← Max Holley / webh.dev

Local Speak — Privacy Policy

Effective and last updated: 9 October 2026. Reviewed extension version: 0.3.3.

Local Speak reads text aloud using speech models on your device. Max Holley is its developer and the operator responsible for this policy. For privacy questions, support or rights requests, email max@webh.dev. The current policy is at webh.dev/local-speak/privacy/.

This policy covers Local Speak, including Pocket TTS, Kokoro and Kitten Nano, and the separate activity involved in visiting this policy page or contacting the developer. Local Voice / Local Dictation is a different extension with its own policy. Other webh.dev apps and websites you read with Local Speak are outside this policy.

Your reading text and generated speech stay on your device. Local Speak has no cloud speech service, developer backend, user accounts, advertising, analytics, tracking pixels or remote crash-reporting service. It does not send your reading text or audio to the developer, Hugging Face or another speech provider.

After you invoke Speak selection, the context menu or the keyboard shortcut, Local Speak obtains the selected page text or selected text in a supported focused editable field. Speak focused field / Speak field obtains the whole supported focused field or editable area's text. The popup also processes text you manually type or paste. These inputs can contain personal, confidential or sensitive information depending on what you choose to read.

Text passes between the extension's components on your device for chunking, tokenisation or phonemisation, speech generation and playback. Local Speak does not save a reading history, upload this content, train models with it or use it for advertising. It uses pretrained voice presets, not microphone recordings or user voice cloning.

The page helper is injected following your action; it does not automatically scrape pages in the background. It can retain a selection range and examine nearby document text to locate the current speech chunk for optional highlighting. Optional page controls show progress and control playback. These operations remain local. The extension observes the source tab's loading state for optional stop-on-navigation, but does not maintain a browsing-history database or list of visited pages.

Standard password and hidden inputs are excluded by the field extractor. Other fields can still contain sensitive information. Text supplied by Chrome's context-menu selection or pasted manually is processed as supplied; it is not classified or automatically redacted. Restricted pages, inaccessible frames and some custom editors cannot be extracted.

Reading text, chunks, tokens, phonemes, generated audio buffers and inference state are held in memory for speech. The extension does not persist your reading text or audio or export audio files. Pasted text remains in the popup while open; closing it does not stop an ongoing reading.

The last non-empty reading remains in the background audio document's memory for Replay, including after completion, errors or Stop. Stop cancels playback and active generation but does not erase Replay text. Another non-empty reading replaces it; trying a sample voice replaces it with sample text. Switching models or changing settings does not itself clear Replay.

Replay text is cleared when the audio document closes, the browser session ends, you remove all downloaded models, or you remove the model associated with current playback or selected settings. Removing an unrelated model does not clear it. Chrome controls the document's lifetime; there is no fixed retention timer. Page-side selection references disappear when the page unloads. Models and prepared preset-voice state can remain in memory between readings for speed; these are not recordings of you.

Playback status, random request identifiers, chunk counts, errors and CPU/GPU information are used locally. There is no automatic diagnostic upload. Chrome or the runtime may display errors locally. Information you choose to include in a screenshot, log or support message can be disclosed by that separate action.

Local Speak uses local/session storage, not Chrome sync storage, and does not synchronise readings or settings to a developer account. https://localvoice.invalid/ cache keys are internal identifiers, never network requests. Local Speak adds no separate encryption layer to its settings or model cache. Browser management, device backups and operating-system policies can handle device data independently.

Available models are Pocket TTS (the default), Kokoro and Kitten Nano. Kitten Micro and Kitten Mini are no longer offered. A saved selection of either retired model falls back to Pocket TTS without an automatic download. Previously downloaded Micro and Mini files can remain in local cache until you choose Remove all downloaded models, clear extension data or uninstall; Remove all also deletes these retired caches.

Choosing Download or Retry requests approved assets from https://huggingface.co/ and its currently permitted delivery host, https://us.aws.cdn.hf.co/. Requests contain the repository, pinned revision and file path. Model packages can include a catalogue of preset voices, rather than only the voice selected.

Providers receive ordinary connection information, such as IP address, request time, requested file address and browser/network headers, and can infer the model package downloaded. They receive no reading text or generated audio. Requests omit credentials/cookies and use a no-referrer policy; they include no page URL, account token or extension-generated user identifier.

Downloads use HTTPS. Approved assets have expected sizes and SHA-256 digests and are checked before cache storage and again when loaded through the asset loader. JavaScript, WebAssembly and runtime code are packaged with the extension rather than fetched as remote executable code.

Speech reads cached assets, and inference workers block external fetches. Missing assets require an explicit download, not a silent download during reading. Speech works offline after installation. A download you separately start can overlap local activity without uploading that reading.

Hugging Face and its delivery providers control their connection records, retention and international processing under their own policies. They may process connection data in the United States and other countries. See Hugging Face's privacy policy. The developer does not receive their download logs through Local Speak and cannot erase their records.

