Privacy Policy
1. The short version
- You sign in with a link we email you, with Google, or with a password you set. We keep your name, email address, your Google account ID if you use Google, and the date your plan ends.
- You can try Text to Speech without an account. We then count your tries with a random code in a cookie and a one-way code made from your IP address: never what you typed, never the audio.
- What you type, the audio you upload and the voices you create are processed in your browser and are not sent to our servers.
- Voices you clone are saved only in your own browser, and the Voice Enhancer cleans up your recordings on your device too: we only count how many times you use it.
- We do not sell your information, show advertising, or use your information to train AI models.
- You can see your information, download it and delete your account yourself on the Account page.
2. Who we are
KUKU Labs (“KUKU Labs”, “we”, “us”) operates https://kukulabs.online, a studio for text to speech and voice cloning. We are responsible for the personal information described in this policy. You can reach us at kukulabsonline@gmail.com.
3. Information we collect
From your Google account
When you choose Continue with Google, Google asks for your permission and then tells us three things: your name, your email address (and whether Google has verified it), and your Google account ID, a unique number that identifies your Google account. We ask only for the basic sign-in permissions (openid, email and profile). We never receive your Google password, and we do not access your Gmail, Google Drive, Contacts, Calendar or any other Google service. We do not store your profile picture.
Account and plan information
When you first sign in we create an account record containing a random internal ID, your email address, your name, your Google account ID (if you use Google), how you first signed in (Google or an emailed link), the date you joined, the time you last signed in, the date your plan ends (if you have one), if you subscribe your Stripe customer and subscription references, which plan you chose (monthly or yearly), whether the subscription is active, set to end or ended, and the date it next renews, whether you came through an affiliate’s link or coupon code (and which affiliate, by their account ID, and when), the date a ban was applied if the owner has banned the account, how many free text-to-speech characters you have used this week (see the Terms), and whether you have switched off update emails. When the owner of the service activates, continues or ends a plan we also keep a record of that action: which account, what was done, who did it and when.
Signing in by email
If you ask for a sign-in link, we keep your email address, a one-way hash of the link (never the link itself), when it was asked for and when it stops working (15 minutes later), and a keyed one-way code made from the IP address that asked, which we use only to stop one network from asking for links without end. These records are deleted after two days. The first time you use a link we create an account record for that address. If you set a password, we store only a salted, one-way hash of it (scrypt): we cannot read it. To slow down guessing we keep, per email address, how many wrong passwords were tried recently and when.
Trying without an account
You can make a few short voiceovers a day without signing in. To count them, your browser gets a cookie (kuku_g) holding a random code, and we store that code, a keyed one-way code made from your IP address (so that clearing cookies does not reset the count), the time and the number of characters. We do not store the IP address itself, the text or the audio, and these rows are deleted after two days. What you typed and the voice you chose are kept in your own browser, so that they are still there after you sign in.
The first-visit question
The first time you open the Studio we ask what you are making (for example a YouTube video or a podcast). If you answer, we keep the answer on your account and use it to choose a starting script and voices. You can skip it.
Sign-in sessions
To keep you signed in, your browser holds a session cookie. On our server we store only a one-way hash of the session token, the account it belongs to and when it expires (30 days after you sign in). A separate short-lived cookie is used during the sign-in itself, to protect it from forgery.
Update emails
After you sign in, the owner of the service may send occasional update emails about the service itself, such as new features and changes. Every one has an unsubscribe link, and you can switch them off at any time in your Account. To do this we keep a personal unsubscribe code for you, whether you have opted out, and a record of which update emails were sent to you and whether they were delivered.
Usage on your Account page
To show you your usage on the Account page, your browser tells us each time you finish a generation: the time, how many characters it had and how long the audio is. We do not receive the text or the audio.
Voice Enhancer usage
The Voice Enhancer is free and unlimited. So that your Account page can show how much you have enhanced, we record each time you start the enhancer: the time, how long the audio was, and whether you started it in the Voice Enhancer or in the Voice Editor. We never receive the audio itself.
