Privacy
Where Cuebird keeps each kind of information, written from the actual code. The full, legally binding privacy policy will be published with the operator’s details before launch.
Summary
- You can use Cuebird without an account. If you sign in, we receive only your email address.
- Words, cards, recordings, practice history, card lists, your daily goal, your files and imported dictionaries are stored in this browser.
- Only the text a feature needs goes to our server: subtitle lines to translate, the word you looked up and its sentence, subtitle lines for word analysis and pinyin, a sentence you ask to have explained, a word to find example sentences for, or a file name to search subtitles with.
- Send feedback sends what you write; your email address and diagnostics are included only if you enter or choose them.
- Audio and frames from cards, shadowing recordings and tab audio for live subtitles are never uploaded. The one exception is when you choose server transcription for one of your files.
- Pro payments are handled by Paddle, our reseller. Cuebird never receives your card number.
- No ads, analytics or trackers. We don’t sell personal data.
Stored on your device only
The following is kept in browser storage (IndexedDB, extension storage, OPFS). It isn’t synced or sent to our server, and it’s removed when you uninstall the extension.
- Card audio and screenshots, shadowing recordings, and shadowing and dictation history
- Card lists, flashcard and quiz results, and adaptive levels
- Your daily goal, cards studied per day and your streak
- Your files (video, audio, subtitles) and subtitle files attached to videos
- Imported StarDict and MDict dictionary files
- Settings (speed, shortcuts, panel position and so on) and the cached transcription model
- Follow-up questions about an AI explanation and their answers (a short thread per sentence)
- Downloaded news, which items you’ve seen, and the “News alerts” setting
- The review request record: install time, how many times and when you were last asked, and whether you answered. Whether to ask is decided from the study days and graded cards counted from this browser’s study history; those numbers and your answer are never sent anywhere
Sent to our server
Our server handles translation, dictionary lookups, word analysis and the features below. Here is what it receives. While you’re signed in, requests also carry your sign-in token so the server can check your plan and usage.
| Feature | What is sent | When |
|---|---|---|
| Subtitle translation | Subtitle lines (text), language codes | Only when platform translations, YouTube auto-translate and Chrome’s on-device translator all fail |
| Dictionary | The word, its base form, the sentence it came from, language codes | When you click a word to look it up |
| Word analysis | Subtitle lines near the playhead, language code | Automatically while you watch (word splitting and base forms). Processed on our server, not forwarded |
| Chinese pinyin | Subtitle lines (text), language code | When pinyin is shown for Chinese subtitles. Processed on our server, not forwarded and not stored; held briefly in memory only |
| AI sentence explanation | The sentence to explain, language codes | When you press Explain. The server passes only the text to Anthropic (Claude) |
| Follow-up questions | Your question, the explained sentence and the lines around it, the video title, the earlier explanation, earlier questions and answers about the same sentence, language codes | When you send a question. The server passes it to Anthropic (Claude) and doesn’t store questions or answers |
| Example sentences (Tatoeba) | The word, its language code, your native language code | When you view examples in the word popup. The server passes only the word and language codes to Tatoeba (tatoeba.org) |
| Subtitle search (OpenSubtitles) | A hash of the file (computed on your device from parts of its start and end), the file size, a search query made from the file name, language codes; when downloading, the chosen subtitle’s ID | When you search subtitles on the My files page. The server passes only the hash, query and language codes to OpenSubtitles (opensubtitles.com). Video and audio are never sent |
| News | Extension version, menu language (and your sign-in token if signed in) | Every 6 hours while “News alerts” is on, and when the version or menu language changes. Used only to pick the news that matches your plan |
| Send feedback | What you write and its category. Your email address only if you enter one. Only if you tick “Include diagnostic info”: extension version, browser, menu, study and native languages, and the domain of the site you were on. Only if you also tick “Also send the full page address”: the full address of the page you were on (without the part after #) | When you send feedback. The server stores it with your user ID if signed in, otherwise a hash of your IP address (never the address itself) |
| Remote config | Nothing | At startup and every 30 minutes. Returns feature switches and page selectors only, never code |
| Usage limits | Signed out: IP address (the server stores only a keyed hash, never the address itself). Signed in: user ID | Daily usage is counted on each translation, dictionary, AI explanation, follow-up question and subtitle search request |
When a word isn’t in the open dictionary or a line can’t be handled by a free source, the server passes only the text to an external translation or AI provider (whichever of Microsoft Azure Translator, DeepL, Google, NAVER Papago, OpenAI, Gemini and Anthropic are enabled in production). Your email, user ID and IP address are never sent to them, nor to Tatoeba or OpenSubtitles. Our server makes these requests, so those services see only our server’s address.
