Privacy
Pronounced Pages is built so that the things that matter most — the books you import, your voice and your reading record — stay on your device. This page says exactly what stays, what leaves, and when.
What stays on your device
Everything about your reading is kept in your browser's own storage on the device you read on. We cannot see it, and it is never uploaded to us.
| Data | Where it lives |
|---|---|
| Imported books |
The text of every EPUB you import, split into sentences, plus its file name and size. The EPUB file
itself never leaves the device: it is unpacked and read in your browser. (IndexedDB, database
libro.)
|
| Reading positions | Where you are in each book. (IndexedDB.) |
| Reading record | Per-word counts of what you read correctly, missed, or read closely, per language. This is the data behind future vocabulary features. It is never sent anywhere. (IndexedDB.) |
| Cached translations | Translations already fetched, so a sentence is translated once. The cache holds the translated text and a hash of the source sentence, and is deleted with the book. (IndexedDB.) |
| Preferences | Text size, the language you are learning, translation settings, the last book you opened, whether you have seen the welcome tour, and a copy of your account status for display. (localStorage.) |
Clearing your browser's site data for pronouncedpages.com removes all of it. The app's settings also let you delete an imported book and clear your reading history.
What we store on our servers
If you sign in, we keep a small account record in a database on Cloudflare (Cloudflare D1). It holds only what sign-in, subscriptions and allowances need:
- your email address, in lower case — the only personal detail we store;
- hashed sign-in codes (we store a hash of each six-digit code, not the code) and their expiry;
- hashed sessions (a hash of the random id in your sign-in cookie, with when it was created, last seen and expires);
- hashed rate-limit keys that slow down repeated sign-in requests;
- your plan and its status (Free, Reader or Pronounced; whether it is active, cancelled or past due, and when the paid period ends);
- usage counters: the number of characters translated and seconds of coaching used in each period;
- billing identifiers from our payment provider (a customer id, a subscription id, and the ids of billing events we have already processed, so a repeated event is not applied twice);
- for coaching, the id and timing of each short-lived speech token we issue.
Our servers never store book text, audio, reading positions or the reading record. There is no table that could hold them, and an automated check fails if one is added.
You can use the shelf, import your own books and read aloud without signing in. Signing in is needed for translation through our service and for coaching.
What leaves your device, and when
Translation
On desktop Chrome with a built-in translator, translation happens on your device and nothing is sent to us. Your browser may download a language pack from its maker the first time.
Otherwise, as you reach each sentence, that sentence — and a few sentences ahead — is sent to our server, which forwards it to Microsoft Azure Translator and returns the translation. Sentences are sent only when on-device translation is unavailable, only for the book you are reading, and a short window at a time: never the whole book, and never the EPUB file. We do not store the sentences and we do not write them to our logs; our server only counts the characters translated against your allowance. Microsoft processes the text to translate it under its own terms. Imported books are never uploaded as a whole, kept on a server or shared with anyone.
Pronunciation coaching (Pronounced plan)
When you turn on coaching or check a sentence, audio from your microphone streams directly from your browser to Microsoft Azure Speech, which scores each word and sends the scores back. Our server never receives the audio; it only issues a short-lived (ten-minute) access token so your browser can connect. We do not record or store audio, and nothing in the app saves it on the device either. The scores are shown to you and are not sent to us. Microsoft processes the audio to assess it under its own terms.
The time you spend coaching is counted in seconds against your monthly allowance; the count is all we keep.
Error reports
If the app hits an unexpected error, it sends our server a short error report — the type of error and its message with any quoted text removed, the path of the page (never its query), the app's version and the places in the app's code involved — which never includes audio, your email address or an account identifier, is built to leave out book text, and is kept in our server logs for up to a week.
Speech recognition
The green and red word feedback uses your browser's own speech recognition (the Web Speech API). We never receive that audio or the transcript. Depending on the browser, recognition may run on the device or the browser's maker (for example Google for Chrome, Apple for Safari) may process the audio on its servers under its own privacy policy; that is why recognition needs a network connection.
Cookies, analytics and ads
We set one cookie, pp_session, and only after you sign in. It holds a random session id, is
marked HttpOnly and Secure, and lasts 180 days from the last time you used the app. Signing out removes it.
There are no analytics, no tracking pixels, no third-party scripts and no ads on this site or in the app.
Your email address
We use your email address to send you sign-in codes and, if you subscribe, to set up your billing account with our payment provider so it can send you receipts. We do not send marketing email and we never share or sell your address. Sign-in codes are sent through an email delivery provider (Resend), which sees the address and the code in order to deliver it.
Payments
Subscriptions are handled by Stripe as the merchant of record. Stripe collects and stores your card or other payment details, handles tax and sends receipts. We never see your card number. When you subscribe, we create a customer record with Stripe using your email address, and Stripe tells our server when your subscription starts, renews, changes or ends; that is the only way your plan is ever set.
What we can see
Our server's logs hold one short, structured line per API request and nothing else — not even the web address you opened. A line holds the route, the response status, how long the request took, which provider handled it, counts (sentences, characters, seconds), the languages of a translation, the kind of billing event received, and an error code or type when something fails. Each line also carries a random id made for that one request, so a problem with one request can be traced. A line about a failure that happens after you have signed in can also carry a pseudonymous account reference: a keyed hash that we can link back to your account, but that is not your email address or your account id. The lines never contain book text, translations, audio, sign-in codes, session ids, tokens, email addresses or email contents. The one exception is an error report's line, which also holds the details listed under Error reports and is built to leave out book text. The operator can use these lines to see that the service is working and how much it is used — not what anyone is reading.
Deleting your data
Everything on your device is yours to delete: use the app's settings or clear the site's data in your browser. To delete your account and the record described above, email us from the address you signed in with (see Contact); there is no self-service deletion button yet, so a person does it by hand. We will confirm when it is done. An active subscription is cancelled first.
Changes
When this page changes, the date at the top changes with it. A change that affects what leaves your device will be announced in the app before it takes effect.
Contact
Questions and requests: hello@pronouncedpages.com.