What leaves your phone when you use Tellune
A stage-by-stage account of local parsing, screenshots, coaching, storage, sync, and diagnostics.
1. Map privacy to the processing stage
Tellune privacy depends on the processing stage and optional features you use. WhatsApp text parsing and deterministic indicators run on the device. Screenshots can leave after separate confirmation; optional coaching sends selected evidence after consent; optional Private Sync sends an encrypted report document; diagnostics send content-free product fields when enabled.
| Stage | Processing location | What can leave the device |
|---|---|---|
| WhatsApp or pasted text | On the device | No raw export for parsing or indicators |
| Screenshot extraction | Tellune service and an AI reader | Compressed image copies after confirmation |
| Written coaching | Tellune service and an AI processor | Goal, indicator data and selected excerpts after consent |
| Private Sync | Encrypted locally before transfer | Opaque encrypted report document |
| Diagnostics | Tellune service when enabled | Allowlisted product and reliability fields |
The canonical Tellune privacy policy is the short legal-facing account. This article explains the implementation details behind those boundaries. It does not promise that all chat data stays on the phone.
2. Local does not mean nothing is stored
The app needs local working data to let you review an import and open a report later. On native builds, that data is protected in separate stores:
- Working draft. Normalized messages can remain in an encrypted on-device draft. Raw export text is normally dropped from the saved draft, except when it is needed to resolve an ambiguous day/month order.
- Pending full scan. A preview-tier report can keep one encrypted conversation payload on the device until the deferred Premium scan runs or that report/data is deleted.
- Report history. Native report history is encrypted on the device. It contains indicator results and coaching output rather than the imported transcript or screenshot files.
These distinctions matter when you remove data. Deleting one report also clears its matching pending scan, but it is not the same operation as wiping the current draft or deleting a sync account. Use the report deletion guide for the exact controls.
3. Screenshots and coaching use separate consent
Two optional paths can send conversation content beyond the device:
- Screenshot extraction. After you tick a separate confirmation, the app compresses selected images and sends them through Tellune’s authenticated service to an AI reader. You review the extracted text before analysis. Tellune deletes the local compressed temporary file after preparing the request and does not add the image copies to report history.
- Written coaching. After consent, the app selects a limited set of excerpts on the device. The request can include your chosen goal, deterministic indicator data, and those excerpts, with participants labeled You and Them. The raw WhatsApp export is not the coaching payload.
You can decline the coaching excerpt path and keep the deterministic indicator output. That numbers-only choice does not include the same written AI coaching.
Do not infer downstream data use from Tellune’s client behavior. The stage description above does not promise that the AI processor uses request data for no training or retains it for zero time.
4. Sync and diagnostics carry different data
Private Sync is an optional Premium feature on native builds. The app encrypts a report document before transfer. A recovery secret derives one key for encryption and a separate value for authentication; the service receives opaque ciphertext, not raw chat files or screenshots. Anyone with the recovery code can derive access, and there is no email reset in the current design.
Diagnostics are not sync. The current diagnostic event contract accepts:
- source type and device platform;
- app, parser, indicator, and analysis versions;
- a broad message-count bucket;
- duration and error codes; and
- model alias or whether the result used a model or fallback.
The event builder does not accept message text, names, filenames, screenshots, or exact timestamps. Diagnostics are enabled by default in current settings and can be turned off under Anonymous diagnostics.
No account is needed to start an analysis. A random device identifier is stored securely to bind short-lived API sessions and rate limits. Private Sync uses a recovery-code account only when the user chooses that feature.
5. Check the stage before you consent
Before a privacy-sensitive action, ask four plain questions: What is being processed? Where does that job run? What is retained afterwards? Which control removes or disables it?
Only import a one-to-one conversation you participated in and may lawfully access. Tellune is for adults.
The current Tellune support page carries release status and the safe details to include if a privacy control fails.