Trust Centre
Last updated: October 2026 Version 2026-10
The short version
FairTalk records a conversation only after the consent steps in the app are complete, turns the audio into text, and has an AI model write an analysis from the words. We never store the audio, and we delete our copy of the transcript when the analysis is saved, although the AI provider keeps its own copy for a limited time. Our application servers and our database are in Sydney, and transcription, AI analysis, email and payments are handled overseas, mainly in the United States. We are a small team with no security certifications and no independent audit.
1. The short version
FairTalk is a self-guided communication tool. It is not therapy, counselling, mediation, or medical or legal advice, and it is not an emergency service.
We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and with New Zealand’s Privacy Act 2020 and its information privacy principles, whatever our size. We do not use your conversations to train AI models, show advertising or sell personal information. The app has no analytics or tracking tools, but our pages load their fonts from Google, so Google receives your IP address and browser details (section 4).
We never store the audio, and we delete our copy of the transcript when the analysis is saved, though our AI provider can keep the text for up to 30 days, or longer in some cases (section 4). Every conversation is sent to providers in the United States, and our database is in Sydney (section 3). The Privacy Policy sets out what we collect and your rights.
2. How a conversation moves through FairTalk
- Step 1: consent. A linked person approves the session request on their own device, and our server checks for that approval before processing the recording. With someone not on FairTalk, both people confirm on the same screen; we store that both did and when, but cannot verify who the second person is. In a “Just me” session you confirm that only you are speaking.
- Step 2: recording. After you press Start, your browser records the microphone only, and no audio leaves your device until the recording stops.
- Step 3: transcription. The recording goes once, over an encrypted connection, to our server in Sydney, which holds it in memory and passes it to the transcription provider. We attach no name, email address or account identifier, but the recording contains whatever was said, including names.
- Step 4: who is who. Our transcription provider returns text with speaker labels (“Speaker 0”, “Speaker 1”). We save the text in our database. The person who recorded sees a short opening excerpt to confirm who is who, and the full transcript is never shown in the app.
- Step 5: analysis. Our server sends the text to the AI provider with names and any coaching style chosen, so it is not anonymous. Saving the analysis deletes our copy of the transcript in the same step; the AI provider keeps its own for a limited time. The analysis can quote what was said.
3. Where information is processed
Our application servers and our database, which holds your account, sign-in and conversation information, are in Sydney, Australia. Transcription, AI analysis, email and payments are handled overseas, mainly in the United States.
4. The companies that process information for us
Conversation content is sent for processing to Deepgram and Anthropic only. Amazon Web Services hosts our own systems, so content passes through or is stored on them. We remain responsible for how providers acting for us handle your information.
| Company | Receives | Where | Training and keeping |
|---|---|---|---|
| Deepgram (transcription) | The whole session’s audio: every voice and everything said | United States | Sent with an instruction not to train its models. It states it keeps audio and transcript only while processing, and content-free usage logs for 90 days or longer |
| Anthropic (AI analysis) | Transcript text, names and coaching style | United States, possibly other countries | No training, under its commercial terms. It states it deletes inputs and outputs within 30 days, unless flagged under its usage rules (up to 2 years) or the law requires longer |
| Amazon Web Services (hosts our application servers, our database and logs) | Everything sent to our servers, and everything we store | Sydney, Australia | States it does not use content on the hosting services we use for its own purposes |
| Resend (email) | Your email address, first name and the email’s content. A session request email says only who is asking. No email contains a topic title, resolution wording or anything said in a conversation. Invitations go to the address the inviter typed in | United States | No, it states, though it may screen mail for abuse. It keeps email content and logs for about 30 days |
| Stripe (payments) | From us: your email address and an internal account identifier. From you, on Stripe’s own pages: card and billing details, IP address and device information. Card numbers never reach us | Outside Australia, including the United States and India | Yes, as a controller in its own right, for fraud prevention, legal compliance and improving its services, including training fraud-detection models. It keeps payment records, generally five years or more, even after you delete your account |
| Google (optional sign-in) | That you signed in, and when. Google typically sends us your name, email address, account identifier and profile-picture link; we use only the name and email address | United States and worldwide | Not our processor. Google’s own privacy policy applies |
| Google (fonts) | Your IP address and browser details, sent by your browser, which also tells Google the request came from FairTalk | United States and worldwide | No agreement with us. Google says it does not profile you or use this for advertising, and sets no cookies |
| Netlify (hosts fairtalk.io) | Visits to our website. Nothing from the app | United States (a United States company) | Not applicable, as nothing from the app reaches it |
Anthropic, Amazon Web Services, Resend and Stripe work under data processing terms that form part of their standard terms. We have no signed data processing agreement with Deepgram yet.
