Privacy Policy

Who operates this app

Voice Compiler is operated by an individual, Thomas Farfeleder, as a personal project. Contact: [email protected].

Accounts and signing in

Every library belongs to an account on the server, identified by an internal id. An account has one or more ways to sign in, or none at all while it is a guest:

• Google. Google OpenID Connect provides your Google account id and your email address. The server keeps the id to recognise your Google sign-in and the address to show which account you are using. It never receives or stores your Google password.
• Username and password. No email address is needed. The server stores the username and a salted Argon2id hash of the password, never the password itself. The recovery code you get when you create the password is stored only as a hash as well; it is the only way back in after a forgotten password, because there is no email reset.
• Guest (“Try without an account”). A guest account has no way to sign in apart from its session. Its articles and audio are stored on the server like any other account's, limited to 100 MiB, and the whole account is deleted automatically after 30 days without a visit (both are defaults the server's operator can change; the app states the period that applies). Adding a password or linking Google keeps it for good.

You can link Google and a password to the same account in Settings → Login methods, and remove either as long as the other remains. When a guest signs in with a Google account that already has a library, the guest's articles and audio can be moved into it; the guest account is then deleted.

A signed session cookie (vc_session, http-only, valid for 30 days and renewed while you use the app) keeps the web app signed in. If your browser does not keep that cookie for this site, the web app keeps the same session as a token in this browser's localStorage instead. The Android app keeps its token in the Android Keystore. After a Google sign-in, your email address travels inside the session so the app can show which account you are using. You can end every active session from Settings → Account & security → Sign out everywhere.

To slow down password guessing, the server counts sign-in and recovery attempts per username and per network address, and new accounts per network address. These counters live only in the server's memory; they are not written to disk and disappear when the server restarts.

What is stored on the server

Content you save — as a guest too — is stored on the operator's self-managed, EU-hosted VPS and isolated to your account:

• Your account record: your login methods (the Google account id and email address, and the username with the password and recovery-code hashes), when the account was created, and the day it was last used — for a guest, that day decides when the account is deleted.
• Imported articles and pasted text you save to your library. When you import by link, the server (not your browser) fetches that page to extract the article.
• Narration audio generated from that text.
• App settings and preferences (playback, provider choice, cleanup rules, labels, favorite voices, etc.).
• Your listening position per article, bookmarks, sleep timers, the up-next queue, and daily listening statistics (how long you listened on a given day) that feed the stats page.
• A per-generation usage log used to show what your narrations cost: time, article, provider, model, characters synthesized, estimated price.
• Provider credentials you add (Google Cloud, ElevenLabs, Gemini, xAI, Amazon Polly, Azure AI Speech, Inworld, Speechify) — used only to call that provider's text-to-speech API on your behalf. They are never sent back to the browser or app after you save them. They are encrypted on disk (AES-256-GCM), with the key kept outside the data directory. That protects them if a copy of the storage ever leaves the server — a disk snapshot, a stray backup — but not against someone who gains control of the server itself, because it has to decrypt them to call the provider for you.

Third-party text-to-speech providers

When you generate narration with a cloud provider, the text of the article is sent to whichever text-to-speech provider you have chosen and configured (for example ElevenLabs or Google Cloud Text-to-Speech) so it can synthesize the audio. That provider's own privacy policy and terms apply to that processing. Voice Compiler does not send your text to any provider you have not selected and configured credentials for.

Two ways of listening send your text to no one: Piper, when the operator has enabled it, synthesizes on this server, so the text never leaves it. Device Read aloud hands the text to your own device's speech engine instead of to Voice Compiler's server — note that some browsers and Android engines implement their built-in voices as an online service of their vendor, which is outside this app's control.

What is not done with your data

Your data is not sold or shared with anyone beyond the text-to-speech provider you explicitly choose to generate audio. There is no analytics, tracking, or advertising in the app.

The old browser-only library

Earlier versions could keep a library only in this browser (IndexedDB) instead of on the server. That mode no longer exists; guest accounts replace it. If this browser still holds such a library, nothing in it is uploaded until you choose Move into this account in Settings. The browser copy stays until you choose Remove local copies, which is offered once every article has been moved. A JSON backup exported from that mode can be restored into an account with Import library.

Other browser storage

The web app also keeps small UI values in localStorage:

• UI preferences: light/dark theme, whether the player shows remaining time, your library filters, the height of the voice list, playback speed, the voice you last picked per provider, and whether single-key shortcuts are on.
• A session token, only when this browser does not keep the session cookie, or when an operator pastes a server token under Advanced: server bearer token on the sign-in page.

An article shared to the app while you are signed out waits in this tab's sessionStorage until you sign in, and is removed from there as soon as it is opened.

None of this is used for tracking, and nothing is shared with third parties from local storage.

Deleting your data

You do not need to contact the operator to remove stored content. Inside the app you can delete individual narration outputs, all audio for selected articles, or the articles themselves. Deleted articles can be permanently removed through the recycle bin. Provider keys can be cleared in Settings, and a password or Google login can be removed there while another one remains. A guest account is deleted with everything in it after 30 days without a visit (the default period). Beyond the account record and the account-scoped content described above, nothing about you is stored.

There is currently no in-app "delete my whole account" button: listening statistics and the usage log are not individually deletable in the app. Email the operator at the address above to have your account and everything stored under it removed, and it will be deleted.

Changes to this policy

This is a small, evolving personal project, so this policy may change as the app changes. Material changes will be reflected on this page.