Product events
To see which parts of the site work and which do not, your browser sends us a short record when certain things happen: a page opens, a generation finishes, a file is downloaded, an upgrade offer is shown or pressed, a checkout starts. Each record holds the name of the event, the time, the page, and a few figures such as the number of characters, the voice’s ID and the plan. It never holds the text you typed or any audio. If you are signed in, the record is linked to your account. If you are not, it is linked to a code worked out from your IP address and browser type together with a secret that changes every day: that lets us count a visitor for one day without storing the IP address and without placing anything on your device. Payments and cancellations are recorded the same way by our server when Stripe confirms them.
Technical information
Like any website, the providers that host our site and database process technical information needed to deliver the service, such as your IP address, browser type and the time of each request. We also use your IP address briefly, in memory, to limit how many requests a single visitor can make, which protects the service from abuse. We do not use this information to build advertising or behavioural profiles.
What we do not collect
- The text you type to be spoken.
- Audio files you upload to clone a voice, or any recording of your voice.
- The audio you generate, or the recordings you enhance with the Voice Enhancer, or the enhanced result.
- The “voice fingerprint” of a voice you clone.
KUKU Labs runs the voice model inside your own browser, using your device’s processor and memory, so none of the above is sent to us.
Your last five generations. So that a reload does not lose your work, your browser keeps the last five voices you make (the audio files) in its own storage. They stay on your device and are never sent to us. They are removed when you sign out, delete your account or clear your browser’s site data, and the oldest is deleted when you make a sixth.
Information stored on your own device
- Cloned voices — the voice fingerprint of each voice you clone, saved in your browser’s IndexedDB storage and linked to your account on that browser. Your original recording is not kept.
- Voice model files — downloaded once and kept in your browser’s cache so later visits load faster.
- Generated audio — held in memory while the page is open. It disappears when you close or refresh the page, unless you download it.
You can remove saved voices on the Account page. Clearing your browser’s site data removes everything listed above.
When you pay
Payments are handled by Stripe, Inc. and its affiliates (“Stripe”). When you subscribe you pay on Stripe’s secure checkout page: Stripe collects your card or other payment details, billing details and email address, and we never see or store them. Stripe then tells our server about each payment (the first one and every renewal) and about changes to your subscription, such as cancelling it, so your plan can switch on, renew or end automatically. We keep a record of each payment: its date, amount, currency, Stripe’s payment or invoice reference, the email address you paid with and the account it belongs to. Stripe is an independent controller of the information it collects to process your payment and handles it under its own privacy policy. If you email or message us, we also receive what you send us, such as your name and contact details.
4. How we use your information
- To provide the service — to sign you in, recognise your account, show your plan and unlock the Studio while your plan is active.
- To manage plans — to switch on a plan when your payment is confirmed (or activate it by hand), to renew, continue or end a plan and let you cancel a subscription, to count Voice Enhancer runs for your Account page, and to count free text-to-speech characters against the weekly allowance.
- To protect the service — to detect and prevent abuse, enforce limits and keep the service secure.
- To communicate — to reply to your questions and requests, and tell you about important changes to your account or these policies.
- To meet legal obligations — and to respond to lawful requests.
We do not sell your personal information, we do not share it for advertising, and we do not use it to train artificial-intelligence models. We make no decisions about you by automated means other than checking whether your plan is currently active.
Where the law requires a legal basis (for example in the European Economic Area or the United Kingdom), we rely on: performing our contract with you (providing the service you signed up for), our legitimate interests (security, preventing abuse and keeping records), legal obligations, and your consent where we ask for it.
5. Google user data
KUKU Labs’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
We use Google user data (your name, email address and Google account ID) only to sign you in and operate your account. We do not transfer it to others except as needed to provide the service (for example to our hosting and database providers), to comply with the law, or with your consent. We do not use it for advertising, and we do not allow people to read it unless you ask us to, it is needed for security or support, or the law requires it.
