Effective 24 September 2026. Narrator Check (“we”) operates narratorcheck.com and is the data controller for what is described here. Questions: support@narratorcheck.com.

Your audio and manuscripts, in the tools

Audio is read, measured, corrected and encoded inside your browser tab. EPUB, PDF, DOCX and TXT files are unpacked or read there to count words and sections. The tools on this site never upload your audio: every check and fix runs in this tab. Except for the explicit book-project save described below, no tool page sends a file, a measurement or a verdict anywhere, and no audio tool calls the developer API; the three checking aids below make one request to start, carrying nothing but which aid it is and, on the pronunciation guide, a random number made when the page loads, so that one visit counts as one session. Outputs stay in browser memory until you download or close them.

That is not only a preference. Unreleased manuscripts are routinely under a non-disclosure agreement with the author, and for those recordings a tool that uploads is not an option at all.

The speech models on three pages

Hear your manuscript, the pronunciation guide and proof-listen use speech models: Kokoro, which reads text aloud, and Whisper, which transcribes a recording. The models are downloaded from this same Narrator Check origin the first time you press the button that needs one, and run on your own device. Your manuscript, your recording, the transcript and the synthesized audio are never sent anywhere, and these pages’ security policy lets them connect to nothing but this origin and the cookieless analytics counter described below.

Serving those models costs us bandwidth, so the three aids start only when you are signed in with Google (see developer accounts): pressing the button asks our API to start a session, and that request carries the aid’s name, your sign-in cookie and, on the pronunciation guide, a random number made when the page loads (so that one visit counts once; we keep a one-way hash of it for two days) — no text, no audio, no file name. We count those sessions against your account, per day and per month (Standard: 10 a day and 60 a month), and keep the counts with the account; deleting the account deletes them. Without a sign-in the pages make no request to our API and download no model.

The events these pages record are the same kind as everywhere else — that a read-back started or finished, that a guide or a synthetic MP3 was downloaded, that a proof-listen finished — with no text, no word, no voice and no result attached. Three more say what a checking-aid session did: aid_session_started, one of aid_model_loaded_fast, aid_model_loaded_medium or aid_model_loaded_slow (the model was ready in under five seconds, five to thirty, or more), and aid_session_completed.

What is stored on your device

Using the tools stores nothing except your browser’s own cache of this site’s files, which includes the speech models once they have been downloaded: no cookie set by us, no saved results, no history of what you checked. The two cookies described under developer accounts exist only if you sign in. Book projects are held in tab memory until you explicitly save them to your account or download a JSON backup; project data is not placed in localStorage, IndexedDB or a URL.

Saved book projects

The audiobook workspace can save project metadata to your signed-in account when you choose Save to account. That includes the book title, chapter filenames and order, file sizes and SHA-256 fingerprints, technical measurements and pass/fail reports, human acceptance, manuscript/recording fingerprints, individual review excerpts, pickup decisions and comments, and the delivery checklist. The audio, full manuscript, full transcript and speech-model buffers are never included.

Saved projects are held in our existing private European Union database (AWS, Frankfurt). They remain until you delete the project or your account. You can export a JSON copy or delete a saved project from the workspace. After returning or using another device, reselect the local audio: a different recording needs a new check. Up to 10 projects, 128 KiB per project and 256 KiB total metadata per account. Unsaved drafts disappear when the page is closed; keep a backup before signing in.

For request limits, short-lived counters record how many workspace requests and saves were attempted, never project content. They expire within two days. They are separate from analytics and from audio/checking-aid quotas. A conflicting or refused save preserves the previous account version and your open local draft. No saved project content is used for advertising or speech-model training.

What is measured

Anonymous, cookieless usage statistics, so we can tell whether anyone is using the tool: which page was visited, roughly where in the world from your IP address (which is not stored), and a small set of events such as “a manuscript estimate completed”, “a batch was checked” or “a fix completed”. These carry no file names and no measurements from your file; the checker’s own result is recorded only as pass or fail. The same cookieless script also collects page loading and interaction timing so we can find slow pages; it does not receive your audio or manuscript. It records only on narratorcheck.com, not on a local preview. If your browser sends a Do Not Track signal, nothing is recorded at all.

The shared funnel names are work_started when a supported file begins local analysis, work_completed when that analysis produces a result, and work_refused when a tool declines — because a recording has no quiet passage to learn noise from, say, or a trim range falls outside the file. Like every event here, they carry no properties: no file name, measurement, duration, verdict or reason is attached. Which refusal it was is only recoverable from which page it happened on.

