Privacy Policy

Last updated: 20 October 2026

1. Who we are

EarMark (earmark-app.com) is a personal podcast service: it converts web articles, PDFs, and text you choose into spoken audio, delivered to a private podcast feed and to the EarMark apps. The service is operated by Earmark Ltd, a private company limited by shares, incorporated in England and Wales under the Companies Act 2006 (company number 17269833), with its registered office at Unit 4, Block E Holyrood Close, Poole, BH17 7FP, United Kingdom. In this policy, "EarMark", "we", and "us" refer to Earmark Ltd, which acts as the data controller for the personal data described here. You can reach us using the contact details in section 13.

2. What information we collect

We collect only what the service needs to work:

• Account data. Your name, email address, and password. The password is stored only as a bcrypt hash. We never store or see the plaintext.
• Content you submit. The article URLs you submit, PDFs you upload, text you paste, and audio files you upload. The text or document content of a submission is kept only while the episode is being generated and is deleted from our database as soon as the job completes or fails. The submitted URL, the generated audio, and episode metadata (title, duration, the voice used) are kept so your feed keeps working.
• Usage and cost figures. Per-episode and cumulative processing costs (text-to-speech and text-cleanup spend), used to manage the shared service budget.
• Devices (apps). If you sign in from the iOS or Android app, we store a per-device access token (only as a SHA-256 hash), the platform, an optional device label, and when it was last used. Signing out in the app revokes that device's token, and resetting your password signs every device out.
• Sharing. If you share an episode by public link, we record the link (which episode, a random token, when it was made and when it expires) until it expires or you revoke it. If someone adds a shared episode to their own EarMark, they receive their own copy of that episode and its audio; we do not record who added it.
• Support requests. When you contact support from the Help page, the topic you chose and your message, with the details our support team needs to help: your name, email and account ID, when you signed up, your plan and remaining Premium allowance, the app platform and version you wrote from and, if your request is about an episode, that episode's title, status, source address and voice. The request is stored with your account and emailed to our support inbox, and we reply to you by email.
• Purchases (apps). If you subscribe in the iOS or Android app, the purchase is processed by Apple or Google. We never receive your payment-card details. We keep a record of the purchase (a store transaction reference, the plan, and the amount) and the subscription it entitles you to, including the period it covers and how much of that period's Premium allowance you have used.
• Promotional messages (free tier). On the free tier the EarMark player plays short promotional messages for EarMark's own plans around your episodes. We record each one that plays: which message, around which of your episodes, whether it finished or was skipped, and whether you tapped through to the plans. The messages are the same for everyone on the free tier; which one plays depends only on the episode and how it was read (for example, whether it opened in a Natural voice), never on anything else about you.
• Days of use. For each day on which you use EarMark while signed in, we record that your account was used that day and whether that was on the website, in the iOS app or in the Android app. We record the day only (counted in UTC): not the time, not what you did, and not how often.
• Technical data. When you request an email verification or password reset link we record the requesting IP address and browser user-agent alongside the short-lived token, as an abuse-prevention audit trail. The no-account sample on our landing page records a coarse network identifier for 24 hours to enforce its daily limit. Our servers also produce standard, short-lived operational logs, plus a diagnostic list of web addresses our reader could not turn into audio. For an episode of yours it records the address without its query string and your account identifier, never the article text.

3. How we use your information

We use this data to run EarMark for you: to generate your audio and deliver your personal feed, to keep you signed in, to send transactional email (email verification, password resets, password-change notices), to meter narration in our Premium voices against your allowance, to keep narration within its daily fair-use limit, to prevent abuse of the service, to debug problems and keep the service running, and to count how many people use EarMark each day and each month.

We do not sell your data, we show no third-party advertising, we do not profile you, and we use no third-party analytics or tracking services. The one measurement of use we make is our own: the days-of-use record in section 2, which stays on our servers and is used only to count how many accounts use EarMark each day, week and month. The promotional messages on the free tier are our own, for our own plans; nothing about you is shared to show them, and the record of which ones played is used only to see whether they are worth keeping. The only emails we send are the transactional ones listed above.

4. Legal bases for processing

Where UK or EU data-protection law applies, we rely on the following lawful bases:

• Performance of a contract (Art 6(1)(b)): for everything needed to provide the service you signed up for: your account data, the content you submit, the audio we generate, your devices, and episode sharing.
• Legitimate interests (Art 6(1)(f)): for keeping the service secure and operational and preventing abuse: the IP / user-agent audit trail on verification and reset requests, rate limiting, the landing-page sample limiter, and our short-lived server logs; for running the free tier: the record of which of our own promotional messages played; and for knowing how much EarMark is used, so that we can plan and pay for it: the days-of-use record and the totals counted from it. We also rely on legitimate interests to stop repeated claims of the one-time welcome credit (we keep a one-way hash of your email so the same person can't claim it more than once). We've weighed these interests against your rights and consider them proportionate, and you can object at any time (see section 9).
• Legal obligation (Art 6(1)(c)): for the records of purchases we're required to keep under UK company and tax law.