So the same subtitle isn’t translated twice, the server keeps translated lines and their translations in a shared cache that isn’t linked to any user. The dictionary cache stores the word and its meaning; the sentence is kept only as a hash. Each shared-cache entry stops being used and is deleted 30 days after it was stored (server setting SHARED_CACHE_TTL_DAYS).
So the same sentence isn’t explained twice, AI explanations are also kept in a shared cache keyed by a hash of the sentence. Example sentences are kept per word in a shared cache and fetched again after 14 days (one day for words that had none). Neither is linked to any user. Subtitle search results and downloaded subtitle files stay in server memory for up to 24 hours and are never written to disk.
Sign-in and sync
You sign in with a 6-digit code sent to your email. There is no password. Login codes and session tokens are stored only as hashes. The production server never writes login codes or email addresses to its logs, and if no email delivery service is configured it refuses sign-in requests instead of creating a code.
While signed in, two things sync about once a minute:
- Word statuses: language, base form, status, timestamps
- Card text: sentence, translation, word, note, review schedule, and the source video’s platform, ID, title, URL and time range
Card audio and screenshots are stripped on your device before syncing, and stripped again on the server. Card lists, quiz results, your daily goal, practice history, settings, your files and imported dictionaries don’t sync.
So deletions reach your other devices, a word you delete stays on the server marked as deleted, with its language, base form and status; a deleted card keeps only its ID. Both are removed when you delete your account.
Audio, video and screen
- Video streams are never downloaded, recorded or altered, and DRM is never touched.
- Audio cards (Alt+Q) store a few seconds of tab audio and one frame on your device. They only leave it if you send them to Anki on your own computer (127.0.0.1:8765).
- Live subtitles from tab audio capture audio only when you turn them on, transcribe it on your device with Whisper, and never store it.
- Transcribing your files: the on-device engine keeps the audio on your computer. If you choose the server engine (Pro), the audio is sent to our server in pieces of up to 10 minutes and passed on to OpenAI (whisper-1). Our server doesn’t write the audio to disk; for free users it records only the seconds used.
If your browser can’t transcribe on device, the server engine may be pre-selected on the My files page. If you don’t want audio to leave your computer, check the engine before you start.
Speech recognition
Shadowing’s speech recognition and the Say it quiz use the browser’s speech recognition (Web Speech API). Chrome may send that audio to Google’s speech servers to turn it into text. This is handled by the browser under Google’s privacy policy. Cuebird never receives the audio or the result; only the recognised text and your score are stored on your device.
A one-time notice explains this just before speech recognition is first used. Choose Turn off speech recognition there, or later switch off Use browser speech recognition under Settings → Speech recognition, and speech recognition never starts. Shadowing then records only, for you to compare with the original by ear, and the Say it quiz asks you to say the sentence and mark yourself right or wrong. Speech recognition also doesn’t run unless you grant microphone access.
Services your browser connects to directly
- Supported platforms and their subtitle servers: your browser fetches subtitles for the video you’re watching directly, using your existing sign-in. These requests don’t go through our server.
- Hugging Face: the Whisper model is downloaded once for transcription. No audio is sent.
- Chrome’s on-device translator: asks before downloading its model, then translates on your device.
- Anki (127.0.0.1:8765): a program on your own computer; you’re asked for permission the first time. This is the only optional permission the extension asks for while running.
Your browser doesn’t connect to Tatoeba or OpenSubtitles directly; our server makes those requests (see Sent to our server). External dictionary links in the word popup, and dictionaries opened with Shift+click, open that site directly in a new tab.
This website (cuebird.dev) uses no cookies, analytics, or third-party fonts or scripts either.
