Tlatoa - Privacy Policy / Política de Privacidad / นโยบายความเป็นส่วนตัว

Last Updated: August 3, 2026

Introduction

Welcome to Tlatoa (hereinafter referred to as "THE APPLICATION", "we", "us", or "our"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, store, and share your data when you use our language learning application, including its artificial intelligence (AI) features.

By using THE APPLICATION, you agree to the collection and use of information in accordance with this policy. We reserve the right to update this Privacy Policy at any time, and we encourage you to review this page periodically to stay informed of any changes.

1. Information We Collect

1.1. Using THE APPLICATION Without a Google Account

When you use THE APPLICATION without linking your Google account, your study content (collections, study progress, preferences) is stored locally on your device using IndexedDB. However, this does not mean your data never leaves the device: when you use AI-powered features (Section 4.4), the phonetic feature, or pronunciation practice, the content you submit is transmitted off your device for processing as described in this policy.

1.2. Using THE APPLICATION With a Google Account

When you choose to link your Google account to THE APPLICATION, we request the following permissions:

• Email address: Access to view your primary Google account email address
• Basic profile information: Access to view your publicly available profile information (name and profile photo)

THE APPLICATION does not request access to your Google Drive and does not create, read, edit, or delete any files in your Google Drive.

1.3. Data Collected Through Application Usage

In addition to the information obtained through Google sign-in, the following data is generated through your use of THE APPLICATION:

2. How We Use Your Information

2.1. Primary Purposes

We use the collected information for the following purposes:

• Account Management: To identify and authenticate users uniquely
• Community Features: To enable social features such as following users, sharing collections, and viewing leaderboards
• Multiplayer Gaming: To facilitate real-time multiplayer game sessions, match players, and track scores
• Content Sharing: To allow you to publish and share vocabulary collections with the community
• Learning Progress: To track your learning progress, points, levels, and achievements
• AI-Powered Features: To generate AI tutor responses, extract vocabulary from documents, translate text, produce pronunciation audio, and analyze phonetics
• App Improvement: To understand, via Firebase Analytics, how users interact with THE APPLICATION and to improve functionality

2.2. Data We Do NOT Collect

For transparency, we explicitly do NOT collect:

• Location data
• Contacts
• Camera input or photos
• Calendar, health, or biometric data
• Access to your Google Drive

Note: we do collect limited usage analytics through Firebase Analytics, an advertising identifier through Google AdMob, and microphone audio during pronunciation practice, as described in Section 1.3.

3. Data Storage and Security

3.1. Local Storage

Data created while using THE APPLICATION without a Google account is stored on your device using IndexedDB (browser/app local storage). Using AI-powered features, the phonetic feature, or pronunciation practice transmits the relevant content you submit off your device for processing — regardless of whether a Google account is linked.

3.2. Cloud Storage

When you link your Google account, your data is stored in:

• Firebase Firestore (Google Cloud): User profiles, published collections, multiplayer game data, and community content, to enable synchronization and multiplayer features across devices.
• Firebase Storage: Profile pictures and other media you upload.

Content you submit to AI features is not necessarily persisted by us; it is processed by the AI providers in Section 4.4, each of which applies its own handling and retention practices.

3.3. Security Measures

We implement industry-standard security measures to protect your data:

• All data transmission occurs over encrypted HTTPS connections
• Firebase security rules restrict data access to authorized users only
• Your email address is never displayed publicly or shared with other users
• We do not sell, rent, or share your personal information with third parties for marketing purposes

4. Third-Party Services

THE APPLICATION integrates with the following third-party services:

4.1. Google Services

• Google Sign-In: For user authentication
• Firebase (Google Cloud Platform): For cloud database (Firestore), media storage (Firebase Storage), real-time synchronization, analytics, and multiplayer functionality
• Google Cloud Translation: For translating text (see Section 4.4)
• Google Ads (AdMob): For displaying advertisements (see Section 4.2)
• Google Play Billing: For managing subscriptions (see Section 4.3)

These services operate under Google's Privacy Policy, available at https://policies.google.com/privacy.

4.2. Advertising

THE APPLICATION displays advertisements through Google AdMob. AdMob may collect and use an advertising identifier in accordance with its own privacy policies and advertising practices. Advertisements may be personalized based on Google's advertising algorithms, which may use information from your Google account and browsing activity. On iOS, you are shown an App Tracking Transparency prompt and may decline tracking.

You can control ad personalization through your Google account settings: https://adssettings.google.com/

4.3. Subscriptions and Payments

THE APPLICATION offers an optional subscription to remove advertisements and access premium features. All payment processing is handled exclusively by the Google Play Store. We do NOT have access to your payment information, credit card details, or billing addresses. Google Play manages all subscription and payment data according to its own privacy and security policies.

