Privacy Policy for Talefall — Audiobook Player

Effective Date: September 4, 2026

Data controller and service provider: OWN PLACE LLC, 7707 NE 141st St, Kirkland, WA 98034-5321, USA. Email: contact@ownplace.net. Telephone: +1 (213) 524-8012. App: Talefall — Audiobook Player (the "App"), bundle identifier com.anisimov.audiobooks.

OWN PLACE LLC ("we," "us," or "our") is a limited liability company organized under the laws of the State of Washington, USA, and is the developer of the App.

Talefall — Audiobook Player is, first of all, an audiobook player that works with your own files, on your own device. The player does not upload your library automatically. Text you explicitly submit for AI Studio narration, and content you choose to include in a report or support request, are exceptions described in this Policy.

Since version 1.3 the App also offers an optional, paid AI Studio: on request, our service writes a work of fiction from your description and reads it aloud in our own narrator voice, or reads aloud a text book you already have. These optional AI Studio functions run on our server; separate on-device writing and narration features are described below. This Policy explains exactly what leaves your device when you use those optional features, where it goes, why, how long it is kept, and what never leaves at all.

Two companion documents are part of our privacy disclosures:

This Policy is available in English (primary). The App interface is available in English, Russian, and Spanish. We provide key purchase, permission, safety, and privacy disclosures in the App's supported languages. If a translation of this Policy is provided and conflicts with the English version, the English version controls; mandatory consumer rights under the law of your residence are not limited by this language-control provision.

1. Who We Are and How to Contact Us

2. Plain-Language Summary

3. Information We Do NOT Collect

Through the App we do not ask for, and the App does not send us, your name, email address (unless you write to us), phone number, contacts, photos, precise location, browsing history, device identifiers, or advertising identifiers. We do not collect titles or text from your local library unless you deliberately submit a title or text to AI Studio for server-based narration. We do not collect your playback history, bookmarks, notes, or highlights. We do not request health information and do not infer anything about your health, beliefs, or personal characteristics from anything you submit; see Section 13 and our Consumer Health Data Privacy Policy for what happens if you include such information in an AI Studio request against our rules.

If you contact us voluntarily. If you email contact@ownplace.net, we receive your email address and whatever you include in your message. We use it only to respond, provide support, act on content or copyright reports, protect our legal rights, and comply with legal obligations. We keep support correspondence for no longer than 24 months after the last message in the thread, and delete it earlier on request, except where we must retain it to document a refund dispute, a content report, or to establish, exercise, or defend legal claims. For consumer health data, retention beyond an applicable deletion deadline is permitted only where a specific applicable legal obligation or statutory exception authorizes it. A general interest in defending possible claims does not by itself override that deadline. Our business email is processed by our email service provider solely to deliver and secure mail.

Apple analytics and diagnostics. If you have enabled "Share With App Developers" in iOS settings, Apple may provide us with privacy-protected, aggregated App Store Connect analytics, crash reports, and diagnostics. This arrives through Apple's developer services, not through any SDK in the App, and we use it only to fix problems. You control this in iOS Settings → Privacy & Security → Analytics & Improvements.

The App keeps a small, size-limited, content-free technical log on your device (App version, pseudonymous book identifiers, step names, error codes, and crash call stacks received from Apple's MetricKit). It is not transmitted anywhere. Earlier versions of the App offered a "Share diagnostics" button; it has been removed.

4. Information Stored Locally on Your Device or in Your Own iCloud

The following player data is created and stored on your device or in your Apple iCloud account and does not reach OWN PLACE LLC. A downloaded AI Studio book is also stored there, but its content necessarily passed through the Service before delivery as described in Section 6.

Deleting the App removes its local container but may not remove Keychain items or values already synchronized through the iCloud Key-Value Store; the evaluation-period start date is intentionally designed to survive reinstallation.

5. Information That Leaves Your Device — Feature by Feature

The table lists every network connection the App makes, what is sent, to whom, why, and for how long it is kept. Optional features send nothing until you use them. Like any Internet communication, each request necessarily exposes your IP address and technical connection data to the receiving service.

