Tala App Privacy Policy

1. Who we are

Tala (the “App”) is a mobile application owned and operated by Borstphoto LLC dba The Odd Stack (“we,” “us,” or “our”). The App is the official mobile companion for Grace & Grit, a faith-based nonprofit ministry that organizes mission trips for adult travelers.

This Privacy Policy explains what information the Tala app collects, how we use it, and the choices you have. We wrote this policy in plain language because you deserve to understand it.

2. Scope of this policy

This policy applies only to the Tala mobile application available on the Apple App Store under the bundle identifier com.graceandgrit.tala. It does not cover the Grace & Grit public website (grace-grit.org), which is governed by its own separate notices.

Tala is invite-only software. It is not available to the general public. Only individuals who have been provisioned an account by a Grace & Grit administrator can sign in and use the App.

3. Information we collect

3.1 Account information

When an administrator provisions your account, we receive and store your email address. When you sign in, we send a one-time code to that email address through our authentication provider (Supabase). The App does not use passwords, social login, or third-party identity providers.

3.2 Traveler profile information

If you are a traveler, the App lets you create and maintain a profile so your guides can support you in the field. You can provide:

• Full legal name
• Date of birth
• Nationality
• Passport number and passport expiration date
• Emergency contact name and phone number
• Dietary needs (free-text)
• Medical notes (free-text)

You provide this information yourself by typing it into the App. We do not import it from Apple Health, Apple Wallet, or any other source. You may leave any of these fields blank, although your guide may not be able to fully assist you in an emergency without them.

3.3 Trip and contact records (admin and guide users only)

If you are a Grace & Grit administrator or guide, the App lets you view and manage trip rosters, contact records, partner records, itineraries, and related documents that the organization has stored in its back-office system. You only see records you are authorized to see.

3.4 Voice input (only when you choose to use it)

The App contains an optional in-app assistant called TalaChat. If you choose to dictate to TalaChat using your voice, the App uses Apple's on-device speech recognition (via the iOS Speech framework) to convert your speech to text. The transcribed text is then sent to our backend server, which forwards it to a large language model provider for a response. We do not retain raw audio. Your dictated text is treated like any other message you type.

3.5 Location (only when you choose to share it)

If you are a traveler on an active trip and you choose to share your location with your guide, the App requests permission to access your precise location while you have the App open. We use this only to share your current GPS position with your assigned travel guide for safety purposes during the trip.

The App does not request “Always Allow” or background location access. We cannot see where you are when the App is closed or running in the background.

3.6 Push notification token

When you allow push notifications, Apple issues your device a push token through the Apple Push Notification service. We store that token in our database so we can send you trip updates, announcements, and reminders. The token by itself does not identify you personally.

3.7 Information automatically collected

The App does not contain any analytics SDKs, crash reporting SDKs, advertising SDKs, or third-party tracking software. We do not collect:

• Apple Advertising Identifier (IDFA)
• App usage analytics
• Crash logs (other than what Apple itself may send to us through App Store Connect if you opted in at the iOS level)
• Device fingerprinting data
• Location while the App is closed

The App does not engage in tracking as defined by Apple's App Tracking Transparency framework. You will not see an ATT prompt because we have nothing to track.

4. Device permissions

The App will only ever ask for the following iOS permissions, and only when you take an action that needs them:

• Microphone & Speech Recognition — requested the first time you tap the voice input button in TalaChat. Used only to transcribe your dictated message.
• Location (While Using the App) — requested the first time you turn on location sharing for an active trip. Used only to share your position with your assigned guide.
• Notifications — requested the first time the App wants to send you a push notification.
• Face ID / Touch ID — requested if you choose to enable biometric unlock for the App. The biometric data never leaves your device. iOS handles the comparison inside the Secure Enclave; we only receive a yes/no answer.

The App does not use the camera, photo library, contacts, calendar, reminders, motion, HealthKit, HomeKit, or background location.

5. How we use information

We use the information described above only for the purposes for which you provided it:

• To authenticate you and keep your account secure
• To let your guide and administrators support you on your mission trip
• To deliver trip updates, reminders, and announcements
• To respond to questions you ask the in-app TalaChat assistant
• To share your location with your guide (only when you have actively turned this on)
• To respond to your support requests
• To comply with our legal obligations

We do not sell your personal information. We do not use your information for advertising. We do not use your information to train any artificial intelligence model.

