Privacy Policy — LingoFlow

Product: LingoFlow — Universal Translator (Chrome extension and website widget) Publisher: Mehdi Eghtedari — greeneye2096@gmail.com Version: 1.1.0 · Effective date: 31 July 2026 · Last updated: 1 August 2026

1. Summary in one paragraph

LingoFlow has no backend server, no user accounts, no analytics and no advertising. The publisher receives no data whatsoever from your use of the extension. Everything the extension stores stays inside your own browser. The only data that ever leaves your device is the text — or, if you explicitly switch it on, the audio — that you ask to be translated, and it goes directly from your browser to the translation service you selected, never through any server operated by the publisher.

2. What is stored on your device

All of the following is written to chrome.storage.local, which lives only in your browser profile on your computer:

The publisher cannot read any of this. Uninstalling the extension deletes all of it.

3. What leaves your device, and when

3.1 Text translation

When you translate a selection, a page, or a YouTube caption, the corresponding text is sent directly from your browser to the engine you selected in Options:

Nothing is sent until you trigger a translation. The extension never scans, uploads or indexes pages in the background.

3.2 Speech features (off by default)

• YouTube bilingual subtitles read the caption text that YouTube already renders in the page. No audio is captured. Only that text is sent to your chosen translation engine.
• Tab-audio translation (beta) starts only after you click the button. Audio from the active tab is recorded in short segments (~6 seconds) and sent to api.openai.com for transcription using your OpenAI key. Segments are held in memory only and discarded immediately after the request; nothing is written to disk.
• Microphone live translation starts only after you press Start and grant microphone permission. With the Whisper engine, audio goes to api.openai.com with your key. With the free browser engine, Chrome's built-in Web Speech API is used — please note that Chrome transmits that audio to Google's speech-recognition service; this is behaviour of the browser itself, not of LingoFlow.
• Read aloud (TTS) uses chrome.tts, i.e. the speech voices installed in your browser or operating system.

3.3 Images and screen areas (OCR)

• Right-click → translate text in this image: the extension downloads that image and reads the text in it. In offline mode the image never leaves your computer. In cloud mode the image is sent to api.openai.com using your OpenAI key.
• Select a screen area (Alt+Shift+O): a screenshot of the visible viewport of the tab you are looking at is taken only at the moment you release the mouse, then immediately cropped to the rectangle you drew. Only that crop is used; the full screenshot is discarded. In cloud mode the crop is sent to api.openai.com; in offline mode it is processed on your device by Tesseract.
• Neither the screenshot, the crop, nor the image is written to disk or kept after the request. Only the recognised text and its translation may enter the local translation cache.
• The extension never captures the screen on its own initiative — a screenshot happens only in direct response to your click, menu selection or keyboard shortcut.

3.4 What is never collected

No browsing history, no page URLs, no form contents, no keystrokes, no cookies, no device fingerprints, no location, no identifiers, no crash or usage telemetry. Nothing is sold, rented or shared with third parties for advertising, and no data is used to train any model by the publisher.

4. Permissions and why each one is needed

The extension requests no permission that is not used by a feature described in this policy.

5. Chrome Web Store Limited Use compliance

LingoFlow's use of information obtained through the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Specifically: data is used only to provide the translation features the user invokes; it is not transferred to the publisher or to any party other than the translation provider the user selected; it is not used for advertising, credit assessment, or any purpose unrelated to the described functionality; and no human reads the data, because it never reaches the publisher.

6. Legal basis and your rights (GDPR / EU & UK)

Because no personal data reaches the publisher, the publisher is not a controller or processor of your content. When you enter your own API key and translate text, you act as the controller of that processing, and the translation provider you chose is your processor under their terms.

For the data held locally on your device, you can at any time:

• Access / export it — Chrome DevTools → Application → Storage, or the Options page
• Rectify it — change any setting in the Options page
• Erase it — Clear translation cache, Reset all settings, or uninstall the extension
• Restrict processing — set the selection mode to off, disable YouTube subtitles, or simply do not trigger a translation

Since the publisher holds no data about you, requests for access or deletion addressed to the publisher will be answered with confirmation that no such data exists.

International transfers: the translation and speech providers you may select operate servers outside the EEA (for example in the United States). Choosing an engine means accepting that provider's own transfer safeguards. If this matters to you, use a self-hosted LibreTranslate server, which keeps all text within infrastructure you control.

7. Children

LingoFlow is a general-purpose utility and is not directed at children under 16. The publisher knowingly collects no data from anyone, including children.

8. Security

There is no server to breach. API keys stay in your browser profile and are transmitted only over HTTPS, and only to the provider that issued them. Network calls are made from the extension's service worker, so keys are never exposed to the web page you are viewing. You should still treat your keys as secrets and revoke them if your device is compromised.

9. Third-party services

Third-party providers process the text or audio you send them under their own privacy policies: Google, MyMemory (Translated s.r.l.), DeepL SE, OpenAI, Anthropic, and — if you configure one — the LibreTranslate instance you point to. Please review the policy of whichever provider you enable. The publisher has no affiliation with, and no control over, any of them.

10. Changes to this policy

Material changes will be published together with a new version of the extension and reflected in the "Last updated" date above. Continued use after an update constitutes acceptance of the revised policy.

11. Contact

Mehdi Eghtedari — greeneye2096@gmail.com

A Persian translation of this policy is available in PRIVACY-fa.md. In case of any discrepancy, this English version prevails.