Privacy Policy

Our Principles

AI Voice — Text to Speech has designed this Policy to be consistent with the following principles:

• Privacy policies should be human-readable and easy to find.
• Data collection, storage, and processing should be simplified as much as possible to enhance security, ensure consistency, and make the practices easy for users to understand.
• Data practices should meet the reasonable expectations of users.

Information We Collect

We collect information when you provide it directly to us, when your browser communicates with our hosted services or analytics provider, and through service providers acting for the purposes described below. Information processed locally by the extension is described separately.

Information You Provide Directly to Us

When you contact us, we receive your email address and the message, attachments, and other information you choose to provide. An optional feedback form, including one opened after uninstallation, collects selected reasons, their displayed labels, an optional comment, and the extension concerned. Submitted feedback is stored in Supabase. The feedback application does not add your IP address or browser user agent to the feedback record, although infrastructure may process connection information separately. Comments may contain personal information if you include it. We do not require user accounts or collect payment details, newsletter subscriptions, or donation information through these Services.

Information that Is Automatically Collected

Device/Usage Information

Optional usage statistics contain limited feature events and predefined error codes, as described under “Usage Statistics.” Requests to hosted services expose connection information, including IP address, browser information, request time, service path, response status, and error details. Vercel and other service providers may process this information in operational and security logs to deliver, protect, and troubleshoot those services. Such logs are separate from optional usage statistics.

Cookies and Other Tracking Technologies

We do not use analytics cookies, tracking pixels, or a persistent device ID. The extension stores preferences, including your usage statistics choice, locally in your browser. Local storage used for extension functionality is distinct from analytics identification. Our analytics processing does not collect page URLs, page titles, browsing history, selected text, or location information. We do not use session replay or person profiles. Analytics identification is described under “Usage Statistics.”

Information from Third Parties

We receive usage reports from PostHog and technical information from providers operating our hosted services. We use this information only for the purposes stated in this Policy. We do not obtain personal information from data brokers, social media platforms, or marketing research firms, or combine extension data with advertising profiles.

How We Use Your Information

We use the information we collect from and about you to:

• Fulfill the purposes for which you provided it and deliver the Services you request.
• Provide and improve the Services, including feature development, technical support, and service security.
• Process and respond to inquiries and voluntary feedback.
• Conduct limited usage analytics and reporting to understand feature use and technical failures, subject to your choices and applicable consent requirements.
• Comply with legal obligations and protect the safety, rights, property, or security of the Services, our users, and the public.

We may aggregate information for internal research and service improvement. We do not sell personal information or use extension data for advertising, fundraising, or unrelated marketing. Identifiable or pseudonymous records remain subject to this Policy even when direct identifiers have been removed.

When We Disclose Your Information

We may disclose information under the following circumstances:

Service Providers.

We disclose information to providers performing hosting, storage, analytics, support, or requested processing on our behalf, limited to the purposes and data described in this Policy. PostHog processes optional usage statistics using its EU service. Vercel hosts our policy and feedback pages, and Supabase stores submitted feedback.

Vercel also hosts our AI-voice backend; Google Cloud Text-to-Speech receives text and voice settings to synthesize requested speech; and Supabase stores IP-hash quota records. Google or another browser voice provider receives text when one of its online browser voices is used, whether you chose it or the extension picked it for the language of the text. Local browser voices do not send text through our backend.

Legal Compliance and Protection of the Services and Others.

We may disclose information where legally required or reasonably necessary to (a) comply with legal process; (b) investigate misuse or protect the Services; (c) respond to your support requests; or (d) protect our rights, property, or personal safety, or those of our users and the public. Disclosures for fraud protection or security are limited to information necessary for those purposes.

Business Transfers.

If ownership or operation of the Services is transferred, information necessary to continue providing the Services may be transferred, subject to applicable law and the restrictions in this Policy, including the Limited Use requirements below. Such a transfer does not authorize sale of user data for advertising or unrelated purposes.

Affiliated Companies.

