Privacy Policy & Terms of Service

1. Privacy Policy

1.1 Controller and contact

The controller for personal data processed in connection with Hearably (website, browser extension, Studio, accounts, billing, support and any released Hearably apps) is drylabs GmbH, Straße der Jugend 18, 14974 Ludwigsfelde, Germany, represented by its managing director Mithat Arda ("Hearably," "we," "our," or "us"). Further company details are in our Imprint. Questions and data requests: [email protected]. We have not appointed a data protection officer.

1.2 Audio and uploaded files

The Chrome/Edge extension's captured tab audio is processed on the user's device and is not uploaded to Hearably. The extension uses Chrome's tab capture and Web Audio APIs to build the DSP chain in an offscreen extension document. Hearably Studio decodes and processes files locally in the browser. Ordinary account, model-download, billing, support, and website-analytics network requests are separate from that audio path.

Hearably does not intentionally record or store the audio waveform handled by the extension or the content of a file opened in Studio. Local processing is not a hearing-safety, confidentiality, or regulatory certification.

1.3 Information kept locally by the extension

While the extension is running, it uses browser storage and in-memory state for settings, presets, authentication state, subscription status, capture state, and the multi-tab mixer. To render and control that mixer, the extension can read the open tab's URL, title, favicon, audible state, and tab identifier locally. Its content script runs on supported web pages and frames to detect <audio> and <video> elements and adjust their local volume. It does not use that script to read article text, form entries, passwords, or keystrokes.

Those tab URLs, titles, favicons, and media-element observations are not sent to Hearably by the current extension. Browser sync behavior and removal of extension storage are controlled by Chrome or Edge and by the user's browser-account settings; uninstalling the extension does not itself delete a separate Hearably cloud account.

1.4 Information sent to Hearably

• Account and support: Email address, display name, authentication records, messages you send, and presets you explicitly save to cloud services.
• Account diagnostics and acquisition: We record the registration channel and Hearably page path, campaign tags when supplied after website analytics consent, and the most recent account-service contact. Extension activity reporting is optional and off until the signed-in user agrees to the in-extension disclosure. The choice can be changed anytime in extension Settings. Consenting accounts send limited events: opening controls, starting audio processing, occasional active-audio samples, and a fixed error category. Events include the account association, server timestamp, Chrome/Edge family, extension version and interface language. These first-party records help us diagnose failures and measure account activity and retention. They contain no tab URL, title, audio, file content, or raw error message, and do not identify anonymous installs. Managed deployments with cloud features disabled do not send these activity events.
• Billing and entitlement: Selected plan, provider and subscription identifiers, payer email and payer identifier supplied by PayPal, payment/subscription status, checkout request identifier, source channel, originating Hearably website path, referral code, and—only when available from consented analytics—the Google Analytics client and session identifiers. For each upgrade we also record which checkout steps were reached (for example opening the checkout page or returning from PayPal) and the country Cloudflare reports for the request, never your IP address, and keep these records for up to 180 days. If you ask on the checkout page for a link to finish later, we store that email address with the checkout for up to 180 days, where our team can see it in checkout reports, and use it only to send that one email. Hearably does not receive your PayPal password or full funding-source details.
• Enterprise inquiries: Name, work email, company, team-size range, use case, inquiry details, consent timestamp, source path, and any campaign parameters submitted with the form.
• Cancellation requests: If you use the Cancel contracts here page, we store your name, email addresses, contract details, your declaration and the date and time we received it, to process and prove your cancellation (Art. 6(1)(b) and (c) GDPR). We keep these records for three years after the end of the year of receipt.
• Optional uninstall feedback: If you choose a survey answer after uninstall, we store that answer with browser, operating-system family, extension version, language, days-installed value, shortened user-agent string, and Cloudflare-derived country code. The requesting IP address is used transiently for abuse-rate limiting and is not written to that survey table.
• Technical requests: Our infrastructure necessarily processes request metadata such as IP address, timestamp, route, and user agent to serve, secure, rate-limit, and troubleshoot requests. Application logs and provider records may retain portions of this metadata for short periods.

1.5 Purposes and legal bases

We process personal data only where the General Data Protection Regulation (GDPR) permits it:

• Contract and pre-contractual steps (Art. 6(1)(b) GDPR): providing accounts, the extension's cloud features, Studio, Pro subscriptions and one-time purchases, billing and entitlement checks, support, enterprise inquiries before a contract, and sending a checkout link you request.
• Legal obligations (Art. 6(1)(c) GDPR): keeping billing and accounting records under commercial and tax law, and answering lawful requests from authorities.
• Legitimate interests (Art. 6(1)(f) GDPR): operating and securing our infrastructure (request metadata, logs, rate limits, abuse and fraud prevention), recording checkout steps to find and fix problems in our purchase flow, account diagnostics, enforcing these terms, and establishing or defending legal claims. Our interest is a secure, working and economically viable service. You may object at any time (see 1.12).
• Consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG): Google Analytics, the optional extension activity reporting, storing a referral code in your browser, and optional uninstall feedback. You can withdraw consent at any time with effect for the future.

1.6 Cookies and similar technologies

We store information on your device, or read information already stored there, only where this is strictly necessary to provide a service you have requested (§ 25(2) No. 2 TDDDG) or where you have consented (§ 25(1) TDDDG). We do not use advertising or cross-site tracking cookies.

Payment components: If you choose a one-time payment on the checkout page, the PayPal, Google Pay and Apple Pay components are loaded from those providers and may use their own cookies or similar technologies under their own privacy policies. They are not loaded on other pages or before you choose that option.

