ChatTune privacy policy

Last updated: 19 September 2026

ChatTune is made by AvenzaSoft UG (haftungsbeschränkt), in Wedel, Germany. It translates WhatsApp messages and draws the translation over them, so you can read a conversation in a language you do not speak.

This policy describes what the app does with your information. It is written to be checkable against the app itself rather than to cover every eventuality, and where a claim depends on a setting, the setting is named.

The short version

• With AI mode off, no message content is sent anywhere. Two things still leave the phone and neither is anything you wrote: a code for this phone, to ask our server what its allowance is, and — when a language pack is missing — a request to Google for that pack, which names the language pair.
• With AI mode on, the text of the messages on screen is sent to Avenzasoft's own server, which forwards it to Google Gemini to be translated and returns the translation to your phone.
• We never store your message content on our servers. It exists in our server's memory for the seconds a translation takes, and there is no database table it could be written to.
• Translations are kept on your phone, so the same message does not have to be translated twice. For a voice note that includes the words that were said and the spoken translation. They are yours: Settings shows what is kept and clears it, and uninstalling removes it. See *What is stored on your phone*.
• A voice note goes the same way only when you ask. Tapping Translate on one, or recording one to send, sends that recording to our server and on to Gemini, which returns the words and a spoken translation. Nothing is sent for a voice note you did not tap. We keep none of the audio on our servers.
• We do keep, against a code for your phone: how many messages you translated, how many requests that took, and what they cost us to run.

What the app reads

ChatTune uses Android's AccessibilityService API, which is the only way an app can read what is on another app's screen. Android restricts ChatTune's service to WhatsApp; it cannot read any other app, and it reads nothing while WhatsApp is closed.

It reads nothing at all until you have been shown what it reads and accepted it. That page is the first thing the app shows, it is on the home screen until it is accepted, and declining it leaves the service switched on and inert — which is a state the app is built to sit in rather than a broken one.

Inside an open conversation it reads the text of message bubbles, their positions, and the contact name shown in the toolbar. It does not read photos or attachments. It does not read your contact list either, with one exception you grant yourself, described under voice notes below.

Voice notes are the one exception, and only on your tap. The accessibility service cannot hear a voice note; what it can see is that a bubble is one, and how long it plays. When you tap Translate on it, ChatTune opens the recording WhatsApp has already saved on your phone — WhatsApp keeps played voice notes in its media folder — and this is why the app asks, the first time you tap, for access to that one folder. Android's own picker opens on it and you grant it or you do not; ChatTune is given that folder and nothing else on the phone, it opens the note you tapped and no other, and it reads nothing in there otherwise. On Android 9, which has no such picker, it asks instead for permission to read audio files. The microphone permission is asked for the first time you record something to send, and the microphone is used only while the recording sheet is on screen.

None of those is asked for during setup. Each is asked for by the tap that needs it, with a panel over the conversation saying what Android is about to ask and why, and the feature can be switched off in Settings without being asked anything at all.

Sending a translated voice note into the open chat is the one thing that touches your contacts. WhatsApp will put a file straight into a chat when it is told which chat, and for a person that is their phone number; the toolbar only shows a name. So the first time you press Send, the app asks for permission to read your contacts, and with it looks up the number saved under that one name. The number goes into the message to WhatsApp on your phone and nowhere else - it is never sent to us, and nothing else in your contacts is read. Refuse the permission and the note is still sent; WhatsApp simply asks you which chat.

It reads nothing at all in a conversation you have not switched translation on for. That switch is off by default for every new conversation.

Where message text goes

AI mode off (the default). Translation runs on your device using Google's ML Kit language packs, which are downloaded once and then work offline. Message text is not sent anywhere and is not written to storage.

One thing does still reach us in this mode, and it is worth saying rather than leaving to be inferred: when the service starts, the app asks our server what this phone's allowance is, and that request carries the device code. No message content goes with it, and nothing about the conversation does — it is the question "what is this handset entitled to", asked so the answer is already known if you ever turn AI mode on. It is the only request the app makes with AI mode off.

AI mode on. You turn this on yourself; it is off until you do. What it sends is written beside the switch rather than on a page of its own: under the switch on the home screen, at the foot of the page setup shows before anything is read, and — the first time you turn it on inside a conversation — in a line the app puts on screen as it happens. Then, for each message being translated:

1. The text is sent over an encrypted connection to Avenzasoft's server at chattune.avenzasoft.com. 2. That server forwards it to the Google Gemini API. 3. Gemini returns the translation, the server passes it back to your phone, and the text is discarded.

