Privacy Policy

Device voices and in-browser processing: text you type or paste is processed in your browser when you use a voice provided by your operating system or browser, or a voice that runs in your browser. The text and the audio stay on your device and are not uploaded to VoiceHue.

Cloud voices: when you choose a cloud voice, your text (at most 1,200 characters per request), the voice and speed you chose and the language are sent over HTTPS to our gateway, which runs as Supabase Edge Functions. The gateway sends the text and the language to the speech provider that creates the audio. Today that provider is Cloudflare Workers AI. We may add other speech providers; each one will be listed under Service providers below before we use it. We do not send your email address, your account or session id or your IP address to the speech provider. The provider handles the text under its own terms.

We do not store your text or the generated audio. The audio is returned to your browser in the response to your request and is not saved on our servers, and the text is not written to our database. We keep only counts, as described in the next section.

For each cloud request we record: a random request id, the id of your anonymous session or account, whether the session is anonymous, a one-way hash of your IP address (not the address itself), the number of characters, the voice id, the day, whether the request completed or failed and, if it failed, a short error code. This record never contains your text or audio.

Retention: these job records and the daily character counters (per session or account, per IP hash and overall) are deleted after about 8 days. Rate-limit counters (a session id or IP hash with a hit count per time window) are deleted after about 1 day. Daily totals per voice (voice id, day, number of requests and characters, with no link to a person) are kept for 60 days. The deletions run as routine clean-up while the service is in use, so on quiet days an old record can stay a little longer.

We also keep a service event log of what the gateway did (for example that a request succeeded, the voice channel used, the job id, the number of characters and bytes, or an error code) and of changes that our staff make to settings. It contains no text, no audio, no email address and no IP address. We keep it for security and accounting and we delete entries automatically after 12 months.

You can use cloud voices without an account. Your browser then asks for an anonymous session: a random id and a sign-in token, created by Supabase Authentication, with no email, name or password. It is kept in your browser's local storage. We delete anonymous sessions automatically about 30 days after they were created, together with anything saved under them.

If you create an account, we store your email address and your sign-in data (your password is kept only as a hash by Supabase Authentication) and, if you set one, a display name. Signed-in users have a higher daily character limit. If you choose Save script in the tool, the script's title, its text, the voice and your settings are stored in your account (never the audio) until you delete the script yourself (every saved script has a Delete button under My scripts in your workspace) or your account is deleted. Under Account in your workspace you can download your scripts and the details of your API keys as a JSON file (key secrets are never included) and delete your account yourself: deleting it removes your account, your saved scripts, your API keys and their usage and job records straight away.

Our staff accounts are protected with a second step (multi-factor authentication with a one-time code). Staff can see usage counts and, when needed for support or abuse handling, account email addresses; the staff tools show IP addresses only as hashes.

Before a cloud voice request is accepted we run a Cloudflare Turnstile check. Turnstile is operated by Cloudflare, which receives your IP address and signals from your browser to tell people from bots, under its own terms. We receive only the result, and we send your IP address to Cloudflare together with the token to verify it.

We limit requests per minute and characters per day for each session or account, for each IP address and for the service as a whole. To do this we compute a one-way keyed hash (HMAC-SHA-256, using a secret key that only we hold) of your IP address and store only that hash in the counters described above; we do not store the address itself in our database. A hash of an IP address can still be linked to a person in some circumstances, so we treat it as personal data. Our hosting and network providers may see your IP address in their own technical logs.

If analytics are switched on, we use Vercel Web Analytics, which does not use cookies and does not follow you across other sites. It records page views and a small set of our own events, such as that text was entered, a voice was selected, audio was generated, played or downloaded, or you switched language. Our events carry only broad categories: language, kind of voice (device, in-browser or cloud), a text length range (0-100, 100-500 or 500+ characters), file format, and a short error code. They never carry your text, voice names, email address or IP address, and nothing is sent from the admin area.

We also use Microsoft Clarity to understand how pages are used. It records clicks, scrolling and page layout as a replay and heatmap, and may set its own cookies. It masks what you type and is off on sign-in, dashboard and admin pages, and we mask documents in the reader.

We do not use advertising or advertising cookies, and we do not sell your data.

VoiceHue itself does not set cookies; Microsoft Clarity may set its own (see above). VoiceHue uses your browser's storage only for things the site needs to work the way you asked, which we consider strictly necessary: phonivect:locale and phonivect:locale-suggestion-dismissed (your language choice and that you dismissed the language suggestion), vh-muted (your interface sound setting), phonivect_tts_draft_v1 in session storage (the text and language you are working on, so a reload does not lose them; cleared when the tab is closed), voicehue_tool_handoff_v1 in session storage (text you chose to open in the tool again, removed as soon as it is read), voicehue-history and voicehue-reader-audio in IndexedDB (the audio clips you generated, so you can replay and download them again under My audio; they stay on your device and are never uploaded, you can delete them one by one or clear them all, and the oldest are removed automatically at about 120 MB) and the Supabase sign-in session (your anonymous or account session).

You can clear all of this in your browser settings at any time; the site then forgets your preferences and, for an anonymous session, starts a new one.

If you join the waitlist, we store your email address, what you are interested in (Pro, API or both), your language and the date, only to tell you when those features open. Joining runs the same Turnstile check; we do not store your IP address (only a hash that is used to limit repeated sign-ups and is deleted after about a day) or your browser details.

We keep your entry until we have told you about the launch or you ask us to remove it, and in any case we delete it automatically after 24 months. To be removed sooner, write to support@voicehue.com from the address you signed up with.

We use these processors to run VoiceHue, and we remove or add providers here before the change takes effect:

Vercel: hosting of the website and Web Analytics. Supabase: database, authentication, Edge Functions (our gateway) and file storage for voice preview samples. Cloudflare: Turnstile (human check) and Workers AI (speech synthesis, which receives the text of cloud requests). Microsoft: Clarity (how pages are used). Other speech providers we may add: listed here before use.

Voices that run on your device or in your browser are provided by your operating system, your browser or downloadable voice files, and are not processors of your text. The first time you use a downloadable voice, your browser fetches the voice file, which reveals to the file host that your browser requested it (for example your IP address and browser type) but not your text.

Our providers run data centres in several countries. Our Supabase project is hosted in the United States (us-east-1), Vercel serves pages from locations around the world and processes data in the United States, and Cloudflare operates globally. If you are outside the United States, your data is therefore transferred to and processed in countries whose data-protection rules can differ from yours. Our providers state that they use contractual safeguards for such transfers; ask us if you want details.

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to object to or restrict how we use it, to receive a copy of it and to withdraw consent you gave. To use any of these rights, write to support@voicehue.com from the email address of your account or waitlist entry (for an anonymous session, tell us what you did and when; we can only find data tied to a session id that you can show us). We aim to reply within 30 days.

If you think we have handled your data unlawfully, you can complain to the data-protection authority where you live or work (for example your national supervisory authority in the EU, or the ANPD in Brazil).

VoiceHue is not directed at children under 16, and we do not knowingly collect personal data from them. If you think a child has given us personal data, write to us and we will delete it.

Like most websites, our hosting and authentication providers keep short-lived technical logs (for example IP address, requested page and time) to keep the service secure and working.

If you write to us, we use your email address and your message only to reply and to keep a record of the conversation.

If we change how data is handled, for example by adding a speech provider or launching new features such as the developer API, we will update this page before the change takes effect and change the date below.

This site is operated by VoiceHue. The operator's registered details will be published on this page once the business is registered.

Email: support@voicehue.com.