We don't use your data to target or personalise anything, we share nothing with anyone for marketing, we send no marketing email, and we don't rely on consent for any current processing. If that ever changes, we'll ask for your consent first.

5. Cookies and local storage

EarMark uses two essential cookies. The session cookie keeps you signed in on the web. It is HTTP-only (inaccessible to scripts), marked Secure, restricted to same-site requests, and expires after 30 days. The em_sample cookie is set only if you try the no-account sample on our landing page: it is HTTP-only, lasts one year, pins that one sample to your browser, and carries the secret that lets you claim the sample into your account when you sign up. There are no advertising, analytics, or third-party tracking cookies.

Your browser's local storage holds a few interface preferences (for example, whether you've dismissed the welcome screen, your autoplay setting and your playback speed). These never leave your device. While you are signed in it also holds some of your account's data, so the app can show your episodes offline and resume where you left off: a copy of your episode list (titles and signed links to the audio files), your listening positions and played marks (which are also kept with your account, so they follow you between devices), the episode you last played, and whether your plan includes listening without our promotional messages or offline listening (so the app behaves the same offline). That account data is wiped from the browser when you sign out, when a different account signs in on the same browser, and when you delete your account. The iOS/Android apps store your device access token in the app's private preferences, and episodes you download are stored in the app's private storage on your device. Deleting a download, or the app, removes them. If the app can't reach Sentry (section 6) when an error happens on one of its screens, the error report, which may carry your account's internal identifier, waits in the app's storage until it can be sent; it is deleted unsent when you sign out of the app, when a different account signs in to it, and when you delete your account from it. The apps' own crash reports and launch signals also wait on the device until they can be sent.

6. Service providers and sub-processors

EarMark runs on a small set of service providers, each of which receives only what its job requires:

• OpenAI: receives the extracted text of your submissions to clean it up for narration, or to condense it.
• Inworld: provides our Premium voices; receives the cleaned or condensed text to synthesise into audio when a Premium voice reads an episode.
• DeepInfra: provides our Natural voices; receives the text to synthesise into audio when a Natural voice reads an episode, or the opening minutes of one on the free tier.
• Modal: runs our Basic voices on its servers; receives the text to synthesise into audio when a Basic voice reads an episode.
• Postmark: sends our transactional email, and delivers your support requests to our support inbox; receives your email address and the message content.
• Migadu: a Swiss provider that hosts our support inbox; holds the support requests delivered to it, with the details listed in section 2, and the email you exchange with our support team.
• Apple and Google: process in-app subscription purchases on iOS and Android. Payment happens entirely on the platform; we never see your payment details, only the purchase record described in section 2.
• Hetzner: hosts our servers and storage; all data described in this policy lives on Hetzner infrastructure.
• Cloudflare: sits in front of our servers for security and performance, and therefore processes your traffic (including your IP address) in transit.
• Sentry: receives error reports from our web pages and apps so we can find and fix crashes: the error and the page or screen it happened on (with any links stripped of tokens), your browser or app version, and your account's internal identifier. It never receives your email address, name or IP address. The iOS and Android apps also tell Sentry each time the app is opened, so we can see what share of launches end in a crash: that signal carries the app version, whether that run of the app crashed, and a random identifier for that installation of the app. It carries nothing about your account or what you did in it. Sentry stores these reports and signals in the EU (Frankfurt, Germany) and keeps them for no more than 90 days.
• Jina: when we can't read an article page ourselves, Jina's Reader service fetches it for us, so it receives the address of the page you submitted. It receives nothing else about you.
• Internet Archive: when neither we nor Jina can read the page, we ask the Internet Archive's Wayback Machine for an archived copy, which sends it the page's address. It receives nothing else about you.

7. Where your data is processed

Our servers and storage are in Germany (Hetzner, Nuremberg), inside the UK/EU-adequate area, so hosting itself involves no restricted transfer. Some of our other providers process data in the United States or globally: currently OpenAI, Inworld, DeepInfra, Modal, Postmark, Cloudflare, Google (Play purchase verification), Jina, and the Internet Archive. Where your data is transferred outside the UK, we rely, for each provider, on one of these safeguards:

• the UK extension to the EU–US Data Privacy Framework (the "UK–US data bridge"), where the provider is certified under it; or
• the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, where it isn't.

In each case we've satisfied ourselves, through a transfer risk assessment, that your data will get a level of protection broadly equivalent to that in the UK. You can ask us which mechanism applies to a particular provider using the contact details in section 13.