Why the text passes through us. Until August 2026 the app called Google directly. That required the API key to be inside the app, where anyone could extract it, so the free allowance was unenforceable and the key was one determined person away from being abused. Moving the call to our server is what lets the key stay secret and the allowance mean something. The cost of that change is this section: your message text now passes through a computer we operate, and you are entitled to know it.

What we do with it: nothing but forward it. There is no table in our database with a column for message text. Our logs record how long a request took and whether it succeeded, never what was in it. Nothing is written to disk and nothing is kept after the response is sent.

Voice notes, in AI mode, on your tap. A voice note is sent by the same path as text — to our server, on to Gemini, and the audio discarded — in exactly two cases: you tapped Translate on a note you received, or you recorded one to send. Gemini returns the words that were said, their translation, and the translation spoken aloud. With AI mode off, a note is not sent anywhere; where your phone has its own offline speech recognition, the app may use it to show the words as text, on the device.

Photos and attachments are never sent, in any mode.

Google's handling of what it receives is governed by Google's own terms for the Gemini API, and those terms differ by tier. On a paid tier Google states that it does not use prompts or responses to train or improve its models. On the free tier it may, and that can include review by people.

Assume the second. ChatTune does not claim the paid protection here, and you should not read one into the sentence above: a promise about somebody else's terms is worth nothing unless the app can keep it. If that changes — if the service moves to terms under which Google does not train on what it is sent — this policy will say so plainly, and it will say so before the app does.

You can turn AI mode off at any time, and translation returns entirely to your device.

What we keep

Against a code for your phone — a salted, one-way hash of your device's Android ID, which we cannot reverse and which cannot be matched with any identifier held by anyone else:

• How many messages you translated, and in which calendar month.
• How many messages the phone has translated in total, by the model or by the language packs on your phone — one number, so we can tell how much of the app's use never needs the server. The messages themselves stay on the phone.
• How many requests that took, and how many words the model read and wrote.
• What those requests cost us, so we know what the service costs to run.
• Which plan you are on, and when it was granted.
• Any voucher code you redeemed, what it granted, and when that grant runs out.
• Which platform and app version the phone reported, and when we first and last saw it — so that a fault can be traced to a version rather than guessed at.

That is the entire contents. No message text, no name, no phone number, no contacts, no email address, no location.

The count is held against the device code so that reinstalling the app does not hand out a fresh free allowance. We have no way to connect it to you as a person.

There is no account. This version of ChatTune has no sign-in, no way to register, and no password. Everything the app does, including a paid plan, is tied to the phone rather than to a person, and nothing anywhere asks for your name, your email address or your phone number.

The consequence is the good one: with no account, the device code identifies a handset and nobody in particular, and there is nothing on our side to join it to. An earlier draft of this section described an optional account that could carry a plan between phones. The server can still do that; the app has no screen for it, so the honest description of what you have is this one. If that changes, this policy changes before the feature ships, not after.

If you buy a plan. Payment is handled by Google Play. We never see your card details. We receive confirmation that a payment succeeded and which plan it was for.

Crash reports. If the app crashes, Google Firebase Crashlytics sends us a report so we can fix it: the stack trace, your device model and Android version, and the app version. It contains no message content — nothing in the app puts message text into a log or an error. Crash reports are not linked to the device code above.

Why we are allowed to hold any of it

Under the GDPR each purpose needs a lawful basis, and ours are different for different things, which is worth separating rather than claiming one basis covers everything:

• Message text and voice notes in AI mode — your consent (Article 6(1)(a)). Nothing is sent until you switch AI mode on, which is an act of your own on a control that states, beside itself, what switching it on sends and to whom; a voice note additionally needs your tap on that note. Withdrawing is the same control in the other direction — one switch, on the home screen and in every chat — which is as easy as giving it was. Withdrawal stops anything further being sent; it cannot recall what was already translated.
• The message count, your plan and your voucher — our contract with you (Article 6(1)(b)). An allowance cannot be honoured without counting against it, and a plan you paid for cannot be delivered without a record that you have one.
• Holding the count against a device code rather than an install — our legitimate interest (Article 6(1)(f)) in a free allowance that cannot be reset by reinstalling. The interest is keeping a free tier that exists at all; what we weighed against it is that the code identifies a handset and nobody in particular.
• Crash reports — our legitimate interest (Article 6(1)(f)) in an app that does not crash. They carry no message content.

