PodTalk Security and Safety

1. Security boundaries

PodTalk uses Firebase Authentication, Firestore/Storage access rules and server-side checks to operate accounts, generation quotas and content access. The current app uses anonymous Firebase identities rather than a password sign-in flow. Connections to its cloud and AI APIs use HTTPS.

AI providers must be able to process the material sent to them. This is not end-to-end encryption that prevents the processor from reading it. Avoid submitting confidential records or credentials. Security controls reduce risk, but no app or infrastructure can guarantee complete protection against loss, misuse or unauthorised access.

2. AI requests, purchases and quotas

In the updated app, AI permission is requested from Create or the Settings → AI data sharing switch and is stored locally. The switch turns on only after explicit acceptance is saved and can be turned off to withdraw permission. It controls when that app starts an AI operation; it is not a separate server-side consent register. The backend separately checks authentication, account restrictions, permitted input formats and generation allowances, and verifies paid access using RevenueCat.

The speech service authorises requests against stored episode text and assigned voices before generating audio. Audio can be cached for reuse. A cache or a service provider’s infrastructure is not a substitute for avoiding sensitive information in source material.

3. Reporting content and users

Use the episode options menu to report an episode, or the user-profile menu to report a user. Choose a reason and add relevant detail. Reports are stored for review. The general feedback form in Settings is for product suggestions and problems; it does not automatically send an email.

For a comment, an urgent safety concern, a copyright complaint or an issue you cannot report in the app, email dydemiryasir@gmail.com. Include the episode/user identifier or link, the relevant text and why you believe it is harmful or violates a right. Do not send further copies of illegal sexual material or unnecessary personal information. For immediate danger, contact the appropriate local emergency service.

Provider safeguards can reject some generation requests, but not every input or comment is reviewed before it appears. We do not claim automated copyright clearance or a guaranteed human-response deadline.

4. Blocking and administrative restrictions

The app offers author blocking and an unblock list in Settings. Blocking filters supported home-feed views; it does not delete the author’s content or guarantee the author is hidden in every part of the app. Report a specific concern as well as blocking when it needs operator review.

Ban management is administrative and is not an in-app moderator control. In the updated backend, an account restriction prevents protected activity and a server process suspends stored episodes, removes public episodes and comments, and disables the authentication account. A later restoration of account access does not automatically republish removed content.

If you believe a restriction is mistaken, email dydemiryasir@gmail.com with the account or episode details and the reason for your review request. A review request does not guarantee reinstatement.

5. Account deletion and practical precautions

The updated app provides account deletion in Settings and background cleanup with retries. Read the deletion and retention section before submitting a request. Removing a record is not an assurance that every cached copy, exported file or provider record disappears immediately.

Keep your device and app updated, avoid submitting secrets or confidential records, and do not publish someone else’s personal information. Synthetic narration is not evidence that a real person said or endorsed the words.

6. Security reports

Send a suspected vulnerability or unintended data exposure privately to dydemiryasir@gmail.com. Describe the affected feature, steps needed to reproduce the problem and the minimum evidence necessary. Do not access other people’s records, disrupt the service or publish personal information while investigating. This page does not establish a paid bug-bounty programme or a guaranteed response time.