Privacy Policy

Effective Date: September 20, 2026

This Privacy Policy explains how Talking Eyes ("the App", "we", "us", or "our") processes information when providing augmentative and alternative communication (AAC), eye-gaze tracking, speech synthesis, and intelligent prediction features. Please review this policy carefully before using the App.

1. Information We Process

TrueDepth API, Facial, and Gaze Data

Upon receiving Camera authorization, the App utilizes Apple ARKit face tracking capabilities (powered by the front-facing TrueDepth camera system on supported iPad devices) to process the following data in real-time on-device: the live front camera feed; ARKit face mesh, facial position, head orientation, eye coordinates, gaze direction vectors, eye-closure coefficients, and ambient lighting estimates; screen gaze coordinates, calibration samples, and calibration matrices calculated from these inputs; and a transient facial geometric signature constructed from four normalized ratios between key facial landmarks (eyes, nose, and mouth).

This data is strictly utilized to:

1. Map the user's line of sight to screen quadrants to enable dwell-gaze selection;
2. Detect eye blinks, face absence, and shifts in device or user posture to maintain tracking precision and prompt for re-calibration;
3. Display a live preview feed within the Placement Assistant view;
4. Perform coarse verification within the active app session to determine if a different user has entered the frame, prompting re-calibration if needed.

The transient facial geometric signature is never used for real-world identity verification, authentication, advertising, profiling, or training AI models, and no facial recognition database is ever created.

During eye tracking, camera frames, TrueDepth data, face mesh, and gaze coordinates are processed strictly in volatile device memory (RAM). Live video frames are continuously overwritten by subsequent frames and immediately discarded upon leaving preview screens; facial geometric signatures, calibration samples, and derived coordinates persist only during the active runtime session, discarded automatically when overwritten, re-calibrated, or when the App process terminates. Eye tracking workflows never write this data to device storage, Photos, UserDefaults, Keychain, or iCloud, nor do they transmit it to developer servers, Volcano Engine, Sentry, or any other third party. Consequently, neither the developer nor third parties receive or store facial data from gaze tracking workflows. Users may revoke Camera permissions or terminate the App process at any time to halt processing immediately. Screenshots submitted voluntarily in user feedback are governed separately under "Feedback & Inquiries" below.

Stability telemetry may collect aggregated, non-identifiable metrics (e.g., calibration success/failure, sample point counts, latency, error codes) that contain no camera imagery, facial geometry, facial signatures, or gaze coordinates.

Location Information & Weather

When Location authorization ("While Using the App") is granted, the App accesses coarse device location to determine the general operational environment, perform reverse geocoding, and retrieve localized weather conditions via Apple WeatherKit. Synthesized environmental tags, locality names, and weather summaries may be incorporated as contextual inputs for AI suggestions. You may decline or revoke Location access in iPadOS Settings at any time; core quadrant presets, Pinyin input, and speech synthesis remain fully functional.

User Profile Settings

Caregivers can optionally configure age group, gender, medical/nursing restrictions, living environments, and custom keywords. These settings are stored locally on the device and used to contextualize AI suggestions. Please provide only information strictly necessary for communication and caregiving needs.

Sentences and Usage History

The App stores previously vocalized phrases and frequency counts locally on the device to prioritize frequently used expressions. The sentence currently being composed, favorite phrases, and high-frequency historical expressions may be used as contextual prompts for AI suggestions.

Microphone, Speech Transcription & Ambient Sounds

The "Listen to Caregiver" feature is disabled by default. When explicitly enabled with Microphone and Speech Recognition permissions, the App performs on-device speech-to-text transcription and ambient sound classification on supported devices to generate short-term contextual summaries. The App never records, stores, or uploads raw audio files. When generating AI suggestions, transcribed text and ambient sound tags may be included in the context payload. Revoking microphone or speech recognition permissions does not impact preset phrases, custom content, Pinyin, touch, or speech synthesis.

Device Identifiers, AI Quota & In-App Transactions

The App generates a random device identifier stored securely in the device Keychain to handle device registration, prevent free quota abuse, and track daily AI usage. When purchasing or restoring monthly subscriptions, the App retrieves transaction metadata via Apple StoreKit (product ID, transaction ID, original transaction ID, expiration timestamp) and validates it against developer servers with Apple. The App does not require account registration.

AI Privacy History

To provide transparency regarding data transmitted for AI suggestions, the App maintains a local 7-day log of request field summaries and timestamps. This log is stored exclusively on the device, is never uploaded, can be reviewed in Settings, and can be cleared at any time via "Clear All History".

Diagnostic Information

The App uses Sentry (Functional Software, Inc.) for crash reporting, performance monitoring, and stability diagnostics. When a crash or anomaly occurs, diagnostic reports may include stack traces, error classifications, App version, OS version, device hardware model, runtime environment, and operational duration. Sentry may also process the device's IP address during transmission.

We have disabled Sentry's default personal data collection, automated UI screenshots, and view hierarchy attachments. Automatic diagnostic events do not contain names, clinical diagnostic tags, sentence text, locations, camera frames, facial geometry, gaze coordinates, AI prompts/responses, or API keys. Voluntary user feedback submissions are handled separately below.

Feedback & Inquiries

When users voluntarily submit feedback within the App, the message text, optional contact details (name, phone, or email), and any attached screenshots are transmitted to the development team via Sentry. This data is used exclusively to troubleshoot issues and communicate regarding bug fixes. Please refrain from including sensitive patient medical records or facial photographs in feedback attachments.

