our hosting provider and ask OpenAI to propagate the request to relevant subprocessors. For an order under an earlier permission we send it by email to OpenRouter’s privacy address, asking it to delete what it holds, including any result of its topic classification that can still be linked to the request, and to pass the request on to the model provider on the route (Microsoft or a GLM hosting provider); we also send it directly to that model provider through its published privacy request channel, and to any other recipient we have a contract with. If a recipient does not acknowledge the request within ten days, we send it again and record that. If the identifiers have already been deleted, we send the request with our account, the route and the time window, which the recipient can use to look for remaining data; we cannot guarantee that it will find it. A request is not treated as handled because time passes: it stays open until we have sent it, and our systems flag any request not sent within three days. Identifiers in an open request are deleted after 30 days; the request itself stays open. After sending, we keep a record of the recipient, the date and the outcome — without identifiers or content — for two years as evidence that we complied. Recipients delete under applicable law, including the deadlines of the Washington and Nevada consumer health data laws where they apply, and otherwise under their own terms. We do not receive proof of deletion and cannot guarantee it.

• For Washington consumer health data, backup copies held by a processor are deleted no later than six months after an authenticated request.

Your own copy. The copy on your device and in your private iCloud storage is yours; we cannot access it, and a deletion request to us does not delete it. Deleting a book in the App offers to remove both. If iCloud is unavailable or full, use Export to Files before deleting the App.

6.5 Safety controls

The AI model has no access to your library or device; it sees only your idea and what it generated for that order.

• Input check for personal and sensitive data in book ideas (on our server, before anything is sent to an AI provider; English, Russian, and Spanish): email addresses, phone numbers, U.S. Social Security numbers, payment-card numbers, IBANs, passwords and API keys, and statements about your own or a named close person’s health, sexual orientation, gender identity, or criminal record. A match is refused, nothing is sent on, no hours are used, and the App asks you to rewrite the request. In versions of the App using permission 2026-10-14.1, text you send for narration in the Talefall voice is checked by the same filter before it is narrated; in earlier versions it is not scanned. In every version your per-book confirmation and the rule apply to it.
• Input check for prohibited content (book ideas, narration text, and passages): clear requests for sexual content involving minors, weapons of mass destruction, or encouragement of suicide are refused the same way.
• Output moderation: every generated chapter is checked before narration and delivery by an open-source safety classifier model running in our own container on Modal, for sexual content (especially involving minors), hate, dangerous instructions, and personal data about real people. A failing chapter is not narrated or delivered; the order is stopped and its hours restored.
• Our logs record only the category of a refusal or moderation decision, never the text. These checks are not used to infer anyone’s health or other characteristics, and they create no profile of you.
• These controls are pattern- and model-based and imperfect; they do not recognize every real person, and the rule applies equally to anything they miss.
• Reports and blocks. Reports (Section 5) are reviewed promptly. We may block a subscription for serious or repeated violations; a blocked subscriber may ask for review by email. Details and the appeal process are in the AI Safety and Content Policy.

6.6 Screens before using the Service, and what we record

1. “Before You Create” (once, before the first book order or narration in the Talefall voice; the App does not send either until you accept): “Creating books from ideas and narrating your text on our service are covered by the Terms of Use and the Privacy Policy. These features are for adults only.” with the switch “I’m 18 or older and agree to the Terms of Use and Privacy Policy” and the button “Continue.” This is a self-declaration of age, not age verification. The App stores the Terms version (currently 2026-10-14.1, the edition of October 14, 2026), the time, and your statement on your device; it is not sent to our server. Updated versions of the App ask you to accept this edition before your next use of the Service. Older versions that hold the acceptance of an earlier edition (October 8, October 12 or October 13, 2026) and an earlier permission send book orders only on the routes that permission named (Section 6.3.5); this edition does not change them.

2. AI-provider permission (before the first book order; again when the permission is renewed as described below). The full text of the screen — title, text, list of AI providers, link, buttons, the line below the buttons, and the Settings footer — is quoted in Section 6.3.1.

