TOKI Privacy Policy
TOKI is a real-time voice translation app, available at toki.brivfy.com and as a mobile app, run by Digital Living Co., Ltd., 35 Soi Bangwaek 2, Khuha Sawan, Phasi Charoen, Bangkok 10160, Thailand. In this policy, "we", "us" and "our" mean Digital Living Co., Ltd., which is responsible for your personal data.
This policy explains what information we collect, why, where it goes, and the choices you have. We have tried to keep it short and honest.
The most important thing to know: while your microphone is on — from when you tap to talk until you tap Stop — your voice recording, its transcript, and the languages you've selected are sent over the internet to our server and then to OpenAI (our artificial-intelligence provider) to be transcribed, translated, and spoken back in the other language. TOKI cannot work without this. Audio is only captured while your microphone is on — never in the background. Before any of this is sent, the app asks for your permission, and you can review or withdraw it any time in Settings.
1. Information we collect
- Account details — your name and email address, and the default language you choose. If you sign up with email, also your phone number (we text you a code to confirm it). If you sign in with Google or Apple, the name and email address they share with us (and, from Google, your profile photo). If you use Sign in with Apple and choose to hide your email, the address we receive is an Apple private-relay address (ending in @privaterelay.appleid.com) that forwards to your real inbox. Whichever way you sign in, you can also choose to add a postal address, or a phone number if you don't have one on your account yet, in Profile & Usage.
- Profile photo — if you upload one, it is stored with Google Firebase and used as your account picture. You can remove it at any time in Profile & Usage, and it is deleted when you delete your account.
- Voice audio and text — the speech you record while your microphone is on, its transcription, and the languages you've selected.
- Saved conversations — after each turn, the text of what was said and its translation is saved to your account automatically, with the languages and the time it was said, so you can reopen the conversation later on any of your devices. The audio is not saved. You can delete any conversation at any time.
- Usage records — how many seconds of translation you have used, kept as a ledger so your free allowance and any credits are counted correctly.
- Your translation permission — whether and when you accepted sending your conversation to OpenAI, remembered on your device so the app knows whether to ask you.
- Technical logs — our server logs record your IP address, the time, and the address of each request, so we can keep the service running and investigate problems and abuse. They do not contain what you said. We keep them for up to 90 days, and then they are deleted.
2. How we use your information
- To translate your conversation — sending your voice audio, its transcript, and your languages to OpenAI, and playing the translation back to you.
- To run your account — signing you in, confirming your phone number, showing your name and profile picture, and starting the app in your default language.
- To count your free minutes and credits — recording how much translation time you use, and applying daily usage limits.
- To save your conversations — so you can reopen, continue, or delete them.
- To provide support, prevent abuse, and control costs — for example, answering your questions, pausing an account that misuses the service, adding minutes to an account, or pausing translation for everyone if abuse or costs make that necessary.
- To keep TOKI secure and working — checking that each request comes from a signed-in account, and using server logs to investigate problems and abuse.
- To understand how our website is used — on the toki.brivfy.com website only, using Google Analytics.
We don't use your conversations for advertising.
3. AI processing and who else processes your data
Your conversation itself — your voice audio, its transcript, and the languages you've selected — is sent to OpenAI to produce the translation. The app asks for your permission before your first translation, names OpenAI by name, and lists exactly what is sent. You can review or withdraw that permission any time in Settings; withdrawing blocks the next translation until you accept again. Our hosting providers carry or store data on our behalf, as listed below.
