Private by design

We have no server and no account system. We never receive the text you read, and we never receive the address of a page you visit. The one exception is a read that fails: the site’s name on its own (for example bbc.com) is sent so the page can be made to work, never the address, and never a site on a private network or a file on your own computer. There is no tracking across sites, no advertising, and nothing is ever sold or shared. The extension does send anonymous usage statistics, described below, which you can turn off.

What the extension stores, and where

• Synced across your browsers (Chrome sync storage): your settings: chosen voice, language, reading speed, highlight colours, keyboard shortcuts, toolbar layout, hidden voices and languages, per-site language, the sites where you turned Readalix off or allowed only on-device voices, whether password fields may be read, interface language, and which hints you dismissed.
• On this device only: your optional Gemini, OpenAI or ElevenLabs API key (with ElevenLabs, also the model and speaking style you chose and the names of the voices in your ElevenLabs account), downloaded voice models, the cache of already-synthesized audio, the daily free-usage counter, your paid/unpaid flag, the date this copy was installed, whether your computer is set to dark mode, Premium’s current prices, and, if you connect Google Drive, a one-hour access token and the id of the folder your exports go to.
• For the snipping tool: on this device only, the alphabet you picked for snips on a site, for each site where you picked one; and, in memory only, the words of your latest snip, until you remove it, leave the page or close the browser. Also, on this device only, the last alphabet you picked for a snip on any site; and, in memory only, the picture of your latest snip for each of your last 4 tabs, so it can be read again in another alphabet. Also, on this device only, how many times the snipping tool’s how-to animation has been shown and whether you have drawn a box yet, so it stops showing.
• For the PDF reader: on this device only, a copy of the PDFs you open in the reader from your computer (picked or dropped), from the browser’s own PDF viewer (with the Readalix button on it, or by pressing Play there, which opens the PDF in the reader), or from Google Drive’s “Open with” menu (the file and its name, never where it was on your disk), so reloading the tab or restarting the browser brings the same document back, even when the site that sent it cannot send it again. The newest are kept, up to 5 files and 500 MB in all, the oldest deleted first; a file stays for as long as a reader tab is showing it, and a file that never opens (not a PDF, damaged, or its password never given) is deleted when its tab closes. A PDF the reader opens from an address in any other way (a link, a Google Drive or Gmail preview, an address typed in) is not copied: it is loaded from that address again each time. Also kept, for your last 200 PDFs and filed under a fingerprint of each file’s contents rather than its name or address: the language it was read in, any language you picked for it, and your answer when the reader asked whether to read the pictures in it, so it does not ask again. A PDF made by a web app (a statement or an invoice a site opens in a tab of its own, up to 50 MB) is copied here as soon as the Readalix button appears on it, so the button still works after that site has closed or moved on. That copy is deleted when you close its tab, restart the browser or update the extension, and the copies take at most 150 MB in all. Once you open it in the reader, it is kept like a PDF from your computer, named after the title of the page that made it. In a private window nothing is copied, and the reader is not offered. A password you type to open a locked PDF is never stored: it stays in that tab’s memory only while the document is open. When Play opens a PDF in the reader, the text you had selected in the browser’s viewer and the page you were on go along in memory only, and are forgotten as soon as the reader opens. If you go back to the browser’s viewer from the reader, the address of that PDF is kept in memory until you close the browser, so Play reads it there next time instead of opening the reader again.
• For scanned PDFs: on this device only, the text the reader recognised in them, with where each word sits on the page, so a scan you open again is ready to read at once instead of being recognised all over again, which can take several minutes for a long document. This covers every scan you open in the reader, from your computer or from the web. It is filed under a fingerprint of the file’s contents, never its name or address, and kept for the 32 scans you opened most recently (at most 150 MB in all), the oldest deleted first. The page images are not kept. The text recognition models are kept too, once downloaded, so each one is fetched only once. Also kept: the alphabet you last chose for scans, and a count of how often you corrected the language the reader guessed for a PDF, so it guesses better next time.
• For dictation: on this device only, the speech recognition model you downloaded (80 to 566 MB, in the browser’s own storage until you remove it in Settings → Dictation), the model and language you chose and how long a silence stops dictation, and the result of a short speed test of your graphics chip that picked the model for this computer; and, until you clear them or close the browser, the words you dictated, so they are still there when you reopen the toolbar.
• For your own voices: on this device only, each recording you made or chose to make one from (up to 15 seconds each, the silence at both ends trimmed), the name you gave it, and the voice made from it for each language you read in, plus the microphone you picked to record with, if you picked one. None of it is synced to your other browsers. Removing a voice deletes all of it, and uninstalling deletes every one. The microphone is used only while you record, from Record until Stop.

