TARKKWHAT LEAVES YOUR PHONE
- Your IP address, to the services any web page reaches: the font CDN this site loads from, and a public STUN server if you join a channel from a browser.
- From the Android app, your IP address to tarkk.ir, when it checks at launch whether a newer version of the app or of these documents is out. It asks for a public file and sends nothing with the request.
- Only if you make an account: your email, a password hash or your Google account id, the display name and avatar you pick, your sign-in sessions and your subscription purchases. They are kept on our server in Iran.
- Whatever you deliberately send us — a diagnostic log attached to a bug report, or an email you write.
WHAT NEVER DOES
- Your voice. It is played and gone. Nothing records it, and no server — ours included — is anywhere in its path, account or no account.
- What happens in a channel: who is in it, when you talk, and what is said. Presence and channel content stay on the local link, and so do the names of the people around you, the network you are on and your phone's addresses.
- Your location. Older versions of Android demand the permission before they will scan for radios; Tarkk never reads a position out of it.
- A profile of you. An account holds only what this page lists — nothing about where you go, who you talk to or how you use the app.
- Usage stats. Tarkk sends no analytics of any kind, to us or to anyone else.
Who this covers Link to this section
Tarkk (تَرک) is an independent project, not a company. This policy covers four things: the Android app, the optional Tarkk account and the server behind it, the browser guest at app.tarkk.ir, and this website.
Every claim on this page is checkable. Tarkk is open source under the AGPL-3.0, so the code that does — or does not — collect something is public, and you are welcome to read it instead of taking our word for any of this.
Your voice Link to this section
Audio goes from one phone to another over the link you are already on: the Wi-Fi network, a hotspot one of the phones is hosting, or a direct Bluetooth connection. There is no server between them, ours or anyone else’s. Sound is played as it arrives and then discarded — it is never written to storage, never queued for upload, and never buffered anywhere it could be recovered from.
This is a property of how the app is built rather than a promise we are keeping on your behalf. If everyone walks out of range, the conversation does not exist anywhere — including here.
That does not change if you sign in or subscribe. The account server handles sign-in, your profile and your subscription, and nothing else: it never receives audio, it is not told when you are in a channel or who with, and nothing people say reaches it.
Tarkk does not add its own encryption on top of the link. On Wi-Fi your audio inherits whatever the network already protects it with; the Bluetooth link is opened without pairing, so that two phones that have never met can still talk. The short channel code keeps groups apart — it is not a password and it does not lock anything. Treat a Tarkk channel the way you would treat a radio channel: anyone with the right access to the same network, or the code, can listen. It is the wrong tool for a conversation that has to stay confidential.
Your account, if you make one Link to this section
You do not need an account to use Tarkk. An account is needed for one thing: a subscription belongs to an account, so it can follow you to another phone. You can make one with an email and a password, or — on Android — with Google sign-in.
If you do, this is everything our server keeps about you:
To identify your account, and to send the emails an account needs: verification codes and links, and password resets.
For a password account, only a one-way hash of it. The password itself is never stored.
For a Google account, the identifier Google gives your account, so the same Google account always opens the same Tarkk account. We never see your Google password.
The display name you choose, and the number of the avatar you picked from Tarkk’s fixed set. There are no photo uploads. The same name and avatar are shown to the people in a channel with you, over the local link, as they always have been.
A record for each phone signed in to the account, including its platform (such as Android) and a random install key the app creates, so a session can be ended — one at a time or on all phones at once.
Which plan you have, when it started and when it ends, and the purchase details Cafe Bazaar gives us to confirm a payment. We never see your card or bank details; paying happens entirely inside Bazaar.
Like any web server, ours sees the IP address each request comes from, as part of answering it.
The server is written in Go with a PostgreSQL database, and is hosted by ArvanCloud in data centres inside Iran. Account emails are sent through Gmail’s SMTP service.
Account data is used to run your account, send its emails and keep your subscription working.
Subscriptions and payments Link to this section
Paid features are sold as a monthly or annual subscription, through Cafe Bazaar only. Bazaar takes the payment and tells our server a purchase was made, so the subscription can be attached to your account. What reaches us is the purchase record, not your payment details.
What Bazaar collects when you buy through it is covered by Bazaar’s own privacy policy.
What stays on your phone Link to this section
Tarkk keeps a small amount of state so it can behave sensibly the second time you open it. All of it lives in the app’s own storage on your device, and uninstalling the app removes the lot. Apart from the account details described above, none of it syncs anywhere.
Language, theme, audio preferences, the callsign you type, and the switches on the Settings screen.
If you sign in: the sign-in session for this phone, and the account details the app shows you — email, name, avatar and subscription status. Signing out removes the session from the phone.
Enough about the last channel and the last connection to reconnect you automatically when someone comes back into range.
If you tap “Not now” on an update, which version that was and when, so the same reminder waits a few days before it asks again.
A rotating technical log — session lifecycle, screen on and off, socket events, which peers a packet failed to reach. If you raise the log level in Settings → Advanced → Diagnostics, it also records the pages you open and, at the highest level, every tap and settings change. Never any audio. It is capped in size (8 MB by default, adjustable), it stays on the phone unless you deliberately share it, and Settings → Advanced → Diagnostics has a button that deletes it.
Permissions, and what each one is for Link to this section
Android names some permissions much more broadly than the use they are being granted for. Here is the whole list, and what Tarkk actually does with each.
