Privacy · the methodology
Your voice never leaves this tab.
This is not a promise wrapped in legalese. It is how the app is built, and it is checked by an automated test on every change. Here is exactly what happens to your voice, and the short list of bytes that ever touch the network.
Everything happens on your device
When you rehearse, your microphone audio is captured, analyzed, and stored on your own device. The pitch detection, the pace and pause maps, the energy arc, and (when you opt in) the transcript all run locally in your browser. No audio buffer, no transcript, and no derived voice feature is ever sent anywhere. Not for sync, not for debugging, not for analytics, not "anonymized." There is no server that could receive it, because we never built one.
What we measure
Aloud measures the take, never the person. Every number is a plain, explainable signal:
- Pace: your speaking rate, shown as an honest range, not a false-precise number.
- Pauses: where you stopped, for how long, and whether you rushed.
- Pitch variance: how much your pitch moves, measured against your own natural baseline.
- Energy: how your volume rises and falls, and whether your ending trails off.
- Language (opt-in): fillers, hedges, vocabulary, and sentence rhythm, from an on-device transcript.
There is no confidence score, no charisma rating, no fluency grade, and no comparison to anyone else. Those things do not exist here by design.
The only bytes that ever move
Aloud is a static app with a deliberately tiny, enumerable network footprint. Today it makes no network calls at all. As accounts and billing arrive, the complete allowlist will be exactly this, published and unchanged:
| Endpoint | Carries |
|---|---|
| Sign-in (Supabase) | Your email or OAuth session, and one entitlement flag. No audio, no metrics. |
| Checkout (Stripe) | A redirect to a hosted page. Card details never touch the app. |
| Static assets | The app itself, fonts, and any opt-in model file you choose to download. |
| Everything else | Blocked. A build-time test fails if any other request appears. |
No account is needed to rehearse. An account exists only to carry a purchase across your own devices.
The wall is tested, not hoped
A test scans the app's code on every change for any network primitive, a fetch, a socket, a beacon, and fails the build if one reaches an origin that is not on the allowlist above. A second rule keeps audio-typed values away from any network call. The privacy wall is a brand asset only because it is inspectable.
Your data is yours
Your takes live in your browser's local storage. You can export them as a file or delete them at any time, and delete means delete. If you ever stop paying, you keep every take and the free Mirror. We never hold rehearsals hostage.
Questions about any of this belong on the feedback page. If something here is ever untrue, that is a bug, and we want to hear about it.