Privacy Policy
Updated: November 13, 2026
Account & login
When you sign in with Apple, we store a digest of Apple’s stable user identifier, your chosen verified email (including private relay addresses), and an encrypted credential used to revoke Apple access when you delete your account. We never receive your Apple password. Failed revocation requests are retried; your local account and sessions are disabled immediately.
We use your email to identify your account, send login codes, and link subscriptions. Google sign-in provides a verified email address; we do not read your Gmail. After a successful web or mobile App sign-in, we update the account’s latest sign-in IP address and time, plus the approximate country, region, and city supplied by Cloudflare when available, for account security and operational investigation. Only authorized administrators can view them. We keep them with the account record; after an account is deleted they stay linked to your email for 90 days, then only to the account number. An IP usually identifies a network exit and does not establish a home address. The website uses HttpOnly session cookies, and the browser extension stores its own login credentials separately. You can sign out of the current device or all devices from the account page.
On the sign-in page, in browsers that support it (such as Chrome and Edge), we load Google’s sign-in script from accounts.google.com so that a browser already signed in to Google can offer one-step sign-in; it is loaded only while you are signed out and the sign-in form is shown. Loading it sends Google your IP address, browser data and your Google cookies, so Google can tell that this Google account visited our sign-in page even if you do not continue; Google processes this under its privacy terms. Only if you choose to continue do we receive Google’s sign-in token; we use only the verified email address in it and do not store your Google name or profile photo.
The website also uses a non-HttpOnly functional cookie (wt.ui.locale) to remember the interface language you choose and keep it consistent across pages. A second cookie of the same kind (wt.ref) records an invitation code when you arrive through a friend’s invite link, so the referral reward can be issued, and is kept for 30 days. Neither carries account data, and you can clear both in your browser at any time.
If you join the desktop or mobile app waitlist, we keep the email you entered (or your sign-in email), the platforms you chose, where you signed up (including the file error type at the time), the linked account, and when you signed up, only to tell you when the app is out, not for other marketing. It is deleted when you close your account, and you can ask us to delete it at any time.
If you tap “Wish this site were supported” in the browser extension, we record only the site’s registrable domain (for example example.com — not the full address, page title or video), the state the extension showed, the channel, the extension version, the interface language and the time. When you are signed in it is linked to your account; when you are not, to a random number used only for this feature (never linked to an account or to free-credit checks). The source IP used for rate limiting is kept only as a digest for about a day. We use these records only to decide which sites to support first and, once a site is supported, to send signed-in users one in-app message and one e-mail; every such e-mail has a one-click unsubscribe. Signed-out records are deleted after 180 days, records 30 days after the notice is sent, unnotified records after at most 365 days, and records for a site marked as not supported after 90 days; closing your account deletes your records, the unsubscribe preference and the “site supported” in-app messages.
Videos & subtitles
Local video files stay on your device. When no original subtitles are available, the service uploads audio segments as needed to generate subtitles; when subtitles exist, only the tracks that need translation are uploaded. Audio or subtitle data is sent to the recognition and translation providers configured for the service (OpenRouter, Alibaba Cloud Bailian). Bailian backup speech recognition processes uploaded audio segments in Singapore; Bailian translation processes subtitle text in Beijing. Please only use content you are authorized to access and process.
To understand which videos people translate, the service stores each translated video together with its source: on YouTube, X, Bilibili and similar sites, the site’s video identifier (for YouTube, also its public title); when you click Translate on another website, that page’s URL (cleaned as described under Failure reports) and the page title. These records stay on our servers, are visible only to authorized operators, and are used for operational investigation, product analysis and deciding where to promote the product; they are not shown to other accounts or used for advertising. They are kept long-term with that video’s subtitle records and can be linked to the account that requested the translation through its translation records.
When a video plays on a site you have allowed the extension to access, the extension briefly keeps the last few minutes of its sound in browser memory (never uploaded, never written to disk, cleared when the page closes). Only after you click Translate are speech segments taken from it and uploaded to be transcribed into subtitles. For accounts with the YouTube backup audio feature turned on (off by default and turned on from our servers, usually per account and possibly for everyone while YouTube's usual audio path is failing), the extension does the same on YouTube pages: before you click Translate it only keeps the last few minutes of the player's already-buffered sound in browser memory and uploads nothing; after you click Translate it decodes and uploads only the segments that are needed. The extension does not download, save or export video or audio files.
Some sites protect their videos with standard AES-128 encryption. To translate these videos, the extension reads the decryption key the site provides, inside your browser, decrypts the audio, and then handles it as described above. The key stays only temporarily in browser memory; it is never uploaded or written to disk.