6. The affiliate program
If you activate an affiliate account we keep: the date and version of the Affiliate Terms you agreed to, the coupon code you chose and the link code we generated for you, a log of activity on the account (for example activation, your code, payout requests, and any request that looks like an attempt to change data), and the sales we have credited to you with the amounts, dates and the account that bought (shown to you only as a count and a total, never as a name). We keep your payout requests and the payouts we have made, which are protected by a signature so that changes made outside the Service can be detected.
When someone visits through your link we count the visit once per visitor per day. To do this we set a cookie named kuku_v with a random value and keep only a keyed, one-way hash of it, never the cookie itself and never an IP address. The code from a link is remembered in the visitor’s browser for 30 days (kuku_ref) so that the discount can be applied; only the code is kept.
If you request a payout, the Service shows a ready-written email to us containing your name, email address, affiliate code, request reference and amount; we also record the request, and, if email is set up, send it to the owner. If we ban an email address for breaking the Affiliate Terms, we keep that address on a block list so that it cannot return. You cannot delete an account that still has unpaid affiliate earnings until they have been paid out.
9. How long we keep information
- Account records — until you delete your account or ask us to.
- Sign-in sessions — each expires 30 days after you sign in, and all are removed when your account is deleted.
- Plan activity records — kept with your account and removed with it.
- Voice Enhancer usage records (time, length and which tool only) — kept so your Account page can show how much you have enhanced, and removed with your account.
- Usage records (time, number of characters and length of audio only) — kept to show your usage, and removed with your account.
- Payment records (date, amount, currency, Stripe’s payment or invoice reference and the email you paid with) — kept for our accounting records for as long as the law requires. If you delete your account, the link to you (your account ID and email) is removed from the record; the amount and date stay.
- Update email records (which update emails were sent to you, and delivery status) — removed with your account. Your unsubscribe choice is kept for as long as your account exists.
- Messages you send us — for as long as needed to handle your request and keep a record of it.
- Technical logs held by our providers — according to their own retention periods.
When you delete your account we remove your account record, your sign-in sessions and the plan activity records linked to your account from our database. Copies may remain for a short time in provider backups before they are overwritten.
10. Your choices and rights
- See your information — your name, email and plan are shown on the Account page.
- Correct it — your name and email come from your Google account. Update them there and sign in again; our record refreshes each time you sign in.
- Download a copy — use Download my data on the Account page, or email us.
- Delete it — use Delete account on the Account page, or email us.
- Remove saved voices — use Remove saved voices on the Account page, or clear your browser’s site data.
- Withdraw Google access — at myaccount.google.com/permissions.
Depending on where you live (for example the European Economic Area, the United Kingdom or California) you may have further rights, including to object to or restrict processing, to data portability, and to complain to your local data protection authority. To use any right, email kukulabsonline@gmail.com. We will respond within 30 days. Because plans are activated by hand, we may need to confirm that you own the account before acting on a request.
11. Security
We use HTTPS for all traffic, store sign-in tokens only in hashed form, set sign-in cookies as HTTP-only and secure, send strict security headers, and limit administrative functions to authorised administrators. No online service can be completely secure, so we cannot guarantee absolute security. If we learn of a breach that affects your information, we will tell you and the authorities where the law requires.
12. Children
KUKU Labs is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us information, email kukulabsonline@gmail.com and we will delete it.
13. International transfers
Our providers operate in several countries, so your information may be processed outside the country where you live, including in the United States. Where the law requires it, we rely on appropriate safeguards for these transfers.
14. Changes to this policy
We may update this policy as the service changes. We will change the “Last updated” date above and, if the changes are significant, tell you on the website. Continuing to use the service after an update means you accept the updated policy.
15. Contact us
Questions, requests or complaints about privacy: kukulabsonline@gmail.com.
See also: Terms & Conditions