Feature What is sent Where it goes Why How long it is kept
Service address lookup (automatic at launch, when AI Studio is available in your build) A plain HTTPS request for a small configuration file. The request contains no identifier added by Talefall, but GitHub necessarily receives the requesting IP address and ordinary connection metadata Our website ownplacellc.github.io, hosted by GitHub Pages (GitHub, Inc., USA) To learn the current address of our AI Studio service without shipping an App update We receive nothing; GitHub may retain server logs under its privacy policy
Online cover lookup (on by default; turn off in Settings → Covers → "Find covers online") Book title and author of books missing a cover Apple iTunes Search API To find a cover image. Search results and artwork are displayed only in compliance with Apple's applicable attribution, linking, and promotional-content terms Not received by us
LibriVox / Internet Archive / Project Gutenberg catalogs (only when you open them) Your search text; download requests librivox.org, archive.org, gutendex.com, gutenberg.org To search and download public-domain books Not received by us
Wi-Fi Upload (only when you turn it on) Your selected files Directly from your computer's browser to your iPhone over your local Wi-Fi network; never via the cloud or any developer server To copy files to the phone Not received by us
Purchases and restore Purchase and restore requests Apple (StoreKit) To buy the player, subscribe, or buy extra hours Apple's policy; see Section 7 for what we receive
Evaluation-period date sync The evaluation start date only Apple iCloud Key-Value Store So reinstalling does not restart the evaluation period Your iCloud account
AI Studio territory and sanctions check Current App Store storefront country or region and country-level (and, for sanctioned regions, region-level) location inferred from the request IP address The App Store and our service on Modal To refuse purchases and AI Studio processing from unavailable territories and requests from regions subject to U.S. sanctions A refusal decision is not retained with an order because no order is created; the IP address, the country inferred from it, and the request path remain in the one-day server log described in Section 9
AI Studio permission records (Terms acceptance before first use of AI Studio; AI-provider permission before the first writing-mode order and again if a document or provider changes) The version and date of the Terms of Use you accepted, the version and time of your permission to transfer writing-mode content to our AI providers, and the Apple-signed subscription transaction — nothing else Our service on Modal (USA) To record that you accepted the Terms and authorized the transfer before any writing-mode content is sent Retained with the billing ledger (Section 6.4)
AI Studio per-order confirmation (before every order) The version and time of your confirmation that the order contains no information about an identifiable real person and no sensitive personal data; stored as a field of the order Our service on Modal (USA) To document that the order was placed under our no-personal-data rule With the order record (Section 6.4). If you indicate that the order does contain such data, the App refuses the order and nothing is sent
AI Studio — write a book (subscription) Your book request ("prompt"), requested length in minutes, an Apple-signed subscription transaction, the App's shared service token, and a random per-order key used to avoid duplicate orders Our service on Modal (USA); the request text is forwarded to the language model via OpenRouter (Section 6.3). While the order exists, our service keeps with it the request identifiers OpenRouter returns; they are deleted together with the order To write the book you ordered Temporary working storage only, for the time needed to run and deliver the order: encrypted, subject to an application-level time-to-live, and excluded from OWN PLACE LLC's application logs and crash reports; we do not create separate content backups. Text and audio are deleted immediately after delivery of the final chapter is confirmed; if full delivery is not confirmed within seven days after the Service accepts the order, all server-side order content is deleted and the hours are restored (Section 6.4)
AI Studio — narrate my text book (subscription; sent only after you confirm the narration upload screen, Section 6.6) The title, language, and full chapter text of the book you chose, plus the same signed transaction and token Our service on Modal (USA). The text is processed by our narrator model running in our private container on Modal. It is processed by Modal as our infrastructure provider but is not sent to OpenRouter, Meta, or another model provider To produce audio of that book in our narrator voice Same as above
AI Studio — read a passage aloud (subscription) The passage text and language, plus the same signed transaction and token Our service on Modal (USA); our own narrator model only To return audio immediately Not retained in our application storage: the text is processed in temporary memory and discarded; only the character count and audio length are logged. Modal may retain Function inputs and outputs for up to seven days under its infrastructure retention policy
AI Studio — collecting finished books Book identifiers; a per-chapter "delivered" confirmation; a delete or cancel request when you delete a book in the App; the signed transaction (so the service shows you only your own books) Our service on Modal (USA) To download your books and to tell the server it may remove its copy See Section 6.4
AI Studio — Report content (only when you use it) The book identifier, the App version, the report category you choose, whatever you add, and the signed transaction (so we can act on your subscription's book). A content report may include the excerpt or chapter you choose to submit for review; reported content is retained separately under the report-retention period. Submitted directly from the App to our service. If submission fails, the App offers email to contact@ownplace.net as a fallback method, in which case we receive what you enter there and your email address Our service on Modal (USA); fallback: our mailbox To review unsafe or unlawful output and act on it (Section 6.5). We review and respond to all content reports in a timely manner; reports involving child exploitation, credible threats, or imminent harm receive immediate priority, and if an investigation requires additional time we inform the reporter through the available reporting channel Up to 24 months after the report is resolved, unless needed for legal claims or required to be preserved by law (for example, 18 U.S.C. § 2258A)
Usage counters (only if you said yes; not offered in the EEA or UK) Session step names with seconds since launch, file type of a failed import, App version, device language, and a random number that groups one session's counters and is not stored Our service on Modal (USA) To learn where new users get stuck in the first session 90 days, then automatically deleted
App Store Server Notifications (not from your device) Apple sends our server a signed notice when a subscription renews, expires, is refunded, or is revoked From Apple to our service on Modal (USA) So a refunded subscription stops being accepted immediately Section 6.4

Third-party privacy policies. These providers operate under their own terms and privacy policies, which we encourage you to review:

Modal and OpenRouter are bound by written data-processing terms covering confidentiality, security, documented instructions, subprocessors, rights requests, deletion, and incident notification. Meta acts as OpenRouter's subprocessor under OpenRouter's applicable flow-down obligations. We require service providers that receive personal data to use it only for the contracted service, apply appropriate security, assist with deletion requests, and provide protection consistent with this Policy. OWN PLACE LLC remains responsible for its selection and use of these service providers. Independent catalog providers, GitHub, and Apple process data under their own terms where they act independently.