Every third party that receives data from TOKI, and what each one receives:
| Service | What it receives, and why |
|---|---|
| OpenAI | Receives your voice audio, its transcript, and the languages you've selected, to produce transcriptions, translations, and translated speech. Under OpenAI's API terms, this data is not used to train OpenAI's models. OpenAI may keep it for up to 30 days to provide the service and detect abuse, and then deletes it unless the law requires otherwise. OpenAI may process it outside Thailand. |
| Google Firebase (Google) | Handles sign-in — with email and password, "Continue with Google", or "Sign in with Apple" — and sends the text-message code that confirms your phone number. Your password, if you use one, is held by Firebase — we never see or store it. Firebase Storage holds the profile photo you upload. Firebase Hosting serves this website and the web app, and like any web host receives your IP address and browser details when you visit. |
| Google (Sign in with Google) | If you choose "Continue with Google", Google confirms who you are and shares your name, email address, and profile photo with us. |
| Apple (Sign in with Apple) | If you choose "Sign in with Apple", Apple confirms who you are and shares your name (only the first time you sign in) and your email address — your real address, or a private-relay address if you choose to hide it. |
| Google Cloud | Runs our application servers, located in Singapore. Everything the app sends to TOKI — including your voice audio on its way to OpenAI — passes through them. Our server logs record the IP address, time, and address of each request. |
| Hostinger | Hosts our database, where your account details, saved conversations, usage records, and records of support actions we take on your account are stored. The database is hosted in Singapore. |
| Google Analytics | Used on the toki.brivfy.com website only, not inside the app. Receives the pages you visit, your device and browser type, an approximate location derived from your IP address, and an identifier stored in a cookie in your browser. |
Some of these services store or process data outside Thailand.
We share personal data only with the services listed above, only for the purposes described next to each one, and we choose providers that protect personal data to the same or an equal standard as this policy, under their own published data-protection and security terms.
A small number of authorised people at Digital Living Co., Ltd. can see account details and usage records to provide support, prevent abuse, and control costs. Our admin tools show your name, email address, when you signed up, how many minutes you have used and have left, and a list of your conversations with their languages, dates, number of turns, and length. They don't show what was said in your conversations, your phone number, or your postal address, and there is no audio to show because we don't keep it. These people can also pause an account or add minutes to it, and each such action is recorded.
We do not sell your personal information, and we do not share it with anyone beyond the services listed above.
4. How long we keep it
- Voice audio is processed to produce a translation and is not stored by TOKI's servers afterwards.
- What we send to OpenAI — your voice audio, its transcript, and your languages — may be kept by OpenAI for up to 30 days to provide the service and detect abuse, and is then deleted unless the law requires otherwise.
- Account details and saved conversations are kept until you delete them or delete your account.
- Profile photos are kept until you remove the photo or delete your account.
- Usage/credit records are kept for financial book-keeping, in anonymized form after account deletion.
- Records of actions our team took on your account are kept for security and audit, including after you delete your account.
- Server logs are kept for up to 90 days, and then deleted.
5. How we protect it
Everything the app and this website send to our servers travels over encrypted HTTPS connections, and our servers reach OpenAI over encrypted connections too. Every request to our servers must carry proof that you are signed in, which we check with Google Firebase; requests without it are refused. Your password is held only by Google Firebase. Only a fixed list of authorised accounts can open our admin tools, and every change made with them is recorded.
6. Deleting your account
You can permanently delete your account at any time from inside the app: your profile picture (or initials) in the top bar → Profile & Usage → Delete account. This removes your profile details, your profile photo, your saved conversations, and your sign-in identity from our systems and from Firebase. It cannot be undone.
Two things are kept: anonymized usage records (with no name, email, or phone attached), for financial auditing; and records of any actions our team took on your account, such as pausing it or adding minutes, including the email address the account had at the time, for security and audit.
If you cannot sign in to the app, you can request deletion from our account deletion page, or by emailing toki@brivfy.com from the address on your account.
7. Your rights
Depending on where you live — including under Thailand's Personal Data Protection Act (PDPA) and similar laws — you have the right to access, correct, or delete your personal data, and to withdraw consent. Most of this you can do directly in the app (edit your profile, delete conversations, withdraw your translation permission in Settings, delete your account). For anything else, contact us at the address below and we will respond within 30 days.
8. Children
TOKI is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.
9. Changes to this policy
If we change this policy in a meaningful way (for example, adding a new data processor), we will update this page and the effective date above. If what TOKI sends to OpenAI changes, the app will ask for your permission again before sending anything.
10. Contact
Questions or requests: toki@brivfy.com