This list accompanies the Privacy Policy. Status values: Integrated / Planned / Server-side. Third-party policy links may change. Google / Apple Sign-In: server capability may exist, but clients currently have no login buttons—add a row only after enablement.
1. Client direct connections
| Third party | Product / service | Data shared | Purpose | Status |
|---|---|---|---|---|
| OpenStreetMap Foundation | Nominatim | Precise lat/lng, client IP, User-Agent, language. No account id or chat body | Reverse geocode | Integrated |
| OpenStreetMap Foundation | OSM tiles | Tile coordinates (may imply coarse location), client IP | Map basemap on other clients / PC picker | Integrated |
| Apple | MapKit / Apple Maps, CoreLocation | Map region and annotation coordinates; when-in-use location (system-handled) | iOS picker basemap and GPS | Integrated |
| Apple | Apple Push Notification service (APNs) | Device push token, notification payload (from our servers) | iOS offline push | Integrated |
| Google LLC | Firebase Cloud Messaging | Push registration id, device info (per Google’s then-current scope) | Offline push on other clients | Planned |
| Google LLC | Firebase Crashlytics | Crash stack, device info, account key (no chat body / password / OTP / contacts / phone) | Stability diagnostics | Integrated |
Note: Nominatim / OSM tiles are client HTTPS direct when the user opens Send location; WinTalk servers do not proxy reverse-geocode requests. FCM is not initialized until production push setup and config are present. Crashlytics is collected on non-Debug production builds when the SDK is configured.
2. Server-side calls
Clients do not talk to these vendors directly; our servers call them when handling your requests. Exact vendor and region follow ops configuration.
| Third party | Product / service | Data shared | Purpose | Status |
|---|---|---|---|---|
| Amazon Web Services | Amazon SES (SMTP) | Recipient email, OTP or notice email body | Login / security email | Server-side |
| Alibaba Cloud | Machine Translation (e.g. Alibaba Cloud general MT) | Text to translate, target language | Message translation | Server-side |
| OpenRouter (fallback, per node config) | LLM translation | Text to translate, target language | Message translation (when primary unavailable or node uses fallback) | Server-side |
| Cloud vendor per deployment | Object storage | Uploaded files/images/videos and key context needed for access (plaintext keys not shipped to clients) | Store and download chat media | Server-side |
3. How you can limit sharing
- Do not open Send location: no Nominatim / no picker tiles or MapKit picker map.
- Turn off location in system settings: no GPS auto-pin; map may still allow manual pick (pick still reverse-geocodes).
- Turn off notifications: no APNs / FCM delivery to that device.
- Do not use translate or actions that need OTP: no translation engine or OTP channel for that action.
- Delete account: see Privacy Policy Section 7.
We cannot delete access logs already stored on third-party servers. Questions: [email protected]