6. AI Studio: Server-Based Writing and Narration

This section applies only if you subscribe to AI Studio and use it.

6.1 No account — an Apple-signed transaction instead

There is still no account. When you subscribe, Apple gives the App a transaction record signed by Apple. The App attaches that signed record to every AI Studio request. Our server verifies Apple's signature and reads from it only: the subscription's original transaction identifier (a number assigned by Apple that stays the same across renewals and devices), the product identifier, the environment (production or sandbox), and the expiry and revocation dates. The signed record itself is not stored on our server; the original transaction identifier is stored with your orders, your permission records, and your hours ledger as the label of "whose subscription paid for this."

The original transaction identifier is a purchase identifier: it contains no name, email, Apple ID, or device identifier. Apple does not provide your identity with the transaction identifier. We may associate it with contact information you voluntarily provide in support or privacy correspondence. Apple can identify you from it, and Apple treats it under Apple's own privacy policy. Because it is a persistent, subscription-level identifier, we treat it as personal information (a "User ID" in Apple's App Privacy terminology) and every right in Sections 10–14 applies to it.

The App also sends a shared service token that is the same for every copy of the App. The shared service token is a coarse abuse-control signal and is not user authentication or proof that an unmodified App sent the request. Authorization for subscription data and books depends on successful verification of the Apple-signed transaction. With book orders, the App also sends a random order key that lets the server recognise a repeated request as the same order. The random order key is a pseudonymous order identifier: it does not directly reveal your identity but is linked to the corresponding order while that order exists.

6.2 What our server stores about an order

For each book you order or ask us to narrate, our service keeps one record containing: your request text (for written books) or the text you supplied (for narration), requested length, language, generated title and chapter text, narration file names and durations, technical state and timestamps, the original transaction identifier, the quota window it was charged to, and the seconds of audio charged. Records live in a Modal Labs data store; audio files live on a Modal Labs storage volume. For each writing-mode order, the record also contains the technical request identifiers returned by OpenRouter.

The order text, the generated chapters, the title, and the audio are held as temporary working storage only for the time needed to run and deliver the order: encrypted, subject to an application-level time-to-live, and excluded from OWN PLACE LLC's application logs and crash reports. We do not create separate content backups. Processor backup copies, if any, are handled as described below. They are deleted as described in Section 6.4 ("no post-delivery server retention").

Separately, for each subscription we keep the permission records described in Section 6.6, the hours ledger described in Section 6.4, and, if you have reported content or we have had to act on abuse, a note of that action (book identifier, date, reason category, and the resulting restriction, if any).

6.3 Who processes the text, and what they may do with it

Writing mode currently requests meta/muse-spark-1.2 (Muse Spark 1.2 by Meta) through OpenRouter with provider.data_collection="deny". Server-based narration uses VoxCPM2, operated by OWN PLACE LLC in its private container hosted by Modal.

Processor Role Location What it receives Commitments and limits
Modal Labs, Inc. Hosting: runs our service, our writer program, our narrator model (in our private container), and stores order records, audio, permission records, the hours ledger, and short-lived logs United States (Modal's default region; requests are routed through Virginia, USA) Everything in 6.2 Modal acts as our processor under its Data Processing Addendum (modal.com/legal/dpa, incorporated by reference into our agreement): it processes data only on our documented instructions, publishes and is responsible for its subprocessors (trust.modal.com/subprocessors), deletes customer data at termination, notifies us of a personal-data breach without undue delay, and offers Standard Contractual Clauses and the UK Addendum for any international transfer; it does not use customer data to train models; request logs are retained for one day (Section 9)
OpenRouter, Inc. Gateway to the language model that writes the text United States (hosted on Google Cloud Platform, US regions) Your request text, the requested length and language, and the writing instructions, plans, summaries, and draft chapters our writer program generates along the way. We do not add an account, device, or subscription identifier to content sent to OpenRouter. The prompt itself may nevertheless contain personal data if you include it, and OpenRouter and the model provider will process that content OpenRouter acts as our processor under the data processing addendum incorporated in its terms: it processes content only on our instructions, encrypts data in transit and at rest, maintains a SOC 2 program, notifies us of a confirmed breach within 72 hours, publishes its subprocessors at trust.openrouter.ai and is responsible for them, and deletes data on our written request. While an order exists, our service stores with each writing-mode order the request identifiers OpenRouter returned for that order; they do not directly identify you and are deleted together with the order. After confirmed delivery we no longer hold identifiers that would let us locate any residual processor copy of your order. Requests are sent with a routing setting that excludes providers that retain or train on content; any limited retention by OpenRouter or the model provider for abuse prevention, security, billing, or legal compliance ends under their own retention periods. If you request deletion while an order is active, we cancel the order and notify OpenRouter with the identifiers we still hold. OpenRouter and Meta process writing-mode content to generate the requested text. Requests are sent using a setting that restricts routing to providers that state they do not use content for training or routine retention. This is not a zero-retention guarantee; limited retention may occur for abuse prevention, security, billing, or legal compliance. The setting operates fail-closed: if no provider with that policy is available, the order is not sent
Meta Platforms, Inc. (the model provider currently behind OpenRouter for our chosen model; OpenRouter's subprocessor) Generates the text United States The same content OpenRouter forwards, with no identifier added by us Meta acts as OpenRouter's subprocessor under OpenRouter's applicable flow-down obligations. OpenRouter and Meta process writing-mode content to generate the requested text. Requests are sent using a setting that restricts routing to providers that state they do not use content for training or routine retention. This is not a zero-retention guarantee; limited retention may occur for abuse prevention, security, billing, or legal compliance. The setting operates fail-closed: if no provider with that policy is available, the order is not sent. To the best of our knowledge, under the API terms published at https://ai.developer.meta.com/legal/terms-of-service, Meta does not use this API content to train its models. The model provider may apply its own safeguards under its current service configuration; we do not rely on those safeguards as a substitute for our controls. We will update this Policy if we change model or provider, and the App will ask for your permission again (Section 6.6)
Our narrator model (running in our own private container on a graphics card rented from Modal) Reads text aloud United States (Modal) The text to be narrated and the language The narrator model is operated by OWN PLACE LLC in a private container hosted by Modal. The text is processed by Modal as our infrastructure provider but is not sent to OpenRouter, Meta, or another model provider. The narrator software and voice assets are ours or licensed to us
Apple Payment, subscription status Apple's infrastructure Purchases; sends us server notifications about renewals, refunds, revocations Apple's policy

