Privacy Policy

The Extension and the Website are operated by Astelle. Astelle is an independent product: it is not affiliated with, sponsored or endorsed by Google LLC. Google Docs and Google Chrome are trademarks of Google LLC.

The Extension needs no account, no sign-in and no payment. In short:

• The text you listen to is taken from the document, page or PDF open in your browser. By default it is sent to our server, passage by passage, so that numbers, dates and abbreviations are pronounced correctly. The server does not store it. You can turn this off in the Extension’s settings (Section 5).
• Natural voices are downloaded only when you choose one, and then run on your device (Section 5).
• Usage analytics and error reports are linked to a random installation number, never to your name, email or Google account, and they never contain the text you read (Sections 3c and 3d).
• The Website uses Google Analytics only if you accept it in the cookie banner (Section 3e).
• We do not sell your data, show advertising or build profiles about you (Section 4).

The Extension reads text aloud. It can:

• Read a Google Docs document — the selected text or the whole document.
• Read ordinary web pages and articles — a selection or the full page — and PDF files you open in its viewer.
• Highlight the sentence and the word being read, in sync.
• Let you choose a voice — including natural voices that you download (Section 5) — and adjust the reading speed.

The Extension does not record your microphone, upload your files or convert speech into text. The text of a PDF you read is handled like any other text (Section 3a).

When you install the Extension for the first time, it opens a welcome page on the Website (Section 3c). After you remove the Extension, Chrome opens our uninstall page, which records the removal and offers an optional survey (Section 3f).

We collect only what is needed to operate and improve the Extension and the Website. The Extension does not ask you to create an account and does not collect your name, email or any sign-in data.

a. The text being read. When you start reading, the Extension takes the text of the document, page or PDF from your browser. By default, it sends this text to our server, passage by passage, to prepare it for reading aloud (Section 5). If you choose a server voice when one is offered, it also sends the text to our server to generate the audio. You can turn off server text processing in the Extension’s settings; the text is then prepared on your device instead. We do not store the text you read, on the server or anywhere else, and we do not use it for any purpose other than reading it to you. The text you read may itself contain personal information; we process it only to read it to you. Section 5 also includes an important note about Chrome’s cloud voices.

b. Local preferences and working data. Settings such as your chosen voice, reading speed, text size, font and highlighting options are stored with Chrome’s chrome.storage API. Chrome syncs settings across your devices only if you have Chrome sync turned on. The Extension also keeps on your device the random installation number (Section 3c), the voice models you download (Section 5) and working data such as where you stopped reading. Usage analytics may include some settings, for example the voice and speed you use (Section 3c).

c. Usage analytics. We use Amplitude to record how the Extension is used — for example, that it was installed or updated, that reading started, paused or ended, which voice and speed were used, how quickly the sound started, or that a setting was changed. Events also include technical details: the Extension version, your browser and its version, your operating system, your browser’s language and how the Extension was installed (for example, by your organization).

Each event is linked to a random installation number that the Extension creates once, when it is installed. This number is not linked to your name, email or Google account. We also record which version you first installed and when, or which earlier version you updated from, so that we can compare groups of users who started at different times.

Events never contain the text you read, the title of a document or the full address of a page. They may contain the kind of page (such as article or PDF), the length of the text, how far you listened, and a fingerprint that tells us when the same document is opened again — a one-way hash made with a random key that stays on your device. Successful reading sends no site name. If reading on a page fails — for example, the text could not be extracted or the sound did not start — the failure event also includes the domain name of that page (for example, en.wikipedia.org), so that we can fix reading on that site. We do not send your IP address to Amplitude with these events, and the events do not include your location.

Usage analytics also include a few technical characteristics of your computer: the operating system, whether its graphics card can run on-device voices, the graphics card maker (for example, Intel or Apple) and, if you use an on-device voice, how fast it runs and whether it was already loaded when you started reading. We never collect the exact graphics card model.