   This permission applies to future book orders until withdrawn. Models may change within the conditions of the permission you gave (for 2026-10-14.1, Section 6.3.2; the recipient, OpenAI, does not change) without renewed permission. Before such a change, we update the registry in Section 6.3.3. We notify you in the App before materially changing processing. Before sending content to a recipient not named on the screen, or broadening the purposes, human access, retention or any geography a permission limits, we explain the change and obtain renewed explicit permission. Updating this Policy alone does not expand an earlier permission, and changes to a provider’s terms do not automatically expand your permission (Section 6.3.2).

   We record your decision, permission version, time and, for version 2026-10-14.1, the fingerprint of the exact text shown, linked to your original subscription transaction identifier (for the first book on us, your app transaction identifier; Section 6.1A), and retain a versioned record of the disclosure to which you agreed. Withdrawal in Settings blocks further transfers under this permission, including further AI calls for pending orders. It does not undo completed processing; deletion rights and retention are addressed separately.

   This permission is not consent to process consumer health data or other sensitive personal data. The restrictions and safeguards in Section 6.5 and the Consumer Health Data Privacy Policy continue to apply.

   The current permission version is 2026-10-14.1. Our server keeps your latest decision (allowed or withdrawn) and refuses book orders without a valid permission. Permissions of the earlier versions 2026-10-08, 2026-10-10.2 and 2026-10-13.1 are used only for the routes those versions named (Section 6.3.5). Updated versions of the App ask again with the current text before your next book order; until then, older versions use only those earlier routes. Narration does not need this permission because the text is not sent to these providers.

3. Before every book order: the switch “My idea contains no personal data about real people”; it covers the exact text, so editing the idea requires confirming again. Recorded in the receipt as described in 6.2.

4. Narration in the Talefall voice: For a book created from your idea, the App reuses the confirmation given when you placed that order for narration of the resulting book; it does not ask you to confirm again. For another book without that confirmation, before its first narration in the Talefall voice you confirm “This text has no real person’s information.” With the on-device Apple voice, the text never leaves your device. A separate narration confirmation stays in the App and is not recorded by our server. The book-order confirmation is recorded in the order receipt as described in Section 6.2.

None of these screens asks for, and no tap is treated as, consent to process health or other sensitive data. Neither a confirmation nor the fact that a request passed our filters authorizes processing such data. If it reaches us despite the rule, that is a residual risk we work to prevent, not a service we offer: it may be processed automatically before anyone notices, but we rely on a “requested service” exception only where the applicable law allows it and the processing is necessary and proportionate, and never because one person submitted another person’s data. When we learn that an order contains such data, we stop any further processing, delete the copies we control (unless the law requires us to preserve them), restore all hours for the order if any chapter was not delivered under Section 4.2 of the Terms of Use, and notify every AI recipient that may have received it to delete it — for an order under 2026-10-14.1, OpenAI directly; for an order under an earlier permission, OpenRouter, which we ask to pass the request on to the model provider that processed the order (such as Microsoft or a GLM hosting provider); and any other recipient listed in Section 6.3.3 that received it — giving the dates and any identifiers we still hold (Section 6.4). We do this also after delivery. We may refuse further orders. See the Consumer Health Data Privacy Policy.

6.7 Territory and sanctions check

The Service is offered only in the Supported Territories (Terms of Use, Section 4.9). For each Service request our server derives the country from the request’s IP address and refuses requests from outside the Supported Territories, from countries and regions subject to comprehensive U.S. sanctions or otherwise excluded (including the Crimea, so-called Donetsk People’s Republic, so-called Luhansk People’s Republic, Kherson, and Zaporizhzhia regions of Ukraine), and when the country cannot be determined. Privacy requests, permission withdrawals, and content reports are not blocked by this check. We record the country code and the decision in our logs, not the IP address; the IP address is used only for this check. We do not derive the U.S. state, do not collect precise location, and do not use location to infer visits to any place. This check is a territorial control and does not by itself establish eligibility under sanctions law.

7. Purchases and What We Receive from Apple

All payments are processed by Apple. We never receive your card details, billing address, or Apple Account credentials. Apple gives us aggregated sales reports.