All of it lives in your browser. Uninstalling the extension removes it. The audio cache can be inspected and cleared at any time in Settings → Manage cache. What the PDF reader keeps is not listed there: it is trimmed on its own, oldest first, as described above.

What leaves your device

• Browser voices, Piper, Kokoro, Supertonic and your own voices: nothing. The speech is generated on your own machine; the text never leaves the browser. That includes the recordings your own voices are made from: they stay on this device. When an exported file is named for you, that too is done by the model built into your browser, on this device.
• Microsoft, Gemini, OpenAI and ElevenLabs voices: only the sentence currently being spoken is sent to that provider, so it can be turned into audio (with ElevenLabs, together with the speaking style you set, if any). It is handled under that provider’s own privacy policy. None of the text you read is ever sent to us. When one of these voices is selected, the extension may also send that provider an empty request carrying no text and no key, purely to check whether its service can be reached, so it can tell you the voice needs an internet connection before you press play. If that check fails, the extension requests a single small file from readalix.com to tell “this network blocks that provider” apart from “this device has no network”, so it can name the right reason. That request carries no text, no key and no identifier, and is logged only the way any ordinary web request to our site is.
• Your API keys: sent only to the provider they belong to (Google, OpenAI or ElevenLabs), directly from your browser. An ElevenLabs key is also used to fetch the list of voices in your ElevenLabs account and this month’s credit usage. They are stored on your device, never synced, and never transmitted to us.
• Voice downloads: downloading a Piper, Kokoro or Supertonic voice, or the model your own voices read a language with, fetches the model file from Hugging Face, which sees the request the way any file download does. If Hugging Face cannot be reached from your network, the same file is requested from readalix.com instead, which fetches it from Hugging Face and passes it on unchanged. That request carries no text, no key and no identifier, and is logged only the way any ordinary web request to our site is.
• Google Drive, only if you switch it on: saving an export to Drive uploads that one audio or video file to your own Google account, into a folder named Readalix. Google receives the file itself, because it is storing it for you. Nothing else about your reading is sent, and the extension never uploads anything you did not ask it to save.
• Snip & read: nothing. When you drag a box over part of a page, the extension takes a picture of the visible tab and recognises the words in that box on your own device. The picture and the words in it never leave your browser. The text recognition models (also used to read scanned PDFs in the Readalix reader) are downloaded once from Hugging Face, which sees the request the way any file download does. When the words in a box look like another alphabet, the model for that alphabet (about 8 to 21 MB) may be downloaded the same way, without asking, to read them. If Hugging Face cannot be reached from your network, these models come through readalix.com instead, the same way as voice downloads.
• Scanned PDFs in the Readalix reader: nothing from the document. When a PDF’s pages are pictures of text, the reader recognises the words on your own device, and neither the pages nor their text leave your browser. To do that it needs text recognition models, up to about 31 MB, which it downloads from Hugging Face by itself the first time you open a scan (or use the snipping tool, which shares them), without asking first, and shows the download’s progress while it runs. A scan in an alphabet you have not read before adds that alphabet’s model, about 8 to 21 MB. Each model is downloaded once and kept on this device, so later scans in the same alphabet need no download. Hugging Face sees the request the way any file download does, never the document. If Hugging Face cannot be reached from your network, these models come through readalix.com instead, the same way as voice downloads.
• PDF previews on Gmail, Google Drive and websites’ own PDF viewers: to decide whether to show the Readalix button on a preview, the extension asks the site showing it for the same file again, with your existing sign-in to that site, the way your browser did to show it. If that site will not send just part of the file, the whole file may be downloaded, up to 64 MB. The file goes only between that site and your browser, it is not kept, and nothing about it is sent to us. If that check fails, it is tried once more after 30 seconds, never more often. It never happens in a private window, or on a site where you turned Readalix off.
• Dictation: nothing. Your voice is turned into text on your own device, only from when you press Start until you press Stop (or until it has heard no speech for the time set in Settings → Dictation, three minutes unless you change it), while a red microphone shows on the toolbar icon, and the sound and the words never leave your browser. Nothing is recorded. The speech recognition model (80 to 566 MB, depending on your computer) is downloaded once, when you press Download, from Hugging Face, which sees the request the way any file download does. If Hugging Face cannot be reached from your network, it comes through readalix.com instead, the same way as voice downloads.

