Privacy Policy

BabaVoices · Last updated October 31, 2026

Your voice

We never receive your audio. Dictation uses your browser's built-in speech recognition (the Web Speech API). Depending on the browser and device, the browser may send your audio to its maker's speech service to turn it into text: Google's in Chrome, Microsoft's in Edge, Apple's in Safari and on iPhone and iPad. Their privacy policies cover that. The optional mic level meter reads your microphone's volume inside the page only; nothing from it is recorded or sent anywhere. Read-aloud uses your device's built-in voices. In the extension you can also pick a premium voice; if you do, the text being read aloud is sent to StreamElements' speech service (api.streamelements.com) to make the audio, under their privacy policy. The built-in voices send nothing.

What stays on your device

The text in the editor and the text you load into the Reader stay in your browser. Your dictation history is kept in your browser's storage (IndexedDB); if you're signed in, it is also synced to your account (see below). If you sign in on the web version, your sign-in session is kept in that browser's local storage until you sign out. To count the free plan's daily Polish allowance without an account, the app keeps a random anonymous ID, signed by our server, in local storage. It is not a cookie and isn't linked to you: once you're signed in, your polishes are logged under your account only, without the anonymous ID. Signing out or deleting your account doesn't erase the history saved in this browser; the app offers to clear it, and you can also use Clear all. Dictations you made while signed out are uploaded to your account only if you choose Add them when the app asks.

Polish

When you press Polish (or turn on Auto-polish), the text you dictated, not the audio, is sent over HTTPS to our server, which sends it to Anthropic's Claude to clean it up and returns the result. Anthropic does not use API data to train its models. Polish itself doesn't store your text; history sync keeps it in your account if you sign in, except on the Private plan (see below). For each polish we log only the time, your account (or, when signed out, the anonymous ID), the model used, the number of tokens and how long it took, so we can enforce the daily limits and see our costs. When you're signed out, we also keep a keyed hash (HMAC) of your IP address, never the address itself, so one network can't take more than its share of free anonymous polishes and anonymous IDs in a day. It's used only for those limits (and the same kind of hash limits ad, invite and link-reading requests), and it's deleted within 48 hours. If we turn on Cloudflare Turnstile (a check that you're a person, used against abuse of the free plan), the app may show its small widget before an anonymous polish; Cloudflare then processes your IP address and browser signals under its Turnstile privacy policy, and it sees none of your text.

In your email (extension)

In Gmail and Outlook on the web, the extension's mic button turns what you say into text and puts the polished text into the email you're writing. On computers that qualify, the extension may polish on the device with the browser's built-in AI model; then your text doesn't leave your computer, and we log only counts (characters in and out, how long it took, whether it worked), never the text. Otherwise, or if that fails, Polish works as described above. The Listen button reads an open email aloud with your device's voices. If the email is in another language, it's translated in your browser when the browser can; if it can't, the text is sent to Google Translate only after you agree.

Signing in

Signing in is optional. With email, you type your address and we send you a sign-in link and a 6-digit code (no password). Your address is used only to sign you in and to identify your account; it is never shown to friends. With Continue with Facebook, we receive your name, profile picture and email address from Facebook. We do not post to Facebook, read your friends list, or see your messages.

What we store when you sign in

• Your name (Facebook's, or the one you type) and profile picture, shown to friends you connect with.
• Your app settings (reading speed, languages, display preferences, typing and speaking speed for the time-saved meter) and saved vocabulary words, so they follow you to other devices.
• Your dictation history: the dictated text, the polished text, the language, word count and minutes saved, and when it was made. The free plan keeps your newest 20; paid plans keep everything. On the Private plan your history is never uploaded: it stays on your device, and our server refuses to store it. If you switch to Private with history already synced, the app asks once whether to delete that copy from our server (your device keeps its copy either way). Deleting an item (or Clear all) deletes it on every device. Only your own dictations are synced; another account used on the same browser never sees yours.
• Your daily reading goal and which days you met it. For each article we store a random ID, not the article's address, title or text, so the ID can't be used to work out what you read.
• Which friends you've connected with through invite codes.
• Your plan, and if you subscribe, your Stripe customer ID and when your plan renews (and, for Business, how many seats). Payments are handled by Stripe; we never see your card number. To offer the first-month price only once, we record that an account, and the anonymous ID of the device it was bought on, has used it, along with a fingerprint of the card that Stripe gives us (a code that identifies the card, not its number). This card check is what prevents repeat intro offers: if the same card was used for the offer before, the account is flagged and the next month is charged at the full price.

Friends you connect with can see your name, picture, daily goal, how many articles you read each day and your streak, and nothing else; never your dictations or what you read. This data is stored with our database provider, Supabase.