• One-time player purchase: App version 1.3.2 no longer offers it; the player needs no purchase. If you bought it earlier, the App checks it on the device with StoreKit; nothing about it is sent to our server.
• Extra hours: App version 1.3.2 no longer offers new extra-hours purchases. If an earlier extra-hours purchase has not yet been credited, the App still sends its signed transaction to our server so that its hours are credited once.
• First book on us: involves no payment; Section 6.1A describes the Apple-signed record of your download that the App sends for it.
• Talefall Subscription and extra hours: in addition to the signed transaction (Section 6.1), Apple’s App Store Server Notifications tell our server when a subscription renews, expires, or is refunded or revoked. We store the original transaction identifier, the event type, and the dates, to open each month’s hours and to stop accepting a refunded or revoked subscription. For an extra-hours purchase our server verifies the signed transaction and stores its identifier so it is credited only once.

8. Usage Counters (optional, off unless you allow them)

On first launch (and, after an update, if you have not answered yet) the App asks whether it may send a few anonymous counters, with two choices, “Not Now” and “Allow”. Until you allow them, nothing is sent; an unanswered question counts as no; and you can change your answer in Settings. While the question is still open, the App may keep the current session’s events in memory only: if you allow counters, they are sent; if you decline, they are discarded; and they are lost when the App closes. To label counters if you allow them, the App stores on the device, whatever you answer, the bookkeeping described in Section 4; it stays on the device unless you allow counters.

If you allow it, the App sends step names (for example: the App opened, the library was shown or was empty, the first choice made on the My Books page — a suggested classic, your own file, or an AI book — the first sound played, playback started, an import succeeded or failed), the seconds since launch, the file type of an imported file (its extension only, such as “mp3”; never the file name), the App version, your device language, the distribution channel (App Store, TestFlight, or debug), and a random number that groups one session’s counters and is not stored. The counters never contain book titles, text, file names, or any identifier of you or your device.

With the same permission, the App also sends separate milestone counters, normally once per installation: first launch, enabling counters, opening the bundled sample, importing a book, and starting playback (these five for new installations only), opening the AI order or a subscription purchase screen, viewing and answering the AI-provider permission screen, an accepted book order, and receiving a book. For installations first launched with version 1.3.2 or later, also: a useful first action (first sound, an import, or opening the AI order) within 60 seconds of the first launch, or leaving the first session without one; 5 minutes of listening in total; and opening the App again on days 2 to 7 after the first launch (by the phone’s calendar). Each milestone request contains only its step name, the App build number, the distribution channel (App Store, TestFlight, or debug), the primary App-interface language without a country, for installations first launched with version 1.3.2 or later the App build and the calendar week (ISO week, UTC, for example “2026-W44”) of the first launch, and a random number generated for that one milestone so that a retried request is normally not counted twice. For these installations the distribution channel is the one recorded at the first launch, which may differ from the current one after the App is reinstalled from another channel. Our server adds the UTC date of receipt. It contains no elapsed time, exact first-launch time, session number, installation identifier, subscription or app transaction identifier, or book identifier. The build and week of the first launch are the same for every installation first launched with that build in that week; they group installations and are not an identifier of you. The per-milestone random number does not provide a common identifier across different milestones. We do not use the counters to identify you or combine them with subscription or order records. After about two days, the individual milestone records, with their random numbers, are combined into daily totals. These are approximate counts: a retried request is normally recognized and counted once, but may occasionally be counted twice.

Our server accepts only the fields described in this section. Usage counters are deleted by a scheduled cleanup after 90 days; cleanup runs every 15 minutes, and a deletion that fails is retried at the next run. No usage counters are sent before you allow them; before you answer, the current session’s events are held only in memory, as described above. Declining or withdrawing permission clears queued events and stops collection of new events. We do not send a counter recording refusal of usage counters. Requests already sent cannot be recalled. Counter requests also carry the App’s shared service token, which is the same across installations. Modal processes the counters on our behalf; we do not use them for tracking.

