Skip to main content
Utterflow

Privacy Policy

What the Utterflow website and browser extension collect, where it goes, and how to access or delete it

Applies to: utterflow.com and the Utterflow browser extension
Effective date: November 1, 2026

Introduction

Utterflow ("we", "us") is a browser extension that reads web pages aloud and types what you dictate, together with this website, where you sign in, manage your account and open the pages you saved.

Your Utterflow account is the same account you may know from cosyvoice.org: both websites are run by the same team and use one account system and one database. Signing in on either site signs you in to the same account, with the same plan, audio minutes and saved pages. The extension talks to that account system (today at cosyvoice.org) for everything that needs a server.

This policy explains what we collect, why, who processes it for us, and how you can access, correct or delete your data.

Information We Collect

  1. Account information. When you sign in with Google we receive your email address, name, profile picture and Google account identifier. We store your account, your sign-in sessions and the time and approximate location (country, region, city and IP address) of your last sign-in.
  2. Where you came from. The first time you visit, the website stores a first-party cookie (cv_attrib) with the page you landed on, the referring website, campaign tags in the link (utm_*), your language and, if analytics is on, your Google Analytics client identifier. On your first visit, and again after 30 days, our servers also record a landing touch whether or not you sign up: the landing page, referring website, campaign tags, language, a random anonymous visitor ID, your country, your device type (mobile, tablet or desktop) and a keyed one-way hash of your IP address (never the address itself). If you create an account, these values are linked to it, so we can tell which channels bring users. Links from the extension carry tags such as utm_source=chrome-extension.
  3. Plan and usage. Your plan, payment status (from the account system's payment provider) and a record of each use that counts against your audio minutes: the time, the kind of use, the number of characters, the voice, the language and the audio length.
  4. Saved pages. The pages you save to your library (see below).
  5. Technical data. Our hosting provider processes IP addresses, browser user-agent and request logs to serve and protect the website.
  6. Cookies and local storage. Session cookies that keep you signed in, your language and theme choice, the cv_attrib cookie above and, where analytics is enabled, Google Analytics cookies. Your browser's local storage also holds the random anonymous visitor ID and the time of your last landing touch.

The Utterflow Browser Extension

Text you choose to hear. When you start reading, the extension takes the text of the page, or the part you selected, and sends it to a speech service to create the audio:

  • Microsoft's read-aloud speech service (speech.platform.bing.com), used for all reading by default. Microsoft receives the text and your IP address as part of the request and processes them under its own privacy terms.
  • Our account system, only if you are signed in and Microsoft's service fails for a passage. That passage (up to 2,000 characters at a time) is converted to speech by our speech provider (Microsoft Azure speech), and the audio length is counted against your monthly audio minutes. We use this text only to create the audio you asked for and do not store the text or the audio. We record only the usage itself, as described under "Plan and usage".
  • Our account system, for numbers and symbols, for every reader, signed in or not, and also while Microsoft's service works. A passage that contains a digit, a slash or a currency sign is sent to our server first (up to 2,000 characters at a time) so it can return how to say it aloud (for example, "$39/month" as "thirty-nine dollars per month"). We use this text only to answer that request: it is not stored or logged, and it is not linked to your account.

Dictation. When you are signed in and use the extension's microphone button, the extension records your voice only while dictation is on and sends that recording (16 kHz mono audio, at most 60 seconds at a time) to our account system, which has it transcribed by Cloudflare Workers AI or Groq (both run the Whisper speech recognition model) and returns the text, which the extension types into the field you chose. We do not store the recording or the transcript. We record the usage (time and seconds of audio) against your monthly audio minutes.

Pages you save to your library. When you are signed in and press Save on the reader toolbar, the extension sends that page's address, title, site icon address, language and extracted article text (up to 200,000 characters; never the page's HTML) to our account system, which stores them on your account so you can open them later in the extension or in your library on this website. To show whether the page you are on is already saved, the extension also sends that page's address to look it up; the lookup is not stored. We keep a saved page, with your reading position, until you delete it, in the extension or in Settings → Library on this website. Deleting it removes the saved text at once and the rest (address and title) within 30 days. Deleting your account removes all of them.

Apart from the cases above, the extension does not send page text anywhere, and it does not record which pages you visit.

Free read limit. Without an account the extension allows 3 reads per rolling 24 hours, up to 1,500 characters each. To count them, it creates a random identifier and sends it, with the number of characters about to be read, to our account system before each read. For each read we allow, we store that identifier, a keyed one-way hash of your IP address (never the address itself), the number of characters and the time, only to enforce the limit, and delete these records after 30 days. When you are signed in, the same check is made with your account and nothing is recorded.

Signing the extension in. You sign the extension in by signing in on this website and clicking Connect on the extension connect page. The website then creates a separate session for the extension and hands its token to the extension, which keeps it, with your account name and email, in the browser's extension storage. Signing out of the extension ends that session on our servers. The extension session and your website session are independent: signing out of one does not sign you out of the other.

Stored in your browser only: reading settings (voice, speed and similar), the toolbar position for each site, your per-site choices, and the times of your recent free reads.

No ads, no analytics in the extension. The extension has no advertising or analytics code. We do not sell extension data or use it for anything other than its features and your account.

How We Use Your Information

  • To provide the extension's features and this website, and to keep you signed in.
  • To manage your plan, measure your audio minutes and enforce the free limits.
  • To understand which channels bring new users (the first-visit attribution above) and how the website is used.
  • To answer your messages.
  • To secure the service against abuse, fraud and attacks.

We do not sell, rent or trade your personal data.

Who Processes Data for Us

  • Cloudflare: hosting, database and email delivery for this website and our account system; Workers AI speech recognition for dictation.
  • Google: sign-in with Google; Google Analytics on this website where it is enabled.
  • Microsoft: the read-aloud speech service used by the extension, and Azure speech for the signed-in fallback voice.
  • Groq: speech recognition for dictation.
  • Payment providers: when you upgrade, checkout happens on cosyvoice.org through its merchant of record (Creem or Waffo), which processes your billing details. We receive only transaction metadata (plan, amount, status, dates), never your full card number.
  • Authorities, when required by law or valid legal process, or to protect someone's safety.

Your Rights and How to Use Them

Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA/CPRA in California), you have the right to access, correct, export or delete your personal data, to restrict or object to processing, to withdraw consent, and not to be treated differently for using these rights.

  • On this website: see your account and plan under Settings, and open or delete saved pages in Settings → Library. Sign out at any time.
  • Account deletion and billing: your account is shared with cosyvoice.org, where you can cancel a subscription (Settings → Billing) and delete your account (Settings → Security).
  • By email: write to privacy@cosyvoice.org from the email address of your account, with the subject "Data Subject Access Request", "Personal Data Correction Request" or "Account Cancellation and Deletion Request". We reply within 48 hours and complete verified requests within 30 days, free of charge.

Data Retention

We keep account data while your account exists. Saved pages are kept until you delete them, as described above. Free-read records are deleted after 30 days. When you delete your account, your account records, sessions, saved pages and usage records are deleted. Limited payment records are kept by the merchant of record for the periods tax law requires.

Data Security

All traffic is encrypted with TLS. Data is stored with Cloudflare, encrypted at rest, with access limited to the people who run the service.

International Transfers

Our providers process data in several countries. Where personal data leaves the EU or UK, we rely on safeguards such as the European Commission's Standard Contractual Clauses.

Children

Utterflow is not meant for children under 13 (under 16 in the EU and UK). If you believe a child has given us personal data, contact us and we will delete it.

Changes to This Policy

We will update the effective date above when this policy changes and give notice on this website, or by email for significant changes.

Contact