We do not share extension data with affiliates for their independent use. Any affiliate acting as a service provider is subject to the same purpose limitations and restrictions described above.

Consent.

We may disclose specific information to another party at your request or with your consent, where permitted by applicable law and the Limited Use requirements. Such consent is specific to the disclosure and is not inferred from acceptance of this Policy.

Aggregate/De-identified Information.

Aggregated and anonymized information may be used for internal service operations and improvement. Pseudonymous analytics events are not treated as anonymous merely because they use a hash. We do not share user data with advertisers or promotional partners.

Chrome Web Store Limited Use.

Our use and transfer of user data, including information received through Chrome APIs, adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Such data is used only to provide or improve the Services’ disclosed features. It is not used or transferred for personalized, retargeted, or interest-based advertising, creditworthiness, or lending decisions. Transfers are limited to those necessary to provide or improve these features, comply with applicable law, protect security, or carry out a permitted business transfer. Human access is limited to your consent to review specific data, necessary security investigations, legal requirements, or aggregated and anonymized data used for internal operations.

Legal Basis for Processing Personal Data

Where applicable law requires a legal basis for processing personal data, we rely on the following grounds, according to the purpose and circumstances of the processing.

To Honor Our Contractual Commitments to You.

We process information necessary to provide the Services you request. This includes processing text and voice settings for requested AI speech and IP-hash usage records to administer the daily allowance. Optional analytics is not a condition of providing the core extension features.

Legitimate Interests.

Where permitted by law, we rely on legitimate interests in customer support, service security, abuse prevention, understanding technical failures and feature use, and improving the Services. We balance these interests against your interests and fundamental rights and freedoms, taking account of the limited data collected, reasonable expectations, and available controls. We do not rely on this ground where your rights override those interests or the law requires consent.

Legal Compliance.

We may use and disclose information as necessary to comply with our legal obligations.

Consent.

Where required by law, we obtain consent before the relevant processing begins. A visible notice or continued use of the Services does not replace that consent. The absence of cookies does not itself remove consent requirements. You may withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

Online Analytics

We use PostHog’s EU service for limited analytics, research, and reporting concerning extension feature use and failures. Processing is restricted to the information and purposes described under “Usage Statistics” and is subject to the choices and legal bases described in this Policy. We do not use Google Analytics or advertising trackers for these extension usage statistics.

Text You Select

The extension runs on the web pages you open so that it can react when you select text. It reads only the text you select, and only when you start reading aloud from the context menu or the optional selection button. The extension processes selected text locally to divide it into sentences, control playback, and highlight the text being read. Your engine choice, voice, speed and player preferences, your usage statistics choice, the version of the statistics notice you have seen, your opt-in record where you gave one, and the region decision described under “Usage Statistics” are stored in Chrome’s local extension storage.

With browser voices, processing depends on the voice used. Voices installed locally synthesize speech on your device. Online browser voices, including Chrome voices named “Google …”, send text to their provider for synthesis under the browser and provider’s privacy practices. When the text is in a different language from your chosen voice, the extension may pick a voice for that language automatically for that reading, so an online voice can be used without you selecting it. These online voices operate separately from our AI-voice backend.

When you request an AI voice, selected text and voice settings are sent to our backend hosted by Vercel and then to Google Cloud Text-to-Speech to generate audio returned to your browser. Our application does not store the submitted text or generated audio in its database or retain a reading history. Text and audio are processed during requests and playback. Infrastructure and provider logs may contain request-related information; the absence of application storage does not guarantee that no service data is retained by those providers.

To apply the free daily character allowance for the paid Google Cloud speech service, the backend derives a keyed hash of your IP address, and Supabase stores this hash, the date, and character usage counts instead of the address itself. The hash is computed with a secret key held on our server, so nobody who does not hold that key can link it back to your address; it stays the same for as long as your address and the key do. Checking the remaining allowance also uses this service. The quota hash is separate from the daily analytics identifier. Quota processing is necessary to operate the requested AI-voice service and continues independently of optional usage statistics.