When you install the Extension, it opens our welcome page at astelle.app/welcome and passes the installation number to the page. The page sends one event to Amplitude when it is shown. If you have clicked Accept in the Website’s cookie banner (Section 3e), it also sends how long the page stayed open and the campaign label of the link that brought you to the Website (Section 11). These events use the same installation number.

d. Error reports. If the Extension encounters an error, it sends a diagnostic report to Sentry: the error and where in the code it happened, the Extension version, your browser and operating system, and the same installation number as usage analytics. Reports do not include the text you read, the full address of the page or your IP address; a report about an error on a page includes the domain name of that page, for the same reason as in Section 3c. Our server sends its own error reports to Sentry without the text it was processing.

e. The Website. On astelle.app we use Google Analytics 4 to understand how people use the Website, but only if you click Accept in the cookie banner. Until you accept, the Google Analytics script is not loaded; if you click Reject, it is never loaded. Google Signals and advertising features are turned off, and Google Analytics keeps this data for 2 months. Your choice and the cookies involved are described in Section 11.

f. Uninstall log and feedback forms. When you remove the Extension, Chrome opens our uninstall page, which records the removal. The record contains the random installation number (Section 3c), the Extension version, the type of build (store or test), your browser’s user-agent string, the time of removal and a one-way keyed hash of your IP address, which we use only to stop automated abuse of this page and delete within about a day after the record is made. The log is stored by our provider Supabase. For version 3.0 and later from the Chrome Web Store, we also send an “extension uninstalled” event to Amplitude under the same installation number, with the Extension version and the browser and operating system taken from the user-agent string; the IP hash and the full user-agent string are not sent to Amplitude.

Our feedback forms are hosted by Tally. After you remove the Extension, the uninstall page forwards you to an optional survey; its link contains only the number of your record in the uninstall log, so that we can match your answer to that record. If you rate the Extension 1 to 3 stars in its rating prompt, you can open an optional feedback form; its link contains your installation number, your rating and the Extension version. In both forms you can write free text; we do not ask for your name or email. We keep the answers in Tally and in our own analytics database, linked to the uninstall log or to the installation number.

Legal basis: your consent, given when you submit a form.

We do not collect microphone audio, uploaded files, payment information or a list of the websites you visit: the only site names we receive are those of pages where reading failed (Sections 3c and 3d).

We use the data described above to:

• Provide the read-aloud, voice, speed and highlighting features, including preparing text on our server and delivering voice models (Section 5).
• Protect our server and our uninstall page from abuse by limiting how many requests can be made from one address (Sections 3f and 5).
• Monitor reliability and fix bugs (Sentry).
• Understand how the Extension and the Website are used, in aggregate, and improve them (Amplitude and Google Analytics 4).
• Read, prioritise and respond to the feedback you send us (feedback forms and email).

We do not sell your personal data, show advertising, use your data for advertising or build advertising or marketing profiles about you; usage events are linked to the installation number only so that we can see how the Extension is used. We do not use the text you read for anything other than reading it to you, and we do not use it to train models.

Chrome Web Store. Our use of data received through the Extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements: we collect and use user data only to provide and improve the Extension’s single purpose — reading text aloud — and we transfer user data only for purposes permitted by that policy, to the providers described in Section 6.

Legal basis. Where data protection law applies, we process the data in Sections 3a–3d and the uninstall log (Section 3f) on the basis of our legitimate interest in providing the Extension, keeping it reliable and secure, and improving it. Google Analytics on the Website (Section 3e) and the feedback forms (Section 3f) rely on your consent. You can stop all data collection by the Extension at any time by removing it from Chrome; the removal itself is recorded in the uninstall log (Section 3f).

Preparing text on our server (on by default). So that numbers, dates, abbreviations and similar text are read correctly, the Extension sends the text it is about to read to our server, passage by passage, together with the language of the text and the kind of voice that will read it. The server returns the prepared text and keeps nothing: it processes the text in memory, does not store it, does not write it to its logs and does not use it for anything else. The connection is encrypted (HTTPS) and goes to our own server; we do not route it through third-party proxies. You can turn this off in the Extension’s settings under Settings → Listening → Server text processing. When it is off, the text is prepared on your device instead.

Server voices. Server voices, if we offer any, are generated on our server. Whether any server voices are offered, and which ones, is decided by us and may change without an update to the Extension. If you choose a server voice, the Extension also sends the text to our server to generate the audio, together with the chosen voice, the language and the random installation number described in Section 3c. As with preparation, the server does not store the text.

Natural voices on your device. Natural voices — at the time of writing, voices based on the Kokoro model (about 330 MB) and the Supertonic model (about 400 MB) — are generated on your device. Models are never downloaded automatically: a voice’s model is downloaded from our download server only after you choose that voice and press Download. Downloading a model, or playing a voice sample before you download it, sends no text from your documents. Downloaded models are stored in your browser and are removed when you uninstall the Extension.

System voices. Speech with the voices installed on your device and the voices Chrome provides is generated by your browser’s text-to-speech engine.