OpenRouter's standard DPA does not contemplate processing Sensitive Data without the agreement or amendment it specifies. Our prohibition on submitting such data is not a substitute for those contractual requirements.

Your request text and generated books are never used by OWN PLACE LLC to train models, are never sold, and are never shared with anyone other than the processors above for the purpose of producing your book, except as described under "Other disclosures" below.

Human access. Authorized personnel do not routinely read content. Limited review may occur when you request support, report content, submit a legal complaint, or when reasonably necessary to investigate abuse, security incidents, or comply with law.

No real people, no sensitive information — confirmed before every order. AI Studio's writing mode is intended solely to generate fictional entertainment. The server-based narration mode may process only text that you are legally entitled to submit and that does not contain personal or consumer health data about an identifiable real person, including you. Use the on-device voice for text containing such data. Before every order the App asks you to confirm that the order contains no information about an identifiable real person and no health, biometric, genetic, precise-location, financial-account, or other sensitive personal data (Section 6.6); if you indicate that it does, the App refuses the order and nothing is sent. We do not request such information, do not read requests to look for it, and do not use anything you submit to make inferences about you or anyone else. We do not ask for, and no screen in the App is treated as, consent to process health or other sensitive personal data. A user's confirmation does not authorize processing of personal or consumer health data. We rely on a requested-service exception only where the applicable law permits it and the specific processing is objectively necessary and proportionate. Otherwise, processing requires a valid legal basis; our current service does not offer a sensitive-data consent option. If such information is present despite your confirmation, it is processed only to write or narrate the book you requested, only by the processors above, and is deleted on the schedule in Section 6.4 or earlier on request; if we become aware that submitted content contains such data, we delete it and may refuse further orders. How consumer health data is handled is set out in our Consumer Health Data Privacy Policy.

Accuracy note. Generated text is produced by a statistical model and may be inaccurate or fabricated even when it sounds confident. Do not rely on it for factual accuracy, and never as medical, legal, financial, or other professional advice.

Other disclosures. We may disclose data when legally required (for example, in response to a valid subpoena or court order, or to report content where the law obliges us to) or as part of a merger, acquisition, financing, reorganization, or sale of assets, subject to applicable notice, purpose-limitation, and data-protection requirements. Where the law allows, we will tell you about a legal demand for your data through a notice in the App or on our website.

6.4 Retention and deletion on the server — no post-delivery server retention

We call this model "no post-delivery server retention."

Modal may retain Function inputs and outputs for up to seven days under its infrastructure retention policy, independently of deletion from our application storage. The one-day period applies to application and container logs only.

6.5 Content limits and safety controls

The language model has no access to your library, your other books, or anything on your device. It sees only the request you typed and what it generated for that order.

We use automated input and output safety controls designed to block prohibited content, including sexual content involving minors, pornographic content, credible threats, terrorist or extremist material, trafficking, self-harm instructions, instructions facilitating serious wrongdoing, targeted harassment, and unlawful exploitation. The model provider may apply its own safeguards under its current service configuration; we do not rely on those safeguards as a substitute for our controls. These controls are automated. The safety controls evaluate submitted text for prohibited content categories, including self-harm instructions. They are not used to infer or create a record of any person's health status or to build a profile; only the enforcement metadata described in this Policy is retained. Report content submits the report directly through the App. If submission fails, the App offers email to contact@ownplace.net as a fallback method. We review and respond to all content reports in a timely manner. Reports involving child exploitation, credible threats, or imminent harm receive immediate priority. If an investigation requires additional time, we inform the reporter through the available reporting channel. Where server content appears unlawful we restrict access to it immediately; we may block a subscription identifier from further use for serious or repeated violations, and report apparent child sexual exploitation to the NCMEC CyberTipline as the law requires. The full rules, enforcement steps, and appeal process are in our AI Safety and Content Policy.