5. How AI is used, and what we do not do
An AI model writes the analysis, suggested resolutions and private coaching from the transcript text. The app labels the analysis as AI-generated.
- Words only. We do not analyse tone of voice, detect emotion from voice, create voiceprints or identify anyone by voice.
- No human review by FairTalk in normal operation: nobody at FairTalk reads an analysis before you see it. Our AI providers run their own automated checks for misuse, and content those checks flag can be kept longer and looked at by the provider’s staff.
- No decision with legal or similarly significant effect is made about anyone by the AI.
- No filtering or safety monitoring. Whatever is said, including sensitive information and things said about people who are not users, is transcribed and analysed. Nothing screens a conversation for signs of danger and nobody is alerted. If you or someone else is in danger, call 000 in Australia or 111 in New Zealand. The Australia and New Zealand Notice lists support services.
Between two people, the AI is instructed to be fair to both and not to take sides. It can still be wrong, incomplete or one-sided, and the transcript it starts from can contain errors. Use your own judgement. To report a wrong or harmful analysis, email contact@fairtalk.com.au.
6. Security measures in place
Only measures that exist today are listed.
- In transit: TLS encrypts data between your browser and FairTalk, and our server calls the transcription, AI, email and payment providers over HTTPS.
- At rest: our hosting providers encrypt stored data at the storage level. FairTalk applies no encryption of its own to stored content.
- Passwords: stored by FairTalk only as a salted hash (bcrypt). Staff with database access can see the hash, not your password.
- Sign-in: our server refuses requests for account or conversation data without a valid sign-in token. The email links that confirm your address or stop reminder emails use their own signed code instead.
- Access rules: on each request our server checks who you are and whether you may open that session. Your browser does not connect to our database directly. Section 7 describes what the app and our server allow.
The app sets two cookies, for the display theme and for security (anti-forgery), and keeps your sign-in token in your browser’s local storage.
7. Who can see your information
Other people
- With a linked person, both of you can open the shared analysis. Resolutions are your own: a linked person does not see them or whether you have done them, and is not told when you tick one off.
- A linked person can see your display name, profile icon and email address. Unlinking means new sessions are not shared. Past shared conversations stay visible to you both. After you unlink, that person keeps seeing your name and icon on them, but no longer your email address.
- Your private coaching is shown only to you. There is no setting to share it, and the person you spoke with gets their own.
- Only you can open a “Just me” session. It is never shared with a linked person, and its resolutions are not shown to anyone else.
- A session with someone who is not on FairTalk lives only in the account holder’s account. The coaching written for the other speaker is not shown to the account holder either.
FairTalk staff
The owner and the developer can technically read stored content through database administration. We have no separate test system, so development and maintenance work is done on the live database. They open stored conversations only to fix a fault, answer a request from the person concerned or meet a legal obligation. The app has no screen for staff to browse conversations. FairTalk keeps no log of this access and nobody independently reviews it.
Conversations and analyses have no legal privilege or counsellor confidentiality and could be required by a court or by law.