Usage Statistics

The extension sends individual usage events directly to PostHog’s EU service through event requests. These events include six event types: popup opened, setup completed, speech started, speech completed, speech failed, and daily allowance reached. Each event carries at most the engine used (browser or AI), where reading was started (menu, selection button, player, setup, popup or welcome page), whether a voice was chosen automatically for the language of the text, whether a browser voice was used as a fallback, one of a fixed list of error codes, and the extension’s name and version. They exclude selected text, page titles, page URLs, browsing history, and location information: the IP address is removed before PostHog’s location enrichment runs, and a filter removes any location field that might still appear. Session replay and person profiles are disabled.

No analytics identifier or analytics cookie is stored in your browser. PostHog receives your IP address and browser information with each request. On the server, it hashes the IP address together with browser information, the app identifier, and the day, using a salt that changes daily. The resulting identifier groups events within one app and day; it is not a persistent device ID. The raw IP address is not stored in the analytics event. This processing is pseudonymous and is not a guarantee of anonymity. Individual events are kept for no more than 24 months; daily identifier changes do not delete them.

Whether usage statistics need your prior consent depends on where you are. The EU General Data Protection Regulation applies to all processing described in this Policy, because the controller is established in Bulgaria; what varies with your location is whether rules on information stored on or read from your device require your prior consent for these statistics. Where they do not, optional statistics rest on our legitimate interest in understanding feature use and technical failures, and you can turn them off at any time.

When the popup or welcome page opens, the extension asks our backend, hosted by Vercel, for the country of your connection. Vercel derives the country from your IP address, and our backend returns only the two-letter country code. Our backend does not store the IP address or the country; Vercel may process connection information in its operational logs as described under “Device/Usage Information.” If this check fails, the extension estimates the region locally from your browser’s time zone and language settings and treats unclear signals as requiring consent. The extension keeps the detected country code, the resulting decision and the time of the check in local extension storage, and repeats the check each time the popup or welcome page opens until you have made an explicit choice. After you choose, no further lookups are made. We rely on our legitimate interest in applying the consent rules that apply to you.

In the European Economic Area, the United Kingdom, and Switzerland, usage statistics stay off until you choose to share them, and no usage statistics are sent before that choice. The time of your choice and the version of the prompt are stored locally as a record of your consent. Elsewhere, usage statistics are on by default after a visible notice. An existing choice to keep statistics off is preserved, and a choice to share is kept if your detected region changes. You may turn usage statistics off in the AI Voice popup’s usage-statistics control. Turning them off stops all optional analytics collection and sending, and your choice is stored locally. An event that is already being sent at the moment you turn statistics off, or at the moment your region is detected as one that requires consent, may still arrive. Core features remain available. This choice does not delete events already sent or prevent processing necessary for services you request, including support and feedback.

Your Choices and Data Subject Rights

You have the following choices and rights concerning information processed through the Services.

Communications

We use support correspondence to respond to your request. We do not send newsletters or marketing subscriptions through the Services. You may contact contact@ai-voice-reader.com concerning further correspondence or deletion of messages we hold.

Extension Preferences

Preferences are managed locally without an account. You may disable usage statistics as described above and remove local extension data through your browser. We cannot retrieve or delete information that exists only on your device on your behalf.

EU Data Subject Rights

Individuals in the European Economic Area (“EEA”) and other jurisdictions may, subject to applicable exceptions and limitations, request confirmation of processing, access, correction, deletion, restriction, or portability of personal data. You may object to processing based on legitimate interests and withdraw consent where it is relied upon. Contact contact@ai-voice-reader.com with the nature of your request. We may need proportionate information to verify it and locate the records concerned. Without a persistent analytics identifier, we may be unable to associate particular events with you. You also have the right to complain directly to the relevant supervisory or legal authority, whether or not you contact us first.

