Introduction
Word2Talk ("we", "our", or "us") is dedicated to protecting your privacy. This Privacy Policy explains how we collect, use, store, and disclose information when you use our Chrome Extension, Web Player, and related services (collectively, the "Service").
Information We Collect
Information You Provide
- Email Address: When you create an account, we collect your email address for authentication, billing communication, and account management.
- Payment Information: When you purchase a listening pack, payment is processed by Stripe. We do not store your credit card number. We receive your Stripe Customer ID and transaction metadata (amount, date, plan type) for record-keeping.
Information Collected Automatically
- Article URL and Content: When you use the Service to listen to an article, the URL and extracted text are sent to our servers for processing. Extracted article text is stored in our database to enable your personal reading library, replay functionality, and progress tracking.
- Audio Cache: Synthesized audio is cached on AWS S3 to enable instant replay without re-processing. Audio is associated with article content, not with individual users.
- Usage Data: We track listening duration, article progress, and reading streaks to provide you with personalized statistics and to calculate billing usage.
- Device & Browser Information: Standard HTTP metadata (IP address, browser type) is collected by our hosting provider (AWS) for security and rate-limiting purposes. We do not profile individual users based on this data.
- Waitlist IP Address: When you join the pre-launch waitlist, we store a truncated one-way hash of your IP address alongside your email. We do not store the address itself, and the hash cannot be reversed back to it. It is used solely for rate-limiting and anti-abuse, and it is kept for as long as the waitlist entry exists; activating your account does not remove it. To have it deleted, email hello@word2talk.com.
- Cookies: We use essential and analytics cookies:
auth_token — An HttpOnly, Secure cookie for session authentication.beta_bypass — An HttpOnly, Secure cookie for early access during beta.- Google Analytics (
_ga, _ga_*) — Analytics cookies used to understand site usage. These are only set if you accept cookies via our consent banner.
Analytics
We use Google Analytics 4 (GA4) to measure traffic and engagement on our marketing pages and, once you have accepted, in the signed-in web player. Our tag container is not loaded until you accept cookies, on either surface, with or without JavaScript. If you decline, or have not chosen yet, it is never requested and no analytics cookies are set. Analytics data is used to improve the product and is not sold or shared with third parties for advertising.
We also send server errors to Sentry so we can find and fix crashes. Those reports carry technical context and can include the URL being processed. They are not used for analytics or advertising.
An earlier version of this policy said we use PostHog for product analytics. We never integrated it and it receives nothing from us. Corrected on 25 August 2026.
How We Use Your Information
- Service Delivery: Article text is processed through OpenAI's API for text cleaning, summarization, translation, and text-to-speech synthesis. Audio is stored for your personal library and replay.
- Billing: Your email and Stripe Customer ID are used to process purchases, send confirmation emails, and manage your subscription status.
- Gifting: When you generate a gift link, we create a unique code associated with your account. The recipient's email is optionally collected when they claim the gift, solely to credit their account.
- Communication: We send transactional emails (purchase confirmations, activation links, login codes) via AWS SES. We do not send marketing emails without your consent.
- Product Improvement: Anonymized usage patterns help us improve features, fix bugs, and optimize performance.
Data Storage and Retention
- Article Content: Stored in our PostgreSQL database for as long as you maintain an active account. You can delete individual articles from your library at any time.
- Audio Cache: Cached on AWS S3. Audio files are content-addressed (shared across users who listen to the same article) and are not personally identifiable.
- Account Data: Retained for as long as your account is active. To request account deletion, contact us at hello@word2talk.com.
Data Security
- Encryption in Transit: All communication is encrypted using HTTPS/TLS.
- Token Security: Authentication tokens are hashed with SHA-256 before storage. Raw tokens are never persisted on our servers.
- Rate Limiting: API endpoints are rate-limited to prevent abuse.
- Access Control: CORS policies restrict API access to authorized origins only.
- Non-Root Container: Our production server runs as a non-root user inside a hardened Docker container.
Third-Party Services
- OpenAI API: Article text is sent to OpenAI for processing. OpenAI's API Data Usage Policy states that API data is not used to train their models.
- Amazon Web Services: Hosting (App Runner), storage (S3), and email (SES). Data is processed within the US-East-1 region.
- Stripe: Payment processing in accordance with PCI DSS standards. See Stripe's Privacy Policy.
- Supabase: Managed PostgreSQL database. See Supabase's Privacy Policy.
- Sentry: Error monitoring for our servers and background workers. See Sentry's Privacy Policy.
- Google Fonts: Our web fonts are served from Google's font hosts, so Google receives your IP address when a page loads, before and regardless of any cookie choice. See Google's Privacy Policy.
- Google Analytics: Website traffic measurement (only with your consent). See Google's Privacy Policy.
Your Rights and Choices
- Access & Export: View all your data (articles, listening history, billing) in the Web Player.
- Deletion: Delete individual articles from your library, or request full account deletion via hello@word2talk.com.
- Opt-Out: The extension only activates when you interact with it. Uninstall at any time.
- Cookie Control: The consent banner appears on your first visit and your choice is stored in this browser. To change it later, use the Cookie settings link in the site footer, which reopens the banner. Clear authentication cookies by logging out.
Children's Privacy
Word2Talk is not intended for children under 13. We do not knowingly collect personal information from children under 13.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last Updated" date.
Contact Us
If you have any questions about this Privacy Policy, please contact us at hello@word2talk.com.