Privacy Policy

Who operates this app

Voice Compiler is operated by an individual, Thomas Farfeleder, as a personal project. Contact: [email protected].

Signing in

If you choose to sign in, Google OpenID Connect provides your email address. The server derives an opaque account id from it (a hash) and uses that id — not the address — to name and separate your data. It never receives or stores your Google password.

A signed session cookie (vc_session, http-only, 30 days) keeps the web app signed in; the Android app keeps the equivalent token in the Android Keystore. Your email address travels inside that token so the app can show which account you are using. You can end every active session from Settings → Account & security → Sign out everywhere.

What is stored on the server

When you are signed in, content you save is stored on the operator's self-managed, EU-hosted VPS and isolated to your account:

• Imported articles and pasted text you save to your library. When you import by link, the server (not your browser) fetches that page to extract the article.
• Narration audio generated from that text.
• App settings and preferences (playback, provider choice, cleanup rules, labels, favorite voices, etc.).
• Your listening position per article, bookmarks, sleep timers, the up-next queue, and daily listening statistics (how long you listened on a given day) that feed the stats page.
• A per-generation usage log used to show what your narrations cost: time, article, provider, model, characters synthesized, estimated price.
• Provider credentials you add (Google Cloud, ElevenLabs, Gemini, xAI, Amazon Polly, Azure AI Speech, Inworld, Speechify) — used only to call that provider's text-to-speech API on your behalf. They are never sent back to the browser or app after you save them. They are encrypted on disk (AES-256-GCM), with the key kept outside the data directory. That protects them if a copy of the storage ever leaves the server — a disk snapshot, a stray backup — but not against someone who gains control of the server itself, because it has to decrypt them to call the provider for you.

Third-party text-to-speech providers

When you generate narration with a cloud provider, the text of the article is sent to whichever text-to-speech provider you have chosen and configured (for example ElevenLabs or Google Cloud Text-to-Speech) so it can synthesize the audio. That provider's own privacy policy and terms apply to that processing. Voice Compiler does not send your text to any provider you have not selected and configured credentials for.

Two ways of listening send your text to no one: Piper, when the operator has enabled it, synthesizes on this server, so the text never leaves it. Device Read aloud hands the text to your own device's speech engine instead of to Voice Compiler's server — note that some browsers and Android engines implement their built-in voices as an online service of their vendor, which is outside this app's control.

What is not done with your data

Your data is not sold or shared with anyone beyond the text-to-speech provider you explicitly choose to generate audio. There is no analytics, tracking, or advertising in the app.

Using Voice Compiler without an account

Local mode stores article text, labels, archive/trash state, queue, and preferences in this browser using IndexedDB and local storage. Local articles are not uploaded to the VPS, are not automatically attached to a later account, and may disappear when browser/site data is cleared. The app therefore shows a persistent warning and offers a local JSON backup.

Nothing you write or import in local mode reaches the server: reading, editing, labels, archive, recycle bin, queue, bookmarks and device Read aloud all run in the browser. No listening statistics are recorded at all in local mode. Provider narration and PDF/link extraction do require sign-in, because they run on the server.

After signing in, you can explicitly add local articles to your account. Migration is additive: an exact title-and-body conflict is skipped, the server copy wins, and the local copy remains in the browser.

Other browser storage

The web app also keeps small UI values in localStorage:

• UI preferences: light/dark theme, whether the player shows remaining time, your library filters, the height of the voice list, playback speed, and the voice you last picked per provider.
• A flag recording whether you chose to continue without an account.
• An optional server bearer token only when an operator manually uses Advanced sign-in.

None of this is used for tracking, and nothing is shared with third parties from local storage.

Deleting your data

You do not need to contact the operator to remove stored content. Inside the app you can delete individual narration outputs, all audio for selected articles, or the articles themselves. Deleted articles can be permanently removed through the recycle bin. Provider keys can be cleared in Settings. In local mode, delete articles in the app or clear Voice Compiler's site data in your browser. Google sign-in creates no separate stored profile record beyond the account-scoped content described above.

There is currently no in-app "delete my whole account" button: listening statistics and the usage log are not individually deletable in the app. Email the operator at the address above to have your account and everything stored under it removed, and it will be deleted.

Changes to this policy

This is a small, evolving personal project, so this policy may change as the app changes. Material changes will be reflected on this page.