Google Drive, if you connect it

Two optional features use your own Google Drive: the “Save as audio or video” tool can save its file there instead of your downloads folder, and “Add to Google Drive” (in General settings) lets you open a PDF from Drive’s “Open with” menu straight into the Readalix reader. They are the only reasons the extension ever asks for a Google account, and both stay off until you turn one on.

• What we ask Google for: permission to add files to your Drive and to open the files you choose to open with Readalix, and, if you use “Add to Google Drive”, to appear in Drive’s “Open with” menu. Nothing else. The exact permissions are the ones Google calls drive.file, which covers only the files this extension itself creates and the ones you open with it, and drive.install, which only adds that menu entry. Your existing documents, photos and folders stay out of reach: the extension cannot browse, read or delete them, even if it wanted to.
• What is kept on your device: a Google access token, which expires after an hour, and the id of the Readalix folder so the next export lands beside the last one, and the email address of each Google account you added Readalix to Drive’s “Open with” menu for, so the settings can tell you which Drives show it. All of it lives on this device only and are never synced to your other browsers.
• What we receive: nothing. There is no server on our side for the file to pass through. Your browser uploads it straight to Google, a PDF you open from Drive comes straight from Google to your browser, and we never see the file, your Google account, your email address or your Drive contents.
• Turning it off: Disconnect, in the export settings, tells Google to revoke the permission, takes Readalix out of Drive’s “Open with” menu, and erases the token and folder id from this device. Files already saved stay in your Drive, where they are yours to keep or delete. You can also revoke access at any time from your Google account’s permissions page.

Anonymous usage statistics

To decide which voices and languages to improve and which bugs to fix, the extension sends anonymous usage events to PostHog on their EU servers. You can turn this off at any time in Settings → General, and nothing is sent after that.

What an event contains:

• The kind of surface that was read (a web page, a PDF, a Google Doc, a form field), never which page or which document. When a read fails, that one event also carries the name of the site (for example bbc.com), because a page Readalix cannot read cannot be fixed without knowing where it is. Only the site name: never the address, never anything after it, and a site on a private network, a local address or a file on your own computer is recorded as just that, without being named.
• Which voice engine, voice and language were used, the reading speed, which voices you played a sample of, how far through the read you got, why the read stopped (you stopped it, it finished, or it failed), whether any sound came out at all, and roughly how long you waited for the first sound and how long you then listened, each as a time range. For the language, that includes how it was chosen: what the page declared, what was detected from the text, what you had pinned for that site, and which other writing systems the text contained (for example that an English page also held Arabic). For a voice sample, also whether it made a sound.
• How much text was read, as a size range (for example “200 to 1000 characters”), never an exact count.
• Which buttons and settings were used, whether the free daily allowance ran out, and whether a purchase was made, or an earlier one was restored by signing in on a new install. If you buy, the event also records which plan you chose, its price, whether a free trial came first, and roughly how long you had the extension before buying (as a range such as 7 to 29 days), never your email address or any payment detail. For settings whose value is the point, the value itself: the highlight colours you chose and the keyboard shortcuts you set, and the toolbar layout you arranged (which buttons sit on its top row and which behind the handle, in order). If you download or remove a local voice model (Piper, Kokoro, Supertonic, or the model your own voices use), which model it was, its size, whether the download finished and, if it failed, why, as a fixed label (the server could not be reached, the connection dropped partway, the disk was full, or the server refused it). If you check a Gemini, OpenAI or ElevenLabs API key, which of those providers it was and whether the check passed, failed or could not reach the provider, never the key itself or any part of it. If you use ElevenLabs, which model you pick, and whether you set, cleared or picked a random speaking style, never what the style says. If you hide or show voices or languages in your menus, which engine and which language they belonged to, how many you hid out of how many were listed, and whether you used the bulk button, never which individual voices you picked. If the extension asks you to rate it in the Chrome Web Store, whether that row was shown, whether you opened the store from it or dismissed it, and whether it was the first or the second time you were asked, never anything about what you read to earn it. On the welcome page that opens when you install Readalix, which of its two steps you reached: that the page opened, whether the extension was already pinned to your toolbar, whether you pinned it, whether you selected the sample text, and whether a sentence was read out. That sample is editable, and nothing you select or type into it is ever sent. If you open a PDF in the Readalix reader: whether the reader button on a PDF was shown, pointed at or pressed, and on which kind of PDF (the browser’s own viewer, a PDF inside a web page, a file made by a web app, or a Google Drive or Gmail preview); how the document was opened, whether it opened and, if not, why (for example the error number the server answered with); its number of pages, amount of text and file size, each as a range; whether it was a scanned document whose text had to be recognised, which alphabet was used for that and how long it took; how many of its pages could not be drawn, or had a picture whose words could not be read, as a range; which of the reader’s tools you used (search, thumbnails, zoom, rotate, print, download, the way back to the browser’s viewer); whether the reader offered to read the words in the document’s pictures and what you answered; whether you opened the other PDFs of a multi-file drop; whether a form’s own scripts could not run, or a saved file lacked something other apps need to show a field or a note correctly; whether you tried a failed text recognition download again; whether the document has a form to fill in, which kinds of field you filled in (a text box, a tick box, a choice from a list), and whether a file you downloaded or printed carried your changes; whether you added text, a drawing, a highlight or an image to a page (and whether that image came from the button or was dropped onto the page), whether you described an image or marked it as decorative, changed its colour, size, thickness or opacity, hid your highlights, or undid or redid a change (and whether with the keyboard, the undo and redo buttons, or the button that brings back something you removed), and roughly how many things you added; and, when you close it, how long it was open, roughly how far through the document you went, and whether you left with changes you had not saved. Never the file’s name or address, what you searched for, anything you typed into it, any picture you added or the words describing it, or any of its text. In the Readalix reader, also: whether the tab was opened fresh or reloaded, how long the first page and its words took to be ready (as time ranges), whether a search found anything (never what you searched for), whether you used select-all, how you turned pages and whether you opened another file; and whether the reader button appeared on a website’s own PDF viewer, or was offered there after a press of Play. If you add a Gemini, OpenAI or ElevenLabs key: which of those services have a key saved, which steps of adding one you reached (opening Voice providers, a service’s tab, the link to get a key, or pressing save before ticking Gemini’s box), the error number a provider answered with when a key check, a read or a voice sample fails, and, for ElevenLabs, whether the key can show this month’s credits and roughly what share of them is used. Never the key or any part of it.
• Errors and crashes, with the file and line they came from. A failed read also carries a short diagnostic trail of the steps that led to it: which capture path ran, how many sentences were found, which engine and voice were speaking, how far in it stopped and what the error was. It is built from a fixed list of diagnostic fields, so the text you read, the page address and the spoken words are left out by design rather than removed afterwards.
• The extension version, your browser and its version, your operating system, the interface language, the colour theme you chose (System, Light or Dark) and whether your computer is set to dark mode, which ElevenLabs model is selected if you saved an ElevenLabs key, and a random id generated on install. That id is stored on this device only, is never synced to your account, and disappears when you uninstall.
• Whether the Microsoft voice service could be reached, and when it could not, the reason as a fixed label: no internet connection, nothing answered on the network, the network blocked it, the device clock is wrong, a missing browser permission, the service answered but refused the connection, or it answered but sent no audio in time. Never how far the clock is out, and never any address, network name or firewall detail.
• When you remove Readalix, Chrome opens a short page on readalix.com that asks why. Answering is optional: if you pick one of the three reasons, only that choice is sent, along with the version you were on and your interface language. The page also has an optional box for writing an answer in your own words. It is the one place Readalix sends text you wrote yourself, nothing is sent unless you fill it in and press Send, and it is limited to 400 characters, so please leave out anything personal. The extension is already gone by then, so these answers carry no identifier at all and cannot be linked to you or to anything you read. Turning usage statistics off also stops this page from opening.
• If you write to us from Settings → About, the message you typed is sent as an event, together with the extension version, your browser, and the voice, language and reading speed you had set, so the problem can be reproduced. Nothing is sent unless you write something and press Send, and the box is limited to 1000 characters. The email address field is optional and always empty until you type in it: the extension never reads an address from your browser, and if you leave it blank nothing about you is sent. Unlike the uninstall page, a message sent from here does carry the random install id described above, which is the point: it lets us look at what the extension was doing before the problem, so a report can actually be acted on. The page tells you this before you press Send. A short random code is attached so a later reply can be matched to your message; it identifies nobody. Please leave anything personal out of what you write. Turning usage statistics off removes this box.
• If you use the snipping tool: how it was started (the toolbar button, the keyboard shortcut, the right-click menu, or on its own when the toolbar opens), the kind of page it was on (a web page, a PDF, a Google Doc and so on) and the kind of thing the box was drawn over (a video, a picture, a drawing area or ordinary page text), whether you cancelled it, whether words were found in the box, which alphabet read them, whether that alphabet was guessed and how many were tried, whether the recognition model had to be downloaded, how long recognising took and how much text came out (each as a range), whether reading started on its own, and whether you picked another alphabet, copied the text or removed the snip, and how you ended it (the ✕ next to the box, the Esc key, the toolbar or the keyboard shortcut). A read of a snip is counted as a read of that kind. Never the picture, the words in it, or where on the page the box was. Also whether a video playing under the box was paused. Also how long snip mode stayed open (as a range) and how many clicks in it drew no box, whether the short how-to animation was showing, and whether a recognition model was still downloading when you ended it.
• If you use dictation: which of its three models was used and whether you or the extension chose it, the language it listened for, whether the model was already loaded and how long it took to load, whether it ran on your graphics chip or your processor, how long the microphone was on and how long a phrase took to be written (as ranges), how many phrases there were, how many came back empty or could not be written (with the model’s own short error message), and roughly how many words (as a range), how it ended (you pressed Stop, a silence stopped it, the microphone went away, or the model stopped working) and whether the toolbar was still open, whether you allowed the microphone when asked, and, if it stopped, why, as a fixed label (the microphone was blocked, missing or in use, or the model could not be downloaded or could not run, with the model’s own short error message in that last case). The model you choose in Settings → Dictation, how long a silence stops it, and the language you pick for dictation are recorded like other settings, and downloading or removing a model like a voice model. Never what you said: no words, no sound.
• If you make your own voices: when you open Your voices and how you got there, whether you pressed Make my voice or Add a voice, whether that language’s voice model was already downloaded, whether you started recording and whether with the microphone you picked or your computer’s default, and whether you closed the recorder before a voice was made and at which step (with how many seconds you had recorded). For each voice: the language, whether it was recorded or made from a file you chose, the recording’s format (for example MP3) and its size and amount of sound as ranges, its length in whole seconds once trimmed, roughly how long making it took (as a range), whether the model was still downloading, whether the new voice read its first sentence back, how many voices you then had, whether you allowed the microphone for it, whether you heard it and tried again, renamed it or removed it, and whether you played the example before downloading (and which of its two clips). If making one failed: why, as a fixed label (too short, nothing heard, no microphone, the microphone not allowed, a file that could not be read, the limit of 10 voices reached, or the extension stopped while making it), the step it failed at, and the short error message your browser or the voice model gave. Never the recording, the name you gave it, the name of a file you chose, nor anything made from them. A read in one of your voices is reported like any other read, with the voice named only as “my voice”, and so is playing a sample of one, with the short error message if it made no sound.

