Privacy Policy

2.1 Account Data

When you register via an OAuth provider (Google, Microsoft, or Meta), the respective provider transmits the following to us:

• Email address
• OAuth provider ID (unique user identifier of the provider)
• Display name (optional, provided by the provider)

We do not store passwords. Authentication is carried out exclusively via the respective OAuth provider.

2.2 Voice Data (Biometric Data)

For the voice cloning feature, you may upload WAV audio files or provide a voice description. We process:

• Uploaded WAV audio files (stored in normalized form)
• Machine-generated voice samples (based on your description)
• Reference texts associated with the uploaded audio

Important: Voice data is treated as biometric data within the meaning of Art. 4(14) and Art. 9 GDPR. See Section 4.

2.3 Usage Data

• Subscribed RSS feeds (URLs and categories)
• Manually submitted URLs
• Generated audio files (cloud storage path, metadata)
• Subscription status and payment history (via Stripe)
• Optional Telegram chat ID when Telegram delivery is enabled

2.4 Technical Data

• IP address (in server access log files)
• Browser type and operating system (user agent, in log files)
• Time and duration of the session
• Session cookies and CSRF tokens (technically necessary)

3.1 Performance of Contract (Art. 6(1)(b) GDPR)

The processing of your account data, subscribed feeds, and generated audio files is necessary for the provision of the contractually agreed service.

3.2 Consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR)

The processing of voice data as biometric data is carried out exclusively on the basis of your express consent, which you grant when uploading a voice sample. You may withdraw this consent at any time (see Section 4).

3.3 Legitimate Interest (Art. 6(1)(f) GDPR)

The storage of IP addresses in server log files serves the security of the service, defense against attacks, and error analysis. Our legitimate interest outweighs your interest in non-processing, as the data is only stored for a short period and for a specific purpose.

3.4 Legal Obligation (Art. 6(1)(c) GDPR)

To the extent that we are legally obligated to retain data (e.g., tax-related record-keeping obligations for payment data), processing is carried out on this basis.

Consent and Purpose

Voice data is used exclusively for personalized text-to-speech synthesis within your own account. It is neither disclosed to third parties nor used for AI model training.

Withdrawal of Consent

You may withdraw your consent to the processing of voice data at any time by deleting the respective voice sample from your account or by deleting your account entirely. After withdrawal, all associated audio files (voice samples and generated audio files using that voice) will be promptly and irreversibly deleted.

Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal (Art. 7(3) GDPR).

Retention Period for Biometric Data

Voice samples are stored as long as your account is active and the voice sample has not been deleted. Upon account deletion or withdrawal of consent, all voice data will be irreversibly deleted within 30 days.

Notice for Users from Illinois, USA (BIPA)

To the extent that the Illinois Biometric Information Privacy Act (BIPA) applies, the following additional notices apply:

• SpokenFeeds collects voiceprints solely for the purpose of personalized speech synthesis within the service.
• Biometric data is not sold, leased, traded, or otherwise disclosed for compensation.
• The retention period ends with the deletion of the voice sample or account deletion, but no later than three (3) years after the last use of the service.
• To exercise your BIPA rights, please contact [email protected].

Rights under the GDPR (Art. 15–22)

• Access (Art. 15): You may request information about the data we process.
• Rectification (Art. 16): You may request the correction of inaccurate data.
• Erasure (Art. 17): You may request the deletion of your data ("right to be forgotten").
• Restriction (Art. 18): You may request the restriction of processing.
• Data Portability (Art. 20): You may receive your data in a machine-readable format.
• Objection (Art. 21): You may object to processing based on legitimate interest.

Withdrawal of Consent (Art. 7(3) GDPR)

To the extent that processing is based on your consent (in particular voice data), you may withdraw it at any time without giving reasons. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.

Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. In Austria, this is:

Austrian Data Protection Authority (DSB)
Barichgasse 40–42, 1030 Vienna
www.dsb.gv.at

Users in the United Kingdom may contact the Information Commissioner's Office (ICO) .