Pressing Sign in in the header, on the account page or in a checking aid’s sign-in box records sign_in_clicked, with nothing attached, together with one name for where it was pressed: sign_in_clicked_header, sign_in_clicked_account, sign_in_clicked_aid or sign_in_clicked_api_key (the developer page’s “Get an API key”). Coming back from Google records sign_in_completed when our API accepts the sign-in, and also sign_in_completed_aid when it started on a checking aid and returns there, and sign_in_failed when it could not start, was cancelled or was refused; signing out records sign_out. When the account page shows an active pass it records pass_seen_active, and when any usage it shows is at 80% of its limit or more it records quota_warning, each once per visit to the page and without saying which limit. On the account page, creating an API key records api_key_created, revoking one records api_key_revoked, choosing the Pro beta records pro_beta_started and deleting the account records account_deleted. Opening the test-mode checkout records checkout_started, a checkout that could not open records checkout_failed, and coming back from Stripe records checkout_returned_paid or checkout_returned_cancelled — never the key, the account, the price or the payment. On the three checking aids, the sign-in box coming into view for a visitor who is not signed in records aid_gate_shown (once per page view), and a day or month of Standard sessions used up records aid_quota_exhausted. On the developer page, following the OpenAPI document link records openapi_downloaded and following the command-line client link records cli_downloaded. The header asks our API who is signed in only when the empty sign-in hint cookie described under developer accounts is present; without it, a page view makes no request to the API at all.

The complete list, which is everything this site can record beyond a page view. The audio checker: file_selected_wav, file_selected_mp3, file_selected_aiff, file_selected_m4a, analysis_complete_pass, analysis_complete_fail, analysis_unfixable, fix_complete, download_complete, preview_play, preview_compare, verify_failed, page_error. Every tool: work_started, work_completed, work_refused, feedback_positive, feedback_negative, feedback_prompt_seen, feedback_message_opened. The manuscript calculator: manuscript_selected_epub, manuscript_selected_pdf, manuscript_selected_docx, manuscript_selected_txt, estimate_complete, estimate_download, script_download. The loudness normalizer: loudness_file_selected, loudness_analysis_complete, loudness_fix_complete, loudness_download. The batch checker: batch_selected, batch_analysis_complete, batch_report_download, batch_csv_download, batch_fix_complete, batch_zip_download. The checking aids: readback_started, readback_completed, synthetic_download, pronunciation_guide_download, proof_listen_started, proof_listen_completed, proof_listen_download, aid_session_started, aid_model_loaded_fast, aid_model_loaded_medium, aid_model_loaded_slow (the model was ready in under 5 seconds, 5 to 30, or longer), aid_session_completed, aid_gate_shown, aid_quota_exhausted. Accounts and the API: sign_in_clicked, sign_in_completed, sign_in_failed, sign_out, api_key_created, api_key_revoked, pro_beta_started, account_deleted, checkout_started, checkout_failed, checkout_returned_paid, checkout_returned_cancelled, openapi_downloaded, cli_downloaded, sign_in_clicked_header, sign_in_clicked_account, sign_in_clicked_aid, sign_in_clicked_api_key, sign_in_completed_aid, pass_seen_active, quota_warning. The audio joiner: join_m4b_completed when it wrote an M4B, and join_m4b_unsupported when this browser cannot encode the AAC audio an M4B needs. Offer visibility, presses and refusals: pro_offer_seen, pro_beta_clicked, pro_beta_failed, api_key_offer_seen, api_key_create_clicked, api_key_create_failed, checkout_offer_seen, checkout_clicked. Offers are counted once per page view when at least half the control becomes visible. Checkout return events describe the return URL, not a confirmed payment. The book workflow: book_offer_seen, book_offer_clicked, book_continue_seen, book_continue_clicked, book_project_created, book_sample_created, book_save_clicked, book_project_saved, book_project_restored, book_chapters_checked, pickup_review_completed, book_package_exported, book_work_failed, book_work_refused. A link to the chapter checker from a requirements guide or a microphone test result: chapter_check_clicked. A press on a link to another website: outbound_click, with one name for where it goes, outbound_click_acx (ACX’s own pages), outbound_click_github or outbound_click_other; the address of the link is not recorded. Each is a bare name; none carries anything else.

