Skip to content
Cloud Speech Install

← Home

Privacy policy

Last updated: September 2026

This policy covers the Cloud Speech extension on every store it ships from. On the Chrome Web Store that is the Cloud Speech listing (formerly Polly for Chrome) and the Azure Speech for Chrome listing, which receives the same build.

The short version: the extension has no servers, no analytics, and no tracking. Your text goes only to the speech provider you choose (a cloud service, or the OpenAI-compatible server you configure: your own or a hosted one), using your own credentials.

Introduction

This Privacy Policy explains how Cloud Speech ("we," "our," or "us") handles your information. The extension's source code is public. You can verify everything below in the source code.

Information the extension stores

API credentials

The extension stores the API credentials you provide for Amazon Polly (access key, secret key, region), Azure Speech (key, region), Google Cloud Text-to-Speech (API key), OpenAI (API key), and/or any OpenAI-compatible server you configure (server URL and an optional API key) in your browser using the browser's extension storage API (browser.storage). They are used solely to authenticate with the provider you selected and are never transmitted to us or to any other third party, other than your browser's own settings sync, described below. We operate no servers.

By default, settings use your browser's sync storage (Chrome Sync or Firefox Sync), so they follow you across devices signed into the same browser profile (Google encrypts synced extension data in transit and at rest). The extension has a sync toggle: turn it off in Settings to keep credentials in local storage on the current device only.

User preferences

Your voice selection, favorites, playback settings, and extension configuration are stored the same way (sync or local, per the toggle above).

Selected text

When you select text for speech synthesis, it is processed locally in your browser (sanitized and split into chunks) and sent directly and only to the one provider you have selected (Amazon Polly, Azure Speech, Google Cloud TTS, OpenAI, or the OpenAI-compatible server you configured) using your own credentials.

The four hosted providers are reached over HTTPS at their own endpoints. An OpenAI-compatible server is reached at the URL you entered; for a self-hosted server that URL may be plain http:// (for example on localhost).

We do not store, log, or have any access to this content. The extension keeps the most recent read's audio, together with the text it was made from, in IndexedDB on your device so that a replay does not call the provider again.

What the extension does NOT do

  • No analytics, telemetry, or usage tracking of any kind
  • No advertising and no third-party trackers
  • No selling, trading, or transferring of your data; we never see it
  • No servers of our own: the extension's own requests go only to the speech provider you configured; the Feedback buttons open GitHub or your store's review page in a new tab (see Third-party services)
  • No sending of your text to providers you have not selected

Third-party services

When you use the extension, selected text is sent from your browser to the provider you chose, under your own account (or to the OpenAI-compatible server you configured). How that provider handles the data is governed by its own privacy policy:

The Report a bug button in Feedback opens a GitHub new-issue page in a new tab whose URL carries the extension version, the install source (store or built from source), your browser and its version, and the name of your selected provider, so GitHub receives those values when the page loads. The Request a feature / provider button opens the feature request form with nothing but the template selected. Neither URL ever carries credentials or text.

The Leave a review button opens the review page of the store you installed from, with no extra parameters.

Data storage and security

All extension data lives inside your browser profile:

  • Credentials and preferences: extension storage, sync or local per the toggle (sync:settings or local:settings); the toggle itself is always local (local:syncEnabled)
  • The import undo (local:importBackup): after a settings import, the previous settings stay in local storage as a one-slot undo until you restore or discard them, or import again (a new import replaces the slot)
  • Voice errors (local:voiceIssues): when a read or preview of a voice fails, or an availability scan finds one of its models failing, the provider's error message is kept in local storage, per voice and model, until a read or preview of that voice and model synthesizes successfully (a replay from cached audio does not count) or a scan finds that model working again
  • Legacy-listing handoff records (local:handoffImports on the Cloud Speech listing, local:migrationBanner on the legacy copy): local storage, described below
  • Playback state and the fetched voice list (session:playback, session:preview, session:voices): session storage, cleared when the browser closes
  • Cached audio and its text: the extension's IndexedDB on the device
  • Your theme choice (light, dark, or system): mirrored into the popup window's localStorage (csfc:theme) so the popup opens in the right theme before settings load

Legacy-listing handoff (Chrome only): when a Cloud Speech install from its own listing starts, it asks a copy installed from the Azure Speech for Chrome listing for that copy's stored settings, credentials included, through the browser's extension messaging (the legacy copy answers only Cloud Speech's listing ID). It merges them once: providers you already configured keep their entries, providers only the legacy copy had are added, favorites are combined, and a fresh install also takes the legacy copy's preferences.

The import is recorded in local storage so it never repeats, and the legacy copy then shows a note that your settings were transferred, with a Remove this extension button that uninstalls that copy. This exchange stays inside your browser.

Your credentials and preferences never leave your browser except for:

  • direct communication with the provider you configured (HTTPS for the four hosted providers; an OpenAI-compatible server uses the URL you entered)
  • your browser's own settings sync, if enabled
  • a settings export file you create yourself
  • the name of your selected provider in the Feedback URL

Your rights and control

Because everything is stored in your browser, you have complete control:

  • Update your credentials, or turn a provider off with its Enabled switch, at any time in the extension's Settings
  • Turn off settings sync to keep everything on the current device only
  • Export your settings as a plain-text JSON file when you click Export in Settings; the file is saved through your browser's downloads, includes your credentials, and is never uploaded anywhere
  • Delete everything the extension keeps in your browser by removing the extension (files you exported or downloaded stay where you saved them)
  • Revoke the extension's access to a hosted provider entirely by deleting or rotating the API keys in that provider's console; for an OpenAI-compatible server, rotate its key at the service that runs it, turn the provider off in Settings, or take your own server offline

Changes to this policy

We may update this Privacy Policy from time to time. Changes are posted on this page with an updated "Last updated" date, and the page history is available in the GitHub repository.

Contact

Questions about this policy? Open an issue on GitHub.