What an event never contains:

• The text you read, or any part of it: no selection, no word, no sentence.
• The address or title of any page you visit, or the name of any file you open. The site name described above is the single exception, it is sent only when a read fails, and it is never sent for a successful read.
• Your name, your email address, or your API keys. Nothing asks you for them, and no event collects them from you. There are two exceptions, both of which you fill in yourself and neither of which is pre-filled: the optional comment box on the uninstall page, and the feedback box in Settings → About, whose optional email field exists so we can reply to you. Both send exactly the words you typed, so please leave personal details out of them.
• Nothing is sold, shared with advertisers, or used to track you across sites. Like any web request, the connection itself reveals your IP address to PostHog; they use it only to derive an approximate country and do not store it.

Visiting readalix.com

The website asks before it measures anything. Press Allow on the cookie notice and the page loads Google Analytics, which shows us which pages are read, for how long, and how visitors found them, so we can improve the pages that help you and drop the ones that don’t. Press No thanks and Google Analytics is never loaded.

• What Google Analytics records: the address and title of the page, the site that sent you (a search engine, ChatGPT, a link), how long you stayed, your approximate country and city, and your browser, device type and language. It sets cookies whose names begin with _ga to recognise a returning visit, and Google deletes the detailed records after two months.
• What it never gets: your name, your email address, anything you type, or anything from the extension. Advertising features are off, so the data is never used to show you ads. Google processes it for us under its data processing terms, and explains how it uses data from sites that use its services.
• Counted without cookies: Cloudflare, which serves this site, counts page views with its Web Analytics. It sets no cookie, stores nothing on your device, and shows us only totals, such as views per page and per country.
• Changing your mind: your answer is saved in this browser only. Use the button below to change it at any time. Choosing No thanks also deletes the Google Analytics cookies this site set.

Change my cookie choice

Payments

Premium is sold through ExtensionPay, which uses Stripe. Your email address and payment details are handled by them; we never see or store card data. The extension only asks them two things: whether the current installation is paid, and what Premium costs today, so the buy buttons show the price checkout will charge. The price request carries nothing about you.

Children

The extension is not directed at children under 13 and collects no personal data from anyone.

Changes

If this policy changes, the effective date above changes with it.

Contact

support@readalix.com