Privacy Policy

What we collect

• —Account — your email address, optional display name, and a bcrypt hash of your password (never the password itself). If you sign in with Apple or Google we store the email address they release to us; we never receive your password.
• —Subscription — your plan, when it changes, and the identifiers issued by our payment processors (a Stripe customer and subscription id for web, an App Store original transaction id for iOS). Card numbers never reach our servers.
• —Library — the title, author and source of each item you add, plus your reading position in it.
• —Uploaded files— the bytes of documents you upload, stored in a private bucket and addressed by a SHA-256 hash of their contents. If two people upload the same file, one copy is stored; neither can list or reach the other's library.
• —Devices — for each device signed in: a per-vendor install id supplied by the OS, the device name and model, OS and app version, and first/last seen times. This is what the device list on your account page shows.
• —Usage — a running count of characters narrated per calendar month, to enforce plan limits and control cost.
• —Crash reports— when the iOS app crashes or freezes, Apple's built-in MetricKit hands us a report on a later launch: the stack that failed, the device model, and the OS and app versions. We forward it to our own server, without your account id or any other identifier, so we can find the bug. The web app sends the same kind of report when a page fails to render.

We do not collect location, contacts, photos, advertising identifiers, or behavioural analytics, and the apps contain no third-party ad, analytics or crash-reporting SDKs — crash reports go to us directly, not to a vendor.

Narration and the shared audio cache

Premium narration is synthesised by our text-to-speech provider, Lemonfox. The passage being read is sent to them to generate audio and word timings. Free reading uses the voices built into your device and never leaves it.

Generated audio and its word timings are cached in our private storage under a key derived from the text, voice and speed — so the same passage in the same voice is only ever paid for and synthesised once, for anyone. The cache holds narration output only; it is not linked to your account, is not readable by other users, and no one can enumerate it or work backwards from it to your library.

Who processes data for us

• —Vercel — hosting for the website and API.
• —Neon — the Postgres database holding accounts, libraries and usage.
• —Cloudflare R2 — private object storage for uploaded files and cached narration. Clients only ever receive short-lived signed URLs; the bucket is never public.
• —Lemonfox — premium text-to-speech synthesis.
• —Stripe — payments and subscriptions on the web.
• —Apple — Sign in with Apple, and In-App Purchase subscriptions bought in the iOS app.
• —Google — Sign in with Google, if you use it.
• —Resend — transactional email (verification links, account notices).
• —Upstash — Redis-backed rate limiting; it sees request counters, not document contents.

These providers act on our instructions. We do not sell personal data and we do not share it for advertising.

How long we keep it

Account, library and device records live until you delete them or delete your account. Removing a book from your library deletes your reference to it immediately; when no account references an uploaded file any more, the stored file is swept and permanently deleted. Usage counters are kept per month for billing and abuse investigation. Email verification links are stored only as a hash and expire on their own. Crash reports are written to our server logs and never to the database, so they age out with the log retention window rather than sitting against an account.

Your choices

• —See or export your data — your account page lists your library, devices, plan and usage. Email us for a machine-readable copy.
• —Delete a book or a device — remove a book in the iOS app, and forget a device from the list on your account page. A forgotten device reappears only if that install signs in again.
• —Delete your account — from the danger zone on your account page, or from the account screen in the iOS app. It happens immediately: the account, library, devices and usage history are erased and any web subscription is cancelled in the same step. Uploaded files stop being reachable at once and are deleted from storage by the next sweep. Nothing to email, nothing to wait for.
• —Cancel a subscription — web subscriptions in the billing portal linked from your account page; App Store subscriptions in iOS Settings → your Apple Account → Subscriptions.

Security

Traffic is encrypted in transit. Passwords are stored as bcrypt hashes. Uploaded files and cached narration sit in a private bucket reachable only through expiring signed URLs. Verification tokens are stored hashed, so a database copy alone cannot be used to take over an account.

Children

Yap Aloud is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, email us and we will remove it.

Changes and contact

If this policy changes materially we will update the date above and, for changes that affect how we use existing data, email account holders. Questions or requests: hello@yapaloud.com.

See also the Terms of Use, Support, and the frequently asked questions.