Privacy Policy & Terms of Service

1. Privacy Policy

1.1 Scope and controller

Hearably is a product of drylabs GmbH ("Hearably," "we," "our," or "us"). This policy covers the Hearably website, browser extension, Studio, accounts, billing, support, and any released Hearably apps. The legal entity details are published in our Imprint. Questions and data requests can be sent to [email protected].

1.2 Audio and uploaded files

The Chrome/Edge extension's captured tab audio is processed on the user's device and is not uploaded to Hearably. The extension uses Chrome's tab capture and Web Audio APIs to build the DSP chain in an offscreen extension document. Hearably Studio decodes and processes files locally in the browser. Ordinary account, model-download, billing, support, and website-analytics network requests are separate from that audio path.

Hearably does not intentionally record or store the audio waveform handled by the extension or the content of a file opened in Studio. Local processing is not a hearing-safety, confidentiality, or regulatory certification.

1.3 Information kept locally by the extension

While the extension is running, it uses browser storage and in-memory state for settings, presets, authentication state, subscription status, capture state, and the multi-tab mixer. To render and control that mixer, the extension can read the open tab's URL, title, favicon, audible state, and tab identifier locally. Its content script runs on supported web pages and frames to detect <audio> and <video> elements and adjust their local volume. It does not use that script to read article text, form entries, passwords, or keystrokes.

Those tab URLs, titles, favicons, and media-element observations are not sent to Hearably by the current extension. Browser sync behavior and removal of extension storage are controlled by Chrome or Edge and by the user's browser-account settings; uninstalling the extension does not itself delete a separate Hearably cloud account.

1.4 Information sent to Hearably

• Account and support: Email address, display name, authentication records, messages you send, and presets you explicitly save to cloud services.
• Account diagnostics and acquisition: We record the registration channel and Hearably page path, campaign tags when supplied after website analytics consent, and the most recent account-service contact. Extension activity reporting is optional and off until the signed-in user agrees to the in-extension disclosure. The choice can be changed anytime in extension Settings. Consenting accounts send limited events: opening controls, starting audio processing, occasional active-audio samples, and a fixed error category. Events include the account association, server timestamp, Chrome/Edge family, extension version and interface language. These first-party records help us diagnose failures and measure account activity and retention. They contain no tab URL, title, audio, file content, or raw error message, and do not identify anonymous installs. Managed deployments with cloud features disabled do not send these activity events.
• Billing and entitlement: Selected plan, provider and subscription identifiers, payer email and payer identifier supplied by PayPal, payment/subscription status, checkout request identifier, source channel, originating Hearably website path, referral code, and—only when available from consented analytics—the Google Analytics client and session identifiers. Hearably does not receive your PayPal password or full funding-source details.
• Enterprise inquiries: Name, work email, company, team-size range, use case, inquiry details, consent timestamp, source path, and any campaign parameters submitted with the form.
• Optional uninstall feedback: If you choose a survey answer after uninstall, we store that answer with browser, operating-system family, extension version, language, days-installed value, shortened user-agent string, and Cloudflare-derived country code. The requesting IP address is used transiently for abuse-rate limiting and is not written to that survey table.
• Technical requests: Our infrastructure necessarily processes request metadata such as IP address, timestamp, route, and user agent to serve, secure, rate-limit, and troubleshoot requests. Application logs and provider records may retain portions of this metadata.

1.5 Website analytics and consent

We use a custom consent banner for Google Analytics 4. The Google tag is not loaded unless you select Allow analytics. If you consent, Google Analytics can receive page views, conversion events, client/session identifiers, approximate geography, and browser/device information, and it may set first-party _ga cookies. Advertising storage, advertising user data, and advertising personalization remain disabled by our tag configuration. You can change the choice through Analytics settings in the footer.

We also use Cloudflare Web Analytics for aggregate page-performance and traffic measurement. Cloudflare describes this service as privacy-first and states that it does not collect or use visitors' personal data. The operational checkout ledger and enterprise inquiry records described above are first-party service records, not proof of payment or GA4 conversion.

1.6 Browser permissions and site access

The released extension manifest requests the following capabilities. A procurement-readable matrix and data-flow description are available on our Security & Deployment page.

• tabCapture: Captures audio output from a user-selected tab for local DSP. Chrome displays a broad permission warning for this capability.
• offscreen: Hosts the Manifest V3 audio pipeline outside the popup.
• storage: Keeps settings, presets, authentication state, and transient capture state in the appropriate extension storage areas.
• tabs: Reads tab ID, URL, title, favicon, and audible state for capture eligibility and the local mixer.
• activeTab: Provides temporary access to the current tab after user interaction.
• alarms: Schedules local health checks and state reconciliation.
• contextMenus: Adds the user-invoked Enhance with Hearably action.
• sidePanel: Opens the extension's controls in Chrome's side panel.

The content script is declared for <all_urls> because media can appear on any site and in embedded frames. A user action is still required to start tab capture. If the user asks to enumerate output devices, the browser may request microphone permission to reveal device labels; the temporary microphone stream is stopped immediately and is not connected to the DSP, recorded, or uploaded.

1.7 Service providers and security

• Cloudflare, Inc. — Website delivery, Workers, D1, R2, KV, security, logs, and Web Analytics. See Cloudflare's Privacy Policy.
• Google LLC. — Google Analytics after consent. See Google's Privacy Policy.
• PayPal group companies. — Payment processing for new web and browser subscriptions. See PayPal's Privacy Statement.
• Stripe, Inc. — Processing for legacy subscriptions that remain on Stripe. See Stripe's Privacy Policy.
• Apple, Inc. — Store distribution or in-app purchase processing where an Apple app offers those functions. See Apple's Privacy Policy.

We use HTTPS, access controls, provider-managed secrets, input validation, rate limits, and an idempotent billing-webhook ledger. No SOC 2, ISO 27001, penetration-test, data-residency, on-premise, SSO, or regulatory-compliance certification is implied unless it appears in a separately signed agreement.

1.8 Retention and deletion

Individual extension activity events and aggregate API-error counts are retained for up to 90 days; daily per-account activity summaries for up to 365 days. Cleanup runs daily. First/last activity and service-contact timestamps remain with the account profile, and registration attribution remains with the account. These monitoring records are available only through the owner's authenticated dashboard.

We keep account and service records while an account or subscription is active and for as long as reasonably necessary for security, support, billing reconciliation, dispute handling, legal obligations, and enforcement. Payment providers keep their own records under their policies. We do not promise a fixed deletion period where a legal or financial record must be retained.

You can request access, correction, export, objection, restriction, or deletion by emailing [email protected]. We may need to verify the request and may retain records that law or legitimate security and accounting needs require. You can withdraw optional Google Analytics consent at any time through the footer setting; this changes future collection and does not automatically erase provider data already collected.

1.9 International processing

Hearably is operated from Germany and uses international service providers. Depending on the service and request route, information may be processed outside Germany or the European Economic Area subject to the provider's contractual and legal safeguards. We do not claim that all Cloudflare, Google, PayPal, Stripe, or Apple processing stays inside the European Union.

1.10 Children's privacy

Hearably is not directed at children under 13, and we do not knowingly create accounts for them. A parent or guardian who believes a child supplied personal information should contact [email protected].

Hearably's use of information received from Chrome APIs follows the Chrome Web Store User Data Policy, including its Limited Use requirements. We do not sell this data or use it for advertising.

1.11 Changes to this policy

We may update this policy as the product or service providers change. The date above identifies the current version. Material changes may be communicated through the website, extension, account email, or another appropriate channel.