8. How long we keep your data

• Submitted text and documents: deleted from our database the moment an episode finishes generating (or fails).
• Generated audio: kept while storage allows. When storage fills, the oldest audio files are removed first; your episode history (titles, dates) remains in your feed view.
• Sessions: expire after 30 days; expired sessions are purged hourly.
• Email verification and password reset tokens (with their IP / user-agent records): valid for 48 hours and 30 minutes respectively, single-use, and purged hourly once expired.
• Device tokens: a device's token stops working when you sign out on it, reset your password, or delete your account; a signed-out device stays listed as such (the 20 most recent), and idle tokens are removed after 180 days.
• Landing-page sample records (which address took a sample, and when): kept for 24 hours and removed at the next landing-page sample request after that.
• No-account samples (a sample made on our landing page without an account: its audio, its title, and the web address or file name it was made from): kept for 30 days and then deleted; if storage fills, a sample's audio is removed before any account's episodes. If you sign up in the same browser, the sample moves into your new account's feed and is kept like your other episodes, and a record that it moved (your account's ID and the sample's ID) is kept with the security audit records.
• Purchase and financial records: kept for six years from the end of the financial year they relate to, as required by UK company accounting and tax rules.
• Welcome-credit email hashes: a one-way hash of your normalised email, kept indefinitely as a fraud-prevention measure so the one-time welcome credit can't be claimed repeatedly. It cannot be reversed to your email and, by design, survives account deletion. That is the whole point of it.
• Reader diagnostics (the list of addresses we could not read): the entries for your account are removed when you delete it; the list is otherwise capped in size, its oldest entries dropped first.
• Usage-limit records: the log of narrations counted against the daily fair-use limit (the episode, its length in characters, when it was admitted, whether your plan included it, and how much of it opened in a Natural voice on the free tier), and the log of paid article reads that did not go on to become an episode (the episode, the size of the read and when it happened), whether the read was refused because the page was longer than your plan had left or you deleted its episode while it was being read. Both are kept, as they underpin our cost records, but severed from you when you delete your account: the link to your account is removed, and a severed record counts towards nobody's limit.
• Support requests: the stored request is deleted with your account. The email copy in our support inbox, and our replies, are kept as correspondence for as long as we need them to support you; ask us at [email protected] to delete them.
• Promotional-message records (which of our own messages played around which episode, and whether it finished, was skipped or was tapped): kept for one year and then purged, and deleted at once with your account.
• Days-of-use records (the days on which your account was used, and on which of the website, the iOS app and the Android app): kept for as long as your account exists, and deleted at once with it. So that deleting an account does not change usage figures we have already counted, at the moment of deletion we add one to our running totals for each day, 7-day period, 30-day period and calendar month the account had been counted in. Those totals are plain numbers: they hold no account identifier, name, email address or device, and nothing in them refers to you.
• Security audit records of sign-ins and other account events (your email address, the IP address and browser user-agent, and your account identifier): kept for 365 days and then purged, including after you delete your account, so for up to a year a deleted account's sign-in history stays on record.
• Everything else tied to your account is deleted when you delete the account (see section 9).
• Backups: before every deployment we take a copy of our database and keep it on the same server for disaster recovery. A backup holds the data as it was at that moment, including records you delete afterwards, until the backup itself is removed; we keep each one for a few days and remove old ones by hand.

9. Your rights and choices

You can view and change your account details and voice in Settings. You can delete your account and all associated data yourself, at any time, from Settings → Account → Delete account (in the apps and on the web). Deletion is immediate and removes your account, sessions, devices, episodes, shares, support requests, days-of-use records, and tokens; generated audio files are removed from storage. Section 8 lists the few records that outlive an account, and the anonymous usage totals that do.

Where UK/EU law applies you also have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to complain to your supervisory authority. You can also complain to us directly about how we handle your data, using the contacts in section 13 (we'll acknowledge your complaint within 30 days), before or instead of going to the ICO (ico.org.uk) or your local supervisory authority. For anything you can't do in Settings, including an export of your data, contact us (section 13) and we'll handle it directly.

10. Security

Passwords are stored only as bcrypt hashes. All traffic is encrypted in transit (TLS), and our origin servers accept traffic only via Cloudflare. Access tokens (device tokens, password-reset and email-verification tokens) are stored only as SHA-256 hashes, so a copy of our database does not contain usable credentials. Your podcast feed and audio are protected by per-user tokens, and each app device has its own revocable token. No system is perfectly secure, but EarMark is built to hold as little as possible and to protect what it holds.

11. Children's privacy

EarMark is not directed at children. You must be at least 16 years old to create an account, and we do not knowingly collect data from anyone younger. If you believe a child has created an account, contact us and we will delete it.

12. Changes to this policy

If we change this policy, we'll update the date at the top. For material changes we'll also tell you in the app or by email before the change takes effect. The current version always lives at earmark-app.com/privacy.

13. Contact us

For privacy questions or data requests, email [email protected], or write to Earmark Ltd at the registered office address in section 1.