8. How long we keep things
| Information | How long |
|---|---|
| Audio | Never stored by us |
| Transcript | Deleted when the analysis is saved, or automatically after about a week if no analysis is made |
| ”Just me” sessions and sessions with someone not on FairTalk, with their analyses, resolutions and private coaching | Until you delete the conversation, or 30 days after your account is deactivated |
| Conversations shared with a linked person | Until deleted on request (section 9). If you delete your account they stay available to that person, without your private coaching and with your name shown as ‘Deleted user’. The analysis text is kept as written, so it can still reflect what you said and use your first name |
| Profile details (name, email, icon, preferences), notifications, feedback and pending invitations | Permanently erased 30 days after your account is deactivated |
| Sign-in record | Disabled 30 days after your account is deactivated, with your email address and password removed from it |
| Internal activity log: sign-ins and their method, invitations and the address invited, topic titles, resolution wording, session start and end times | 12 months, then deleted. Not shown in the app, so topic titles and resolution wording can remain there after you delete a conversation |
| Consent records and records of accepting our documents | 7 years, as evidence |
| Billing records | 7 years, because tax law requires it |
| Server logs (internal identifiers, page addresses, error details, never conversation text) | A limited period, for security and fault-finding |
| Backups | Erased information can remain in a backup for up to 14 days before it expires |
| Waitlist email addresses | Until launch communications finish or you ask to be removed by emailing contact@fairtalk.com.au, whichever is first |
9. Your controls
- Stop a recording at any time. Either person can. Stopping sends what was recorded so far for transcription.
- Email us for a copy of your data: what you can open in the app, plus your profile, subscription status, links, consent records and your own private coaching. No audio or transcripts. In Profile you can unlink a person (section 7).
- Delete a conversation: use the delete option on it where it is offered, or email us. A conversation shared with a linked person is deleted within 30 days of either person asking, and we tell the other person.
- Delete your account: if you are paying, your subscription ends with the time you have paid for and you keep using FairTalk until then; if not, the account is deactivated at once. You can keep it before it is deactivated, or restore it by signing in within 30 days after. Section 8 shows what is then erased and kept.
- For anything else, including a copy of information not in the download, a correction, or if you have no account but believe you were recorded, email contact@fairtalk.com.au. The Privacy Policy sets out your rights, and the Australia and New Zealand Notice explains how to complain.
Your part: record only adults who know they are being recorded and have agreed. The Acceptable Use Policy sets out the rules.
10. If there is a security incident or data breach
We have no automated security monitoring or alerting, so we would most likely learn of a problem from a provider, something we notice or a report. Our database, AI, email and payment providers must, under their terms, tell us of a security incident without undue delay. We do not yet have that commitment in a signed agreement with our transcription provider.
When we learn of a suspected breach we will contain it and work out, as far as our limited records allow (section 11), what happened and whose information was involved. If it is likely to cause serious harm, we will tell the people affected and the regulator as soon as practicable, saying what happened and what you can do. The regulator is the Office of the Australian Information Commissioner or, for people in New Zealand, the Office of the Privacy Commissioner. We usually cannot identify or contact a recorded person who has no account.
11. What we do not have
- No security or privacy certification, independent audit or penetration test. The only security reviews of our code are our own.
- No dedicated security staff, and no security monitoring, intrusion detection or alerting system. Nobody watches the service around the clock.
- No log of who has viewed a conversation, and no separate test or staging system (section 7).
- No multi-factor sign-in for FairTalk accounts. Five wrong passwords lock an account for 15 minutes.
- No standby system, status page, uptime target, service level commitment, web application firewall of our own or bug bounty.
12. How to report a security problem
Email contact@fairtalk.com.au with “Security” in the subject line, and tell us what you found and how to reproduce it. Please do not access other people’s information while testing, and give us a reasonable time to fix the problem before making it public. We read every report.
13. How this page is kept up to date
We update this page when a provider, location, retention period or security measure changes. Its date and version show when it last changed. There is no email alert or subscription, so check the date. If something here looks wrong, email contact@fairtalk.com.au.