1. Who we are
Narravo ("Narravo", "we", "us", or "our") is a text-to-speech application that converts written content — text you type, documents, PDFs, and links you provide — into natural-sounding speech audio in multiple languages and voice styles. Narravo is operated by Tupandas. This Privacy Policy explains what data we collect when you use the Narravo mobile app and related services (together, the "Service"), how we use it, and the choices you have. This policy complies with applicable data-protection laws, including the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where applicable, the EU/UK General Data Protection Regulation.
2. Scope
This policy applies to information processed when you download, install, register for, or use Narravo on any supported platform. It does not apply to third-party services that you choose to connect to the app, which are governed by their own privacy policies.
3. Information we collect
3.1 Information you provide
- Account information. When you create an account or sign in, we collect identifiers such as your email address, display name, and a unique user ID. If you sign in with Apple or Google, we receive only the basic profile fields you authorize.
- User content. Text you type or paste into the app, documents and files you import (PDF, DOCX, TXT, etc.), links you submit, and any voice/style preferences you save. We refer to this as "Input Content".
- Generated audio. Speech audio that the Service produces from your Input Content and any edits you make to it.
- Files and media. When you import a document, link, image, or file, we collect the file content and metadata (file name, size, type) so we can convert it to speech and store the result.
- Communications. When you contact support, we collect the messages, attachments, and contact details you provide.
3.2 Information collected automatically
- Device & app data. Device model, operating system and version, app version, language, time zone, country, screen size, locale, install source, and a randomly generated installation identifier.
- Usage data. Events such as screens viewed, features used, audio generations started, errors, crashes, session duration, and similar product analytics. Session-replay-style analytics may capture anonymized interaction events (taps, scrolls, screens) but not the content of your Input Content.
- Subscription & purchase data. Subscription status, plan, transaction identifiers, store country, and renewal/cancellation events received from the App Store, Google Play, or our subscription provider. We do not receive your full payment card number.
- Diagnostics. Crash logs, performance traces, and stack traces (with personal content stripped where reasonably possible).
- Approximate location. We may infer your country/region from your IP address. We do not collect precise GPS location.
3.3 Information from others
- Sign-in providers. If you sign in with Apple or Google, we receive the profile fields you authorize.
- Attribution & measurement partners. We may receive non-content signals (such as install attribution and campaign IDs) to understand how users discovered Narravo.
4. How we use information
- To provide the core Service: converting your Input Content into speech audio, applying the voice and style you chose, storing the resulting files, and syncing across your devices.
- To authenticate your account and keep it secure.
- To process subscriptions, manage entitlements, prevent fraud, and handle refunds.
- To debug issues, monitor performance, and improve features.
- To measure marketing campaigns and understand which channels drive new installs (where permitted).
- To communicate with you about your account, important updates, security notices, and (with your consent where required) product news.
- To comply with legal obligations and enforce our Terms of Use.
We do not sell your personal information, and we do not use the content of your Input Content or generated audio to serve third-party advertising.
5. Text-to-speech processing
Narravo uses a third-party speech-synthesis engine to turn your Input Content into spoken audio. To do so, we transmit the relevant text from our backend to the speech provider acting as our processor, which returns the audio file.
Provider we currently use:
- Microsoft Corporation — Azure AI Speech (Cognitive Services Text-to-Speech) for neural voice synthesis of the text you submit. Privacy statement: privacy.microsoft.com/privacystatement.
We may add, change, or replace this provider as the Service evolves. When we do, we will update this section.
- Content is transmitted over encrypted connections (TLS).
- We rely on the standard data-processing terms offered by our speech provider, which today do not use API inputs to train their public foundation models by default. Where the provider offers additional enterprise data-processing addenda or stricter no-training options, we may enable them where commercially feasible.
- Input text is sent for the sole purpose of returning the requested audio result and is handled by the provider in accordance with their published retention and security terms.
- Synthesized speech may occasionally mispronounce words, misread numbers, or otherwise produce results that are not exactly what you intended. You are responsible for reviewing generated audio before relying on it.
6. Legal bases for processing (KVKK / GDPR)
We process your personal data on the following legal bases under the Turkish Personal Data Protection Law ("KVKK") and, where applicable, the EU/UK GDPR:
- Performance of a contract — to provide the Service you requested (Article 5(2)(c) KVKK; Article 6(1)(b) GDPR).
