Legal

Privacy Policy

Effective October 20, 2026

The short version

Your study history stays on your computer. Sentences, translations, audio clips, chats and subtitle timelines are saved locally and are not uploaded to our servers. You can delete them, or turn saving off.
The AI does hear the audio. While a session is running, the audio it captures is streamed from your computer directly to OpenAI, which transcribes and translates it. That is how the product works, so we say it plainly.
RainbowSay captures audio only — never your screen. The microphone is used only when you start a Speaking session or choose it as the source for Subtitles.
Our servers see how much you used, not what you watched or said. For billing we receive counts and durations per session. We do not receive audio, transcripts or translations.
Payments are handled by Stripe. We never see or store your card number.
This website sets no tracking cookies. We count visits with Cloudflare Web Analytics, which uses no cookies and doesn’t fingerprint you. Fonts are served from our own domain.
We don’t sell your data, and we don’t use it for advertising.

This summary is here to help. The full text below is what applies.

Who we are

RainbowSay is a desktop app, with this website (rainbowsay.ai) and a cloud service behind it, operated by RainbowSay (“we”, “us”). This policy explains what information we handle when you use any of them, why, and what choices you have.

If anything here is unclear, write to [email protected].

Information we collect

Your account

You sign in with Google. When you do, Google confirms your identity to us and we receive your email address and your name. We don’t receive your Google password, and we don’t ask for access to your contacts, files or anything else in your Google account. Your account is identified by your email address.

Your devices

Each computer you sign in on is registered to your account as a device, so that your usage and plan follow you across computers. For each device we store a random identifier, a one-way hash of its access token (never the token itself), the operating system and app version it reported, and when it was registered or revoked.

Payments and billing

Payments are processed by Stripe. You enter your card details on Stripe’s pages, not in the app, and we never see or store your full card number. We keep what we need to run your subscription: a Stripe customer reference, your subscription status and billing period, the history of your plan changes, and a ledger of credit on your account (purchases, free or promotional credit, referral credit, credit used, refunds).

Usage data for billing

To measure your allowance, the app reports totals for each session to our servers:

a random session identifier, the kind of session (Listening, Speaking or Subtitles), and the AI model used;
when the session started and how long it ran;
how much audio was sent and received, measured as durations;
counts: sentences, chat messages, and the AI provider’s usage units (“tokens”);
for Subtitles, the languages you translated into, with the minutes streamed for each;
an estimated cost, which is what your allowance is measured in.

We also record each time the app asks our servers for permission to start or continue a session, with the time and the session it belongs to.

This is metering, not content. These reports contain no audio, no transcripts, no translations, no chat text, and nothing about which app, site or file the audio came from.

Email and support

We send a small number of transactional emails, such as a welcome message when you create your account, through Amazon Simple Email Service. If you write to us, we keep the conversation so that we can help you.

Update checks

The app checks our servers for new versions from time to time. That request contains your operating system, processor type and current app version. It is not tied to your account.

This website

This website is hosted by Cloudflare. To see which pages are read and whether the site is fast, we use Cloudflare Web Analytics, a privacy-first service: it sets no cookies, stores nothing in your browser, and does not fingerprint you by IP address, browser or any other signal. It tells us, in aggregate, which pages were visited, where visitors came from, their country and browser type, and how quickly the pages loaded. That is the only third-party script on this site; there is no advertising, and no tracking cookies. Fonts are served from our own domain.

Like almost every website, our hosting provider processes basic request information — IP address, browser type, the page requested and the time — to deliver the pages and to protect the site from attacks, and our servers keep the same information in logs, which we use to keep the service secure and running.

What we do not collect

Audio. Our servers never receive the audio RainbowSay captures.
Transcripts, translations, vocabulary, grammar notes or chats. They go from the AI provider straight to the app on your computer.
Your screen. RainbowSay has no screen recording. On macOS it asks for the “System Audio Recording Only” permission, which covers sound and nothing else.
What you watch or listen to. We don’t know which app, website, show or file a session was listening to.
Your study history. It is stored on your computer (see below).

Audio and AI processing

To transcribe and translate speech, RainbowSay uses OpenAI’s real-time API.

When audio is captured. Only while a session you started is running. Listening and Subtitles capture the sound your computer is playing (all of it, or one app you choose). Speaking sessions capture your microphone, and so do Subtitles sessions if you choose the microphone as their source. The app stops sending audio during longer silences, and while you have a session suspended or the microphone muted.
Where it goes. The audio is streamed from your computer directly to OpenAI. It does not pass through our servers. Our servers only issue the app a short-lived credential that lets it open that connection, after checking your plan and allowance.
What else OpenAI receives. The instructions that tell the model what to do (for example, your language pair), the text of questions you ask in the chat about a sentence, and a safety identifier: a random account ID, not your email address or name, which lets OpenAI detect abuse of its service.
What comes back. Transcripts, translations, vocabulary and grammar notes, spoken translations and chat answers are returned to the app on your computer.
OpenAI’s handling. OpenAI processes this data as a service provider to us, under its API terms and data-usage policies, which you can read at openai.com/policies.