9. Server Logs

Our service on Modal writes technical logs: request paths with book numbers, status codes, times, the original transaction identifier (for the first book on us, the app transaction identifier) on hours and order events, character and duration counts, refusal and moderation categories, and the country code from the territory check, and the result of notification sends, including the silent “book ready” signal (book number, kind, counts, and Apple’s response code — no device token). Our application does not write the IP address or any request or book text to these logs. Modal’s infrastructure processes IP addresses to route and secure traffic under its own policies. Our application logs are kept for about one day.

For troubleshooting, reliability, and security, we also keep daily aggregate counts, without user identifiers or content, for 30 days: on Modal, daily counts of refused requests by reason; and on an access-restricted Mac controlled by OWN PLACE LLC, daily counts of service requests (by method, route pattern, and status code), outcomes, refusal-event categories, and errors. To produce the Mac counts, a program on that Mac reads our application logs from Modal and saves only the counts, not the log lines. The Mac also keeps processing checkpoints, including second-level coverage times and boundary counts, pending aggregate totals, and collector-run summaries and error codes. These contain no user identifiers or book content and are overwritten or removed under the same 30-day cleanup policy. Local deletion runs at the next scheduled cleanup, normally every six hours, and resumes when the Mac is available. Counts may distinguish the controller’s own tests from other activity.

10. Your Choices, Rights, and How to Make a Request

• Use the player only. If you do not use the Service and do not allow counters, no library content is sent to us. Cover lookup and the counters are off unless you turn them on in Settings. To stop the automatic requests for classics shelf covers to the Internet Archive, hide the shelf on the My Books page; Settings → “Show classics picks” brings it back.
• Delete a book. Deleting a book in the App deletes our server copy if one still exists and stops a running order; its hours are restored if any chapter was not delivered (Terms of Use, Section 4.2).
• Withdraw the AI-provider permission in Settings. Further transfers to the AI providers stop, including further AI calls for orders still in progress, and new book orders stop until you allow it again; processing already done is not undone.
• Turn off “book ready” notifications in iOS Settings → Notifications → Talefall. The next time the App is open, it asks our service to delete the token (Section 6.2).
• Make a privacy request — access, a copy, correction, deletion, or a request that we stop collecting, sharing, or selling your consumer health data: email contact@ownplace.net with the subject “Talefall: privacy request”. In App versions 1.3 and later, Settings → Privacy → “Request data deletion” requests deletion directly from our service after you confirm, and offers an email fallback (subject “Talefall: data deletion request”, with your subscription’s original transaction identifier and, from version 1.3.2, the app transaction identifier, if the App can find them) if your subscription cannot be identified or the request fails. From version 1.3.2 the direct request also carries the Apple-signed record of your download, so that data kept for the first book on us (Section 6.1A) is deleted too. If the App shows “Almost done”, tap “Request data deletion” again in a few minutes to finish. Include that identifier if you have it; it helps us find your records. The identifier alone is not proof of authority, so before disclosing or deleting data we may ask for proof proportionate to the request, such as an Apple receipt for the subscription. People who do not use Talefall may also make requests; we verify them by an appropriate alternative method.
• What deletion covers. We delete any remaining order content, receipts, permission records, reports linked to you, order key records, notification tokens, registration and revocation records and the notification index — under the subscription identifier and, for a request that carries the record of your download, under the app transaction identifier — and other records eligible for deletion (per-order notification-attempt records contain the book number, notification kind and time, but no push token or subscription identifier in the record itself; they may remain linkable to your subscription through retained order or hours records; they are normally deleted eight days after the attempt at scheduled cleanup; applicable deletion rights also apply to these records), and notify every recipient that received the data (processors, contractors, and other third parties: for orders under 2026-10-14.1, OpenAI directly; for orders under earlier permissions, OpenRouter, which we ask to pass the request on to the model provider that processed the order, such as Microsoft or a GLM hosting provider; and any other recipient listed in Section 6.3.3 that received it) to delete it, also after delivery, giving the dates and the request identifiers we still hold (kept 30 days after delivery; Section 6.4). We cannot access directly copies that providers keep (Section 6.3.3), cannot verify their deletion, and providers delete them under their own rules, subject to applicable law (Section 6.4). A deletion request does not automatically remove the hours ledger and financial transaction records, subscription-status records, block records, or the service operation and deletion-safeguard records described in Section 6.2, except as stated there. We also retain the deletion-request record described in Section 6.4, and the first book on us records described in Sections 6.1A and 6.4 (keyed hashes, book numbers, amounts and times; no content and no identifier in readable form, but linkable to you through the keyed hash or book number), because without them the gift could be claimed again or the cost of books in progress could not be settled; they are deleted on the schedule in Section 6.4. Requests to delete retained records are assessed under applicable law; retaining a record for operational purposes does not mean that the law requires us to keep it. Deletion does not forfeit unused purchased extra hours without your confirmation. Where Nevada law (NRS 603A.515) applies, we delete covered data within 30 days after authentication and notify recipients.
• Access and correction. We provide a copy of what still exists and the list of recipients that received order content. Once our working copy of the order has been deleted as described in Section 6.4, we cannot provide or correct content we no longer hold.
• Authorized agents may act for you with your written permission.
• Cancel the subscription in iOS Settings → Apple Account → Subscriptions. Cancelling does not by itself delete records; make a request for that.

