Privacy Policy
This describes what we collect and why, in plain language. It is short because we collect very little: the audio pipeline does not need to know who you are beyond your account, and the only third-party analytics we run is Google Analytics, configured as described below.
What we store about your account
An email address, a display name if you provide one, a password hash if you signed up with a password, and a Google account identifier if you signed in with Google. We also store the country reported by our network provider, whether you last used a phone or a desktop browser, and a record of where you first arrived from — a search engine, a referring site, or direct.
We do not store your password. We store a bcrypt hash, which cannot be reversed into the original.
What we store about your content
Scripts, characters and rendered audio belong to your account and are stored so you can come back to them. We do not use your scripts to train voice models, and we do not read them except when you ask us to investigate a specific problem and give us permission.
Deleting a project deletes its scripts and audio. Deleting your account deletes everything associated with it.
Analytics, and what makes ours unusual
Page views are recorded by a small first-party script that sends the path, the referring site, the language and — if the link you arrived by carried one — its campaign tag (utm_source or ref) to our own server. When you leave the page it sends one more note: how long the page was in the foreground, how far down you scrolled, and whether you clicked, tapped or typed at all — not what you clicked or where. It sets no cookie. Instead of storing your IP address, we store a hash of your IP, your browser string and a salt that changes every day — which means the identifier cannot be used to follow you from one day to the next, and cannot be reversed into an IP address.
Google Analytics 4 also runs on the production site. Because it is a third party it is worth being exact about what it does, so here is the configuration rather than a reassurance. Advertising signals — ad storage, ad user data and ad personalisation — are denied in every region, so nothing collected here feeds ad targeting or remarketing. Analytics storage is denied by default in the EEA, the United Kingdom and Switzerland: in those regions Google Analytics sets no cookie and stores no identifier, and sends cookieless pings only. Those pings still carry the page address, the referring site and your device and browser details, and they reach Google from your IP address; what they lack is anything that ties one visit to the next. There is no consent banner yet, which means consent is never granted there — the denied default is the permanent state until we build one.
Outside those regions analytics storage is allowed, and Google Analytics does set its own cookies (_ga and _ga_*) to tell a returning visitor from a new one. That is a real cookie, set without asking you, and it is the one thing on this site that does not match the first-party script described above. Google receives the page address, the referring site, the approximate location derived from your IP, and your device and browser. It does not receive your email address, your script text, or any audio. You can stop it by blocking googletagmanager.com, by using Google's official opt-out add-on, or by any content blocker — nothing on the site depends on it.
Voice clone recordings
When you clone your voice, the only thing you give us is one recording: you reading the consent statement shown in the studio, which contains your name and the date. That recording is both the consent record and the voice. We store it on our own servers, together with the statement text, the name you gave the voice and when it was made. We do not train a voice model from it.
Each time a line is synthesised with your cloned voice, the recording is made available to our speech synthesis provider through a signed link that expires after ten minutes, together with the statement text and the line to be read. The provider does not receive your email address or account details.
We keep the recording until you delete the clone, which you can do from the studio at any time; deleting it also deletes the audio generated with it. The person whose voice was cloned may ask us to delete it whether or not they hold the account that created it. We do not ask for a reason. We keep a log entry that a clone was created or deleted, without the audio.
Who else sees your data
The speech synthesis provider receives the text being rendered and the voice identifier — and, for a cloned voice, the consent recording and its statement text, as described in the section above. It does not receive your account details. Which provider is in use is shown in the app, and the provider layer is designed so the answer can change without anything else changing.
We do not sell data, and we do not share it with advertisers. There are no advertising trackers on this site, and the one third-party analytics tool, described in the analytics section above, runs with every advertising signal denied.
Your rights and how to use them
Email [email protected] to request a copy of your data, a correction, or deletion. We will do it. If you are in a jurisdiction with statutory data rights, this is how you exercise them; if you are not, the process is the same, because having two processes would be silly.
This document is a working draft written by the team, not a lawyer-reviewed final. It will be reviewed before payments are enabled, and this note will come off when it has been.