Norsk

Privacy policy for Atcha

Last changed 24 October 2026.

Atcha translates speech while it is given. A speaker talks in the app or on the website, and the audience reads or listens to the translation on their own phones. The audience never needs an account. This page says which information is processed, why, for how long and who receives it.

Who is responsible

Atcha is responsible for the processing. Questions about privacy: privacy@atcha.me.

Information about the speaker

• Sound from the microphone, only while the translation is running. The sound is sent to our server and on to a service that turns speech into text. We do not store sound.
• The recognized text and the translations. They are stored with the talk and shown to the audience.
• The name of the room and the names and terms the speaker adds so that recognition and translation are more accurate.
• An access key that lets only the speaker control the room. The key is stored on the speaker's own device. The server stores only a fingerprint of it, not the key itself.
• The access code, for speakers who have one. It is remembered on the speaker's own device, so it is typed only once. The server checks it and does not store it. The speaker's IP address is used to limit wrong codes to 10 in 10 minutes, sign-ins to 30 in 10 minutes and new rooms without an account to 30 an hour. It is held only in memory for that long and is not stored.
• Technical information: IP address and time, which the server provider needs to deliver the service, and measurements of delay, errors, reconnections and the number of characters read aloud, with the room's ID and language. The measurements contain no text from the talk and no IP addresses.
• The app and the country. The app and the website send which app and version they are, for example iPhone 1.1.2. The server stores the app and the country Cloudflare finds from the IP address, with the account (first and last sign-in) and with each talk. The IP address is not stored.
• The steps in the app, for example that the sign-in or the packages were shown, or that a purchase was started, cancelled or failed. The steps are counted per day, app and country, without being tied to you. The first time the account saw the packages, bought and went live is stored with the account.
• Whether you have read a talk before. The phone or the browser remembers that it has shown a talk to a reader. When you make an account, only yes or no is sent, so we can see whether readers become speakers.
• The answer to “How did it go?” after a talk: good or not good, and the text you write, if you write any. It is stored with the talk's account.
• Crash reports. When the app or the website crashes, a report is sent to Sentry: what went wrong in the code, the phone model, the version of the operating system and the app, and a random number for the installation, so we see how many an error affects. The report has no IP address, account, email or text from the talk. Reports from the website go through our server, so Sentry does not see the address.
• On the phone or in the browser Atcha remembers the rooms you have made (code, name, speech language and the access key), the speech language, the access code and whether you have signed in before. A room is forgotten when you delete it. Everything is deleted when you clear the site data for atcha.me. In the iPhone app the rooms and the sign-in are kept in the keychain, on this device only.

Accounts for speakers

• Sign in with Apple. The speaker can sign in with Apple to get time on an account. Apple gives us an ID that applies only to Atcha. We store only a fingerprint of it and give the account its own number. So that we can revoke the sign-in with Apple when the account is deleted, we also store a key from Apple with the account. In the Android app, Apple's page opens in a browser tab. Apple sends the answer to our server, and the app gets only a one-time code that signs it in.
• Sign in with Google, in the Android app. Google sends us an ID for your Google Account, the email address, whether Google has verified it, the name and a link to the profile picture. Of the ID we store only a fingerprint. We store the email address only when Google has verified it. We do not store the name or the profile picture. Google learns that you have signed in to Atcha, and Atcha is listed among the connected apps in your Google Account, where you can remove it. Google does not learn what you do in Atcha.
• Email. We ask for your email address, but not your name. With Google we receive the address of the Google Account. Apple lets you choose “Hide My Email”. We then get an address from Apple that forwards email to you, and we never see the real one. We use the email to answer you when you need help, and for important messages about the service, such as downtime or changes to prices and terms. We do not send advertising or newsletters unless you have agreed to it. Accounts made before 8 October 2026 have no email with us.
• The account number is shown in the account in the app and on the website. Give it when you write to us about a purchase or your balance, so we can find the account.
• The balance: time given or bought, and time used, with times. The rooms the account has made, with code, name and speech language.
• The sign-in is remembered with a key. On the web it is in a cookie used only for signing in, which lasts 180 days after it was last used; in the iPhone app it is in the keychain, and in the Android app encrypted in the app's own storage on the phone. The server stores only a fingerprint of it.
• Delete account is in the app and on the website. The balance, the email, the sign-ins and the key from Apple are deleted at once, and the rooms right after. The phone or browser you delete from forgets the rooms too. We keep only a fingerprint of the Apple ID and whether the free 60 minutes have been given for it, so that they are not given again. Of a Google Account we keep nothing.