Pages you read

When you paste a link into the Reader on the web version, our server fetches that page to pull out the article text; neither the link nor the page is stored. To check the link doesn't point inside a private network, the server looks up the site's name; if its own lookup isn't available, it asks Cloudflare's public DNS service (1.1.1.1), which sees only the site's name. In the Chrome extension, a pasted link is opened in a hidden, muted tab in your own browser instead, the same as if you had opened it yourself (so sites you're signed in to show you their full article), and the tab is closed once the article is read.

When you use Read this page (Alt+L or right-click), the extension reads the article on that tab so it can read it aloud. If the article is in another language, or you press Auto-Translate or pick a word in the Reader, the text is sent to Google Translate to be translated. We don't keep copies of any of this.

Display ads on the free plan

On the free plan, a small card marked “Ad” may appear under a finished dictation or polish: at most one per result and one a minute, never while the microphone is on, and never on paid plans. Until an ad network is set up, these are our own house ads and nothing is loaded from an ad server. When we turn on Google AdSense for the web app, the ad loads inside a separate, sandboxed frame served from a different web address than the app, so Google's code never runs in the page where you dictate and can't read it. Inside that frame Google may set or read cookies and use your IP address and browser details under Google's policies; no text you dictate is ever sent to it. We count a network ad only when the frame reports that an ad was actually shown. For each display ad we log the same kind of record as for audio ads below, marked as a display ad, with the ad's provider.

Phone banner and History banner. On screens narrower than a tablet, the free plan may show that one ad as a small banner pinned above the tabs instead of under the result, and a small banner may appear when you open History. Both follow the same rules (one ad per result, at most one a minute, never while the microphone is on, never on paid plans) and load only inside the same separate, sandboxed AdSense frame; when that frame isn't set up, they don't appear at all. You never get anything for viewing or clicking them.

Rewarded videos (optional)

When you've used today's free polishes on the web, you can choose to watch one short video for 10 more, up to 3 a day. Nothing plays until you tap, and never while the microphone is on. The video opens in a new tab on a separate site of ours (ads.voicesir.com), so it can't see the app's data: not your text, your history or your sign-in. The app hands that page only a one-time code, in the part of the address that browsers never send to a server. The code is opaque: it doesn't show your account or anonymous ID to that page or anyone else; only our server can match it to the account to credit. It expires after 15 minutes and works once. The video comes from AppLixir, whose player (and the ad partners it uses, such as Google's video ad service) loads only on that separate page; like any ad server, they receive your IP address and browser details and may use cookies under AppLixir's privacy policy. Only a video you watch to the end earns polishes; if there's no video, or you stop it, nothing is added. Our server then adds the polishes and records the reward (time, your account or anonymous ID, the provider and the one-time code's ID) so it can keep the daily cap and make sure each code is used once. No text you dictate is ever sent to AppLixir.

Audio ads on the free plan

The free plan of the extension and of the web app plays a short audio ad after every few read-aloud clips (a clipboard item read aloud, or a start in the Reader). Ads never play while the microphone is on, can be skipped after a few seconds, and are labeled “Ad” on screen. Paid plans have no ads. How often ads play, and which ones, comes from a small settings file on our server that the app reads about every six hours.

• Ad networks. When an ad is due and an ad network is set up, the app requests an ad from that network's server, and the audio file and tracking addresses it names are loaded from the network and its partners. Like any web request, these servers receive your IP address and your browser's user agent, and they may set or read their own cookies under their own privacy policies. No text you dictate, copy or read is ever sent to them. When there is no network ad, a short house ad is spoken by your browser's built-in voice instead and nothing is requested from an ad server.
• What we log. For each ad we record: which app (extension or web), which slot (audio or display) and provider, what happened (the ad started, finished, was skipped, its “Learn more” link was clicked, or it failed), whether it came from a network or was a house ad, the sponsor's name, and the time. If you're signed in, the record is linked to your account; if not, it's anonymous. We don't log what you were reading.
• On your device. The app keeps a count of clips since the last ad, a cached copy of the ad settings and your plan in its local storage. These never leave your device.
• Clicking “Learn more” opens the sponsor's site in a new tab; that site's own privacy policy applies.

Deleting your data

In the extension, open the Reader, click the 📖 today button, and choose Delete my data. On the web, open voicesir.com/app.html, go to the Friends tab and choose Delete my data. If you have a paid plan, the subscription is cancelled with Stripe first; if Stripe can't cancel it, nothing is deleted and the app tells you, so you're never billed for a deleted account. Then your profile, settings, streak, friend connections and the synced copy of your dictation history are removed from our server right away, and your ad records are unlinked from your account (they are kept only as anonymous counts). The copy of your history saved in this browser stays until you clear it: the app offers to clear it right after, and Clear all in the History list does it any time. Your sign-in record (your email address, and the name Facebook shared if you used it) is kept only so you can sign in again; to have it erased as well, contact us using the link below and we will delete it. You can also remove the app from your Facebook account under Settings → Apps and Websites.

Contact

Questions about this policy: voicesir.com.