To pick up your voice and send it to the channel, live. Nothing is recorded, and the app does not listen while you are not in a channel.
To find the other phone and open the link. Only used while you are connecting over Bluetooth or the hotspot bridge.
Older versions of Android refuse to scan for Wi-Fi or Bluetooth at all unless an app holds this. Tarkk asks for it for that reason alone and never reads a position; on Android 13 and newer it is not requested.
To see which network you are on, to bind the channel to it, and to bring up a local hotspot when that is the route being used.
So the channel keeps running with the screen off and the phone in a pocket. Android requires a visible notification for that.
Optional, and asked for once. Without it some phones kill the channel a few minutes after the screen goes off.
Only when you scan a channel’s QR code. Nothing is stored and no image leaves the phone.
Declared because Android treats local network sockets as internet access. A Wi-Fi or Bluetooth channel needs no internet connection and works with none. When a connection happens to be there, the app also uses it at launch to ask tarkk.ir whether a newer version of the app or of these documents is out, and — only if you use an account — to sign in, keep your profile and check your subscription with our server. With no connection, it skips all of that and carries on.
Joining from a browser Link to this section
app.tarkk.ir lets somebody join a channel without installing anything. It is a static page: it has no accounts, no database, and no record of who opened it.
The connection itself is WebRTC, which browsers encrypt end-to-end by default — so a browser guest’s audio is in fact better protected in transit than the app-to-app Wi-Fi link. To let two devices that are not on the same network find each other, it asks a public STUN server run by Google what your public address looks like from the outside. That server sees your IP address and nothing else; it is not part of the audio path. Tarkk runs no relay server, which means audio never passes through any third party — and also means a strict corporate or carrier NAT can leave a browser guest unable to connect at all, with no fallback.
This website Link to this section
tarkk.ir sets no cookies, runs no analytics and carries no trackers or advertising. There is no consent banner because there is nothing to consent to.
It stores exactly one thing in your browser: a key called tark_lang, remembering whether you asked for English or Persian so the site stops sending you to the other one. It never leaves your browser, and clearing your site data removes it.
The page’s font is loaded from a public CDN, which — like any host serving any file to your browser — sees the request and your IP address. Everything else on the page is served from the site itself.
Links in account emails point to tarkk.ir/v/. On a phone with Tarkk installed they open the app directly. If one opens in a browser instead, the page only tells you what to do next: the code in the link stays in your browser, and the page runs no scripts and sends it nowhere.
Services we rely on Link to this section
The complete list of third parties any part of Tarkk touches. Each has its own privacy policy, which governs what it does with what it sees.
Hosts tarkk.ir, including the files the app checks for updates and the page account-email links fall back to. Sees each request the way any web host does.
Sees the IP address of a browser guest while a connection is being set up. Never carries audio.
Delivers account emails, which are sent through Gmail. If you choose Google sign-in, Google confirms your account to us and shares your Google account id and email address; it does not share your password.
Serves this website’s font, and sees the request for it the way any file host would.
Distributes the Android app and its updates, and sells and bills the subscriptions. Buying, renewing, cancelling and refunds go through Bazaar and are covered by Bazaar’s own terms and privacy policy.
Hosts the Android download, and the Tarkk account server and its database, inside Iran. Sees the requests made to them, as any host does, and stores the account data described above.
Handles donations, only if you choose to make one. That happens entirely on their site; no payment detail ever passes through Tarkk.
Children Link to this section
Tarkk is not built for or aimed at children under 13. The app works without an account, and the optional account asks for an email and a name but never an age, so there is no way for us to tell how old anyone is. If you are a parent and believe your child has made an account, write to us and we will delete it.
How long it is kept, and deleting it Link to this section
Account data is kept for as long as the account exists. You can delete the account whenever you like: in the app, go to Profile → Delete account and confirm with your email and password, or with a fresh Google sign-in. It is deleted straight away, and every phone signed in to it is signed out.
Deleting removes your email, your password hash or Google account id, your name and avatar, and your sign-in sessions. Records of purchases and subscriptions may be kept where the law or Cafe Bazaar requires it, only as long as required by law, and for no other purpose.
Deleting the account does not cancel a subscription running in Bazaar. Cancel it in Bazaar as well, or it will keep renewing.
Both ways to do it — in the app, or by an email request if you can’t use the app — and exactly what is deleted.
What you can control Link to this section
- Delete the diagnostic log at any time in Settings → Advanced → Diagnostics, or shrink the cap on how much of it is kept.
- Change your display name, avatar or password on the Profile page, sign out, or sign out on all phones at once.
- Delete your account in the app, under Profile → Delete account, or ask us to by email.
- Ask us by email for a copy of what your account holds, or to correct anything in it that is wrong. We will answer, and tell you when it is done.
- Revoke any Android permission in the system settings. The app will tell you plainly what stopped working rather than failing silently.
- Uninstall, which removes everything the app kept on the phone. If you have an account, uninstalling does not delete it — delete it in the app first, or ask us.
Changes to this page Link to this section
If what Tarkk collects ever changes, this page changes with it and the date at the top moves. A change that widens what is collected will be called out in the app’s release notes rather than left for you to spot here.
This site is part of the public repository, so the full history of what this page has said is in the commit log — you do not have to trust a “last updated” date on its own.
Contact Link to this section
Questions about anything on this page, or about something you think it fails to describe, go to the address below. A specific question about a specific line gets a specific answer.
Privacy questions, account deletion requests, and everything else.