Purchases

• In the iPhone app you buy through Apple. Apple processes the payment. Your Atcha account number goes with the purchase, so the time reaches the right account. We receive a receipt from Apple with transaction number, product, price, currency, country and time, but no payment details.
• In the Android app you buy through Google Play. Google processes the payment. Your Atcha account number goes with the purchase, so the time reaches the right account. We ask Google about the purchase and receive the order number, product, country, time and whether it is paid, but no payment details. When Google refunds a purchase, we are told and take the time back.
• On the web you pay through Stripe, also with Apple Pay and Google Pay, once purchases on the web are open. Stripe processes the payment and the card details. Stripe receives your Atcha account number and the package you buy. We receive the payment number, amount and time.
• Receipts: Apple, Google and Stripe have the receipts for purchases and keep them under their own rules. Atcha has only the transaction number or order number in the account's record of time, and it is deleted with the account.

Information about the audience

• The room code and the language you read in. The language is chosen from your phone's language and sent to the server, so you get the right translation. When you press Listen, the server is told, so it can send you speech read aloud. This is not stored.
• The text size, look, typeface and whether the original is shown are stored only on your own device.
• The app you read in (the website, the iPhone app or the Android app, with its version) is sent to the server, so we can count readers per app in the talk's account. Nothing about you is stored.
• How long you read and your country are counted together with the other readers of the talk: how many read, how long they usually stayed, how many stayed to the end, and which countries they read from (the country Cloudflare finds from the address, never the address itself). Countries with fewer than 3 readers in a talk are counted together as «others». The times of each connection are deleted when the room's next talk starts, and the talk's account has only the numbers. The phone or the browser remembers that it has shown a talk (see above), and crash reports are sent as for the speaker.
• In the iPhone app the phone remembers the last talk you read (code, name and language), so you can go on reading. With Listen on, the lock screen shows the talk's name and the newest sentence.
• The IP address is used to limit how many wrong room codes can be tried in one minute. When a room code is right, the server remembers the address with the room for an hour after the last lookup, so that other people's typing errors on the same network do not lock out a hall that is reading. The address is held only in memory and is not stored.
• The audience has no account, and we use no cookies, tracking or advertising for the audience.

When you visit the home page

• The country you visit from. The home page shows the App Store prices in your country. Cloudflare works out the country from the IP address.
• The visit is counted. When the home page is opened (not when it is reloaded or you go back to it), and when you follow a link to the App Store or Google Play, we add one to a count per day. The count has the country, which language version of the page you opened, where you came from (for example direct, Google, Bing, an AI service or a social network) and the device in broad groups: phone, tablet or computer, the operating system (for example iOS or Android) and the browser. Other sites are counted only as «other», and the address of the page you came from is never stored.
• How many people visit the site per day is counted without cookies. The server makes a code from the IP address and the browser's identification (User-Agent) together with a random key that is changed every night, and counts each code once per day. After midnight (UTC) the key and the codes are deleted, at the latest within an hour. Visits therefore cannot be linked from one day to the next, and the IP address cannot be found again from the code. The IP address is not stored, and the counts cannot be linked to you.
• The language you choose for the site is remembered only on your own device.
• The home page uses no cookies or advertising, and it does not follow you from one visit to the next.