Payments and subscriptions
Pro payments are processed by Paddle (Paddle.com Market Limited and its affiliates). Paddle is our merchant of record: it takes the payment, calculates and remits tax, issues receipts and processes refunds. The card and billing details you enter at checkout go straight to Paddle; Cuebird never sees or stores your full card number. Paddle handles that data under the Paddle privacy policy.
| Direction | What | Why |
|---|---|---|
| Cuebird → Paddle | Your Cuebird user ID and account email address | To link the purchase to your account. Sent only when you open checkout |
| Paddle → Cuebird | Subscription status, plan (price ID), billing period (start, renewal and end dates), scheduled and actual cancellation times, Paddle customer and subscription IDs, and whether a payment was fully refunded or charged back. Our server stores only the values the subscription needs, plus each notification’s ID, type and time so it isn’t processed twice. Your country and checkout email are not stored even if Paddle sends them | To turn Pro on and off, and reflect cancellations, failed payments and refunds |
Free-trial record: the 7-day free trial can be used once per account. To enforce that, we store a hash of the email address that started the trial (not the address itself) and keep it even after the account is deleted. The address can’t be recovered from the hash.
When you delete your account, our server first asks Paddle to cancel any renewing subscription so you aren’t charged again (the period you’ve paid for runs to its end; if that request fails, the account is not deleted and you see an error). It then deletes the subscription details on our server (status, period, Paddle customer and subscription IDs) together with the account. Billing records such as receipts and transactions are kept by Paddle, our merchant of record, under tax and accounting law and Paddle’s own policy.
Retention
| Data | Where | How long |
|---|---|---|
| Everything stored on your device | Your browser | Until you delete it or uninstall |
| Email, plan, synced words and cards | Server | Until you delete your account |
| Login codes (hashed) | Server | Expire after 10 minutes; codes older than a day are deleted on the next code request |
| Sessions (token hash) | Server | Expire 90 days after last use; deleted immediately on sign-out |
| Daily translation and dictionary usage (a hash of the IP address when signed out) | Server | 35 days |
| Daily AI explanation, follow-up question and subtitle search usage (a hash of the IP address when signed out) | Server | Not deleted automatically; usage while signed in is deleted with your account |
| Feedback you sent (text, the email you entered, chosen diagnostics, user ID or a hash of the IP address) | Server | Not deleted automatically; feedback sent while signed in is deleted with your account |
| Shared AI explanation cache (explanations keyed by a sentence hash) | Server | Not deleted automatically (not linked to users) |
| Shared example sentence cache (examples per word) | Server | Refreshed after 14 days (one day for words with none); not deleted automatically, not linked to users |
| Subtitle search results and downloaded subtitle files | Server memory | Up to 24 hours, never written to disk |
| Server transcription seconds (free users) | Server | Until you delete your account |
| Shared translation and dictionary cache | Server | 30 days from when each entry was stored (not linked to users) |
| IP address for rate limiting | Server memory | Briefly, never written to disk |
| Subscription details (status, plan, period, Paddle customer and subscription IDs) | Server | Until you delete your account |
| Payment notification log (notification ID, type and time; nothing that identifies you) | Server | Not deleted automatically |
| Free-trial record (email hash) | Server | Kept after account deletion, to allow one trial per account |
| Payment and billing details, transaction records (including country and checkout email) | Paddle | Under tax and accounting law and Paddle’s privacy policy |
Managing your data
- Export: Settings → Account → Export data downloads your server data as a JSON file.
- Delete: Settings → Account → Delete account immediately removes your email, synced words and cards, usage, feedback sent while signed in, subscription details and sessions, and signs out every device. A renewing subscription is cancelled automatically first, so you don’t need to cancel it yourself. Data in this browser stays until you uninstall the extension. The free-trial record (an email hash) remains, and billing records held by Paddle remain as described under Payments and subscriptions.
- Feedback sent while signed out isn’t linked to an account, so it can’t be deleted from the app. To have it removed, ask the operator (see Not yet decided for the contact).
- Stop syncing: sign out. Microphone and Anki access can be revoked in your browser settings.
Cuebird isn’t directed at children under 14 (under 13 in the US), and we don’t knowingly collect their data.
Not yet decided
Cuebird hasn’t launched, so the following is still open. This page will be updated, with a new date, as each is settled.
- Operator name, privacy officer and contact address (settled together with the operator details in the Terms of Service)
- How long feedback and AI explanation, follow-up question and subtitle search usage are kept before automatic deletion
- Hosting provider and country (including international transfers)
- Which translation and AI providers are enabled in production, and their retention policies
- The email delivery service for login codes (the code currently supports Resend only) and its retention policy