For the book workflow, offer exposure requires half the control to be visible; a save is counted only after the server confirms it, and an export only after the complete package is produced. No project ID, title, filename, fingerprint, note, excerpt or measurement is included.

The feedback buttons

After a tool produces a result it asks whether that result was what you needed. When that question becomes visible, the site records feedback_prompt_seen. Answering records one of feedback_positive or feedback_negative — the thumb, and nothing else.

Saying something went wrong opens a box to describe it. That text is never transmitted by this site. The button below it is an ordinary mailto: link addressed to support, so your own mail client opens with the message and you send it yourself, having read it. Opening that link records feedback_message_opened; whether you then send anything, and what it says, is not something this site can see.

The developer API

The developer API is separate from every tool and opt-in: it processes only the files that key holders send to it, by calling it themselves with a key. If you never create a key, nothing in this section concerns you.

• What it receives. The audio file or text you upload for a job, and the parameters of that job. The file goes to a private storage bucket in the European Union (Amazon Web Services, Frankfurt, eu-central-1) on a signed URL, and is processed there by the same code the tools run in a tab.
• How long it is kept. Your upload is deleted when the job finishes, and results expire within 48 hours. An upload that never became a finished job is deleted by storage within 48 hours as well. The job record — its id, kind, state, times, the report and what it cost — is kept for three days, then deleted. Monthly usage counts are kept with your account.
• No human access. No person listens to or reads what you send. The only exception is a specific job you ask us to investigate, and then only that job. Nothing you send is used to train anything.
• Your rights to the file. Send only files you have the right to process. The API does not clone, imitate or train on anybody’s voice, and it offers no way to.
• Synthetic speech is labelled. Text-to-speech output is read by a built-in synthetic voice and carries tags in the file saying it is synthetic and not for ACX. It is for proof-listening, not narration.

Developer accounts and Google sign-in

An account exists for the API, the checking aids and explicitly saved book projects; local chapter checks and delivery do not need one. You create it by signing in with Google at /account/ or from a checking aid’s own page. We request only the openid, email and profile scopes and receive only:

• your Google account identifier, which we store only as a one-way hash;
• your email address and whether Google has verified it, to recognise you when you return and to contact you about the service;
• your name, to show you who is signed in.

We use this only to operate your account, saved book projects, checking aids and API keys. Narrator Check’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: we do not sell Google user data or transfer it to third parties except as needed to provide the service or to comply with the law; we do not use it for advertising or profiling; and we do not allow humans to read it except with your request, for security, or where the law requires. We request no scope that reaches your mail, files, calendar or contacts, and hold no token that lets us act at Google on your behalf.

Cookies. Signing in sets two cookies on this site and nowhere else: __Host-sf-narratorcheck, the signed, HttpOnly session, which expires after 12 hours; and __Host-sf-narratorcheck-hint, which holds only the value 1 and tells the account page that asking who you are is worth a request. Both are strictly necessary for the account, set only when you sign in and cleared when you sign out. There is no consent banner because nothing else is set.

API keys are shown once, when you create them; we keep only a hash, and a revoked key stops working at once.

Deleting your account removes the hashed identifier, the email, the name, every API key and every job record at once from the account page, or within 30 days if you email support. Aggregate counts that carry no identity — how many people chose Pro in a month — are not affected.

Legal bases

For people in the European Economic Area and the United Kingdom, under the GDPR:

• Legitimate interests (Article 6(1)(f)) for the cookieless usage statistics and for keeping the service secure. Neither involves an identifier.
• Performance of a contract (Article 6(1)(b)) for operating a developer account you create by signing in, and for processing the jobs you send to the API.
• Legal obligation (Article 6(1)(c)) where we must retain or disclose information by law.

You may ask what we hold about you, ask for it to be corrected, deleted or exported, object to processing, or complain to your data-protection authority. Email support@narratorcheck.com; a person answers within one month.

What is not here

No advertising, no advertising network, no payment processor, no tracking pixels, and no cross-site identifiers. That is why you were not asked to accept anything when you arrived.

The page loads the cookieless analytics script from analytics.pagefabrica.com. The EPUB/DOCX reader uses fflate and the PDF reader uses Mozilla PDF.js; both libraries are served from this same Narrator Check origin and do not receive your file.

The “Try a sample chapter” buttons fetch a short file this site synthesized, from this same origin, and check it in the tab exactly as they would check yours. Nothing travels the other way, and a sample is not counted as a file you chose.

Contact

Questions about any of this: contact us.