Why

The information is used only to deliver the translation and the speaker's account: turn the speech into text, translate it, read it aloud when a reader wants to listen, show it to the audience, keep account of the time and answer the speaker. We also count accounts, purchases, time used, the steps in the apps, the visits to the home page, the apps and versions in use, the countries and the delay and errors in each talk, and we read the crash reports, to see how the service is used and what needs to improve. Atcha has an overview of the accounts with account number, email and time bought, given and used, which only Atcha sees. It is used to help speakers and keep account of the time. Atcha can also see which rooms are live (name, room code, languages and how many are reading) and follow a room without showing as a reader, to check the quality and fix problems. The information is not used for advertising, profiling or training our own models. The legal basis is the agreement with the speaker (GDPR Article 6(1)(b)), our legitimate interest in showing the translation to the audience and in improving the service and fixing errors (Article 6(1)(f)) and the Bookkeeping Act for purchases (Article 6(1)(c)).

For how long

• Sound is not stored by us. Speech read aloud is made for each sentence, sent to those who listen, and not stored.
• Text and translations from a talk are deleted 24 hours after the talk ends, or when the next talk in the same room starts.
• The room with its code, name and names and terms lives until the speaker deletes it, or until it has gone unused for 90 days.
• The account, with the email, lives until the speaker deletes it. Its record of purchases is then deleted too; the receipts are with Apple, Google and Stripe.
• The account of each talk is not deleted: when the talk was and how long, the speech language and the languages it was read in, how many read it and in which app, the app and country the speaker used, why the talk ended, the delay and the errors, the time drawn from the balance, what that time was worth and what the talk cost us. It holds no text from the talk. When the room or the account is deleted, the talk's name, the room code and the link to the account are removed from it. The talks of a deleted account share a number that cannot be traced back to the account.
• The app, the country and the first steps with the account are deleted when the account is deleted. The steps and visits per day are not deleted; they do not say who you are.
• The codes for visitors to the home page and the key that makes them are deleted after midnight (UTC) the same night, at the latest within an hour.
• The answer to “How did it go?” stays with the talk's account. The text you wrote is deleted when the account is deleted.
• Crash reports are deleted by Sentry after 30 days.
• A copy of the accounts is made so that an error that loses a balance or a purchase can be put right. It holds the same as the accounts, without the sign-ins, and is deleted after 30 days.
• Server logs contain no text, sound or IP addresses. They hold the room's ID, the measurements above and the names of errors, and are deleted after 7 days.

Who processes the information for us

We use these providers. They process the information on our behalf and on our instructions.

• Cloudflare runs the server and stores the rooms and the accounts. Each room is stored in a data centre near where it was created.
• Speech to text: Google Cloud Speech-to-Text. The sound is processed in Google's data centres in the EU and is not stored by Google.
• Translation: Google Gemini, with Google Cloud Translation as a fallback. Gemini receives the sentence, the previous sentences of the talk and the speaker's names and terms, so the translation hangs together. Google does not use the content to improve its products, but keeps it for a limited time to detect abuse. Processing may take place outside the EU.
• Speech read aloud: Google Cloud Text-to-Speech makes sound from translated sentences when a reader presses Listen. The text is sent to Google, and the sound is not stored.
• Crash reports: Sentry (Functional Software, Inc.), with the data stored in the EU (Frankfurt). Sentry does not store IP addresses for us.
• Sign-in: Apple (Sign in with Apple) and Google (Sign in with Google in the Android app). If you hid your email, Apple forwards email from us to you. Payment: Apple (purchases in the iPhone app), Google (purchases in the Android app through Google Play) and Stripe (purchases on the web).

Transfers outside the EEA

Atcha is used all over the world. The information may therefore be processed outside the EEA, in the country where the room is created and where the providers have data centres, among them the United States. Transfers follow the providers' data processing agreements, which use the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

Children

Speakers must be of age or have consent from a parent to buy time. The audience gives no information about themselves, and we do not ask for age.

Your rights

You have the right of access to, correction of and deletion of information about you, and to object to or restrict the processing. A speaker with an account can delete the account themselves. Without an account we can find a room only if you give the room code. Write to privacy@atcha.me. You can also complain to the Norwegian Data Protection Authority (datatilsynet.no).

Changes

We update the policy when the service changes. The date at the top shows the last change.