Privacy for iPhone

What stays on your device, and what doesn’t.

Last updated November 5, 2026

This notice covers the Renarrator app for iPhone and the account service it uses. Renarrator is published by Nathan Brown. For privacy questions or a request about your records, email support@renarrator.com.

Renarrator has no advertising, no third-party analytics and no tracking across apps or websites. We don’t sell your data. Websites you open in the app have their own practices, described below.

What the app and account service collect

Apple voices work without an account. The records below exist only if you sign in or link a purchase, except where noted.

• Email digest. When you ask for a sign-in code, your email address goes to our server and to our email delivery service, which sends the code. Our database then keeps a keyed digest (HMAC-SHA-256) of the address, not the address itself. The digest is a lasting account identifier, so it isn’t anonymous.
• Account ID and session. A random account ID, a digest of your session token, and when that session expires.
• App Store transaction link. When you are signed in, the app sends Apple’s signed record of your Lifetime purchase. We verify it and store its original transaction ID, product ID, app ID, whether it was a live or test purchase, when it was linked, and whether it was revoked. Apple also notifies us when a purchase is refunded or revoked, and we record that even if the purchase was never linked to an account.
• Free-minute metering. Your free AI voice minutes are counted on the server. Each request carries an allowance ID and a listening duration. We don’t receive the video’s title or address, its captions, or any audio.
• Sign-in protection. A digest of each sign-in code with its attempt count, and rate-limit counters keyed by digests of your email and network address.
• Request logs. The account service logs each request’s method, route and response status. Those logs don’t record email addresses, session tokens, captions or audio.
• Other Renarrator licenses. If your account already holds a license bought outside the App Store, we also keep the link between your account and a digest of that license key.

We don’t receive your payment-card details, browsing or search history, bookmarks, captions, generated speech or provider API keys. The app sends us no advertising or device identifier.

What stays on your device

• History and bookmarks. Up to 200 recent pages, your bookmarks and your Quick start sites are stored in the app. Private tabs don’t keep history or website data.
• Website data. Cookies and site storage set by the websites you visit are stored in the app’s web view.
• Captions and translations. Caption text is read from the page and processed on your device. It leaves only if you choose a cloud voice and allow it, as described below.
• Generated speech. Narration made by on-device voices is held in memory. Short voice previews are saved in the app’s storage so they play faster next time.
• Diagnostics. The app keeps its newest 300 playback events in memory. They hold timing and status details, not captions, audio, titles or addresses, and they are never sent anywhere automatically.
• Your settings and credentials. Your preferences, your account email and session, and any provider keys you add are stored on the device. Your session and provider keys are kept in the iOS Keychain.

Deleting the app removes its stored data. iOS can keep Keychain items after an app is deleted, so remove provider keys in Settings and sign out first if you want those gone too.

Websites you visit

The app opens the pages you choose using Apple’s WebKit, much as a browser does. Those sites receive your network address and whatever else a visit normally shares, under their own policies. Searches from the address bar go to the search provider you pick in Settings.

To narrate a video, the app runs its scripts on the web pages you open, including frames inside them. The scripts find the video and its captions, read the page’s address and title, and follow the video’s playback. They don’t read form fields, so they don’t read what you type into a password box. They skip a listed set of sign-in and payment hosts, such as Google, Apple and Microsoft account pages, PayPal and Stripe. That list can’t cover every site, so the scripts do run on other sign-in pages, such as a bank’s or a website’s own login page.

The app doesn’t use the camera or microphone itself, and it refuses a website’s request for live camera or microphone access. A website can ask to use the camera or microphone only through a file upload you choose: if its upload button offers to take a photo or video, iOS opens the camera, and may ask your permission first. The file goes to that website, not to us.

Apple’s translation and voices

Translation uses Apple’s Translation framework, and Apple voices use the speech system built into iOS. Both run on your device, and iOS may download language files or voices from Apple when you ask for them. Renarrator doesn’t receive that text or audio. Apple’s privacy policy applies to its services.