6. How we share information

We share your information only as described below:

• With Grace & Grit staff and your assigned guide — so they can plan your trip and support you in the field.
• With service providers we rely on to run the App — see Section 7.
• When required by law — for example, in response to a valid subpoena, court order, or government request.
• To protect rights and safety — if we believe in good faith that disclosure is necessary to prevent harm, fraud, or a violation of our Terms.

We do not share your personal information with advertisers, data brokers, or marketing companies.

7. Third-party services we rely on

The App uses a small number of trusted third-party services. Each of these has its own privacy policy that governs how it handles data on our behalf.

• Supabase — database, authentication (one-time email codes), and file storage. supabase.com/privacy
• Apple Push Notification service — delivers push notifications to your device. Operated by Apple Inc.
• Expo Push Notification service — relays our push notifications to the Apple Push Notification service. expo.dev/privacy
• Anthropic and/or OpenAI — large language model providers used by the in-app TalaChat assistant. Your dictated or typed messages to TalaChat are sent through our backend server to one of these providers to generate a response. The App itself never holds API keys for these providers. anthropic.com/legal/privacy · openai.com/policies/privacy-policy
• Amadeus — flight search results displayed inside TalaChat. The App never talks to Amadeus directly; our backend server makes the request.

We do not use Google Analytics, Firebase Analytics, Sentry, Mixpanel, Amplitude, Segment, RevenueCat, Stripe, DocuSign, HelloSign, Plaid, Facebook SDK, or any advertising network in the App.

8. Data retention

We keep your personal information only as long as we need it to provide the App and to comply with our legal obligations.

• Account & profile data — retained for as long as your account is active. If your account is deleted (see Section 10), we remove your personal information from our active systems within 30 days.
• Trip records — if you participated in a mission trip, your participation record (name, trip dates, role) may be retained as part of Grace & Grit's organizational records for up to seven years for accounting, insurance, and legal purposes, even after you delete your account.
• Push notification tokens — deleted when you sign out, when you uninstall the App, or when your account is deleted.
• Backups — routine backups of our database may contain your information for up to 30 days after deletion before they are overwritten.

9. Your rights and choices

Depending on where you live, you may have rights under laws such as the California Consumer Privacy Act (CCPA), the Texas Data Privacy and Security Act, or the European Union General Data Protection Regulation (GDPR). These rights generally include:

• The right to know what personal information we hold about you
• The right to request a copy of your personal information
• The right to correct inaccurate personal information
• The right to request deletion of your personal information
• The right to opt out of the sale or sharing of personal information (we do not sell or share for advertising purposes)
• The right to non-discrimination for exercising these rights

To exercise any of these rights, email us at gracebyfaithADMIN@gmail.com. We will respond within 30 days. We may need to verify your identity before fulfilling certain requests.

10. How to delete your account

You can delete your Tala account at any time:

1. From inside the App — open the Settings screen and tap “Delete Account.” This option is being added in an upcoming release.
2. By email — until in-app deletion is available, send an email from the address associated with your account to gracebyfaithADMIN@gmail.com with the subject line “Delete my Tala account.” We will confirm and complete the deletion within 30 days.

When you delete your account we will remove your account credentials, traveler profile, push tokens, and any optional content you supplied. As noted in Section 8, certain trip-participation records may be retained as part of Grace & Grit's organizational records.

11. Security

We use industry-standard practices to protect your information, including encryption in transit (TLS), encryption at rest, role-based access controls, and the principle of least privilege. The App stores its biometric unlock secret and any cached session token in the iOS Keychain. No system, however, is ever completely secure. If we ever experience a breach that affects your information, we will notify you in accordance with applicable law.

12. Children's privacy

The App is intended for adults. It is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe we have collected information from a child under 13, please contact us at gracebyfaithADMIN@gmail.com and we will delete it.

13. International users

The App is operated from the United States, and the data it collects is stored on servers located in the United States. If you access the App from outside the United States, you understand that your information will be transferred to and processed in the United States, which may have different data protection laws than your country of residence.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page and, if the changes are material, we will notify you in the App or by email. Your continued use of the App after the changes take effect means you accept the updated policy.

15. How to contact us

If you have any questions about this Privacy Policy or how the Tala app handles your information, please reach out:

See also: Tala App Terms of Use