← Back to Home

Privacy Policy

Last Updated: April 26, 2026

VibeReader ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our Chrome extension and web application. This policy is compliant with GDPR (General Data Protection Regulation) and CCPA (California Consumer Privacy Act).

1. Information We Collect

We collect the following types of information:

• Account Information: When you sign up via Google OAuth, we collect your email address, name, and Google profile picture.
• Usage and product analytics: We record playback duration, selected voice/provider, playback speed, coarse onboarding and feature events, and subscription/payment status to operate the service and understand aggregate product usage. We use Google Analytics 4 for website page views and product events from both the website and extension. Pre-signup events use a random session identifier; signed-in events use a pseudonymous identifier derived from your account ID. For extension analytics, we may include an approximate country code resolved transiently from the request IP; the IP itself is not sent to Google Analytics. We do not send your email, reading text, or full page URL/domain to Google Analytics; page views use fixed product route names.
• Text Content: Text you select for text-to-speech conversion is temporarily processed through third-party TTS APIs (Fish Speech, Edge TTS) but is NOT stored permanently by VibeReader.
• Payment Information: Payment processing is handled by Paddle.com (our Merchant of Record). We do not store your credit card details.
• Extension Data: The Chrome extension stores your authentication token, preferences, and usage statistics locally in your browser.
• Technical Data: We may process IP addresses for security and abuse prevention. For country-level audience analytics, the request IP is temporarily sent over HTTPS to MaxMind GeoLite Country to resolve an approximate country; we do not store the IP or precise location. We store only a country code, activity source, and a pseudonymous account key for aggregate counts. Product analytics does not store the text you read or the URLs/domains of pages you visit.

2. How We Use Your Information

We use your information to:

• Provide and improve our text-to-speech services
• Manage your account and subscription
• Track credit usage and enforce plan limits
• Send important service updates and notifications
• Respond to support requests

3. Data Storage and Security

Your data is stored securely in Supabase (PostgreSQL) with industry-standard encryption. We implement appropriate technical and organizational measures to protect your personal information.

4. Third-Party Services and Data Processing

We use the following third-party services:

• Google OAuth: For secure authentication
• Paddle.com: For payment processing (Merchant of Record)
• Fish Speech API: For premium AI voice synthesis. Important: Text you convert is sent to Fish Speech servers for processing but is NOT stored or used for training AI models without your explicit consent.
• Microsoft Edge TTS: For free text-to-speech conversion
• Google Analytics 4: For aggregated website and extension usage analytics, including page views, onboarding, playback/provider, and subscription funnel events. Signed-in analytics use a pseudonymous identifier; we do not send account email, page text, or the pages' URLs/domains. Extension activity may include an approximate country code, but not the request IP.
• Heroku/PostgreSQL: For secure database hosting

Data Processing Disclosure: When you use our service, your selected text is temporarily transmitted to third-party TTS APIs (Fish Speech, Edge TTS) for audio generation. These providers process your text in real-time but do NOT store it for training purposes. Audio files are generated on-demand and are not permanently stored by VibeReader or our TTS providers.

Product analytics: Analytics events may include the event name, a random onboarding session identifier, selected voice/provider, coarse source type (website or extension), duration, speed, character/byte counts, and technical outcome codes. These events are sent to Google Analytics 4; signed-in events use a pseudonymous identifier rather than an email or account ID. Website page views use fixed product route names; we do not send page text, user-generated page titles, full URLs, or domains. For country-level audience analytics, an IP address is checked transiently through MaxMind GeoLite Country; only the approximate country code and a separate pseudonymous account key are retained, not the IP or precise location. Extension listening events may also include that approximate country code in Google Analytics, but never the IP itself. Paddle-confirmed billing events are used for subscription reporting. Analytics figures are used to understand aggregate product usage, not to build browsing profiles.

These services have their own privacy policies governing their use of your information.

5. Cookies and Local Storage

We use cookies and browser local storage to:

• Maintain your login session
• Store your preferences (voice, speed, etc.)
• Track usage for analytics

6. Your Rights (GDPR & CCPA)

Under GDPR and CCPA, you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your account and data ("right to be forgotten")
• Right to Data Portability: Export your data in a machine-readable format
• Right to Object: Opt out of marketing communications
• Right to Restrict Processing: Limit how we use your data
• Right to Withdraw Consent: Revoke consent for data processing at any time

To exercise any of these rights, contact us at support@vibereader.ai. We will respond within 30 days.

7. Data Retention

We retain your data for as long as your account is active or as needed to provide services. If you delete your account, we will:

• Delete your personal information within 30 days
• Anonymize usage statistics for analytics purposes
• Retain billing records for 7 years as required by law

Text content sent to TTS APIs is NOT stored by VibeReader and is deleted immediately after audio generation.

8. Children's Privacy (COPPA Compliance)

VibeReader is not intended for users under 13 years of age. We do not knowingly collect personal information from children under 13. If we discover that a child under 13 has provided us with personal information, we will delete it immediately.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through the application.

10. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy and applicable laws.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us at:

Email: support@vibereader.ai

Data Protection Officer: Available upon request