Telli Privacy Policy

1. The short version

Your bookshelf, reading progress, and audio are stored on your device, and in your own iCloud private storage if you turn on iCloud Bookshelf. Telli's servers do not keep your bookshelf.
When you generate a book, the page photos and text pass through Telli's server to Google Gemini for recognition and narration. They are deleted as soon as the book reaches your device, and never later than 72 hours.
When you record a family voice, the two recordings pass through Telli's server to Google, which checks the consent and returns an encrypted voice key. Neither Google nor Telli stores the voice; the recordings and the key stay on your devices and in your own iCloud.
No ads, no tracking, no sale of personal data, and no third-party analytics or advertising tools.

2. Who provides Telli

Telli is developed and operated by TopoMind ("we"). This policy covers the Telli app for iPhone and iPad and its backend service. Contact: support@topomind.ai.

3. What we handle

Data	When	Why	Where and how long
Page photos, book title, recognized text	When you tap Generate	Recognize the text, reading order, and narration segments	Held temporarily on Telli's server. Deleted as soon as the whole book reaches your device; unfinished jobs are deleted after at most 72 hours. Afterwards only a content-free job record (page counts and status) remains for page accounting.
Narration text	Generating a book, re-narrating with another voice or in Mandarin/Cantonese, re-narrating after you edit text	Create narration audio and per-character timing	As above. Temporary audio for edited text is deleted after 30 minutes.
Two family-voice recordings (a story sample and a spoken consent statement)	When a Plus subscriber records a family voice	Google creates a reusable voice	Streamed through Telli's server to Google; Telli does not store them. Google checks them and returns an encrypted voice key valid for 7 days, without storing the voice. The original recordings stay on this device and are backed up to your iCloud private database, so a new key can be made before the old one expires.
Family voice list and voice keys	After a voice is created	Let your devices on the same Apple ID read in that voice	Your iCloud Keychain. When you make or re-narrate a book in that voice, the key is sent to Telli's server and held only while the job runs, then deleted on delivery or after at most 72 hours. Otherwise the server keeps only a fingerprint of the key to confirm the voice is yours.
Apple user identifier, email, name	When you sign in with Apple. You choose on Apple's screen whether to share your email and name; the email may be an Apple relay address.	Sign-in, syncing your subscription and page allowance	Telli's server, until you delete your account.
Anonymous install ID	While signed out	Count the free page allowance; merged into your account when you sign in	Your device and Telli's server, until you delete your account.
Page allowance and job status	Each time you make a book	Show remaining pages, resume interrupted jobs; count the AI resources each job used, for internal cost accounting	Telli's server. Random book IDs, page counts, times, status, and AI usage (calls, tokens, cost) only; never book content. AI usage is kept for 400 days and is no longer linked to you after you delete your account.
Purchase records	After you subscribe or buy a page pack	Confirm Plus and page-pack entitlements	Telli's server, until you delete your account. Payment details are handled only by Apple.
Bookshelf, reading progress and history, capture drafts, audio cache	Everyday use	Reading, offline listening, reading history	On your device only. With iCloud Bookshelf on, book archives go to your CloudKit private database and never pass through Telli's server.
On-device flow events	Everyday use	Check on the device whether capture and reading work smoothly	On your device only, at most 30 days and 1,000 records; not uploaded in the current version.
Service logs	Each connection	Troubleshooting and abuse prevention	Cloudflare keeps request logs (including IP address) for up to 7 days; no page content.

4. Service providers

Google Cloud (Gemini models on Vertex AI): page recognition, narration, and family voice creation. Under the Google Cloud terms Google acts as a processor and does not use this data to train models. To provide the service Google may briefly cache request content on its servers for up to 24 hours.
Cloudflare: runs Telli's server, stores temporary files and account records (Asia-Pacific data centers), and uses Workers AI to time the narration audio.
Apple: Sign in with Apple, iCloud, and App Store payments, under Apple's privacy policy.

These providers may process data outside your region, for example in the United States or elsewhere in Asia-Pacific. We send them only what the feature you asked for needs; requests do not include your email, name, or purchase history.

5. When we ask for your permission

Before your first book, the app explains that page photos and text will be processed by Google. Nothing is uploaded until you tap "同意云端处理" (Agree to cloud processing).
To record a family voice, the speaker reads Google's consent statement aloud, word for word. The recordings are uploaded only after that.
If you decline, you can still read the built-in books and the books you have already made.

6. What we never do

No ads, no advertising identifiers, no tracking across other companies' apps or websites.
No selling, renting, or trading personal data.
No third-party analytics, crash-reporting, or advertising SDKs.
No training models on your pages, text, or voice.
No public sharing, export, or social features.

7. Children

Telli is a tool for parents. Children may listen with a parent, or after a parent has chosen the book, but Telli has no child accounts and asks children for nothing. Family voices must be recorded by an adult speaking for themselves; please do not let children record. Please avoid photographing pages that show a child's name, photo, school, or other personal details. We do not knowingly collect personal information from children under 13; if we learn that we have, we delete it promptly.

8. Your choices and deletion

Delete a family voice: in 朗读声音 (Reading Voice), delete that voice. The app deletes its recordings and key on this device and in iCloud, and the server's record of it.
Delete reading data on this device: 我的 → 隐私与数据 → 本机阅读数据 (Me → Privacy & Data → Reading Data on This Device).
Delete the iCloud Bookshelf backup: 我的 → iCloud 书架 → 删除 iCloud 备份 (Me → iCloud Bookshelf → Delete iCloud Backup).
Delete your account: 我的 → 账户与登录 → 删除账户与数据 (Me → Account → Delete Account and Data). This deletes your account, usage records, generation jobs, and temporary files on the server, and the family voices you created, with their recordings. It does not cancel an App Store subscription; cancel it in your Apple account.
Stop using Sign in with Apple for Telli: iPhone Settings → your name → Sign-In & Security → Sign in with Apple.
To access or correct your data, or exercise other rights under the law where you live, email support@topomind.ai. We reply within 30 days.

9. Security

All traffic between the app and the server uses HTTPS. Data on the server is encrypted at rest by Cloudflare and Google. Each generation job can be read only by the account or device that created it, and a family voice can be used or deleted only by the account that created it.

10. Changes

If the purposes or providers change in an important way, we will update this page and explain the change in the app, and ask for your permission again before you use the affected feature.

Your books stay on your devices and in your own iCloud.