1. Overview
WhatIsTTS ("we", "us") operates a text-to-speech aggregation platform. This policy explains what data we collect, how we use it, and your rights regarding that data. We do not sell your personal data.
2. Data We Collect
Account Data
- Email address — used for account creation, login, and transactional emails.
- Password — stored as a salted hash (PBKDF2/Argon2). We never store plaintext passwords.
- Payment information — processed by Stripe, PayPal, Square, or Coinbase. We store only processor tokens and transaction IDs, never full card numbers.
Usage Data
- API requests — we log request metadata (timestamp, model used, character count, credit cost) for billing and rate limiting. We do not permanently store the text content you submit or the audio generated.
- Job records — operation type, model, status, and credit cost are stored for your account history.
- IP address — collected for rate limiting and fraud prevention. Retained for 90 days.
Cookies and Analytics
- Session cookie — essential for authentication. Expires when you close your browser or after 14 days.
- CSRF token — security cookie to prevent cross-site request forgery.
- Language preference — stored to remember your selected language.
- We may use privacy-respecting analytics. We do not use third-party tracking pixels or advertising cookies.
3. How We Use Your Data
- To provide and maintain the Service (authentication, billing, credit tracking).
- To route your TTS/STT requests to upstream providers.
- To enforce rate limits and prevent abuse.
- To send transactional emails (account verification, password reset, billing receipts).
- To improve the Service based on aggregate usage patterns.
We do not use your data to train AI models. We do not sell or rent your data to third parties. We do not send marketing emails unless you opt in.
4. Data Shared with Third Parties
When you use the Service, we share the minimum necessary data with upstream providers to fulfill your request:
- TTS providers — receive the text you submit and voice/model parameters. They do not receive your email, name, or account details.
- Payment processors (Stripe, PayPal, Square, Coinbase) — receive payment details necessary to process transactions.
- Email service — our self-hosted mail server sends transactional emails. No third-party email marketing service is used.
We may disclose data if required by law, court order, or to protect our legal rights.
5. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data | Until account deletion + 30 days |
| Job/billing records | 1 year after creation |
| Submitted text | Not permanently stored (transient processing only) |
| Generated audio | Not permanently stored (returned to you, then deleted) |
| IP addresses | 90 days |
| Payment tokens | Until account deletion |
6. Your Rights
Depending on your jurisdiction (GDPR, CCPA, etc.), you may have the right to:
- Access — request a copy of the data we hold about you.
- Correction — request correction of inaccurate data.
- Deletion — request deletion of your account and associated data. Use the "Delete Account" option in your account settings, or contact us.
- Export — request an export of your data in a machine-readable format.
- Objection — object to processing of your data for specific purposes.
To exercise these rights, contact us through our contact page. We will respond within 30 days.
7. Security
- All connections are encrypted via TLS (HTTPS).
- Passwords are hashed with PBKDF2 or Argon2.
- API keys are generated with cryptographically secure random bytes.
- Server-to-server communication with upstream providers uses shared secrets.
- We perform regular security reviews of our codebase.
No system is perfectly secure. If you discover a security vulnerability, please report it to us through our contact page.
8. Children's Privacy
The Service is not directed at children under 13. We do not knowingly collect data from children under 13. If we learn we have collected such data, we will delete it promptly.
9. International Transfers
Your data may be processed in the United States and other countries where our servers and upstream providers operate. By using the Service, you consent to this transfer. We ensure appropriate safeguards are in place.
10. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated via email or a notice on the Service. Continued use after changes constitutes acceptance.
11. Contact
For privacy-related questions or data requests, contact us at our contact page.