Because session audio may include other people’s voices — a call, a classroom, a meeting — please read the section on acceptable use in our Terms of Service: you are responsible for having the right to capture and process the audio you use RainbowSay with.

Data stored on your computer

Your study history lives on your computer, in the app’s data folder: the text of each sentence and its translation, vocabulary and grammar notes, chats, subtitle timelines, the audio clips used for replay, your settings, and the sign-in details for this device. None of the study history is uploaded to us.

You control it: delete a sentence or a whole session in the app, turn saving off in Settings, or remove the app’s data folder. Because this data never reaches us, we cannot recover it for you, and it is not included when we answer a request for the data we hold. Anyone with access to your computer account may be able to read it, so protect your computer as you normally would.

How we use information

to create and secure your account and sign you in;
to provide the service: issuing the credentials the app needs, and applying your plan’s limits;
to measure usage against your allowance, and to process payments, credit and refunds;
to send you transactional messages and answer your support requests;
to deliver app updates;
to prevent fraud and abuse, and to meet legal, tax and accounting obligations;
in aggregated form that doesn’t identify you, to understand costs and improve the product.

We do not sell your personal information, we do not share it for advertising, and we do not use it to build advertising profiles.

We share information only with the service providers that help us run RainbowSay, and only what each one needs:

Provider	What for	What they receive
OpenAI	Transcription, translation, chat	Session audio and prompts, directly from your computer; a random account ID
Stripe	Payments, subscriptions, fraud prevention	Your payment details (given to Stripe directly), email, purchase information
Google	Sign-in	The sign-in request; Google tells us your email and name
Amazon Web Services (SES)	Sending email	Your email address and name, and the message
Cloudflare	Hosting this website; privacy-first web analytics	The requests your browser makes to this website; aggregate, cookieless visit statistics
Hosting and infrastructure providers	Running our servers and database	The data described in this policy, stored or processed on our behalf

We may also disclose information if the law requires it, to protect the rights and safety of our users or the public, or as part of a merger, acquisition or sale of the business — in which case this policy continues to apply to your information until you are told otherwise.

Fraud and abuse prevention

Stripe screens payments for fraud. If Stripe blocks a payment as fraudulent or sends us an early fraud warning, the account involved may be disabled automatically. We also keep a list of blocked email domains, limit how often the app can request session credentials, and limit the number of devices per account. If you think your account was disabled by mistake, write to [email protected].

How long we keep information

We keep account, device and usage information for as long as your account exists, and billing records for as long as tax and accounting rules require. Short-lived records, such as the queue entry for an email that is about to be sent, are deleted once they have done their job.

When you ask us to delete your account, we delete or anonymize the personal information we hold about you. Two things work differently, and we’d rather tell you than hide it:

Billing records are anonymized, not erased. Our credit ledger is append-only by design, so that money can’t be miscounted. We remove the link between those records and you, rather than removing the records.
A one-way hash of your email address is kept so that the free starter credit can’t be claimed again with the same address. The hash can’t be turned back into your email.

Your choices and rights

See or correct your information. Your name and email come from your Google account. Ask us for a copy of what we hold at any time.
Delete your account. Write to [email protected] from the address you sign in with, and we will delete or anonymize your information as described above. Cancel any paid plan first, in the app, so that you are not billed again.
Delete your study history. Do it yourself, in the app — it is on your computer, not with us.
Permissions. You can withdraw the audio, microphone or Accessibility permission (on macOS 27 and later, the pane is called Device Control and Data Access) at any time in your system settings. The features that need it stop working; nothing else does.
Email. We send transactional email only.

Depending on where you live, you may have further rights under laws such as the GDPR or the CCPA — for example to object to or restrict certain processing, to data portability, or to complain to your data protection authority. Write to us and we will honor the rights that apply to you.

Children

RainbowSay is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, write to us and we will delete it. Students who are under the age at which they can consent to data processing in their country (16 in some places) should use RainbowSay only with the involvement and permission of a parent, guardian or teacher.

International transfers

We and our service providers may process your information in countries other than the one you live in, including the United States, where data protection laws may differ from those in your country. Where the law requires it, we rely on appropriate safeguards for these transfers.

Security

Connections between the app, our servers and our providers are encrypted in transit. Access tokens are stored on our servers only as one-way hashes, the credentials that let the app reach the AI provider expire within minutes, and our application logs identify accounts by random ID, never by email, name or token. No system is perfectly secure; if we learn of a breach that affects you, we will tell you as the law requires.

Changes to this policy

When we change this policy we will update the effective date at the top of this page.

Contact

Questions, requests or complaints about privacy: [email protected].