SayAgain — Privacy Policy
SayAgain is a browser extension that lets you capture, translate, and replay phrases from YouTube subtitles. This policy explains, in plain terms, what data the extension handles, why, and who it is shared with. We keep the list deliberately short — SayAgain collects only what it needs to do its job.
1. Who we are
SayAgain is an independent project operated by the extension's developer ("we", "us"). For any privacy question or request, contact us at the address in the Contact section below.
2. What we collect
The extension works without an account. If you choose to create one, and as you use the features, the following data is handled:
Account information
- Email address — collected only if you create an account, so you can sign in and recover access. Account sign-in is handled by our authentication provider, Supabase; the account emails it sends (confirmation code, password reset) are delivered through our email provider, Resend.
Saved phrases ("cards")
When you save a phrase, we store the information needed to show and replay it later:
- the phrase text and its translation;
- the source video's title, URL, and identifier, and the timestamp of the phrase within the video;
- the target language and the time you saved the card.
Settings and subscription
- your preferences (for example, your native language and the hover-to-pause option);
- your subscription status, and — if you subscribe — a customer identifier provided by Stripe so we can recognise your subscription. This identifier is used only on our server and is never exposed to the extension.
Your voice
SayAgain can show you how closely you repeated a line. Pressing the microphone is the only thing that starts this, and this is the whole of what happens.
- The transcription is your browser's, not ours. Your speech is turned into text by the browser's own speech recognition — the same feature behind voice typing in Chrome. In Chrome that work is performed by a Google service, so the audio leaves your computer the way it does for any other use of that feature, and it is covered by Google's privacy policy rather than by this one.
- We never receive the audio. What reaches SayAgain is the text your browser produced. It is compared with the subtitle line already on the page, used to colour that line and work out a score, and then discarded. It is not stored on your device, is not sent to our servers, and is not part of a saved card.
- What we are told is a number. The only thing that ever leaves for us is the anonymous count described below: that an attempt happened and how it scored — never the words you said.
- Nothing listens in the background. The microphone is requested at the moment you press the button and at no other time. Your browser will ask for it on behalf of
www.youtube.com, because that is the page SayAgain runs on.
Anonymous usage statistics
SayAgain counts how the extension is used, so that we can tell which parts help people learn and which parts are failing. These counts are deliberately anonymous. This is the complete description of them.
- What is counted. Only a fixed list of events: that a period of use began; that a phrase was selected, saved, or replayed; that a review session was started, that a card was rated, and that the session was finished or abandoned; and, when something goes wrong, that subtitles were unavailable, that a subtitle conflict was detected, or that an error occurred — the last identified by a code from a fixed list. Each event carries a few properties chosen in advance, such as how many words a phrase had, whether a translation was present, which of the four ratings was given, or how many cards were due for review. Since version 1.3.0 the list also includes: that the extension was installed; that the welcome page was opened, that a language was chosen on it, and that its button to YouTube was pressed; and that a repeat-out-loud attempt was started, scored, or could not be completed — the score being the share of the line's words that matched, alongside how many words the line had. Nothing outside that list is sent. Each event also carries a random number of its own, made when the event is created, so that an event sent a second time after a network failure is not counted twice; it is different for every event and says nothing about you.
- What is never counted. No phrase text and no translation. No video title, video identifier, video address, page address, or referring page. No subtitle or transcript text. No email address, account identifier, password, or access token. No free-text message of any kind — when something fails we record a code, never a message, precisely so that a message cannot carry your content out with it. No clicks, keystrokes, or mouse positions; no screen or session recording; and no automatic capture of anything on the pages you visit.
- How the counts are labelled. The first time SayAgain runs it generates a random identifier on your device. It is not derived from your email address, your account, or anything else about you, and it is not linked to any account you may create. It is stored only on your device, it is not part of the settings that sync to your account, and it is not cleared when you sign out — because it contains nothing about you to clear. Removing the extension removes it.
- Where it goes. The extension sends these events to our own server, which passes them on to PostHog, the analytics provider we use. The extension never contacts PostHog, or any other third party, directly. Our PostHog project is hosted in the European Union, so these events are processed within the EU and are not transferred outside it. The contents of these requests are never written to our own logs.
- If you remove SayAgain. Your browser opens a short page on our server that asks one optional question about why you left. The page's address carries the random identifier described above — but in the part of a web address that your browser keeps to itself and never sends to a server. So the identifier reaches us only if you pick an answer, and only inside that answer. If you open the page and close it without answering, we are never told which installation it was; our server records that the page was requested, as any web server does, and that record contains no identifier of yours. The page has no text box and asks nothing else about you.