6.6 Permission screens, the per-order confirmation, and what we record

Before first use of AI Studio, the App presents the Terms screen. Before the first writing-mode order, and again if the provider changes, the App separately asks permission to send writing-mode content to OpenRouter and Meta. Server-based narration does not require permission to send content to OpenRouter or Meta because it is not sent to them. No order content is sent to our service until you have completed the screens that apply to that mode.

  1. Terms screen (before first use of AI Studio) — a separate "I Agree" action. You accept the Terms of Use, acknowledge this Policy, confirm that you are 18 or older, and confirm the rule: AI Studio's writing mode is intended solely to generate fictional entertainment. The server-based narration mode may process only text that you are legally entitled to submit and that does not contain personal or consumer health data about an identifiable real person, including you. Use the on-device voice for text containing such data.
  2. AI-provider permission screen (before the first writing-mode order; again if the provider changes) — a separate "Allow and Continue" action with the text: "Allow content from my AI Studio writing-mode orders to be sent to OpenRouter and Meta in the United States until I withdraw this permission or the provider changes. OpenRouter and Meta process writing-mode content to generate the requested text. Requests are sent using a setting that restricts routing to providers that state they do not use content for training or routine retention. This is not a zero-retention guarantee; limited retention may occur for abuse prevention, security, billing, or legal compliance." The screen provides "Allow and Continue" and "Don't Allow" actions. Choosing "Don't Allow" sends no content to OpenRouter or Meta and leaves writing mode disabled; the player and server-based narration remain available.
  3. Narration upload screen (before every server-based narration order) — the text: "Upload this text to OWN PLACE LLC's service hosted by Modal in the United States for server-based narration. It will not be sent to OpenRouter or Meta."

Before your first order, and on the paywall, the App also discloses that we keep no server copy after delivery: "Delivery is confirmed only after the App has durably saved every chapter on the device." Once that has happened we delete our server copy and cannot restore it (Section 6.4).

Before every order the App additionally shows: "I confirm that this order does not contain information about an identifiable real person, including me, and does not contain health, biometric, genetic, precise-location, financial-account, or other sensitive personal data" with the button "Confirm and Continue." If you indicate that the order does contain such information, the App refuses the order; nothing is sent to our server, and for narration the App points you to the on-device voice. None of these screens asks for consent to process health or other sensitive data, and no tap is treated as such consent.

We record, for the Terms screen and the AI-provider permission screen, only the document or permission version, the time, and the original transaction identifier of the subscription used; the per-order confirmation's version and time, and the narration upload confirmation's version and time, are stored as fields of the order record. If we change the model provider or materially change the Terms or this Policy, the App asks again before the next order. You can see the current versions in Settings → Privacy. Withdrawing AI-provider permission disables writing mode only. Server-based narration remains available subject to its separate upload confirmation.

7. Purchases, Subscription, and What We Receive from Apple

All payments are processed by Apple through the App Store. OWN PLACE LLC never receives or stores your payment card details, billing address, or Apple Account credentials. Apple provides us with aggregated sales and financial reports in App Store Connect.

For the one-time player purchase, the App checks entitlement on the device with StoreKit. Nothing about it is sent to our server.

For the AI Studio subscription and extra-hours purchases, in addition to the signed transaction described in Section 6.1, Apple's App Store Server Notifications send our server a signed message when a subscription is started, renewed, expires, or is refunded or revoked. From it we store the original transaction identifier, the event type, the new expiry date, and the revocation date, if any. We use this solely to open a new monthly quota on renewal and to stop accepting a subscription that Apple has refunded or revoked. For an extra-hours purchase, the App sends the Apple-signed consumable transaction to our server, which verifies it and credits the hours once; we store that transaction's identifier in the hours ledger so the same purchase is never credited twice. Apple may charge your Apple Account when it approves a purchase, before our server has verified it; see the Terms of Use, Section 4.3, for what happens if crediting is delayed. We do not receive your name, email, or payment details.

8. Usage Counters (optional, off unless you turn them on)

When you allow it, Talefall sends a small set of counters, carrying no identifier of you or your device, describing the steps of a session: that the App was opened, that the library was shown, that the demo book was opened, that playback started, that thirty seconds were played, that the add button was tapped, that an import succeeded or failed, that the trial banner or the purchase screen was shown, and that the App was closed. Each counter carries only its name and the number of seconds since the App was opened; a failed import also carries the file type (for example m4b), never the file name or its location. The batch carries the App version and your device language, and a random number that exists only to group one session's counters together and is not stored by the service.

