Spaash — Privacy Policy
Last updated: 5 August 2026
[LEGAL ENTITY],
[CONTACT EMAIL] and [JURISDICTION] below with real
values. The contact address must be monitored — Google Play and users will
write to it.
Spaash is a real-time multilingual messaging and calling app. This policy explains what we collect, why, who we share it with, and how you can delete it. It describes the app's actual behaviour — not aspirations.
1. Who we are
Spaash is operated by [LEGAL ENTITY]. For any privacy question or
request, contact [CONTACT EMAIL].
2. What we collect
| Data | Why |
|---|---|
| Email address | Account identity, sign-in, account recovery. |
| Username & display name | So other users can find and recognise you. |
| Password | Stored only as a salted bcrypt hash. We never store or transmit your plaintext password. |
| Profile photo (optional) | Shown to your contacts. |
| Preferred language | Chooses your default translation target. |
| Messages you send | Delivered to recipients and stored so your chat history persists across devices. |
| Photos, videos, documents, voice notes you send | Delivered to recipients; stored on our servers so recipients can download them. |
| Call records | Who called whom, when, duration and outcome — for your call history. Call audio and video are not recorded. |
| Online status & last-seen time | Presence indicators shown to your contacts. |
| Device/session info (device name, platform, IP, last used) | Powers the "Linked devices" screen so you can see and revoke active sessions. |
| Abuse reports you file | Reviewed by moderators. Retained after your account is deleted, but unlinked from your identity. |
We do not collect your phone contacts, your location, or advertising identifiers. Spaash contains no advertising and no third-party analytics or tracking SDKs.
3. Translation and AI processing — important
Translation is the core purpose of Spaash, and it happens on our servers, not on your device. When you use text translation, voice-note translation, or live call translation, the relevant content is sent to Google's Gemini API to be translated and returned.
- Text translation: the message text is sent to Google.
- Voice notes: the audio is sent to Google.
- Live call translation (opt-in): while enabled, your speech audio is streamed to Google in real time to be translated. It is relayed to the other participants as translated speech and is not stored by us.
Google processes this data under its own terms. Because the server must be able to read your content in order to translate it, Spaash is not end-to-end encrypted. Please do not use Spaash to send information you would not want a service provider to be able to access.
We cache translated results (keyed by a hash of the content) so repeated translations don't have to be re-processed.
4. Who else can see your data
- The people you message or call.
- Google (Gemini API) — for translation, as described above.
- Our hosting provider (Google Cloud) — stores the servers and database.
- Our administrators — a moderation dashboard exists that can access accounts, reported content and message records in order to investigate abuse and operate the service.
We do not sell your personal data, and we do not share it for advertising.
5. Security
Passwords are stored hashed. Sessions use short-lived access tokens, and refresh tokens are stored hashed on the server. Access to chats, rooms, media and call signalling is permission-checked on the server. Data is stored on Google Cloud infrastructure, which encrypts data at rest.
Data in transit is encrypted. The app communicates with our
servers exclusively over HTTPS/TLS (and wss:// for real-time
messaging and call signalling). Voice and video call media travels directly
between participants over WebRTC, which is encrypted end-to-end by DTLS-SRTP.
6. Retention and deletion
We keep your data while your account exists. You can delete your account at any time — see Delete your account. Deletion is immediate and permanent, and removes your profile, messages, uploaded media, group memberships, call history, contacts and sessions. Abuse reports you filed are retained for safety purposes but are unlinked from your account. Copies of messages already delivered may remain in other participants' chat history.
7. Children
Spaash is not directed at children under 13 (or the minimum age in your country). We do not knowingly collect data from them.
8. Your rights
Depending on where you live (for example under GDPR), you may have the right to
access, correct, export or delete your data, and to object to processing. You
can edit your profile and delete your account in the app, or contact
[CONTACT EMAIL]. Governing jurisdiction: [JURISDICTION].
9. Changes
If this policy changes materially we will update this page and revise the date above.