Privacy Policy

1. Data protection framework

We process personal data in accordance with applicable law, including:

• the Digital Personal Data Protection Act, 2023 (India) and the rules made under it;
• the Information Technology Act, 2000 and the rules made under it (India);
• the General Data Protection Regulation (GDPR) and UK GDPR, where they apply to you;
• the California Consumer Privacy Act (CCPA), where it applies to you.

Ma-anah Corp is the data controller (the "Data Fiduciary" under Indian law) for the personal data described here. For any privacy question or request, contact privacy@read2listen.com.

2. What we collect

Account data, when you sign in with Google:

• your name and email address from your Google account, and Google's account identifier for you;
• a session record for each signed-in browser or app (your name and email, a security token stored only as a hash, and when it expires).
• We do not receive your Google password, and we do not store your profile picture or any Google access token. We do not access your Gmail, Drive, contacts or any other Google data.

Your documents, when you upload them:

• the file itself, its filename, and the details you give it (name, version, date and intended use);
• the text and page layout we extract from it so it can be read aloud.

Listening activity, while you listen:

• when you listened to which of your documents, in one-minute intervals, and your place in each document (including a short snippet of text around it, so your place can be found again);
• your time zone, so your daily listening goal and streak follow your local day.

Waiting list, if you join it: your email address, the date you joined, and the consent you gave.

Product analytics and error reports (see "Analytics" below): pseudonymous usage events and technical error details.

Technical data:

• our server records each request's method and path (not the query string or your IP address), errors, and the filenames of uploaded documents, for operating and securing the Service;
• your IP address is used briefly in memory to limit abuse (for example, repeated sign-in attempts), and is not stored by us;
• server performance metrics (CPU, memory, disk and request timings) that contain no personal data.

3. What we do not collect

• We do not collect payment information. The Service is currently free.
• We do not use advertising or cross-site tracking cookies, and we do not sell or rent personal data.
• We do not record your screen or sessions, and we do not capture what you type into the app.
• We do not send your documents, their text or their names to our analytics provider.

4. How we use your data

• To provide the Service: sign you in, store your library, prepare documents for listening, keep your place in sync across your devices, and show your listening progress and streak.
• To keep the Service secure: prevent abuse, enforce invitations and our Terms of Service, and investigate problems.
• To understand whether read2listen works and to fix it: count how many people listen and how often, and find and fix errors.
• To contact you: if you joined the waiting list, to tell you about early access and launch; and, if you have an account, about important changes to the Service or these policies.
• To comply with legal obligations.

Legal bases: we process account, document and listening data to provide the Service you asked for (performance of a contract); security, analytics and error data for our legitimate interest in running a reliable, safe service (and, under Indian law, for these legitimate uses or with your consent); and waiting-list email with your consent, which you can withdraw at any time.

5. Your documents

Documents are processed on our own servers to extract their text and layout. We do not send your documents or their text to AI providers or other third parties, and we do not use them to train AI models. We read your documents only when needed to operate the Service (for example, to investigate a problem you report) or when the law requires it.

Upload only documents you have the right to use. Please do not upload documents containing highly sensitive information (such as health, financial or government identity records): the Service is an early beta and is not designed for them.

6. Voices and speech

read2listen reads your documents aloud with one of two kinds of voice:

• System voices are provided by your device's operating system (for example Apple, Microsoft or Google). The app passes the text being read to your device's speech engine. Most system voices work entirely on your device; voices marked "needs internet" may send that text to the voice's provider to generate speech, under that provider's own privacy policy. Choose a voice not marked "needs internet" if you want text to stay on your device.
• Natural (on-device) voices run entirely on your device. The first time you use one, the app downloads the voice model from Hugging Face; Hugging Face sees your IP address for that download, but no document text is sent to it. The model and generated audio are then saved on your device.

7. Analytics and error tracking

We use PostHog to understand how the Service is used and to find errors. We designed this to be privacy-conscious:

• Only a fixed list of events is sent, such as a page being viewed (by its general route, never the full address), a document being uploaded (only its file type and approximate size), listening starting, and reaching the daily listening goal.
• You are identified only by a pseudonymous ID derived from your account, not by your name or email. Visitors who are not signed in get a random ID that lasts for one page load.
• No cookies or device storage are used for analytics, and we disable session recording, heatmaps and automatic click tracking.
• Web addresses are stripped of query strings, fragments, referrers and campaign parameters, and IDs in addresses are removed.
• Error reports include the type of error, a shortened error message, and where in our code it happened.
• We do not use IP addresses for location, and we configure PostHog to discard them.
• If your browser sends a "Do Not Track" signal, the web app does not send analytics events.

