Privacy Policy

Subtitle Tutor is operated as a personal, open-source project. For any privacy or general support question contact [email protected].

If you self-host Subtitle Tutor, you are the data controller for your deployment. This policy describes the design of the software; you decide where it actually runs.

We use the information above only to:

• Authenticate you and protect your account.
• Render the subtitles, vocabulary, and lessons you have created back to you.
• Send your subtitle and word requests to the AI, dictionary, and translation providers you have selected, on your behalf, and store the result.
• Enforce rate limits and detect abuse.
• Debug crashes (mobile) and improve reliability.

We do not:

• Sell, rent, or trade personal information.
• Use your captures to train AI models. Whether upstream AI providers retain your prompts is governed by their policies; see section 4.
• Send marketing email.

Subtitle Tutor relies on external services to do its job. When you hit one of them the request leaves our server with the minimum text needed to answer it.

We do not have a contractual relationship that lets us audit these providers; read their own privacy policies. We pass the minimum text necessary and never your account credentials or AI key.

All primary data (accounts, subtitles, vocabulary, encrypted AI keys) lives in:

• PostgreSQL for durable storage.
• Redis for short-lived job queues, rate-limit counters, and WebSocket fan-out.

Backups are scoped to the same database instance and retained only as long as needed to perform a restore.

We take the following protective steps:

• Passwords hashed with bcrypt. Password policy: minimum 8 characters, three of four character classes (lowercase, uppercase, digit, symbol), maximum 72 bytes (bcrypt’s silent-truncation ceiling), and cannot match the email local-part.
• JWT tokens issued with a server-side tokenVersion revocation channel, so password change or logout-everywhere invalidates all outstanding tokens.
• AI API keys encrypted at rest with AES-256-GCM, versioned envelope.
• Per-IP rate limits on authentication endpoints; per-user rate limits on AI and dictionary endpoints.
• Postgres and Redis bound to loopback in development; production deployment is fronted by an nginx reverse proxy and uses authenticated Redis.
• Periodic multi-agent security review (most recent: 2026-05-17, documented in the repository).

No system is perfectly secure. If you believe you have found a vulnerability please contact [email protected] privately rather than disclosing publicly.

Wherever you live, you can:

• Access— request a copy of the data tied to your account.
• Correct— fix wrong information from the dashboard’s Settings page.
• Delete— request deletion of your account and the associated captures, vocabulary, and AI keys.
• Withdraw consent— revoke any AI, translation, or dictionary provider key from Settings; the server will purge the encrypted value.
• Object or restrict— ask us to stop processing a specific category of data.
• Port— export your captures and vocabulary in a machine-readable format.

To exercise any of these rights email [email protected] from the address on the account. We aim to respond within 30 days.

If you are in the EU or EEA, the United Kingdom, or Brazil, you also have the right to lodge a complaint with your local data-protection authority (for example your national DPA, the ICO, or the ANPD).

• Account data and captured material are kept for as long as the account exists.
• On account deletion we remove your captures, vocabulary, encrypted AI keys, and session tokens within 30 days. Aggregated server logs may persist somewhat longer for security and accounting purposes.
• Crash and analytics data follow Firebase’s retention defaults. If you self-host the mobile build you can configure or wipe them via the Firebase console.

• subtitle-tutor-token— HTTP-only session cookie. Required for the dashboard to work.
• Your theme preference (light / dark) is stored in localStorage so it survives reloads.

We do not use advertising cookies or cross-site tracking.

The Service is not directed at children under 13 (under 16 in the EU or EEA). We do not knowingly collect data from children. If you believe a child has registered, contact us and we will remove the account.

If you use a hosted Subtitle Tutor instance, your data may be processed in jurisdictions different from your own — in particular, the AI, translation, and dictionary providers you select may be located in other regions. By using the Service you accept those transfers; the providers we list above publish their own safeguards.

We may update this policy as the product evolves. When we make a material change we will update the “Last updated” date at the top. Continued use of the Service after a change means you accept the revised policy.

Questions, requests, or complaints: [email protected].