Timing. We respond without undue delay and within 45 days of receiving your request; verification does not restart this period. We may extend it once by 45 days where the law allows, telling you why within the first period. Shorter legal deadlines apply where they exist. Appeals: if we decline a request, reply to our answer within 45 days; we answer the appeal in writing within 45 days and, where the law provides, tell you how to contact your state’s Attorney General. We will not discriminate against you for exercising your rights. If you ask us to stop processing your data for the Service, we cannot write or narrate new books for your subscription while that request is in effect; your player and the books on your device are not affected.

11. Children and Age

The App is rated 18+ on the App Store, and the Service is for adults only. Before first using the Service you state that you are 18 or older; we do not verify age. The App is not directed to children, and we do not knowingly collect personal information from children under 13. If we learn that we have, we delete it. Parents may contact contact@ownplace.net.

12. California (CCPA/CPRA)

To the extent the CCPA applies to us, California residents have the rights to know/access, delete, and correct personal information and to non-discrimination; we honor these requests even where the law may not require it. We do not sell or “share” personal information, do not use it for cross-context behavioral advertising, and do not use sensitive personal information for purposes that would require a right to limit. In the past 12 months we collected: identifiers (the original transaction identifier; the app transaction identifier received for the requests described in Section 6.1A, including checking the gift offer before an order is placed, and its keyed hashes used for gift eligibility and abuse prevention; and the push-notification token if you allowed notifications); approximate geolocation (the country derived from the IP address of a Service request, Section 6.7); commercial information (subscription status, hours, and whether the first book on us was given or given back, with its cost records); user-generated content (book ideas and narration text, held temporarily, and content reports); limited internet activity (optional anonymous counters); and contact details and correspondence if you wrote to us. We do not solicit sensitive personal information; if submitted contrary to our rules, text or reports may contain information about a real person’s health or other sensitive characteristics, and Sections 6.4–6.6 and the Consumer Health Data Privacy Policy explain how we handle it. The purposes, recipients and retention periods for each category are in Sections 5–9 and 17; we disclose personal information only to the recipients in Sections 5 and 6.3. Make requests as described in Section 10; we acknowledge them within 10 business days.

13. Washington, Nevada, Connecticut, and Other U.S. States; Consumer Health Data

The Service is not a health service, and our rule prohibits personal and sensitive data about real people in requests. A request may nevertheless contain consumer health data under Washington’s My Health My Data Act, Nevada SB 370, or the Connecticut Data Privacy Act if someone includes it against the rule. Our separate Consumer Health Data Privacy Policy (https://ownplace.net/talefall/health-data), linked from the ownplace.net home page, explains what we may collect, why, who receives it, how long it is kept, and your rights. We do not use geofences and do not infer health status.