International Transfers

As described under “When We Disclose Your Information,” service providers may process information outside your country of residence, where privacy protections may differ. Our analytics project uses EU hosting; this does not mean every provider or support operation processes information exclusively within the EEA.

Where personal data is transferred outside the EEA or another jurisdiction requiring transfer safeguards, we use the safeguards required by applicable law, such as an applicable adequacy decision or appropriate contractual protections. Use of the Services does not itself constitute consent to an international transfer.

The providers that receive personal data in connection with AI Voice, what each receives, where it processes data, and the transfer safeguard that applies:

• Vercel Inc. (United States) hosts our AI-voice backend, this website and the feedback pages. It receives connection data (IP address, browser information) for every request and carries the selected text, voice settings and country lookup in transit. Its primary processing facilities are in the United States. Vercel is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, and provides EU standard contractual clauses in its data processing addendum.
• Google LLC (United States), through Google Cloud Text-to-Speech, receives the selected text and voice settings to synthesize speech, and may process data in any country where Google maintains facilities. Google LLC is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework; processing is governed by the Google Cloud Data Processing Addendum.
• Supabase Pte. Ltd. (Singapore) stores the IP-hash quota records and submitted feedback in the hosting region selected for each database, and may process data in the United States and Singapore. Transfers rely on EU standard contractual clauses with the UK and Swiss addenda in its data processing addendum.
• PostHog Inc. (United States) receives optional usage events, including your IP address and browser information at receipt, and stores the resulting daily hash and the event, without the address or any location derived from it, on its EU Cloud, hosted in Frankfurt, Germany. Any access from outside the EEA relies on EU standard contractual clauses under PostHog’s data processing agreement.

Security Measures

We use technical and organizational safeguards to protect against loss, misuse, and alteration of information. Safeguards vary with the sensitivity and location of the information processed. However, no Internet transmission or electronic storage can be completely secure, and we cannot guarantee prevention of every unauthorized access, use, or disclosure. Local extension storage also depends on the security of your device and browser profile.

Children

The Services are not directed at children under the age of 13, as defined by the Children’s Online Privacy Protection Act, or under the age of 16, as defined by the EU GDPR. If we become aware that we have collected personal information from a child below those ages, we will take reasonable steps to delete it as soon as practicable.

Data Retention

We retain information for as long as necessary for the purposes in this Policy, subject to applicable legal requirements. Individual analytics events are kept for no more than 24 months, which is long enough to compare feature use and reliability across releases and to investigate recurring technical issues. Our analytics provider’s plan would keep them longer by default, so we delete events older than 24 months ourselves at least once a year. Rotation of their daily identifier does not shorten this period.

Local settings remain until changed or local extension data is removed. Our application does not retain reading text or generated audio in its database. IP-hash quota records are kept to administer the allowance and prevent abuse and are deleted automatically once they are older than 24 months; resetting the daily allowance does not delete them earlier. You may ask us to delete the records for your address sooner. Provider service data and logs are retained under their applicable terms and settings.

Feedback is retained in Supabase for as long as necessary to investigate issues and improve the Services. Support correspondence is retained as necessary to handle inquiries and related obligations. Provider operational and security logs follow the relevant provider’s retention settings; no uniform retention period applies to all such logs. Information may persist in backups for additional time. You may request deletion of personal information we can identify, subject to applicable exceptions.

Third-Party Links and Services

The Services may contain links to third-party websites or services. If you choose to use them, information you provide is subject to their privacy practices. We are not responsible for the content or privacy practices of independent third-party websites. We encourage you to review their privacy statements. Processing by providers on our behalf remains subject to the purposes and restrictions described in this Policy.

Changes to this Privacy Policy

We will continue to evaluate this Policy as we update and expand the Services and may make changes accordingly. We will post changes here and revise the date last updated. We encourage you to check this page periodically to stay informed about our information practices. We will provide notice of material changes and obtain consent where required by applicable law.

Questions About this Privacy Policy

If you have any questions about this Policy or our privacy practices, you can contact us at contact@ai-voice-reader.com.