These counters never contain what you listen to or read: no book titles, no text, no file names, no paths, no bookmarks or notes. We do not attach a persistent user, subscription, or device identifier to counters and do not attempt to link them to a person; there is no advertising identifier and no account, and Talefall uses no third-party analytics SDK. Our server accepts only the fields listed above and discards anything else without looking at it. Ordinary server logs may temporarily contain an IP address and request timestamp for up to one day (Section 9); analytics storage is segregated from those logs, and we do not join the two. Because of that one-day log we describe the counters as identifier-free rather than absolutely anonymous. The counters are not used to track you across apps or sites, are not shared with anyone, and are deleted after 90 days. We ask once, the default answer is no, and you can change your answer at any time in Settings → Privacy. The counters are not offered to, and are not sent from, devices located in the European Economic Area or the United Kingdom (Section 14).

9. Server Logs and Security Records

Our service on Modal writes technical logs: the IP address from which each request arrived, the request path (which includes pseudonymous book identifiers), status codes, timestamps, the original transaction identifier on quota events, and character/duration counts for narration. Logs contain deletion status and a pseudonymous book identifier, but not the book title or content. For AI Studio purchases and requests, the service also derives the country or sanctions-relevant region from the IP address for the territory and sanctions checks described in Sections 5 and 14; we do not derive the U.S. state. GeoIP is a territorial control and does not by itself establish sanctions eligibility. This is done for legal-compliance and security reasons. This location information is not stored with an order, but it appears in the same log line as the request and, on quota events, alongside the original transaction identifier — which is why Section 18 discloses it as coarse location linked to the subscription identifier. We do not request or collect precise location. Logs do not intentionally contain your request text or book text. Modal Labs retains these logs for one day on our current plan, after which they are gone. Our service also keeps daily counts of refused requests by reason (for example "quota exhausted", "territory not supported"); these are numbers only, with no identifiers, and are kept for 30 days.

10. Your Choices and How to Delete Data

We respond without undue delay and within 45 calendar days after receiving your request. Verification does not restart this period. We may extend it once by 45 days where permitted, explaining the extension within the initial period. Where the CCPA applies, we acknowledge receipt within 10 business days. Shorter statutory deletion deadlines remain applicable. If we decline a request, you may appeal by replying to our response within 45 days; we answer appeals in writing within 45 days and, where the law provides, tell you how to contact your state's Attorney General.

11. Children's Privacy (COPPA) and Age Rating

The App's player is a general-audience audiobook player. It is not directed to children under 13, and we do not knowingly collect any personal information from children. If we obtain actual knowledge that personal information was submitted by a child under 13, we will stop processing it, delete it promptly, and will not use the information except as permitted to respond to or protect the child. Parents may contact us at contact@ownplace.net.

Because the App also offers AI Studio — which can generate unpredictable, user-directed text and narration that we do not review before it reaches you — the App is rated 18+ on the App Store as a whole (the rating reflects the App as a package, not the player by itself), and AI Studio is not intended for use by minors. Before the first AI Studio order the App asks you to confirm that you are at least 18. See Terms of Use, Section 2, for the App's age requirement.

12. Your Rights — California (CCPA/CPRA)

To the extent the CCPA applies to OWN PLACE LLC, California residents have the rights described below. Even where it does not apply, we voluntarily accept access, correction, and deletion requests as described in this Policy, subject to verification and lawful retention exceptions.

We do not sell or "share" (as those terms are defined in the CCPA/CPRA) personal information, do not use it for cross-context behavioral advertising, and do not use or disclose sensitive personal information for purposes that require a right to limit. In the preceding 12 months we have collected the categories of personal information described in Sections 5–9 (identifiers limited to a purchase identifier and IP address; commercial information about subscription status and hours used; user-generated content in the form of AI Studio requests and narrated text, and, for writing-mode orders, the OpenRouter request identifiers described in Section 6.2; Internet activity limited to optional identifier-free counters; country or sanctions-relevant region inferred from IP for the territory and sanctions checks) for the business purposes stated there, and disclosed them only to the service providers listed in Section 6.3. We also collect contact information and correspondence voluntarily supplied in support, privacy, and content-report requests, and disclose them to our business email provider for delivery, storage, and security.

California residents have the rights to know/access, delete, correct, opt out of sale or sharing (not applicable — we do neither), and limit use of sensitive personal information (not applicable), with a right to non-discrimination. Exercise them by emailing contact@ownplace.net (Section 10); Settings → Privacy → Request Data Deletion in the App prepares that email for you. We verify requests as described in Section 10 and respond within the time allowed by law, and where the CCPA applies, we acknowledge receipt within 10 business days. An authorized agent may submit a request on your behalf with written permission.

13. Washington State and Other US States; Consumer Health Data

This Policy and the App are governed by the laws of the State of Washington.

Consumer health data. AI Studio is not a health service. Its writing mode is intended solely to generate fictional entertainment, its narration mode may process only text without personal or consumer health data about an identifiable real person, and before every order you confirm that the order contains none. A request may nevertheless contain consumer health data if you include information about an identifiable person's physical or mental health, including your own. We do not request, read, infer from, sell, or share such data; if it is present, it is processed only to write or narrate the book you requested, by the processors in Section 6.3, and deleted on the schedule in Section 6.4 or earlier on request. A user's confirmation does not authorize processing of personal or consumer health data. We rely on a requested-service exception only where the applicable law permits it and the specific processing is objectively necessary and proportionate. Otherwise, processing requires a valid legal basis; our current service does not offer a sensitive-data consent option. We do not rely on that exception for consumer health data about another person. Third-party consumer health data is prohibited; when detected, processing stops and the data is deleted. We do not establish geofences around health-care facilities and do not use location data to identify or infer visits to health-care facilities. Country- and region-level GeoIP checks are used solely for territorial and sanctions compliance.

