Privacy Policy

01

Information We Collect

Account information: When you register/log in with an email, use email-verification-code login, or log in via Google / Apple third-party sign-in, we store your email address and an account identifier generated by the login system. Third-party sign-in never provides us with your Google / Apple password — we only receive the identity credential after a successful login.

Avatar and nickname: Avatars you upload are stored in our cloud object storage; profile data like your nickname lives in the settings record bound to your account.

Chat and reading session records: If you're logged in, sessions you create in Soniva and the text you send/read are synced and stored in the cloud database bound to your account, readable only by you. Usage when logged out is kept only in your current browser's local storage and is never uploaded.

Third-party API keys (BYOK): If you fill in your own TTS/translation provider keys in Settings, they're by default kept only in your current browser's local storage and never sent to our servers. If you proactively turn on the "Sync to account" toggle, the keys are stored in the cloud database after encryption, used only to make requests to your designated provider on your behalf while logged into the same account, never for any other purpose, and never shared with third parties other than that provider.

Usage and billing records: Whether or not you're logged in, we record the character count or call count consumed by each speech-synthesis/translation request, for calculating your quota usage and billing. If you're a paid subscriber, your subscription status and payment status are processed and recorded by the payment provider Paddle (see "Third-Party Providers" below).

Input text used for product analytics: By default, we save the full input text of your speech-reading or translation requests along with usage records, to analyze common usage scenarios and improve the product. It is never used to train third-party models or sold externally. You can turn this off anytime under Settings → Content & Cache → Allow input text to be recorded for product analytics; turning it off doesn't affect billing or quota statistics — it simply stops retaining the original text.

Information stored on your device: To keep the product working when logged out, offline, or when switching accounts, the browser's local storage (localStorage) holds some data, including theme appearance, language preference, temporary session cache while logged out, and third-party keys that haven't had cloud sync enabled. This data exists only on your own device and can't be read by our servers.

02

How We Use This Information

We use the collected information to: provide core features like speech synthesis/translation, maintain your account and cross-device sync, calculate subscription quotas and billing, analyze product usage to improve the experience, and communicate service changes or security matters with you when necessary. We do not use your personal data or reading/translation text for purposes unrelated to delivering the service, nor do we sell it to any third party.

03

Third-Party Providers

To provide the service, we pass necessary information to the following categories of third parties, limited to the minimum scope required for their functions:

• Supabase: our account-system and database provider, hosting storage of account information, session records, and avatar files.
• Paddle: our payment and subscription processing provider, acting as the Merchant of Record for transactions and handling your payment information; our own servers never touch or store your card numbers or other payment credentials.
• Speech-synthesis / translation providers (Alibaba Cloud, Volcano Engine, MiniMax, Tencent Cloud, Baidu Cloud, iFlytek, ElevenLabs, Microsoft Azure, Cartesia, DeepSeek, etc.): only when you choose to use a given brand is the text you want read/translated sent to that provider to generate the result; system-provided brands route through our servers as a proxy, and with your own key (BYOK) that provider is simultaneously your own direct customer relationship.
• Google / Apple third-party sign-in: used only for authentication and never reads your other data on those platforms.
• Google Analytics: used to measure site visits and common usage paths; it writes analytics cookies in your browser (see the next section).

04

Cookies & Local Storage Technologies

Soniva uses two kinds of technology stored in your browser:

1. localStorage: used to keep theme, language, account cache, and unsynced keys, as described above under "Information stored on your device." This data isn't automatically sent to our servers with requests.
2. Cookies: we use Google Analytics for site traffic statistics; it writes analytics cookies in your browser to identify visit sessions. These cookies aren't used for targeted advertising, but they are non-essential (analytics) cookies.

The first time you visit Soniva, a cookie-consent prompt appears in the bottom-right corner: only after you click "Accept" do we load Google Analytics and write analytics cookies; clicking "Only necessary" won't load them. You can reset this choice anytime by clearing browser data, without affecting the core reading/translation features.

05

Data Storage & Security

We use industry-standard encrypted transmission protocols (HTTPS/TLS). Account data has row-level security (RLS) enabled at the database layer, ensuring only the account owner can read their own session records, settings, and keys. Third-party API keys you sync to your account are encrypted server-side before being stored in the database, so the database and ordinary data access channels can't see the plaintext keys.

Despite the above measures, no method of internet transmission or storage is absolutely secure, and we can't guarantee 100% security of your data.

06

Data Retention & Deletion

You can export your session records anytime in account settings, or delete your account and request deletion of your cloud data (sessions, settings, synced keys, avatar files).

Deletion must be confirmed with a verification code sent to your registered email address. Once confirmed, the account enters a 30-day grace period: your data is still retained during that window and signing back in cancels the deletion. After the grace period ends, we automatically and permanently delete the cloud data listed above, and it cannot be recovered.

After deletion, cache data left in your local browser from when you were logged out isn't cleared automatically; you can clear browser data manually.

07

Children's Privacy

Soniva's service is aimed at users with full legal capacity. We don't knowingly collect personal information from minors under 14 years of age (or the age specified by law in your region); if you find a minor has used the service and submitted personal information without a guardian's consent, please contact us so we can help handle it.

08

International Data Transfers

Because some of the providers we use (cloud database, payments, some TTS/translation vendors) may run servers outside mainland China, your information may be processed across borders during transmission and storage. We require the relevant providers to follow reasonable data-protection standards.

09

Policy Changes

We may update this policy from time to time to reflect changes in product features or legal requirements. Material changes are reflected by updating the "Last updated" date on this page, and, when necessary, we'll notify you via in-app notices or email.

10

Contact Us

If you have any questions about this Privacy Policy, or wish to exercise the rights above, email us at soniva.cde@gmail.com, or reach us via the in-product feedback entry point.