Important: some of the voices Chrome offers are cloud voices provided by Google. If you choose one of these voices, the text to be spoken is sent by your browser to Google’s speech service to generate the audio. This happens through Chrome itself, under Google’s own privacy terms. If you prefer to keep the text on your device, turn off server text processing and choose a natural voice or one of your system’s local voices.

Your IP address. Like any web server, ours sees your IP address when the Extension contacts it. We use it only to limit how many requests can be made from one address: the server keeps a one-way hash of the address in memory, deletes it about a minute after the last request from that address and never writes it to disk. Our server logs do not contain IP addresses.

The Extension and the Website use the following providers:

We also use infrastructure providers that host our server, the voice model downloads and the Website; they process data only to provide these services to us. We do not use a payment processor, because the Extension has no payments. We share data with no one else, unless the law requires it.

We keep copies of analytics events, the uninstall log, error reports and feedback answers in our own analytics database for the periods above, and we delete them earlier on request where we can find the data (Section 8).

Depending on where you live, you may have the right to access, correct, delete, restrict or port your personal data, to object to its processing and to withdraw consent. Because the Extension links its data only to a random installation number and not to your name or email, we may be unable to identify you from this data alone; if you contact us, we will tell you what we can do.

You can withdraw your consent to Google Analytics on the Website at any time with Cookie settings at the bottom of every page.

Residents of the EEA, the UK and Switzerland have the right to lodge a complaint with their data protection authority. Where the California Consumer Privacy Act applies, California residents have the right to know what personal information we collect, to request its correction and deletion, directly or through an authorised agent, and not to be discriminated against for exercising these rights; we do not sell personal information and do not share it for cross-context behavioural advertising.

To exercise any of these rights, email support@astelle.app. We aim to answer within 30 days.

All data that the Extension and the Website send — the text sent to our server, analytics, error reports and voice model downloads — travels only over HTTPS (TLS). Our server does not keep the text you read, and the Extension holds no account. The text you read may contain sensitive information, so the server keeps it only in memory while it is prepared. No system is 100% secure, and we cannot guarantee absolute security.

The Extension and the Website are not directed at children under 13, and we do not knowingly collect personal data from them. The Extension needs no account and collects no names or contact details, so a child who uses it, for example at school, is not identified to us. If you believe a child has sent us personal data, for example through a feedback form, contact us at support@astelle.app and we will delete it promptly.

The Extension itself does not use web cookies. It uses Chrome’s chrome.storage API to remember your preferences and the random installation number described in Section 3c; this number is not linked to your real identity.

On the Website, a banner asks whether you accept analytics. Your choice is saved in your browser’s local storage under the key astelle-consent, with no expiry, and is not sent to us; you can change it at any time with Cookie settings at the bottom of every page. Cookies are set only by Google Analytics 4 and only after you click Accept; if you click Reject, Google Analytics is not loaded at all. If you accept, the Website also saves the campaign label of the link that brought you (utm_source and utm_campaign) in local storage for 30 days, and the welcome page adds it to its events (Section 3c). The welcome page sends its events without cookies. The Website does not use advertising cookies.

Our providers are located in the United States (Amplitude, Sentry), Australia (Supabase) and the European Union (Tally), or operate globally (Google). Where personal data is transferred internationally, we rely on appropriate safeguards, including the EU Standard Contractual Clauses and the UK International Data Transfer Agreement or Addendum. You can ask us at support@astelle.app which safeguards apply to your data and for a copy of them.

We may update this policy from time to time. When we do, we update the “Last updated” date at the top. If we change what the Extension does with your data in a way that matters to you — for example, if we start sending more data to our server or add a new provider — we will tell you in the Extension or on the Website before the change applies, and we will update this policy and the Chrome Web Store listing at the same time. The updated policy applies to your use of the Extension and the Website after that date. Continued use alone is not consent: where the law requires your consent for a new use of your data, we will ask for it before that use begins.

What changed in version 3.0. Compared with versions 2.x of the Extension, version 3.0:

• prepares the text you read on our server by default, with a switch to turn this off (Section 5); earlier versions prepared all text on your device;
• offers natural voices that you download once and that then run on your device (Section 5);
• records more detailed usage analytics under a random installation number (Section 3c), including a few technical characteristics of your computer, and sends error reports with the same number (Section 3d);
• keeps a more detailed uninstall log (Section 3f);
• adds an optional feedback form in the rating prompt, linked to your installation number (Section 3f);
• opens a welcome page on the Website after a first installation (Section 3c).