8. Cookies and storage on your device

We use only essential cookies:

• __Host-read2listen_session keeps you signed in (lasts up to 7 days);
• __Host-read2listen_oauth protects Google sign-in while it is in progress (lasts up to 10 minutes).

The app also stores data on your device so it works quickly and offline: your settings and voice preferences, your place in each document, listening activity that has not synced yet, saved narration audio, and the voice model. The desktop and Android apps also keep an offline copy of your library and the text of your documents.

• Signing out of the desktop app deletes its offline library, sign-in credentials and saved narration; downloaded voice models stay until you remove the app.
• On Android, signing out removes your sign-in credentials, but offline copies of your library, document text, saved audio and listening history stay on the phone until you clear the app's storage or uninstall it.
• We cannot remotely erase copies stored on your devices, including after your account is closed.

9. Who we share data with

We share personal data only with service providers that help us run the Service, under their terms and privacy policies:

• Google, to sign you in;
• Akamai (Linode), which hosts our servers and stores your account, documents and listening data;
• PostHog, for product analytics, error tracking and server metrics, as described above;
• Hugging Face, which hosts the downloadable voice model (it receives only the download request).

We may also disclose data when required by law, regulation, legal process or a valid government request; to protect the rights, safety or property of our users, the public or us; or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to your data.

We do not sell or share personal data for advertising.

10. International transfers

We are based in India. Our service providers may process data in other countries, including the United States. Where the law requires it, we use appropriate safeguards (such as contractual commitments from our providers) for these transfers.

11. How long we keep data

• Account data, documents and listening activity: for as long as your account is open. Deleting a document removes the file and its extracted text; its listening history stays with your account until the account is deleted.
• Sign-in sessions: up to 7 days in a browser and up to 30 days in the desktop and Android apps, then they expire.
• Waiting-list email: until you ask us to remove it, or until we no longer need it to tell you about early access and launch.
• Analytics and error data: no longer than 24 months. Server metrics: 30 days.
• Server logs: rotated automatically and overwritten after they reach a fixed size.
• When you ask us to delete your account, we delete your account, documents and listening data from our servers within 30 days, except where the law requires us to keep something.

12. Security

We protect your data with encryption in transit (HTTPS), security tokens stored only as hashes, sign-in credentials encrypted on your device by the operating system, an isolated database network, and strict separation between accounts.

No service is perfectly secure, and read2listen is an early beta. If a breach affects your personal data, we will notify you and the relevant authorities as required by law.

13. Your rights and choices

Depending on where you live, you may have the right to:

• access a summary of the personal data we hold about you and how we use it;
• correct or update inaccurate data;
• delete your data or close your account;
• receive your data in a portable format;
• restrict or object to certain processing;
• withdraw consent (for example, to waiting-list email) at any time, without affecting earlier processing;
• nominate another person to exercise your rights if you die or become incapacitated (India);
• lodge a complaint with a supervisory authority, such as the Data Protection Board of India or your local data protection authority.

To exercise any of these rights, email privacy@read2listen.com from the email address on your account. We do not yet offer self-service account deletion or data export in the app, so we handle these requests by email. We will respond within 30 days and may need to verify your identity first. You can also delete individual documents in the app at any time.

14. Children

The Service is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact privacy@read2listen.com and we will delete it.

15. Changes to this policy

We will update this policy when the Service changes the way it handles data, and change the "Last updated" date above. For material changes, we will notify you by email or in the app before they take effect.

16. Contact and grievances

For questions, requests or complaints about privacy, contact our Grievance Officer at privacy@read2listen.com. We will acknowledge complaints within 24 hours where the law requires it and aim to resolve them within 15 days.

• Company: Ma-anah Corp (read2listen)
• Address: 18, Radhakrishnan Nagar Main Road, Thiruvanmiyur, Chennai, Tamil Nadu 600041, India
• Email: privacy@read2listen.com