Temporary audio uploads are normally deleted after the task finishes, and cleaned up after service recovery if interrupted. When speech recognition has a structural anomaly, delivers a degraded result, fails with both providers, or the two providers disagree on review, we may keep the already uploaded WAV audio window as a private diagnostic sample. Abnormal and risk samples among these diagnostic samples are kept for up to 90 days; while the service runs, expired files are cleaned up hourly, and samples may be deleted sooner when the storage cap is reached. They are used only for operational investigation and quality evaluation and improvement. To evaluate recognition quality, the service also keeps a small daily sample of audio from normally completed windows; these daily normal samples are kept for no more than 24 hours and, like the abnormal samples above, are used only for quality evaluation and improvement. Accounts that already had speech recognition processing records when this rule took effect remain subject to this small daily normal-sampling policy. Windows after the first cumulative 20-minute retention range also follow this daily normal-sampling policy.
For accounts using speech recognition for the first time, including existing accounts with no speech recognition processing history in the available service records when this rule takes effect, we attempt to retain diagnostic audio from their first cumulative 20 minutes accepted into speech recognition processing, including failed attempts and attempts with no speech, across days and videos. This measures audio duration, including lead-in, rather than watching time, time since registration, or credits. We use only audio already received for the existing recognition request and do not record additional audio. These samples are kept privately for up to 14 days from their first capture; authorized staff use them for operational investigation and quality evaluation and improvement. Limited diagnostic storage gives priority to first-time recognition samples. Retention is best-effort: storage limits or write failures can mean some eligible audio is not saved. When this diagnostic pool is full, we skip new saves and keep existing samples until their expiry. Retries do not extend retention.
All diagnostic audio samples are private, are not used as subtitle cache, and are not made available to other users. Subtitle results are stored as task records and kept for reuse with no expiry. Subtitles for the same video, segment, and language pair can be reused free of charge at any time, including across accounts; the service never assigns subtitle ownership to a single account. Because subtitles are stored per video and language and shared with other accounts, subtitles already generated for a video cannot be deleted for one account alone; see Your choices for querying, correcting, or deleting your account data. We do not show your email, credits, or payment records to other accounts.
Once a public YouTube video has been fully translated and manually confirmed, up to its first 30 bilingual subtitle lines may be shown on a public subtitle page at watchtranslate.com/share so visitors can see what the subtitles contain. The page shows only the video title, languages and these lines — never who processed the video, when, or any account details. Rights holders or the video's creator can ask for removal at [email protected], and we will block every public page for that video.
App (phone and computer)
Account: The app uses the same account as the website, with email-code or Google sign-in; iOS also supports native Sign in with Apple. The Apple identifier, email (including private relay addresses), and revocation credential handling are described under Account & login. The app keeps its sign-in credential in secure system storage; website login cookies are not handed to the app. Web sign-in and the App’s native Apple/Google sign-in both update the account security record with the IP address and the approximate country, region and city supplied by Cloudflare; nothing is updated when a trusted IP or country is missing.
Video, audio and subtitles: Local video files stay on your device. When recognition is needed, the app uploads short audio windows for the requested segments (usually about 30 seconds, for progressive or ahead-of-playback translation), never the picture. Audio processing, diagnostic-sampling purposes and the 90-day/24-hour/14-day retention rules are described under Videos & subtitles. Recognized speech and translated subtitles are stored as task records for ongoing reuse. Task and usage records can be linked to the requesting account; cross-account subtitle sharing does not make those records anonymous.
Video identifiers: To match reusable subtitles, the app sends a stable digest calculated from file/media content, or from a normalized page address and video duration. These translation requests do not directly send a file name, original page URL or video title; the full local browsing history and favorites are not uploaded. A stable digest is not anonymity: a known page address and duration can reproduce the identifier, and the server links requested-video identifiers to tasks, accounts and usage records.
Usage, performance and error diagnostics: Release builds send feature-use events and technical performance measurements, including app opens and sign-in results, translation starts and first-subtitle latency, viewing and subtitle-wait/buffering time, seek recovery time, control taps, update notices and installation results. Custom error diagnostics contain only an error type and deduplication fingerprint, not the original error message, stack or page content. Events carry the OS type and version, device type (phone, tablet or computer), system language, app version, install channel and install method (store or portable package), whether the computer version detected a system proxy, an installation identifier randomly generated at first launch (it changes when you reinstall or clear app data; it is not an advertising identifier and no hardware identifier is read), and a temporary translation-attempt identifier. When you open a video we record how it was opened (for example file picker, drag-and-drop, library) and the container format category (such as MKV or MP4); when you open a local file, the app also works out on your device a coarse category from the file name (for example episode, movie, anime, course, screen recording, downloaded web video or code-style name such as ABC-123) and which writing system the name uses (for example Latin letters, Chinese characters or kana), and sends only these categories, never the file name; when playback fails we record the failure stage and error category. The server also records the IP address that sent the request (cleared after 30 days) and the country supplied by Cloudflare. Signed-in events are linked to the account for product-use analysis, feature-effectiveness evaluation and reliability investigation, and should not be considered anonymous. Events contain no URLs, file names, video titles or subtitle text, and no advertising identifier. App events are kept for up to 180 days. Apple or Google may provide native crash reports according to your system settings; those are separate from these custom error events. On the next launch, the computer version looks at crash reports the system left for this app (macOS diagnostic reports, Windows Error Reporting) and sends only the crash category (exception type and the category of the faulting module, such as the playback component or a system library), the app version that crashed and how long it had been running; the report itself is not uploaded.
