Privacy Policy

Last updated: October 6, 2026

1. What We Collect

  • Account info: Email address, display name and account identifier, through Firebase Authentication with email/password, Google Sign-In or Sign in with Apple.
  • Voice samples: Audio files you upload for voice cloning. Stored in Cloudflare R2.
  • Text input: Text you enter for speech generation is stored alongside your generation history and audiobook projects for your reference and re-use. You can delete individual generations from your history.
  • Generated audio: Audio files created by the Service. Stored in Cloudflare R2 until you delete them.
  • Usage data: Character counts, generation history, plan information.
  • Payment info: For card purchases on the website, Stripe handles checkout and we keep the purchase and subscription records (we do not store card details). For KBZPay purchases, the payment screenshot you send and the Telegram chat ID and username you use with our bot.
  • Mobile diagnostics and notifications: Firebase Crashlytics collects crash reports, app state, device and operating-system information, installation identifiers and session information in release builds to help us diagnose errors and improve reliability. Firebase Cloud Messaging uses installation identifiers and push tokens to deliver notifications. These identifiers are not advertising identifiers.
  • Device and analytics info: IP address, browser and device type, approximate country, referrer and campaign tags, random browser/session identifiers, and selected product events. Server-side identifiers derived from account, IP, network range, device ID, and user agent are purpose-separated keyed pseudonyms and do not contain the raw values.

2. How We Use Your Data

  • To provide text-to-speech generation and voice cloning services.
  • To manage your account, plan, and billing.
  • To enforce the one-time trial across related accounts and browser/device clusters and prevent abuse.
  • To understand and improve the Service using Vercel Analytics and our first-party, pseudonymous usage analytics.
  • To process payments (via Stripe — we do not store card details).
  • For internal moderation — authorized AthanLab staff may review account details, generation history, and audio content to investigate abuse reports, enforce our Acceptable Use Policy, and provide technical support.
  • To deliver requested notifications and investigate mobile crashes. We do not use the mobile app's data for cross-app advertising tracking.

3. Third-Party Services

We use the service providers below to run AthanLab. They process data on our behalf, and each receives only the data it needs for its part of the Service. We do not sell your data to any third party.

  • Firebase (Google): Firebase Authentication handles sign-in with email and password, Google Sign-In or Sign in with Apple, and receives your email address, display name and account identifier. If you sign in with Google or Apple, that company also processes the sign-in under its own privacy policy. In the mobile app, Firebase Cloud Messaging receives installation identifiers, push tokens and the notifications we send you (on iPhone, delivered through Apple Push Notification service), and Firebase Crashlytics receives the crash reports and device information described in section 1. See Firebase's privacy and security information.
  • DigitalOcean: Hosts the AthanLab API servers. Everything the website and app send to AthanLab passes through them, including your IP address, the text you submit, voice samples and generated audio.
  • Neon: Hosts our database, which holds your account details, plan and usage, generation history, the text you submit, project and script contents, voice names and transcripts, and the other records described in this policy.
  • Cloudflare R2: Stores your voice samples, generated audio and audio exports, and the payment screenshots you send for KBZPay payments. Files are only served through time-limited links.
  • Modal: GPU cloud that runs AthanLab's own speech model. To generate speech, Modal receives the text to be spoken plus the voice sample and transcript of the voice you chose, and returns the generated audio. Modal does not receive your name, email address or account identifier, and processes this data only to produce the audio you request.
  • Resend: Sends our emails. Receives your email address and the content of the emails we send you, such as account, billing and deletion notices.
  • Stripe (website only): Processes card payments and subscriptions bought on the website. Receives your email address, account identifier and the payment details you enter at checkout. We do not store your card details.
  • Telegram (KBZPay payments on the website): If you pay with KBZPay, you send your payment screenshot to our Telegram bot. Telegram delivers it to us with your Telegram chat ID and username, which we link to your AthanLab account so our staff can verify the payment and credit your purchase.
  • Cloudflare Turnstile (website): Processes technical browser and network signals to verify trial generation requests; see Cloudflare's Turnstile Privacy Addendum.
  • Vercel (website): Hosts athanlab.com and provides Vercel Analytics and Speed Insights. Receives your IP address, browser and device type, the pages you visit and selected product events (for example starting a generation or checkout), without your name, email address or account identifier.
  • Google Fonts (website): The website loads its fonts from Google, so Google receives your IP address and browser information when a page loads.
  • Discord (staff alerts): Our staff receive internal account, payment and developer-application alerts through Discord. These can include your email address or display name, plan, usage, payment amount and approximate country. Developer-application alerts also include the company name, website, expected volume and use-case description you submit, and card-payment alerts can include the reason a payment failed and a link to the Stripe invoice. Payment screenshots, the text you submit for speech and audio are not sent to Discord.

Some of these providers store or process data outside your country.

4. Voice Data

Your voice samples are sensitive data. Here's how we handle them:

  • Voice samples are stored securely with encryption at rest.
  • Access is controlled via time-limited URLs.
  • Voice samples are only accessible to you, marketplace users if you publish, and AthanLab staff for platform moderation, abuse investigation, and technical support. They are stored in Cloudflare R2 and sent to Modal only to generate the audio you request (see section 3).
  • When you delete a voice, the audio file is permanently removed from storage.
  • We do not use your voice samples to train AI models.
  • Marketplace voice clones are stored as separate copies — deleting your clone doesn't affect the original publisher.

5. Cookies & Local Storage

We use:

  • Authentication tokens: Firebase Auth tokens stored in browser for keeping you signed in. No server-side cookies are used.
  • Local storage: Theme preference, language selection, UI state, a random first-party analytics visitor identifier, and a random trial device identifier with a server-signed proof. The trial identifier persists across account switches so another Google account in the same browser cannot claim another trial; it is not an authentication credential.
  • Analytics: We use Vercel Analytics for page views and selected product events, and Vercel Speed Insights for performance metrics. Our first-party analytics records an allowlisted set of page and product events (for example, sign-in or a generation request), with bounded event properties. It does not accept arbitrary text content.

We do not use advertising cookies. Hand-selected reviewer invitation emails may contain an open pixel so we can tell whether an invitation was received; only the first open is recorded, and it is not used for advertising. First-party analytics respects supported Global Privacy Control or Do Not Track browser signals, and can also be disabled by setting the local preference ath_analytics_opt_out.

6. Data Retention

  • Account data: Kept until you delete your account.
  • Voice samples: Kept until you delete them.
  • Generated audio: Kept until you delete them or your account.
  • Usage and analytics logs: Retained for billing accuracy, security, abuse prevention, operational reliability, and product analysis. Access is limited to authorized staff. Some fraud-prevention, legal, payment, and unsubscribe records may be retained after account deletion when required to protect the Service or comply with legal obligations.
  • Trial eligibility records: We retain keyed pseudonyms and trial claim events after account deletion so deleting an account or creating another Google account does not create another free trial. These records do not contain raw IP addresses, email addresses, text, or audio.

7. Your Rights

You may:

  • Delete your voice samples and generated audio at any time.
  • Schedule deletion from your account settings, or contact support@athanlab.com for help.
  • Export your generation history (feature coming soon).

8. Security

We protect your data with industry-standard measures including encryption in transit and at rest, secure authentication, time-limited access to files, and regular security reviews.

9. Children

AthanLab is not intended for children under 16. We do not knowingly collect data from children.

10. Contact

Privacy questions? Email support@athanlab.com