Google separately operates Chrome and the Chrome Web Store, including installation, updates, reviews and browser diagnostics enabled in your settings. Store dashboards may provide the developer with aggregate installation/rating statistics and feedback you submit; these are separate from extension telemetry. See Google's privacy policy. Following a source, licence or other external link contacts its destination under that service's policy.

The reviewed build requests no all-websites host access, history, microphone, camera, geolocation or clipboard read/write permission. Pasting is your browser's normal paste action, not clipboard monitoring. There is no Gmail account integration, Google OAuth access or email API. You can choose to read text on a supported email page as on another page.

Local Speak's use of information obtained through Chrome permissions follows the Chrome Web Store User Data Policy, including Limited Use, and is limited to its disclosed reading, playback, highlighting and settings features. Reading text, audio and browsing information are not sold, rented, transferred to advertising services, used for personalised advertising, unrelated profiling, creditworthiness/lending assessments or AI training. The developer has no remote access to local readings and does not have people inspect them.

There is no automated decision-making with legal or similarly significant effects. Speech synthesis converts your supplied text into audio; it does not make decisions about you. Voluntary support disclosures are handled separately as described below.

This static page is hosted on webh.dev through GitHub Pages. Loading the page and its same-site stylesheet sends ordinary requests, including IP address, requested URL and browser headers, to the hosting/delivery infrastructure. GitHub documents logging visitors' IP addresses for security. Its retention and international-transfer practices are explained in GitHub's privacy statement.

This policy page uses optional Google Analytics only if you accept analytics in the website cookie banner. The website stores your consent choice locally and Google may set analytics cookies after consent. See the website privacy and cookie policy for details and use “Cookie settings” to change your choice. This page has no advertising, contact form, third-party embeds or remotely loaded fonts. The portfolio also saves a colour-theme preference and loads Google Fonts. Website analytics is separate from the extension and does not receive your readings or generated speech.

Emailing max@webh.dev voluntarily gives the developer your email address, message, attachments and information you include. Send only what is needed, preferably a non-personal example for troubleshooting. Correspondence is used to answer requests, troubleshoot and administer privacy rights, not for marketing or model training. Public reviews or issue reports can be seen by others; do not post private reading content.

Email providers deliver/store correspondence. Necessary information may also be disclosed to comply with legal obligations or address a specific security incident. Messages are retained only as long as necessary to resolve and follow up on the request, with longer retention only for legal obligations or unresolved disputes. Ask about retention or request deletion by email; provider backups or legal requirements can affect when deletion finishes.

Where UK/EEA data-protection law applies to information received by the developer, voluntary support and security processing rely on legitimate interests in answering requests and protecting the service, balanced against your rights. Applicable legal duties rely on legal obligation. These purposes do not create a remote copy of local readings. Download, browser and hosting providers explain their own legal bases and international-transfer safeguards in their policies.

• Choose what to read; Pause or Stop controls speech. Closing the popup or hiding the mini-player does not stop it.
• To explicitly clear Replay text, use Settings → Remove all downloaded models, or remove the current/selected model. This also deletes relevant model files; using them again requires another download.
• Individual removal deletes that model's complete/partial cache and retains other models. Cancel can leave verified files cached. Model removal retains settings.
• Disable Local Speak or manage site access in Chrome. Uninstalling removes extension-managed storage. Manage backups and information sent to external services separately.

Depending on applicable law, you may have rights to access, correction, erasure, restriction, objection, portability and withdrawal of consent where consent is the legal basis, without affecting earlier lawful processing. Applicable US state laws can also provide opt-out and appeal rights. Local Speak performs no sale, cross-context behavioural advertising or such tracking, including when Do Not Track or Global Privacy Control signals are present.

Contact max@webh.dev for requests or complaints. The developer may request proportionate identity verification and will respond within applicable legal deadlines. Rights are subject to legal conditions; the developer cannot retrieve readings held only on your device or delete third-party records. You can complain to your local authority; in the UK, contact the Information Commissioner's Office.

Local Speak requests no age and creates no child profiles; it does not knowingly collect children's reading text remotely. Local processing works the same for all users. A parent/guardian may email to request removal of personal information a child sent to the developer where appropriate. External services can have separate age rules.

Local processing reduces disclosure to remote speech services but does not secure the original website or device. Others can hear audio aloud. Websites retain their existing access to their own content; administrators, browser tools, malicious software or backups can have access independently. Keep your browser/device secure. Local Speak does not guarantee secure erasure from memory, operating-system swap or backups.

This policy describes reviewed version 0.3.3 and will be revised when data practices change. Material changes will be described in the policy and relevant release information, with further disclosure or consent before new processing where required. A modified build or new owner must disclose its actual practices; this policy does not authorise undisclosed collection or transfer of local readings.