Cloudflare: Our hosting provider may set strictly necessary security cookies (such as __cf_bm) to protect the service against automated abuse. Cloudflare Web Analytics does not use cookies.

You can delete stored information at any time in your browser settings. Strictly necessary items may be recreated when you use the related feature again.

1.7 Website analytics and consent

We use a custom consent banner for Google Analytics 4. The Google tag is not loaded unless you select Allow analytics. If you consent, Google Analytics can receive page views, conversion events, client/session identifiers, approximate geography, and browser/device information, and it may set first-party _ga cookies. Advertising storage, advertising user data, and advertising personalization remain disabled by our tag configuration. You can change the choice through Analytics settings in the footer. The checkout page does not load Google Analytics.

We also use Cloudflare Web Analytics for aggregate page-performance and traffic measurement. Cloudflare describes this service as privacy-first and states that it does not collect or use visitors' personal data. The operational checkout ledger and enterprise inquiry records described above are first-party service records, not proof of payment or GA4 conversion.

1.8 Browser permissions and site access

The released extension manifest requests the following capabilities. A procurement-readable matrix and data-flow description are available on our Security & Deployment page.

• tabCapture: Captures audio output from a user-selected tab for local DSP. Chrome displays a broad permission warning for this capability.
• offscreen: Hosts the Manifest V3 audio pipeline outside the popup.
• storage: Keeps settings, presets, authentication state, and transient capture state in the appropriate extension storage areas.
• tabs: Reads tab ID, URL, title, favicon, and audible state for capture eligibility and the local mixer.
• activeTab: Provides temporary access to the current tab after user interaction.
• alarms: Schedules local health checks and state reconciliation.
• contextMenus: Adds the user-invoked Enhance with Hearably action.
• sidePanel: Opens the extension's controls in Chrome's side panel.

The content script is declared for <all_urls> because media can appear on any site and in embedded frames. A user action is still required to start tab capture. If the user asks to enumerate output devices, the browser may request microphone permission to reveal device labels; the temporary microphone stream is stopped immediately and is not connected to the DSP, recorded, or uploaded.

1.9 Recipients and service providers

• Cloudflare, Inc. (USA) — Website delivery, Workers, databases and storage, security, logs, and Web Analytics, as our processor. See Cloudflare's Privacy Policy.
• Resend (USA) — Delivery of account, billing, checkout-link and service emails (recipient address, message content and delivery status), as our processor. See Resend's Privacy Policy.
• Google — Google Analytics after consent, and Google Pay if you choose it. See Google's Privacy Policy.
• PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg — Payment processing for subscriptions and one-time purchases. PayPal processes payment data as an independent controller. See PayPal's Privacy Statement.
• Stripe — Processing for legacy subscriptions that remain on Stripe, as an independent controller. See Stripe's Privacy Policy.
• Apple — Apple Pay if you choose it, and store distribution or in-app purchases where an Apple app offers them. See Apple's Privacy Policy.
• Hugging Face, Inc. (USA), jsDelivr and unpkg — When you start an AI or video feature in Studio, your browser downloads the required model and program files directly from these services, which receive your IP address and browser information. No audio or file content is sent to them.

We use HTTPS, access controls, provider-managed secrets, input validation, rate limits, and an idempotent billing-webhook ledger. No SOC 2, ISO 27001, penetration-test, data-residency, on-premise, SSO, or regulatory-compliance certification is implied unless it appears in a separately signed agreement.

1.10 International transfers

Some recipients process data outside the EU/EEA, in particular in the USA. Where a recipient is certified under the EU–U.S. Data Privacy Framework, transfers rely on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR); otherwise they rely on the EU standard contractual clauses (Art. 46(2)(c) GDPR). You can request information about the safeguards at [email protected]. We do not claim that all Cloudflare, Google, PayPal, Stripe, Apple, Resend or Hugging Face processing stays inside the European Union.

1.11 Retention and deletion

Individual extension activity events and aggregate API-error counts are retained for up to 90 days; daily per-account activity summaries for up to 365 days; checkout step records for up to 180 days. Cleanup runs daily. First/last activity and service-contact timestamps remain with the account profile, and registration attribution remains with the account. These monitoring records are available only through the owner's authenticated dashboard.

We keep account and service records while an account or subscription is active and for as long as reasonably necessary for security, support, billing reconciliation, dispute handling, legal obligations, and enforcement. Billing and accounting records are kept for the periods required by commercial and tax law (generally up to ten years, § 257 HGB, § 147 AO). Payment providers keep their own records under their policies.

1.12 Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), and the right to withdraw a consent at any time with effect for the future (Art. 7(3)). To exercise these rights, email [email protected]; we may need to verify your identity. Withdrawing Google Analytics consent through the footer setting stops future collection and does not automatically erase data the provider already holds.

Right to lodge a complaint (Art. 77 GDPR): You may complain to a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work or the alleged infringement. The authority responsible for us is: Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany, www.lda.brandenburg.de.

1.13 Required data and automated decisions

You are not legally obliged to provide personal data. An email address and password are required to create an account, and payment through a payment provider is required for Pro; without them we cannot provide those features. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

1.14 Minimum age

Hearably accounts are for people aged 16 and over. Purchases require full legal capacity under the law of your country of residence or the consent of a parent or guardian. We do not knowingly process data of children under 16; a parent or guardian who believes a child supplied personal data should contact [email protected].

Hearably's use of information received from Chrome APIs follows the Chrome Web Store User Data Policy, including its Limited Use requirements. We do not sell this data or use it for advertising.

1.15 Changes to this policy

We may update this policy as the product or service providers change. The date above identifies the current version. Material changes may be communicated through the website, extension, account email, or another appropriate channel.