- This version has no switch to turn the counts off. We chose to tell you exactly what is collected rather than offer a setting we would then have to be trusted about. If you would rather send nothing at all, the reliable answer today is not to install SayAgain, or to remove it.
What we do NOT collect
- No record of your browsing. We do not see, log, or store the pages you visit or the videos you watch. The one exception is deliberate and listed above: when you save a phrase, the card keeps that video's address and title, so it can replay that exact moment later. Videos you merely watch leave no trace with us — and in particular, the usage counts described above never carry a video, an address, or a page.
- No advertising, no profiling, and no cross-site tracking. The usage counts above are the only measurement we do, and they are limited to the fixed list given there.
- No payment card details — see Payments.
3. How we use your data
- To provide the core features: translating phrases and storing your saved cards and settings so they are available when you return and across your signed-in devices.
- To operate accounts: sign-in, email confirmation, and password reset.
- To manage subscriptions: recognise whether your plan is active and unlock the corresponding features.
- To improve the extension: the anonymous usage counts described above tell us which features are used and which are failing. They are not linked to you, and they are not used to decide anything about an individual — only to see how the extension as a whole is doing.
We do not use your data for advertising or profiling, and we do not sell or rent it to anyone.
4. Who we share data with (service providers)
SayAgain relies on a small number of trusted providers that process data on our behalf, strictly to deliver the features above:
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Database and account authentication (sign-in, account emails) | Email, saved cards, settings, subscription status |
| Resend | Delivering account emails (confirmation code, password reset) on Supabase's behalf | Your email address and the message contents (e.g. the verification code) |
| Google Cloud Translation | Translating the phrase text you ask to translate | The phrase text and the target language (no account identity attached) |
| Google Cloud Run (Frankfurt, EU) | Hosting our server — the one that translates, syncs cards and serves the review player page | Everything the extension sends us passes through it: phrase text, saved cards, account requests |
| PostHog (EU region) | Anonymous usage statistics — which features are used and when | Only the fixed list of events described above, labelled with a random per-installation number. No phrase, translation, video, address or account identity. Our server sends these; the extension never contacts PostHog directly, and the data stays in the EU. |
| Cloudflare | Our domain and the secure connection to our server | Requests to our server pass through Cloudflare, which terminates the encrypted connection |
| Stripe | Processing subscription payments and the billing portal | Payment details you enter on Stripe; a subscription/customer identifier |
| Google Chrome Web Store | Distributing and updating the extension | Governed by Google's own policies |
Each provider processes data only as needed for its function and under its own privacy terms.
5. Payments
Subscriptions are not switched on yet — the current version of the extension cannot take a payment at all. This section describes how it will work when they are.
Subscription payments are processed entirely by Stripe. When you upgrade, you are taken to a Stripe-hosted page and enter your card details directly with Stripe. We never receive, see, or store your card number. We only learn from Stripe whether your subscription is active, plus an identifier that lets us match it to your account.
6. Browser permissions
The extension requests only the permissions it needs:
storage— save your cards and settings on your device and sync them when signed in.alarms— schedule background retries (for example, re-attempting a translation that failed).identity— support signing in with Google.- Access to
youtube.com— read subtitles on the page so you can capture phrases. - Access to our own backend server — send phrases for translation and sync your cards. It is never granted access to any other website.
The microphone is not in this list, and that is not an omission. The
repeat-out-loud feature uses your browser's own speech recognition from the YouTube
page itself, so the extension asks for no microphone permission of its own — your
browser asks you directly, on behalf of www.youtube.com, the first time
you press the button. See Your voice above.
7. Data retention and deletion
We keep your data for as long as your account exists. You can request deletion of your account and associated data at any time by contacting us at the address below; we will remove it from our database. Cards you keep only on your device (before signing in) are removed when you clear the extension's storage or remove the extension.
8. Data security
All communication between the extension, our server, and our providers uses encrypted HTTPS connections. Access to the database is restricted to our server, and account credentials are handled by our authentication provider, not stored by the extension.
9. Children
SayAgain is not directed at children under 13, and we do not knowingly collect data from them.
10. Changes to this policy
We may update this policy as the extension evolves. Material changes will be reflected here with a new "Last updated" date. Continued use of the extension after an update means you accept the revised policy.
11. Contact
For any privacy question, or to request deletion of your data, contact us at: flsfedorovlev@gmail.com.