Payments & operational records
Website payments are handled by Stripe and iOS in-app payments by Apple; we never receive or store full card numbers. We keep the payment identifiers, order status, credit batches, and usage records linked to your account to provide subscriptions, reconciliation, and entitlement adjustments after refunds. Operational logs record request types, task status, and limited diagnostics, and should not contain login credentials or raw payment keys. Necessary translation-request diagnostics record the currently authenticated account, loaded code version, current extension version, package distribution channel, and its own installation method to investigate old-client and free-reuse issues. These client reports are not signed proof. Package channel is not first-touch acquisition, and normal CRX installation alone does not prove installation from the Store. Turning off extension usage statistics stops feature-use analytics events, but does not stop these necessary request diagnostics. These diagnostics add no device identifier, IP, raw user agent, audio, subtitle text, or login credentials.
For iOS subscriptions, we process Apple-verified product, transaction and renewal/refund states and retain those facts with their necessary account binding to deliver allowance, restore purchases, reconcile billing and prevent claims by a different account. Necessary transaction identifiers and non-transferable bindings remain after account deletion as described under Your choices. We do not receive full card numbers or bank-account details handled by Apple.
Referrals, reliability & usage analytics
To understand which websites visitors come from, whether the product is stable, and whether the subtitle features are actually used, we record the referring domain, plus the external referrer URL actually supplied by the browser on public-page visits (which may include a path and selected content identifiers and campaign parameters, with credentials, fragments, search terms and other query parameters removed) and the visitor IP address, a randomly generated device identifier that you can reset, limited error diagnostics (error type and a deduplication fingerprint, with no page content), coarse media technical diagnostics (declared local file format and size bucket, duration and resolution category, plus audio codec category, sample-rate category and channel count when a local track is parsed; when MP4 audio configuration cannot be read, limited categories for the selected audio entry, configuration state and index layout; when MP4 audio index validation fails, limited categories for the index layout and failure reason), an aggregated estimate of caption-available playback time (forward playback seconds only, counted after a translated subtitle window is ready; excludes paused, background, and seek playback), and clicks on core controls as a fixed action enum (for example start/stop translation, changing language or subtitle source, changing display mode, export). This data is used only for referral, reliability, and product-usage analysis; when you are signed in, the server associates these statistics with your account so your own account page and operators can see usage. Referrer URL and visitor IP details are retained for 30 days and available only in the operator dashboard. Other analytics and diagnostic events sent by the website, the Local Player and the browser extension also record the IP address that sent the request, likewise cleared after 30 days. If you click to download the App on our website (the Android APK, the App Store link or an App button on a page), or open the download page by scanning its QR code, and then sign up in the App, at sign-up we match the network used by the App sign-in (the same IPv4 address, or the same first 64 bits of an IPv6 address) with the one browser device on that network that did so within the previous 48 hours, and record that device’s earliest recorded referring website or campaign label as the account’s sign-up source, marked as inferred (for a QR-code download, it may follow to the one other visiting device on the same network). When the match is not unique, nothing is recorded. We keep the resulting source and the matched browser device identifiers (at most two for a QR-code download: the scanning phone and the computer showing the code), so the operator dashboard can show those devices’ website visits (for example pages viewed, including the pricing page, and buttons clicked) with the account; we do not keep the IP pairing used to find it. Browsers may provide only the origin; removed paths cannot be recovered. Expired details are hidden immediately and deleted at the next cleanup; backups may retain prior copies under their lifecycle. When you open a local file in the Local Player, the player works out on your device a coarse category from the file name (for example episode, movie, anime, course, screen recording, downloaded web video or code-style name such as ABC-123) and which writing system the name uses (for example Latin letters, Chinese characters or kana), and sends only these categories, never the file name. Apart from the generic web-page translation page URL described under Failure reports, these analytics events do not contain the currently playing video URL, titles, file names, media identifiers, or subtitle text; the referrer itself may point to an external video page. This data is not shown to other accounts and is not used for advertising, account authorization, or billing.
Viewing measurement retention
New versions also record a random identifier for each viewing attempt, host and subtitle-source categories, same-page time to the first subtitle, and aggregate seconds for foreground translated viewing, missing subtitles, confirmed no-content intervals, and media waiting. Presentation confirmation means a browser rendering opportunity, not proof of human attention or understanding. Viewing and click events, including first-subtitle events from the new protocol, are kept for at most 31 days; legacy first-subtitle and other analytics events are kept for at most 180 days.