Residents of other states with privacy laws (for example Colorado, Connecticut, Oregon, Texas, and Virginia) may access, correct, delete, or obtain a copy of their personal information, and opt out of targeted advertising, sale, or profiling; we do none of those three. Make requests as described in Section 10.

14. European Economic Area, United Kingdom, and Switzerland

The App is not distributed on App Store storefronts in the European Economic Area, the United Kingdom, or Switzerland, and the Service is not offered to people located there (Section 6.7). If you contact us from there for support, we process your email and message to respond, on the basis of your request, our legitimate interest in providing support, and our legal obligations; you may ask for access, correction, deletion, restriction, or portability, object, and complain to your supervisory authority.

14A. Mexico

If you use the App in Mexico, our privacy notice (aviso de privacidad) under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) is Section 14A of the Spanish version of this Policy (https://ownplace.net/es/talefall/privacy#mexico). In short: the controller is OWN PLACE LLC (Section 1); the primary purposes are providing the App and the Service, the safety checks, handling requests, and legal compliance, and the only secondary purpose is the optional usage counters, which are off unless you allow them (Section 8); recipient roles and processing are described in Section 6.3.3. The AI-provider permission covers only the recipients, content, purposes and safeguards disclosed for its version. It does not authorize processing health or other sensitive personal data, or constitute another person’s consent. Where a disclosure constitutes a transfer under Mexican law, we comply with the applicable notice, recipient-obligation and consent requirements, or an applicable statutory exception. You may exercise ARCO rights (access, rectification, cancellation, opposition) and revoke consent by writing to contact@ownplace.net; and changes are notified as described in Section 19.

15. Security

• All connections between the App and our service, and between our service and its processors, use TLS. Working content is stored encrypted.
• Service requests must carry an Apple-signed transaction (for the first book on us, the Apple-signed record of your download), which our server verifies before doing work; books are shown, cancelled, and deleted only for the subscription or download record that ordered them.
• On your device, keys are kept in the Keychain; local files have the protection iOS provides, which a device passcode improves.
• Wi-Fi Upload uses a session token over plain HTTP on your local network; use it only on a trusted private network.

We are a small company without a dedicated security team; the shared service token in the App could be extracted, though it does not give access to anyone else’s books. No Internet service is perfectly secure. We notify affected people and authorities of a breach as and when the law requires.

16. No Tracking, No Cookies, No Advertising

We do not track you across apps or websites, do not use the advertising identifier, do not show the App Tracking Transparency prompt, and include no analytics, advertising, or tracking SDKs. The App sets no browser cookies; websites you open from it follow their own policies.

17. Retention Summary

18. App Privacy Label

Our App Store privacy label and the privacy manifest in the App disclose:

• Data linked to you: Identifiers — User ID (the subscription’s original transaction identifier and, for the first book on us, the app transaction identifier); Identifiers — Device ID (the push-notification token, only if you allow notifications); Purchases — Purchase History (subscription status, extra hours, hours used); User Content — Other User Content (book ideas, narration text, content reports); Location — Coarse Location (the country derived from the IP address of a Service request, logged as a country code with the request for about one day); all for App Functionality.
• Data not linked to you: Usage Data — Product Interaction (the optional anonymous counters), for Analytics.
• No tracking.

The country is used only to decide each request under Section 6.7 and for security; it is not stored with your orders or used for any other purpose.

19. Changes to This Policy

We will update the Effective Date and post the new version at its public address; earlier versions are available on request, and we keep a versioned record of each AI-provider disclosure to which users agreed. Before changing a provider or model within the conditions of a permission, we update the registry in Section 6.3.3. We notify you in the App before materially changing how Service data is processed. Before sending content to a recipient not named in your permission, or broadening its scope (for example, new data, new purposes, broader retention or human access, training, or a country outside the geography a permission limits), we explain the change and obtain renewed explicit permission (Section 6.6); updating this Policy alone does not expand an earlier permission. Before enabling a new AI route or materially changing its processing, we also update our data-protection assessment (Consumer Health Data Privacy Policy, A9).