4.4. AI Services and Third Parties

Tlatoa includes AI-powered features (an AI tutor/agent, vocabulary extraction from documents, translation, pronunciation audio, and phonetic analysis). When you use these features, the content you provide — chat messages, uploaded documents, text for translation, and phonetic phrases — is transmitted from your device and processed by the following services:

• DeepSeek — the primary large language model used to generate AI tutor responses and extract vocabulary. Your messages and uploaded content, and your display name, may be included in the prompts sent to DeepSeek.
• Google Gemini (via Firebase) — an additional AI model that processes prompt content for supported features.
• Microsoft Azure (Text-to-Speech) — receives text and generates the pronunciation audio played in the app.
• Google Cloud Translation — receives text you ask to translate.
• Thai Phonetic API — our own backend service, hosted on Google Cloud Run, which receives the Thai phrases you submit for phonetic analysis.

Some of this traffic is routed through Developers Mix's own backend services (tlatoa-api and the Thai Phonetic API, both on Google Cloud Run), which act as intermediaries before reaching DeepSeek and Google Cloud Translation. Content processed by these providers may be handled in their respective regions under their own privacy and retention policies. We do not sell the content you submit to these services.

Links to the providers' privacy information: DeepSeek, Google (Gemini, Translation), Microsoft (Azure).

5. Your Rights and Choices

5.1. Data Access and Control

You have the following rights regarding your data:

• Access: You can view your data within THE APPLICATION at any time
• Export: You can export your collections and share them as plain text files
• Modify: You can edit your profile, collections, and preferences at any time
• Delete: You can delete individual collections, unpublish content, or delete your entire account

5.2. Account Deletion

You can delete your account and associated data through three methods:

1. Public deletion request (no login required): Follow the instructions in the "How to Request Account or Data Deletion" section on this page — this is the link declared in the Google Play Store. Email developersmix@gmail.com with the subject "Data Deletion Request".
2. Within THE APPLICATION: Go to Settings → Account → Delete Account. This will:
   • Delete your data from Firebase servers
   • Disconnect THE APPLICATION from your Google account
   • Permanently delete your profile, collections, and game progress
3. Through Google Account Settings: Revoke THE APPLICATION's access permissions in your Google account settings. This disconnects THE APPLICATION; to fully remove stored data, also use method 1 or 2 above.

5.3. Local Data Management

If you use THE APPLICATION without linking a Google account, you can delete the locally stored study data by:

• Uninstalling THE APPLICATION from your device
• Clearing your browser's local storage/cache (for the web version)

5.4. Opting Out of Community Features

You can choose not to publish collections or participate in community features. Simply keep your collections private and do not use social features like following users or joining multiplayer games.

6. Children's Privacy

THE APPLICATION is designed as a general-audience language learning tool. We do not knowingly collect personal information from children under the age of 13 (or applicable age in your jurisdiction) without parental consent. If you are a parent or guardian and believe your child has provided personal information to us, please contact us immediately at the email address provided below, and we will delete such information.

7. International Data Transfers

Your data may be stored and processed in data centers operated by Google (Firebase, Google Cloud) and by our AI providers — DeepSeek, Microsoft Azure, and Google (Gemini and Cloud Translation) — located in various countries around the world, including regions outside your country of residence. By using THE APPLICATION, you consent to the transfer of your data to these locations. We ensure that all data transfers comply with applicable data protection laws and that adequate safeguards are in place.

8. Data Retention

We retain your data as follows:

• Active Accounts: Data is retained for as long as your account remains active
• Deleted Accounts: Upon account deletion, your data is permanently removed from our servers within 30 days
• AI Providers: Content you submit to AI features is subject to each provider's own retention policy (see the links in Section 4.4)
• Legal Requirements: In some cases, we may be required to retain certain data for legal or regulatory compliance

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make significant changes, we will notify users through:

• An in-app notification
• An update to the "Last Updated" date at the top of this policy
• Email notification (if you have linked your Google account)

We encourage you to review this Privacy Policy periodically. Your continued use of THE APPLICATION after changes are posted constitutes your acceptance of the updated policy.

10. Your Legal Rights (GDPR Compliance)

If you are located in the European Economic Area (EEA), you have the following rights under the General Data Protection Regulation (GDPR):

• Right to Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: Request limitation of how we process your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to certain types of processing
• Right to Withdraw Consent: Withdraw consent for data processing at any time

To exercise any of these rights, please contact us using the information in the Contact section below, or use the deletion request described here.

11. Links to External Content

THE APPLICATION may provide access to vocabulary collections and learning materials shared by the community. When you download or use content shared by other users, you acknowledge that such content is provided by third parties and we are not responsible for its accuracy, quality, or appropriateness.

Summary

In short: Tlatoa stores your email as your account identifier and keeps your community activity (collections, progress, social and multiplayer features) within the app. When you use AI, translation, pronunciation, or phonetic features, the content you submit is transmitted off your device and processed by our AI providers (DeepSeek, Gemini, Azure, and Google Cloud Translation). We do not access your Google Drive, do not collect location/contacts/camera data, and do not sell your information. You can delete your account at any time from within the app or by emailing us at developersmix@gmail.com.