How long we keep it

• Message text and voice audio: not at all. They are in memory for the seconds a translation takes and are never written down, so there is no retention period to state — there is nothing to retain.
• Usage counts are kept per calendar month for as long as the app is in use on that phone, and until you ask us to delete them. They are what stops a reinstall handing out a fresh free allowance, so they deliberately outlive an uninstall.
• Voucher redemptions are kept after the grant expires, so that a code already used on a phone cannot be used on it again.
• Crash reports are held by Google Crashlytics under Google's own retention, which we do not set.

What is stored on your phone

• Your settings — reading language, which conversations to translate, tone. Conversations are identified by a one-way hash of the contact name, so the app does not keep a list of who you talk to.
• Translations, in AI mode only. So the same message never has to be sent twice. They are stored under a hash of the original text rather than the text itself. You can delete them at any time from Settings, and they are removed when you uninstall the app.
• Voice translations you asked for. For a voice note you tapped Translate on, or recorded to send, the app keeps the words, the translation and the spoken translation, so playing it again sends nothing. They are stored under a hash of the recording rather than a name, for thirty days at most and within 200 MB, oldest-unplayed first. Settings shows how many are kept and clears them, and they are removed when you uninstall the app.
• Language packs, which are Google ML Kit models and contain nothing of yours.

With AI mode off, no message text is written to storage at all.

Who else receives anything

• Google (Gemini) — message text, in AI mode only, for translation; and a voice note's audio, only when you tapped Translate on it or recorded it to send.
• Google (ML Kit) — nothing. The packs run on your device.
• Google (Firebase Crashlytics) — crash reports, with no message content.
• Google Play — payment details, which go to them and not to us, if you buy a plan.

Nobody else. We do not sell anything to anyone, and there is no advertising, profiling or analytics of your messages.

Outside Europe. Google processes the text sent in AI mode, and Google's infrastructure is not confined to the EEA, so that text may be processed outside it. Google LLC is certified under the EU–US Data Privacy Framework, and where a transfer falls outside that certification Google's terms rely on the European Commission's Standard Contractual Clauses. Those are the safeguards; they are Google's rather than ours, and we are not in a position to add to them. It is one more reason AI mode stays off until you turn it on.

Children

ChatTune is not directed at children and we do not knowingly collect anything from them.

Your choices

• Stop everything: turn off ChatTune's accessibility access in Android Settings, or uninstall the app. Both stop all reading immediately.
• Stop sending anything off the phone: turn AI mode off. Translation continues on your device.
• Delete stored translations: Settings, then Clear — once for text, once for voice notes.
• Keep voice notes out of it entirely: switch off "Translate voice notes" in Settings, or decline the audio permission when it is asked for. Neither affects text translation.
• Delete what we hold: uninstalling does not remove the usage count — that is precisely what stops the free allowance being reset by reinstalling. Email us and we will delete it. The code is derived from your device and we hold nothing that identifies you, so we will ask you to confirm the request from the device it concerns.

Your rights

If you are in the EU or the UK, the GDPR gives you rights over what we hold:

• Access — a copy of what we hold against your device code.
• Rectification — correction of anything inaccurate.
• Erasure — deletion, as described above.
• Restriction and objection — including objecting to anything we do on the legitimate-interest basis named above.
• Portability — what you gave us, in a machine-readable form.
• Withdrawing consent — turn AI mode off. No email needed, and no reason has to be given.

Email us to exercise any of them. Because we hold nothing that identifies you as a person, we will ask you to send the request from the device it concerns — not to make it difficult, but because we have no other way to tell that the request is yours, and handing somebody else's records to whoever asks would be the worse failure.

If you think we have got any of this wrong, you can complain to a data protection supervisory authority — in Germany, the authority for the state we are established in; elsewhere in the EU, the one where you live.

Changes

If this policy changes materially we will update the date at the top and the copy shipped with the app.

Who we are, and how to reach us

The controller of everything described here — the one who decides what is collected and why, in the sense the GDPR gives the word — is the maker of ChatTune:

AvenzaSoft UG (haftungsbeschränkt), Pinneberger Str. 8a, 22880 Wedel, Germany. Registered at Amtsgericht Pinneberg under HRB 20096 PI, represented by its managing director, Aymen Mokhtari.

Email: ayman.mokhtari@proton.me — Telephone: +49 177 5001911

The email reaches a person, and it is the one to use for any of the rights above, for a question about this policy, or to tell us it is wrong.

The full Impressum, in German, is at chattune.avenzasoft.com/impressum.