2. Online AI Predictions & Third-Party AI Data Sharing

AI Suggestions are disabled by default. Prior to initiating any AI requests, the App displays a dedicated disclosure modal detailing the specific data fields transmitted, the third-party recipient, and the purpose. Requests are initiated only after the user or caregiver selects "Agree and Enable". Declining does not affect presets, custom content, Pinyin input, touch selection, or speech synthesis; authorization can be revoked at any time in "Settings → General".

Upon receiving explicit consent, requests are transmitted via HTTPS through a developer-operated proxy service to the large language model APIs of our third-party AI provider, Volcano Engine / Volcengine Ark (Beijing Volcano Engine Technology Co., Ltd.). Authorizations granted for previous recipients do not carry over automatically. Contextual payloads may include:

• Current sentence text and the active selection category;
• Age group, gender, medical/nursing restriction tags;
• Residential environment, locality description, current time, and weather summary;
• Caregiver keywords and selected high-frequency phrase history;
• Caregiver speech transcripts and ambient sound summaries (only when audio context is explicitly enabled);
• A random device identifier and device token sent exclusively to the developer proxy for authentication and quota management (the proxy does not forward these identifiers to Volcano Engine).

These fields are used solely to generate contextual phrase suggestions, authenticate requests, calculate quotas, prevent abuse, and ensure content safety. Camera feeds, TrueDepth data, face meshes, facial signatures, raw or derived gaze coordinates, and raw audio recordings are never sent to the developer proxy or Volcano Engine.

The developer proxy does not write AI prompts or model responses to persistent logs or databases; request payloads exist solely in volatile memory during transit. The proxy may retain random device identifiers, daily request counts, and transaction statuses, alongside sanitized operational logs (model name, HTTP status code, latency, truncated device ID) for security, quota control, and troubleshooting.

For details on Volcano Engine's privacy practices, see the Volcano Engine Privacy Policy. Volcano Engine processes data in accordance with applicable laws and service agreements. We contractually require service providers to process data only for the purposes of delivering App functionality and to provide a level of protection consistent with this Policy.

When AI is disabled, the App immediately halts all AI inferences and quota queries. To request the deletion of developer-held records (device registrations, quota, or operational logs), contact us as described in Section 10. Data rights requests for Volcano Engine are governed by their respective privacy policy.

3. Purposes of Data Processing

We process information solely for the following purposes:

• Providing gaze dwell and touchscreen selection capabilities;
• Facilitating device placement and 6-point gaze calibration;
• Assembling, storing usage frequency for, and vocalizing communicative phrases;
• Generating contextual phrase suggestions aligned with user profile preferences;
• Managing daily AI usage quotas, validating subscription statuses, and preventing abuse;
• Maintaining application stability, troubleshooting crashes, and fulfilling statutory obligations;
• Evaluating performance metrics and feature success rates to improve reliability and interaction design.

We do not sell personal information, use personal data for third-party advertising, or engage in cross-app or cross-website behavioral tracking.

4. Storage & Security

User profiles, general preferences, and phrase history are stored locally in device preferences; random device IDs and tokens reside in the device Keychain. TrueDepth, facial mesh, and gaze coordinates are never stored persistently. Online AI requests, device registration, and subscription verification are conducted over encrypted HTTPS connections to developer endpoints; diagnostic telemetry is transmitted via HTTPS to Sentry.

5. Third-Party Service Providers

To provide our services, data may be processed by the following entities:

• Apple Inc.: System permissions, ARKit, Speech Synthesis, Reverse Geocoding, WeatherKit, StoreKit, and In-App Purchase validation;
• Developer-Operated Proxy Service: Device registration, AI quota enforcement, subscription verification, and AI request forwarding;
• Volcano Engine / Volcengine Ark: Third-party AI model provider generating contextual language suggestions;
• Functional Software, Inc. (Sentry): Crash diagnostics, performance metrics, and voluntary feedback submissions.

The App's eye-tracking pipeline never transmits TrueDepth, camera feeds, facial geometry, or gaze points to any of these parties.

6. Your Rights and Choices

You have the right to:

• Revoke Camera, Microphone, Speech Recognition, or Location permissions at any time via iPadOS Settings;
• Modify user profile information, custom content, and interaction parameters within the App;
• Toggle AI Suggestions on or off at any time under "Settings → General";
• Disabling AI Suggestions immediately withdraws consent for data sharing with the third-party AI provider;
• Remove locally stored data by uninstalling the App;
• Inquire about, access, rectify, or request deletion of developer-held records via the contact details below.

7. Children's Privacy

The App may be utilized by users of diverse ages under the supervision of parents, guardians, or clinical caregivers. Please do not input sensitive identifiers regarding children without appropriate parental or guardian consent.

8. Medical & Emergency Disclaimer

Talking Eyes is an augmentative and alternative communication tool. It does not provide medical diagnosis, clinical treatment recommendations, or emergency call services, and cannot substitute for professional clinical AAC evaluations, medical equipment, continuous nursing observation, or emergency alarm hardware.

9. Policy Changes

We may update this Privacy Policy to reflect changes in functionality, third-party integrations, or applicable laws. The revised policy will be posted with an updated Effective Date. Substantive updates will be highlighted appropriately within the App.

10. Contact Us

If you have questions, inquiries, or data requests regarding this Privacy Policy, please contact:

Developer: Beijing Sharp Knife Interactive Entertainment Technology Co., Ltd.

Email: talkingeyes@sharpknife.games