Page traffic analytics
When you visit a public page, we also record a category from a fixed list of page routes to count page views and distinct devices. Language variants share one route; share links use a route template. We do not record the full page URL, query string, or dynamic share identifier for this purpose.
On public marketing pages only, you may choose to allow Google Analytics 4. If you allow it, Google receives a fixed page route, an optional referring website origin and safe campaign tags, plus the browser and cookie data needed for its visitor statistics. Google also uses your IP address at collection time to derive approximate location, then discards the IP before logging it in its data centers or servers. We do not send video, account, checkout, share-page, file or subtitle content to Google Analytics, and advertising features are disabled. The Google tag is not loaded before you allow it. Your choice is saved in this browser; you can change it here. Google processes this data under its privacy terms.
The same prompt also asks whether to allow Microsoft Clarity. If you allow it, Clarity records the page address and referring address, the page structure, and your mouse movement, clicks and scrolling on those public pages only, so we can replay and summarize how visitors use the site; our own public page copy is recorded as shown, while anything you type, the email in the account button, and on the pricing page the plan status, “current plan” and “used up” marks and unfinished-order notices in the plan cards, payment messages and dialogs are masked before upload. Clarity sets its own cookies (such as _clck and _clsk) with random visitor and session identifiers to link the pages of one visitor; we do not send our account, email or the site’s device identifier to Clarity. A visit is not recorded when the page address carries parameters other than campaign tags; it is recorded only when the referring address is empty, the home address of an external site, or one of the public pages above without parameters. This data is not shared with Microsoft Advertising. Microsoft keeps recordings for 30 days, then a sampled share for up to 9 months; aggregated heatmap data is kept for up to 9 months. The Clarity script is not loaded before you allow it, and you can change your choice through the same link above. Microsoft processes this data under its privacy statement.
Failure reports
Service-quality data: the waiting time for the first subtitle after translation starts, seconds spent waiting for subtitles or without subtitles during playback, failure stages and error codes, and client version. Used to ensure translation service quality and not controlled by the Usage stats toggle; contains no URLs, video titles or subtitle text.
To troubleshoot problems you run into, the browser extension and the app send a failure report when an operation fails (for example signing in, choosing a file, fetching subtitles, reading audio, the extension's internal messaging, or uploading or waiting for a subtitle task — including failures the service later recovered from). A report says which step failed, the error category and code, the HTTP status, elapsed time and retry count, the site category (YouTube, X, Bilibili, or other websites), the client version and install channel, the browser category, and the random ID of that viewing. When you use generic web-page translation on other websites, so that we can open the page that failed, failure reports and the result record of each Translate click also contain that page URL (without the part after # unless it is a page route starting with #/, and without query parameters whose names look like tokens, signatures, sessions, passwords, codes, emails or phone numbers) and the site’s registrable domain; a failure while preparing the video also records the host name serving the media file. These page URLs are kept with their records for up to 180 days, not the 31 days stated below. Apart from that, a report does not contain page URLs, video URLs or identifiers, titles, file names, subtitle text, audio, or raw error messages. When you are signed in it is linked to your account; only authorized operators can see it, it is used only to find and fix problems, and it is kept for 31 days. Failure reports are sent only when something goes wrong and are not controlled by the Usage stats switch; if you do not want them sent, you can uninstall the extension or the app.
Your choices
You can stop translating, sign out, uninstall the extension or the app, or cancel renewal from subscription management.
You can delete your account from the account page (or in the app under Settings → Account → Delete account). Deletion takes effect immediately: the account is deactivated and every device is signed out. An active Stripe subscription must be cancelled first. An Apple subscription does not block deletion, but deleting your account does not cancel Apple automatic renewal; cancel it separately in Apple subscription management, and remaining credits are forfeited and not refunded. After deletion we keep your sign-in email for 90 days, used only to investigate abuse such as repeated sign-ups for free credits; then we remove it and keep only a one-way digest of it, so that signing up again with the same email does not receive free credits again. Orders and payment records, credit history, usage statistics and diagnostics remain under the account number for accounting, legal obligations and product analysis, no longer linked to your email after those 90 days. Subtitles are shared per video and are not deleted with the account. Your “Wish this site were supported” records, the unsubscribe preference and the “site supported” in-app messages are deleted with the account. Necessary Apple transaction identifiers and their non-transferable account binding remain after deletion for accounting and to prevent restoration to another account. Our payment processors, Stripe and Apple, keep the email used for payment as their own legal obligations require, and records of sign-in code requests (email and IP), kept to prevent abuse, are deleted automatically after 35 days.
To query or correct your account data, contact [email protected]; to verify your request we may need to confirm the account email.