Changes in this edition (October 22, 2026; App version 1.3.2). First book on us: without a subscription you can order one AI book of about 15 minutes; the App sends the Apple-signed record of your download (AppTransaction), our server keeps the app transaction identifier with that order the way it keeps the subscription identifier, and keeps a keyed hash of it so the gift is given only once (Sections 2, 3, 5, 6, 6.1A, 6.2, 6.4, 6.6, 7, 9, 10, 12, 15, 17 and 18, and the privacy notice for Mexico in Section 14A of the Spanish version). “Book ready” notifications: the token may also be linked to the app transaction identifier, and a silent background signal, containing only the kind “ready”, lets the App collect a ready book in the background (Sections 2, 5, 6.2, 6.3.3, 9 and 17). Classics shelf: the App automatically requests the cover images of the suggested classics from the Internet Archive while the shelf is shown on the My Books page, U.S. storefront only (Sections 2, 4, 5, 10 and 17). Usage counters: new step names, the file type of successful imports, the distribution channel in session counters, the build and week of the first launch in milestone counters, and a clearer description of what the App holds before you answer (Sections 4, 5 and 8). The player needs no purchase: the trial and its date are no longer used, and the App no longer offers new player or extra-hours purchases (Sections 4, 5, 6.4, 7, 15 and 17). The AI-provider permission (version 2026-10-14.1), its recipients and its conditions are unchanged.

Changes in the October 17, 2026 edition. Section 10 now describes how the “Request data deletion” button works in App versions 1.3 and later: after you confirm, it requests deletion directly from our service; email is a fallback if your subscription cannot be identified or the request fails; and “Almost done” means you should tap the button again in a few minutes. The earlier text said that the button only prepares a deletion email. Nothing else in this Policy changes.

Changes in the October 16, 2026 edition. “Book ready” notifications: if you allow notifications for Talefall, the App sends our service the device’s push-notification token, which we store linked to the subscription identifier for the periods in Section 6.2, and Apple Push Notification service delivers the notification (Sections 2, 3, 5, 6.2, 6.3.3, 9, 10, 12, 17 and 18). If you previously allowed Talefall notifications, the updated App defers initial token registration until your next book order and waits for you to tap “OK” in an in-app notice before sending the token, provided notifications remain allowed in iOS (Section 5). You can turn notifications off in iOS Settings at any time, and the App then asks us to delete the token. Separate anonymous milestone counters, sent only under your existing usage-counters permission (Section 8). Daily aggregate counts of service operation, without user identifiers or content, also kept on an access-restricted Mac controlled by OWN PLACE LLC for 30 days (Section 9). The privacy notice for Mexico (Section 14A of the Spanish version) also now lists the processors under the current permission 2026-10-14.1 and the push-notification token. This edition does not change the AI-provider permission, its recipients or its conditions.

Material change in the October 14, 2026 edition. Under permission version 2026-10-14.1 OpenAI (OpenAI OpCo, LLC) is the only external AI model provider we use directly, through the OpenAI API under our own contract and OpenAI’s data processing addendum; we do not route these orders through OpenRouter or another AI gateway; OpenAI may process content through its published affiliates and subprocessors under its DPA, and our hosting provider Modal also processes order content (Sections 6.3.2 and 6.3.3): no model training, no sale and no advertising; OpenAI may keep requests up to 30 days, and longer only where the law requires or to protect against harm, with no single maximum; processing in several countries, but no recipient or route chosen in China (including Hong Kong and Macau) or another country of concern under US law. Under it, books are written by the GPT-6.1 Sol model in the OpenAI API. OpenRouter’s anonymous topic classification does not apply to orders under this permission. We rely on OpenAI’s published documents for where processing takes place. These conditions apply only to orders placed under that permission; earlier permissions keep their routes through OpenRouter (Section 6.3.5). Updated versions of the App obtain permission 2026-10-14.1 before the next book order and require acceptance of Terms version 2026-10-14.1.