We do not use submitted text to identify, infer, or determine any consumer's health status; we process it only to generate or narrate the work the user requested.

Because Washington's My Health My Data Act (Chapter 19.373 RCW), Nevada SB 370, and the Connecticut Data Privacy Act may treat such information as consumer health data, we publish a separate Consumer Health Data Privacy Policy containing the information those laws require, including the categories collected, sources, purposes, processors, your rights (access, correction, deletion, appeal), and how to contact us; it is linked prominently from our home page and from Settings → Privacy in the App: https://ownplacellc.github.io/listenbook/consumer-health-data-privacy-policy.html. Our rules for AI Studio content, the safety controls, reporting, and appeals are in a separate document: https://ownplacellc.github.io/listenbook/ai-safety-and-content-policy.html.

Sensitive data generally. We do not process sensitive personal information to make inferences about you, and we do not profile you.

Other US states. Residents of states with comprehensive privacy laws (for example Colorado, Connecticut, Oregon, Texas, Virginia) may have rights to access, correct, delete, or obtain a copy of personal information and to opt out of targeted advertising, sale, or profiling. We do none of the latter three. Send requests through the App (Section 10) or to contact@ownplace.net; if we decline a request you may appeal by replying to our response, and we will answer the appeal in writing.

14. European Economic Area, United Kingdom, and Switzerland; Territorial Limits

The App is not distributed on App Store storefronts of the European Economic Area, the United Kingdom or Switzerland, and AI Studio is not offered to persons located there. AI Studio — including its subscription, extra-hours purchases, book writing, server-based narration, read-aloud requests, and collection of server-generated books — is not offered to, and may not be purchased or used by, any person while that person is physically located in those territories. AI Studio is also unavailable in the other countries and regions identified in the App and at https://ownplacellc.github.io/listenbook/ai-studio-territories.html.

AI Studio requires physical presence in a Supported Territory. Purchases also require availability in the current App Store storefront. These checks apply to new subscriptions, top-ups, and Service requests. An existing subscription may continue to renew through Apple while you are outside a Supported Territory unless you cancel it; unused monthly hours still expire. This restriction is based on the person's physical location when a purchase, top-up, or AI Studio request is made. It is not based on citizenship, residence, or the country or region of the person's Apple Account. Availability of a product in an App Store storefront does not by itself establish eligibility to use AI Studio.

To enforce this restriction, the App and Service may use the country or region of the current App Store storefront and the country-level location inferred from the IP address of a purchase, top-up, or Service request. We do not request or collect precise GPS location for this purpose. If either check indicates an unavailable territory, the request is refused before generation begins, no order is created, no text is sent to OpenRouter or a model provider, and no hours are charged. Independently of the country check, the Service refuses requests originating from the Crimea region and the so-called Donetsk People's Republic and Luhansk People's Republic regions of Ukraine, as defined by OFAC, and any other region later designated as a Covered Region (Terms of Use, Section 7). GeoIP is a territorial control and does not by itself establish sanctions eligibility. As described in Section 9, the hosting provider may retain the IP address, the country inferred from it, and the request path in a security log for one day.

A subscription purchased in a supported territory does not authorize use of AI Studio while the subscriber is physically located in an unavailable territory. During that time, the local audiobook player and books already downloaded to the device remain available, and any unused extra-hours balance remains recorded for later use from a supported territory.

The optional first-session usage counters described in Section 8 are not offered in the EEA or UK. The player library, imported files, reading and listening activity, bookmarks, notes, and playback history remain on the device as described in Sections 3 and 4.

GDPR / UK GDPR. We do not offer the App or AI Studio in, and do not target users in, the European Economic Area, the United Kingdom or Switzerland. If you contact us for support, we process your email address and the information in your message to respond to your request, protect the security of the App, and comply with legal obligations. Where the GDPR or UK GDPR applies to this limited processing, our legal bases are steps taken at your request or performance of a contract, our legitimate interests in providing support and protecting the App, and compliance with legal obligations, as applicable.

Where the GDPR or UK GDPR applies, you may request access, correction, deletion, restriction, or portability of your personal data, object to processing based on legitimate interests, and lodge a complaint with the supervisory authority where you live or work. Send requests to contact@ownplace.net. We do not rely on Article 49(1)(b) GDPR or its UK equivalent for recurring AI Studio transfers from the EEA or United Kingdom; such AI Studio processing is not permitted from those territories.

15. Security

Honest limits: we are a small company without a dedicated security team; the service token is embedded in the App and could be extracted by a determined person (it does not grant access to anyone else's books, which require the Apple-signed transaction of the ordering subscription); and no Internet service is perfectly secure. We provide breach notices within the deadlines and by the methods required by applicable law. Where available, we use appropriate contact information. Where substitute notice is legally permitted, we fulfil all applicable substitute-notice requirements; an in-App or website notice alone may not suffice. We also notify the relevant authority where the law requires it.

