Privacy.

1. Data controller

The controller responsible for the processing described in this privacy notice is:

No data protection officer has been appointed.

2. Talori website

Website delivery and server log data

When you visit this website, the contracted hosting provider processes technically necessary data in server log files. This may include, in particular, your IP address, the date and time of access, the requested file, the amount of data transferred, the previously visited page, browser type and operating system.

The data is processed to deliver the website, ensure its security and stability, and prevent misuse. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is providing this online service securely and reliably. The retention period depends on the settings and statutory obligations of the hosting provider concerned.

Optional website analytics and cookie settings

The language is determined solely by the page address you visit; choosing a language does not set cookies or save a preference in your browser. The quick capture feature example shows only predefined examples. Your selection changes only what is displayed in the browser. No text input is collected, no AI requests are made, and no selections are saved or sent to Talori.

External links

Where this website contains external links, they lead to services from other providers. A connection to the relevant provider is established only when you click such a link. That provider's own privacy notices apply to processing there.

Contact form

When you use the contact form, we process your selected category, name, email address, subject, message and only the additional details relevant to that category in order to answer your request. The legal basis is Art. 6(1)(b) GDPR for contractual or pre-contractual enquiries and Art. 6(1)(f) GDPR for other communication and product improvement.

The message is sent by our web server to talori.app@gmail.com and is not stored in a website database. To prevent automated misuse, the server temporarily stores a keyed, pseudonymised network identifier and one-time form tokens; the raw network address is not written to the form log. Security data expires automatically, while correspondence is retained only as long as necessary for the request and statutory obligations.

Email delivery uses Gmail by Google. According to Google, Google Ireland Limited provides its consumer services in the EEA; data may be processed on servers outside the user's country under Google's stated transfer frameworks. Google's information on international data transfers.

3. Talori iPhone app

Local first, without a Talori account

Talori does not require a user account. Items, loans, names, contact pictures, categories, notes, values, dates, reminders, photos and event history are initially stored locally in the protected app area on your device. Talori does not operate its own server for this content and does not use advertising, tracking or analytics SDKs.

Optional private iCloud sync

iCloud sync is optional and switched off by default. If you enable it, Talori stores your entries, including linked names, contact pictures, photos, history and synced lending settings, in your Apple Account's private CloudKit database. They can then appear on your other devices using the same Apple Account.

Talori's provider cannot view the private CloudKit database in the developer portal. Apple processes iCloud data under its own privacy terms. Talori does not use a public CloudKit database or one shared between unrelated people for your lending data.

Contacts, photos and camera

Contact access is optional. Names and contact pictures are searched on your device. Your entire address book is not uploaded. Only personal details and pictures you deliberately associate with an entry are saved in that entry and, when iCloud sync is enabled, transferred to your private iCloud. You can also enter names manually.

The camera, photo library and selected image files are used only following a deliberate action. Added photos are associated with the entry locally and synced privately when iCloud sync is enabled. Image analysis using Apple Vision takes place on the device. You can change or withdraw permissions in system settings at any time.

Microphone and on-device AI

The microphone is used only while you actively operate a voice feature. Audio is processed for ongoing local recognition and is not saved by Talori as a recording. AI-assisted quick capture, scan refinement and wording suggestions use supported local Apple features on your device. Talori does not send input text, voice input or photos to its own or a third-party AI server for these features.

Availability depends on the device, operating system, Apple Intelligence being enabled, models being ready and the language being supported. Setup guidance explains the necessary steps. Standard manual entry and reminders remain available without AI. Drafts are reviewed before saving; messages are shared through the selected sharing app only when you explicitly take that action. The destination's own privacy terms apply.

Reminders and motion

At your request, Talori can schedule local iOS notifications for returns. Optional motion permission is used solely for the visible movement of the dot grid. Talori neither stores nor transmits motion values.

Talori Pro and the App Store

In-app purchases are handled exclusively by Apple through StoreKit and the App Store. Talori does not process payment details. The app receives information verified by Apple about existing purchase entitlements. Apple's privacy policy applies to its processing.

Export, retention and deletion

Talori can export your saved content, including photos, as a local JSON file. The file is sent to a selected destination only through the iOS sharing function you choose.

You can delete individual entries in Talori. The data and backup features let you choose to delete only the local device copy, only the private iCloud copy, or both. If only the device copy is deleted, sync is turned off so that the cloud copy is not immediately restored. If you deliberately enable sync again later, the retained cloud copy can be downloaded again.

Removing the app deletes its local copy, but does not automatically delete a private iCloud copy previously created. That copy must be removed separately through Talori or iCloud storage management. Locally stored content remains until it is deleted; private iCloud data remains until it is deleted from the Apple Account.

4. Recipients and retention periods

Website log data is received by the hosting provider used for technical operation. Apple is involved as an independent controller in providing and purchasing the app and, if you voluntarily enable it, in private iCloud sync. Beyond this, app content is not transmitted to Talori or any other servers operated by Talori.

Website log data is retained only for as long as necessary for security and technical operation. Content stored locally in the app remains on your device until you delete it or remove the app. A private iCloud copy remains until it is deleted separately. If you contact me by email, I process your message to handle your enquiry and retain it only for as long as necessary for that purpose or to meet statutory retention obligations.

Legal bases

The website is technically provided on the basis of Article 6(1)(f) GDPR. Voluntarily granted iOS permissions, such as for contacts, photos, the camera or notifications, are based on Article 6(1)(a) GDPR and can be withdrawn in device settings at any time. Contact enquiries are processed, where necessary, under Article 6(1)(b) GDPR or on the basis of Article 6(1)(f) GDPR.

5. Your rights

Where the statutory requirements are met, you have the right of access, rectification, erasure, restriction of processing and data portability, as well as the right to object to processing based on legitimate interests. You may withdraw consent with effect for the future.

To exercise your rights, simply send a message to talori.app@gmail.com. You also have the right to lodge a complaint with a data protection supervisory authority. One authority with jurisdiction at the controller's location is:

6. Last updated and changes

This privacy notice was last updated on 14 September 2026. I will update it if the features of the website or app, or the associated data processing, change substantially.