Privacy Policy

Last updated: March 24, 2026

TomeVox ("we", "us", "our") operates tomevox.com and app.tomevox.com. This policy explains what data we collect, how we use it, and your rights under applicable law.

1. Data we collect

Account data: When you create an account, we collect your email address and a hashed password.

Uploaded files: Manuscripts you upload (EPUB, PDF, DOCX, TXT) are stored to process your audiobook order. Files are deleted from our servers within 30 days of order completion.

Generated audio: Audio files we produce for you are stored for 90 days after delivery. You can download and delete them at any time from your account.

Payment data: We use Stripe for payments. We never see or store your full card number. Stripe's privacy policy governs payment data.

Usage data: We collect anonymised usage statistics via Umami Analytics. Umami uses browser localStorage — not cookies — and collects no personally identifiable information. It does not track you across other websites.

Server logs: Standard server logs (anonymised IP address, browser type, pages visited, timestamps) are retained for up to 30 days for security and operational purposes.

2. How we use your data

To process your audiobook orders and deliver files
To send transactional emails (order confirmation, delivery notification, receipt)
To understand aggregate site usage and improve the service
To diagnose errors and maintain security
To comply with legal obligations

We do not sell your data. We do not share your data with advertisers. We do not use your manuscript content to train AI models.

3. Cookies and tracking technologies

Strictly necessary: We use a single session cookie to keep you logged in to your account. This cookie is exempt from consent requirements under GDPR, UK GDPR, and CCPA as it is essential to service operation.

Analytics: Umami Analytics uses browser localStorage (not cookies) to collect anonymised usage data. Because it does not use cookies or collect personal data, it does not require consent under GDPR or CCPA. You may opt out via your browser's privacy settings or by clearing localStorage.

No advertising cookies: We do not currently use any advertising, retargeting, or third-party tracking cookies.

Your consent preferences are managed via the cookie consent banner displayed on your first visit. You can change your preferences at any time by clicking "Manage preferences" in the site footer.

4. Third-party services

We use the following third-party services to operate TomeVox:

Stripe — payment processing (privacy policy)
Cloudflare — CDN, DDoS protection, and geolocation detection (privacy policy)
Cloudflare R2 — file storage for manuscripts and generated audio, encrypted at rest
Resend — transactional email delivery (privacy policy)
Umami Analytics — privacy-first, cookieless analytics (privacy policy)
Salad Cloud — GPU processing for audiobook generation

5. Data retention

Uploaded manuscripts are deleted within 30 days of order completion. Generated audio files are deleted 90 days after delivery unless you delete them sooner. Account data is retained until you close your account. Server logs are retained for up to 30 days.

6. Your rights

Depending on your location, you may have the following rights regarding your personal data:

EU/EEA/UK (GDPR / UK GDPR): Right to access, rectification, erasure, restriction of processing, data portability, and to object to processing. You have the right to withdraw consent at any time without affecting the lawfulness of prior processing. You may lodge a complaint with your national data protection authority.
California (CCPA/CPRA): Right to know what personal information is collected, right to delete, right to opt out of the sale or sharing of personal information, and right to non-discrimination. We do not sell or share personal information. To exercise your rights, email [email protected] or use the "Do Not Sell My Info" link in the site footer (shown to California visitors).
Brazil (LGPD): Rights equivalent to GDPR including confirmation of processing, access, correction, anonymisation, portability, deletion, and right to object.
All users: You can request access to, correction of, or deletion of your personal data at any time by emailing [email protected]. We will respond within 30 days.

7. Legal basis for processing (GDPR)

For users in the EU/EEA and UK, we process personal data under the following legal bases:

Contract performance (Art. 6(1)(b)): Processing your order, delivering files, sending transactional emails
Legitimate interests (Art. 6(1)(f)): Server logs for security; anonymised analytics via Umami
Legal obligation (Art. 6(1)(c)): Compliance with applicable law
Consent (Art. 6(1)(a)): Any future non-essential analytics or marketing cookies, if added

8. Security

All data is transmitted over HTTPS. Files are stored encrypted at rest on Cloudflare R2. We use industry-standard security practices and conduct regular reviews.

9. Changes to this policy

If we make material changes to this policy, we will notify registered users by email and update the "last updated" date above. Continued use of the service after changes constitutes acceptance.

10. Contact

Questions about this policy? Email us at [email protected].