16. No Tracking, No Cookies, No Advertising

17. Data Retention Summary

Data Where Kept until
Library, playback, reader data, settings Your device / your iCloud backups You delete it
Evaluation-period start date Keychain + iCloud KVS Persistent by design
AI Studio order text (request, chapters, title) Modal (USA), temporary working storage: encrypted, subject to an application-level time-to-live, and excluded from OWN PLACE LLC's application logs and crash reports; no separate content backups Deleted immediately after delivery of the final chapter is confirmed (durably saved on the device); if full delivery is not confirmed, no later than 7 days after the Service accepts the order; sooner if you delete the book in the App or ask us
OpenRouter request identifiers (writing-mode orders only) Modal (USA), with the order record Deleted with the order (same schedule as order text)
AI Studio audio Modal (USA), temporary working storage Same as order text: deleted immediately after confirmed delivery, or no later than 7 days after the Service accepts the order
Order that is never fully delivered Modal (USA) Treated as failed at 7 days after the Service accepts the order; further processing stopped, all server-side order content deleted, and all hours reserved or charged for that order restored
Your own copy of a delivered book Your device and, where available, the copy the App stores through Apple's iCloud service under your Apple account; OWN PLACE LLC does not access or control that copy Until you delete it (the delete-book button offers to remove the local and the iCloud copy)
Read-aloud passages Modal (USA) Not retained in our application storage; Modal may retain Function inputs and outputs for up to seven days under its infrastructure retention policy
Hours ledger and subscription-notification records (by original transaction id) Modal (USA) 7 years after the last related financial event, then deleted or irreversibly aggregated
Permission records (document/permission version, time, original transaction id — nothing else) Modal (USA) With the hours ledger
Per-order confirmation (version, time) Modal (USA) With the order record
Content-report and enforcement notes, including any excerpt or chapter you choose to submit with a report Modal (USA) / our mailbox Up to 24 months after resolution, longer only where a specific applicable legal obligation or statutory exception requires it
Materials preserved for a report under 18 U.S.C. § 2258A Modal (USA) / our mailbox One year after submission, and longer where legally required; held under a legal hold excluded from ordinary automatic deletion
Deletion-request record (date, keyed hash of the transaction id, what was deleted; no content) Modal (USA) 2 years
Extra-hours entitlement record kept after a deletion request Modal (USA) Until the balance is used, refunded, or you confirm forfeiture
Territory / sanctions-check decision — Not retained (no order is created)
Usage counters (identifier-free) Modal (USA) 90 days
Server logs (IP, request paths with pseudonymous book ids, transaction id on quota events, IP-derived country; no titles or content) Modal (USA) 1 day. The one-day period applies to application and container logs only; Modal may retain Function inputs and outputs for up to seven days under its infrastructure retention policy, independently of deletion from our application storage
Backup copies held by processors (we keep no backups of order content) Processor Next scheduled expiration cycle; for Washington consumer health data, no later than 6 months after an authenticated request
Refusal counters (numbers only) Modal (USA) 30 days
Support email Our mailbox 24 months after the last message; deleted earlier on request, longer only for disputes or legal claims
Content sent to OpenRouter / model provider (writing mode only) OpenRouter, model provider (USA) Requests are sent using a setting that restricts routing to providers that state they do not use content for training or routine retention. This is not a zero-retention guarantee; limited retention may occur for abuse prevention, security, billing, or legal compliance. After confirmed delivery we no longer hold identifiers that would let us locate any residual processor copy of your order; any such limited retention ends under the processor's own retention periods. If you request deletion while an order is active, we cancel the order and notify OpenRouter with the identifiers we still hold

18. App Privacy Label

Our App Store "App Privacy" disclosure reflects this Policy and matches the PrivacyInfo.xcprivacy manifest bundled in the App:

"Linked" reflects that these data types are stored together with, or in the same log line as, the subscription's original transaction identifier. Apple does not provide your identity with the transaction identifier. We may associate it with contact information you voluntarily provide in support or privacy correspondence. Other User Content is disclosed as linked to the user because an order's text remains on our server while the order runs and for up to seven days if delivery is never confirmed, and because a provider may retain limited records as described in Section 6.3. The country or region derived from the IP address for the territory and sanctions checks is not stored with an order; it exists in the one-day server logs described in Section 9, and is disclosed above for that reason.

19. Changes to This Policy

We may update this Policy to reflect changes to the App, our processors, or applicable law. When we do, we will revise the "Effective Date" above and post the updated Policy at its public URL; previous versions remain available on request. For material changes to how AI Studio data is processed — including a change of model provider — we will show a notice in the App and ask for your affirmative acceptance before the next order. Material changes do not reduce benefits already purchased for the current billing period. Where applicable law requires consent for a change, we will ask for it.

20. Contact

OWN PLACE LLC 7707 NE 141st St, Kirkland, WA 98034-5321, USA Email: contact@ownplace.net Telephone: +1 (213) 524-8012