Privacy Policy

This policy explains what WebToSpeech collects when you use the website at kokoro.webtospeech.app and the WebToSpeech browser extension, why we collect it, who we share it with, and the choices you have. WebToSpeech is run by EngBlock; “we” and “us” mean that business.

The short version: we collect what we need to read pages aloud for you and to take payment. We do not sell your information, show you advertising, or track you across other websites.

What we collect

Your account

Your name, your email address, and your password. The password is stored as a one-way hash, so we cannot read it. We also record whether you have confirmed your email address and which voice you prefer.

The pages you have read aloud

For every page or PDF you ask us to read, we keep:

• the address of the page, and its title;
• the text we took from it, stored as the script that is read aloud, including any changes you make to that script in the composer;
• the voices you chose, the audio we generated, its length, and when it was made, which is how we count your monthly hours.

Payments

Payments are taken by Stripe. Your card details go straight to Stripe and never reach our servers. We keep a reference to your Stripe customer record, your card’s type and last four digits, and the state of your subscription. Stripe holds your billing address and your invoices.

Technical information

While you are signed in we keep your IP address and your browser’s user agent alongside your session. To find faults and stop abuse, our monitoring records errors, log messages and a sample of requests, which include the address requested, the time, the IP address, and the account that made the request.

Cookies

We use only the cookies the site needs to work: one that keeps you signed in, one that protects forms against forgery, and one that remembers you between visits if you tick “Remember me”. Your choice of light or dark appearance is kept in your browser’s own storage. There are no advertising or analytics cookies, which is why there is no cookie banner.

The browser extension

The extension does nothing until you click its button. When you then choose to listen to or compose a page, it opens WebToSpeech in a new tab and passes along the address of the tab you were on. It does not read the contents of the page, does not see your other tabs or your history, and does not run in the background.

How we use it

• To provide the service: fetching the pages you ask for, turning them into audio, and keeping your audio available to you.
• To take payment and to work out what your plan covers.
• To send you the emails the service depends on, such as confirming your address or resetting your password. We do not send marketing email.
• To keep the service working and secure, and to stop it being abused.
• To meet our legal obligations, such as keeping tax records.

If the GDPR or a similar law applies to you, our legal bases are that we need the information to perform our contract with you, that we have a legitimate interest in keeping the service secure and working, and that some records are required by law.

Listening links are open to anyone who has them

Every recording has its own link containing a long random identifier. Anyone who has that link can listen to the recording, download it, and see the page’s title and where it came from. The link does not show your name or your email address, and we do not publish a list of recordings. Treat a link the way you would treat a shared document: anyone you send it to can pass it on.

Because a page’s address, and any PDF, is sent to the companies below and the result can be opened by anyone with the link, please do not ask us to read pages that contain information you need to keep private.

Who we share it with

We share information only with the companies that help us run the service, and only what each one needs:

• Google (Gemini API) receives any PDF you ask us to read, so it can be transcribed, and the text of a script you ask to have directed in the composer, so its roles can be cast. Pages are read aloud on our own server, so the text you listen to is not sent to Google to be turned into speech.
• Defuddle receives the address of a web page you ask us to read, fetches it, and returns its main text. It is not told who you are.
• Stripe receives your name, your email address, and whatever you enter at checkout, in order to take payment, work out tax, and issue invoices.
• Cloudflare carries the traffic between you and our server, stores finished audio, and delivers the emails we send you.
• netcup hosts our server, which runs our database and reads pages aloud, in the European Union.
• Laravel Nightwatch receives the errors, log messages and sampled requests described under “Technical information”.
• Proton hosts our mailbox, so it holds any email you send us.

We may also disclose information when the law requires it. If WebToSpeech is ever sold or merged, your information would pass to the new owner under this policy, and we would tell you beforehand.

Where it is kept

We are based in Australia, our server is in the European Union, and the companies above operate in the United States and other countries. Using WebToSpeech therefore means your information is processed outside the country you live in.

How long we keep it

• Your account, your scripts and your recordings are kept until you delete your account.
• Deleting your account in your settings removes your details, your scripts and your list of recordings from our database straight away, and every listening link stops working. The audio files are removed from storage within 30 days.
• There is not yet a button for deleting a single recording. Email us the link and we will delete it for you.
• Sessions end after two hours without activity, unless you ticked “Remember me”.
• Monitoring data and logs are kept for a limited period and then deleted automatically.
• Records of payments are kept for as long as tax law requires, generally five years, even after your account is deleted.

Your choices and rights

You can change your name and email address, and delete your account, in your settings. You can also ask us for a copy of the information we hold about you, ask us to correct or delete it, or object to how we use it. Email [email protected] from the address on your account and we will respond within 30 days.

If you are unhappy with how we have handled your information, please tell us first so that we can put it right. You can also complain to the Office of the Australian Information Commissioner, or to the data protection authority where you live.

Security

The site is served over HTTPS, passwords are hashed, and access to the server is limited to the people who run it. No system is perfectly secure. If a breach is likely to cause you harm we will tell you, and tell the regulator where the law requires it.

Children

WebToSpeech is not meant for anyone under 16, and we do not knowingly collect information from them. If you believe a child has created an account, email us and we will delete it.

Changes to this policy

When we change this policy we will update the date at the top. If a change affects how we use information we already hold, we will email you before it takes effect.

Contact

WebToSpeech is run by EngBlock, a business based in Victoria, Australia.

Write to us at [email protected]. We aim to reply within a few working days.