Permission versions in test versions of the App, and the October 9, 2026 edition. Permission 2026-10-13.1 was shown only in test (TestFlight) versions of the App on October 13–14, 2026; its conditions, quoted in Section 6.3.5, apply only to orders placed under it. The published edition before the October 14, 2026 edition is dated October 9, 2026. It did not describe OpenRouter’s anonymous topic classification; the October 14, 2026 edition was the first published edition to disclose it, for every permission version (Section 6.3.5). That disclosure does not itself authorize the classification under an earlier permission. Earlier app versions may continue placing orders on their existing routes. You may withdraw AI-provider permission in Settings at any time, stopping further AI calls and restoring hours for unfinished orders under Terms Section 4.2.

Change log.

• October 22, 2026 (App version 1.3.2): first book on us and the app transaction identifier (Section 6.1A and related sections); notification tokens linked to it and the silent “book ready” signal; automatic classics shelf cover requests to the Internet Archive; new usage-counter steps and fields (file type of successful imports, distribution channel, build and week of the first launch); trial date no longer used, no new player or extra-hours purchases offered in the App. The AI-provider permission (version 2026-10-14.1) is unchanged.
• October 17, 2026: Section 10 corrected to describe the in-app deletion request in App versions 1.3 and later (a direct request to our service after confirmation, an email fallback, and repeating the request after “Almost done”). No other changes.
• October 16, 2026: “book ready” notifications — the device’s push-notification token, its storage and deletion, and Apple Push Notification service as a recipient (Sections 2, 3, 5, 6.2, 6.3.3, 9, 10, 12, 17 and 18); separate anonymous milestone counters under the existing usage-counters permission, disclosure of the distribution channel and the per-milestone random number, daily totals, approximate counts, and scheduled deletion of usage counters after 90 days (Sections 5, 8 and 17); daily aggregate service-operation counts on an access-restricted Mac controlled by OWN PLACE LLC for 30 days (Sections 9 and 17); the privacy notice for Mexico (Section 14A of the Spanish version) updated to the processors under permission 2026-10-14.1 and the push-notification token. The AI-provider permission (version 2026-10-14.1) and the Terms of Use are unchanged.
• October 14, 2026 (permission and Terms version 2026-10-14.1): a single external AI model provider used directly for new orders — OpenAI, through the OpenAI API under our contract and data processing addendum with OpenAI (OpenAI may use its published affiliates and subprocessors), without OpenRouter (OpenRouter’s topic classification does not apply to these orders); exclusion of countries of concern; OpenAI’s retention (up to 30 days, longer only where the law requires or to protect against harm), store: false and prompt caching off; fingerprint of the accepted permission text; “18+” removed from the permission screen (age is confirmed on the “Before You Create” screen); the October 13 permission moved to Section 6.3.5; first published disclosure of OpenRouter’s anonymous topic classification, for every permission version; provider request identifiers kept 30 days and the procedure for deletion requests to recipients, sent for these orders directly to OpenAI (Section 6.4); narration filter for versions using permission 2026-10-14.1.
• October 13, 2026 (permission and Terms version 2026-10-13.1, test versions of the App only; this draft was not published): conditions-based AI-provider permission with a static list of recipients; recipients registry with countries, retention, caching, human access and disclosed exceptions (Section 6.3); privacy notice for users in Mexico (Section 14A and the Spanish version).
• Earlier published editions, the latest dated October 9, 2026 (permissions 2026-10-08 and 2026-10-10.2), are available on request.

Website forms

Our website, ownplace.net, has two forms: a waitlist form (email address and interface language) and a support form (name, email address, product, and message). Submissions are stored in a Cloudflare D1 database located in the United States. Support messages are also delivered to contact@ownplace.net through Resend, our email delivery provider. To prevent spam, the forms use Cloudflare Turnstile, which may process your IP address and browser signals. We use this data only to reply to you or to notify you about the launch. We keep waitlist entries until the launch notification plus 12 months, and support messages for 24 months. You can request deletion at any time by emailing contact@ownplace.net.

20. Contact

OWN PLACE LLC 7707 NE 141st St, Kirkland, WA 98034-5321, USA Email: contact@ownplace.net Telephone: +1 (213) 524-8012