- Legitimate interests — to keep the Service secure, prevent abuse, debug issues, measure aggregate usage, and grow our business in a way that is balanced against your rights (Article 5(2)(f) KVKK; Article 6(1)(f) GDPR).
- Consent — for optional analytics, advertising identifiers, and marketing messages, where required by law (Article 5(1) KVKK; Article 6(1)(a) GDPR). You can withdraw consent at any time.
- Legal obligation — to comply with applicable laws (Article 5(2)(a) KVKK; Article 6(1)(c) GDPR).
8. Third-party services we use
The table below lists the third-party services we currently rely on, the provider, and what we use them for. Specific providers may change over time as we improve the Service; when they do, we will update this section.
| Category | Provider | Purpose |
|---|---|---|
| Authentication, database & object storage | Supabase, Inc. | Account sign-in, account data, sync, and hosting of your imported files and generated audio |
| Backend | Tupandas (operator of Narravo) | API, request routing to the speech provider, and entitlement enforcement |
| Text-to-speech synthesis | Microsoft Corporation — Azure AI Speech | Converting your Input Content into spoken audio in the voice and style you choose |
| Subscriptions | Apple App Store, Google Play, RevenueCat (RevenueCat, Inc.) | Managing purchases, entitlements, and renewals |
| Product analytics & session insights | Microsoft Clarity (Microsoft Corporation) | Measuring usage, navigation flow, and reliability |
| Customer support & email | Email and helpdesk providers (e.g. transactional email gateways) | Responding to your requests |
9. Analytics & advertising identifiers
On iOS, we ask for your permission through Apple's App Tracking Transparency framework before accessing the IDFA. If you decline, we do not access the IDFA and limit what we share with attribution partners. We do not use third-party advertising networks to show you ads inside the app.
You can change your tracking preference at any time in your device settings.
10. Data retention
- Account & content — kept while your account is active. If you delete an item (Input Content, generated audio, or a project), we delete it from active storage and from backups within a reasonable period.
- Account deletion — when you delete your account, we delete or anonymize your personal data within 30 days, except where we are required to keep it for legal, tax, or security reasons.
- Diagnostics & analytics — typically retained for up to 14 months in identifiable form.
- Subscription records — retained for the period required by Turkish tax and consumer-protection law (generally up to 10 years for financial records under the Turkish Tax Procedure Law).
- Support records — retained for up to 5 years for quality assurance and legal compliance.
11. Security
We use industry-standard safeguards including encryption in transit (TLS), encryption at rest where supported by our providers, access controls, audit logging, and least-privilege principles. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security. If we become aware of a security incident affecting your data, we will notify you and the relevant authorities (including the Turkish Personal Data Protection Authority where applicable) as required by law.
12. International transfers
Narravo is offered globally. Your information may be processed in countries other than your own, including in the United States, the European Union, and Türkiye. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. Where we transfer personal data out of Türkiye, we rely on the safeguards permitted under Article 9 of the KVKK.
13. Your rights
Depending on where you live, you may have the following rights:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Deletion — ask us to delete your account and associated data.
- Portability — receive your data in a structured, commonly used format.
- Restriction or objection — limit or object to certain processing.
- Withdraw consent — where processing is based on consent.
- Lodge a complaint — with your local data-protection authority (in Türkiye, the Kişisel Verileri Koruma Kurumu).
You can exercise most of these rights from inside the app (for example, by editing your profile or deleting your account) or by contacting us at [email protected]. We will respond within the time required by applicable law (30 days under the KVKK).
14. Children's privacy
Narravo is not intended for users under 18 years of age. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected information from a user under 18, we will delete it. If you are under 18, please do not use the Service.
15. California & US state rights
If you are a California resident, the California Consumer Privacy Act (CCPA/CPRA) gives you the right to know what personal information we collect, the right to delete it, the right to correct inaccurate information, and the right to opt out of "sale" or "sharing" of personal information. We do not "sell" personal information as that term is commonly understood. Residents of other US states with comparable laws (such as Virginia, Colorado, Connecticut, Utah, and Texas) have similar rights, which can be exercised by contacting us at the address below.
16. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you in the app, by email, or by updating the "Last updated" date at the top of this page. Your continued use of the Service after the change becomes effective means you accept the updated policy.
17. Contact us
If you have any questions about this Privacy Policy or our handling of your personal information, please contact us:
- Operator: Tupandas
- Email: [email protected]