Privacy Policy

Last updated: May 5, 2026 (SMS messaging update)

Terrayap (“we”, “our”, or “us”) is a multilingual messaging app operated by KSD Apps (KSD Inc., Toronto, ON, Canada). This policy explains what information we collect when you use our mobile app or web app, how we use it, who we share it with, and how long we keep it. By using Terrayap you agree to this policy.

1. Information you give us

We collect the following when you sign up or use Terrayap:

• Phone number. Required to create an account and to find your contacts who also use Terrayap. Verified via one-time SMS code (see “SMS messaging” below).
• Display name and optional profile photo. Shown to your contacts inside the app.
• Message content. Text, voice recordings, images, and documents you send through the app.
• Voice samples (optional). If you opt in to voice cloning, a short recording you make is used to create a voice model for translating your messages into spoken audio in your contacts' languages.
• Contacts (optional). On mobile, with your permission, we read your device address book and send only hashed phone numbers to our server to identify which of your contacts already use Terrayap. Non-matching numbers are stored so we can notify you if those people join later. You can revoke this permission in your device settings at any time.
• Subscription data. If you subscribe, we receive your tier, period, and payment status from Apple, Google, or RevenueCat. Subscriptions are sold only through the mobile app; the web app inherits your mobile subscription. We never receive your full card number or bank details.

2. SMS messaging

Terrayap uses SMS only to verify the phone number you sign up with. By providing your phone number and tapping “Send code,” you consent to receive a one-time verification text. You will receive one SMS per sign-up or sign-in attempt, plus very occasional account-security texts (for example, if a new device is linked).

• SMS messages are sent on our behalf by Twilio, our SMS provider.
• Message frequency: one verification text per sign-in attempt; otherwise rare.
• Message and data rates may apply from your mobile carrier.
• To stop receiving texts, reply STOP to any verification message. You will be unsubscribed and we will not send further SMS to that number; signing in to the app would require contacting support@terrayap.com to re-enable verification.
• For help, reply HELP or contact support@terrayap.com.
• Mobile carriers are not liable for delayed or undelivered messages.
• We do not share the phone numbers we collect for SMS verification with any third party for marketing purposes.

3. Information we collect automatically

• Device identifiers. A per-device ID is recorded when you sign in (phone or paired browser) so we can enforce per-tier device limits and show you your linked devices.
• Push notification tokens (mobile) so we can deliver notifications when you receive a new message.
• Usage counters. We count the characters you translate each billing period to enforce your plan's limit. We do not log the content of individual translations for analytics.
• Minimal server logs. Our API provider (Vercel) keeps short-lived request logs (IP address, user-agent, request path) for operational and abuse-prevention purposes.

We do not use third-party analytics, advertising SDKs, or cross-site tracking. There is no Google Analytics, PostHog, Mixpanel, Amplitude, Sentry, or similar embedded in the app or website.

4. How we use your information

• To deliver messages, translations, and voice playback between you and your contacts.
• To generate text translations via large-language-model providers (currently OpenAI).
• To transcribe voice recordings via speech-to-text services (currently OpenAI Whisper).
• To synthesize translated speech via voice-synthesis providers (currently Fish Audio for cloned and preset voices, and Google Cloud Text-to-Speech for standard and fallback voices).
• To show your own messages, conversations, and subscription tier to you across your linked devices.
• To enforce plan limits and prevent abuse.

5. Who we share it with

We share data only with the following processors, strictly for the purposes above:

• Supabase — database, file storage (chat-images, message-audio, translated-audio, voice-samples), authentication, and realtime. Data is stored in Supabase's cloud region.
• Vercel — hosts our API and web app; short-lived request logs only.
• OpenAI — receives the text and audio we need to translate or transcribe. OpenAI retains this data only as long as required by their API terms.
• Fish Audio — receives the voice sample (once, for model creation) plus the translated text to synthesize; returns the audio file.
• Google Cloud — receives text strings for Text-to-Speech synthesis; returns the audio file.
• Apple, Google, and RevenueCat — receive purchase events so we can grant your subscription tier. The web app does not process payments.
• Twilio — sends the SMS verification code to the phone number you sign up with. Twilio receives the destination phone number and the message body containing the one-time code.
• Expo (push notifications). When a message is delivered, a small notification payload is routed through Expo's push service to Apple Push Notification Service or Firebase Cloud Messaging.

We do not sell your personal data. We do not use your messages or voice samples to train any third-party model outside the necessary processing described above. We may add or change processors from time to time; the current list above will be updated on this page when we do.

6. How long we keep it

• Messages (text, voice, images, files): 90 days from delivery, then deleted from the server. A local copy persists on your devices until you clear the chat, delete the conversation, or uninstall.
• Media attachments on the server: purged roughly 24 hours after delivery (or after 30 days if undelivered). Your device keeps a local cache so old content stays visible on your side.
• Translated audio files: follow the same purge rule as their parent message.
• Voice samples: kept for the lifetime of your active voice profile. When you revoke or replace it, the sample file is deleted and the corresponding Fish Audio model is retired.
• Account data (phone, display name, settings): kept until you delete your account.
• Subscription records: kept as long as required by applicable tax and accounting law.

7. Your rights and choices

• You can delete any message for yourself (“Delete for Me”) or for everyone in the conversation (“Delete for Everyone”).
• You can clear or delete an entire conversation at any time.
• You can unlink a paired browser or sign out of all devices from the Linked Devices screen.
• You can revoke your voice profile at any time; the voice sample and Fish Audio model are deleted.
• You can request account deletion from inside the mobile app (Settings → Account → Delete account) or via our public Delete Account page. We will delete your account, messages, media, voice profile, contacts list, and (subject to legal retention requirements) subscription records within 30 days.
• You can export your data on request (same email).
• Depending on where you live you may also have rights under GDPR (EU / UK) or CCPA / CPRA (California). Email us to exercise them.

8. Security

Traffic between you and our servers is protected by TLS. Media files are served through time-limited signed URLs. Authentication tokens are scoped to a single device and can be revoked individually. We use access controls (Supabase Row Level Security) to ensure one user cannot read another user's data at the database layer. No system is perfectly secure; you are responsible for keeping your phone and paired browsers protected with a screen lock or account password.

9. Children

Terrayap is not directed to children under 13 (or the minimum age of digital consent in your country, whichever is higher). We do not knowingly collect personal information from children. If you believe a child has provided us information, email us at support@terrayap.com and we will delete it.

10. International transfers

Our data is processed in Supabase's cloud region and in the data centers of the third-party services listed in Section 5, which may be located outside your country. By using Terrayap you consent to the transfer of your information to these regions.

11. Changes to this policy

We may update this policy from time to time. Material changes will be announced in-app or by email. The “Last updated” date at the top reflects the latest revision.

12. Contact

Privacy questions or requests: support@terrayap.com.

KSD Apps · KSD Inc., Toronto, ON, Canada.