Privacy policy

For any questions about data or requests to take something down or delete it, email hello@tilsaz.com. We will reply and remove it.

Tilsaz is free and has no ads. We do not sell data or use it for advertising tracking.

Sign-in is optional. Words, progress, favourites, playlists, reading position, recipes, communities and settings stay on your device. Downloads work offline. Without sign-in, no personal backup is sent to our server. Your phone may separately back up data to its cloud according to your system settings.

Catalogue updates and downloads also work for guests. Signals and error reports are sent only if you choose to enable them. The website has no cookies, forms or analytics; servers receive technical request information.

Apple or Google verifies sign-in. We receive a provider identifier, a sign-in token and an email address if supplied. Apple may hide your real address. Your name stays on the device; we never receive your provider password. The server stores an encrypted Apple token to revoke access.

After sign-in, an account-linked backup is saved automatically: words and your translations, progress, favourites, playlists and radio preferences, shelves and reading position, recipes, communities and download lists. It supports recovery and transfer between devices. Downloaded files, cache, settings, listening history and recent searches are excluded.

Signals and error reports are optional. Tapping “Get started” on the welcome screen means you agree to this policy and enable “Help improve the catalogue” and “Send error reports”. These data are neither collected nor sent before you tap the button. To turn them off, open Settings, then Privacy, and turn off the relevant switches. You can also open this policy and the website instructions for account deletion there. If you already made a choice on the previous screen, it stays unchanged. The choice stays on this device only.

If you enable “Help improve the catalogue”, the app sends plays after 30 seconds, searches without results, words without translations and book ratings. Signals contain a content ID or text, a section and a UTC day, without tokens, email, account or device IDs. Failed searches include up to 200 characters. Do not enter personal details in search: they may appear in a signal. Turning it off immediately stops recording and sending signals and clears the unsent queue. Old signals collected before your first choice are also cleared.

The same consent also enables daily counts: opens of music, books, language, traditions, kitchen and community; music minutes, songs played to the end and downloads; books opened and reading minutes; lessons completed, words added and reviewed; tradition articles read, recipes opened and searches. Once a day when online, the app sends totals for closed UTC days, app version, platform and interface language. These packets have no text, content, user or device IDs, or precise times. Active installations and returns use a random tag that changes every UTC calendar month, plus a bucket of days since first launch: 0, 1, 2-7, 8-30 or 31+. For existing installations, counting starts with the first launch of this version. Tags are not linked across months. Turning the option off erases unsent counts and the tag. Counts and the first-launch date are excluded from account backups.

If you enable “Send error reports” and the build has Sentry configured, it receives errors, stack traces, app version, OS, device model and technical player details, including latency, network type and cache status. The app filter removes emails, IPs and tokens from messages. Server errors may include URLs, query parameters and error text. Screen recording, screenshots and automatic tracing are disabled. Turning it off immediately stops sending app reports. Reports are not saved for sending after you enable the option again. These switches do not delete data already received by a server or disable necessary network requests, server logs or server diagnostics.

Google and Apple handle sign-in. Sentry helps find errors. Cloudflare R2/CDN may deliver public files and receive IP addresses, file URLs and connection details. Hosting and PS Cloud S3 store the working database and disaster recovery archives. Services receive data for these tasks, without sales or advertising; their terms and safeguards govern their processing. Recipients must provide at least the protection described in this policy.

During network requests, servers see IP addresses and technical connection details for delivery and abuse prevention. A Telegram bot receives operational statuses and a summary of usage totals without monthly tags, search text or personal backups. Messages to hello@tilsaz.com are handled in Google Workspace. External websites and messengers apply their own policies when you follow a link.

The working database is on the owner’s VPS in Kazakhstan. Encrypted recovery backups are in private PS Cloud S3 storage in Almaty. Local data stays on your device.

Google, Apple, Sentry and the CDN may process data in other countries. Keeping the database in Kazakhstan does not exclude cross-border transfers to these services.

Accounts and personal backups stay until you delete the account; inactivity does not trigger deletion. Local data stays until cleared. Signals stay in the working database for 90 calendar days. An IP-derived protection code used to limit signals stays for 60 seconds.

Raw count packets and monthly tags are kept for no more than 90 UTC calendar days. After cleanup, only daily totals without tags remain, with no fixed retention limit. Unsent days on the device also expire after 90 days.

Recovery archives help restore service after failures. We keep the latest backup; others are thinned to one per day for the last 7 days, one per week for the next 4 weeks and one per month for the next 6 months. The combined period is about 7 months. Failed backups or cleanup can extend it; the latest copy remains until replaced.

Server application logs rotate by size: up to 3 files of 10 MB per container, without a fixed day limit. Hosting and CDN log retention and Sentry event retention depend on service settings. Email us to ask about the period for your data.

Open Profile, choose “Delete account”, tick the confirmation and tap “Delete permanently”. Internet is required. This removes the account, tokens and personal backup from the working database and revokes Apple access. The current phone’s session and personal data are cleared; downloads and settings remain. Clear other devices separately. Signing out alone does not delete the server backup.

Without the app, email hello@tilsaz.com with the subject “Delete Tilsaz account”. Include your sign-in provider and account email, including an Apple relay address. We will verify ownership through an email address you can access; passwords and sign-in codes are not needed. Instructions: https://tilsaz.com/en/account-delete/

Existing recovery archives are not rewritten: data stays until they are removed under the schedule above. We repeat deletions before putting a restored database back into service. Signals are not linked to an account and cannot be found by it; they expire under their general retention period. Account deletion does not disable guest signals.

You can request access to your data and processing details, correction, blocking or deletion where applicable, withdraw consent and seek protection of your rights. Email hello@tilsaz.com. We verify that the request concerns you to protect your data.

We review consent withdrawal within 15 working days: we stop processing or explain a legal exception. Sign-in and backup are optional. This policy does not itself replace separate consent where required.

Tilsaz is for families, without a set minimum age. We do not ask for birth dates or verify age. There are no ads or advertising profiles. If a child’s data requires a legal representative’s consent, the account must be created with their involvement and consent.

Connections to our server use HTTPS, and session tokens stay in the phone’s secure storage. Access to a personal backup requires sign-in. Recovery archives use AES-256 encryption and restricted access. Personal backups are not end-to-end encrypted: the server stores their contents.

The app does not request contacts, microphone, camera or precise location access and uses no advertising SDKs.

The date and version appear above. The policy is available offline in the app and at https://tilsaz.com/en/privacy/. If processing changes, we update the policy and store disclosures and request fresh consent where needed.