The AI voice download

English AI voices run on your device after an optional 332 MB download, which starts only when you ask for it. The files come from huggingface.co, run by Hugging Face. Your device connects directly to that host, so it receives your device’s IP address and ordinary request details. It doesn’t receive your account details or captions. Hugging Face’s privacy policy applies to that connection.

Optional cloud voices

Cloud voices are off by default. They need your own API key for OpenAI, ElevenLabs or Google Cloud Text-to-Speech. The app asks your permission, one provider at a time, before sending caption text to that provider, and sends none unless you allow it.

When you use one, your device connects directly to the provider, not through Renarrator. It sends the caption or translated text of the video being narrated, any short preview sentence you play, your API key, the voice and speed you chose, and your IP address. Google also receives the app’s bundle ID. Loading a provider’s voice list sends only your API key and IP address. The provider handles that data under its own terms and your account with it: OpenAI, ElevenLabs, Google. Remove the key in Settings to stop sending text to that provider and withdraw your permission.

Companies that process data for us

• Cloudflare hosts this website, the account service and its database, handles network addresses for hosting and rate limiting, and forwards email sent to our support address.
• Resend delivers sign-in codes, so it receives your email address and the code.
• Apple handles App Store payments and tells us about refunds and revocations. Apple doesn’t share your card details with us.
• Lemon Squeezy sold any license you bought outside the App Store, and our server checks that license with it.
• Google hosts the Gmail inbox that receives support email. Support messages contain the address and details you choose to send.

How long we keep it

• Sign-in codes expire after 10 minutes and sessions after 30 days. Rate-limit counters expire within 2 hours. Expired records are removed during later sign-in-code requests.
• Your email digest, account ID, metering records and purchase links stay until your account is deleted. Reinstalling the app doesn’t remove them.
• A spent free-minute record left by deleting an account lasts up to 12 months, or until that address signs in again.
• App Store transaction records and license records have no set end date, for the reasons under Delete your account.
• Request logs hold only the method, route and response status, with retention governed by our hosting provider’s policy.
• Database backups at our hosting provider allow recovery for up to 30 days, so a deleted record can remain there until that window passes.
• Sign-in email records at our email delivery service are kept under that service’s policy.
• Support email is kept as long as needed to resolve and follow up on your request. You can ask us to delete it.

Delete your account

Go to Settings → Account → Delete Account in the app, choose Email Me a Code, enter the code, then choose Delete Account Permanently. Deletion is complete as soon as the app confirms it. Database backups age out separately, as listed above. If you can’t sign in, email support@renarrator.com from your account address.

Deletion removes your email digest, account ID, sessions, any pending sign-in code, the sign-in email counter for your address, your free-minute records and the links between your account and your purchases or licenses. These things remain:

• Your App Store purchase. It belongs to your Apple Account, and you can restore it in the app without a Renarrator account. Deleting your account doesn’t refund it. Apple keeps its own purchase records.
• A purchase record without your account. We keep Apple’s transaction ID, the product, app and environment, and whether the purchase was revoked, with the link to your account cleared. This keeps a refunded purchase revoked if it is later restored to another account.
• License records that name no account. If you bought a license outside the App Store, we keep its key digest, device activations, status and any older credit balances or subscription IDs. It keeps working on your computers, but it no longer unlocks voices in this app unless you link it again.
• A record of free minutes you spent. If you used any, we keep an HMAC of your email digest and the seconds spent, for up to 12 months or until that address signs in again. At that point the seconds move to the new account and the record is removed, so you get back what you had left. Without it, deleting an account would refill its free minutes. Matching it requires both our secret key and your address.
• Rate-limit counters. Digests of network addresses, not tied to your account, which expire within 2 hours.
• Anything on your device. History, bookmarks, website data, downloaded voices and provider keys stay until you remove them or the app.
• Records held elsewhere. Support email until you ask us to delete it, request logs and database backups until they expire as listed above, the delivery records our email service keeps of your sign-in emails, including your address, and whatever your cloud voice provider, Apple, Lemon Squeezy or a website you visited holds under its own policy. Deleting your account can’t reach those.

Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict how it is used, and to complain to your local data protection authority. Email support@renarrator.com from your account address to make a request. We may ask you to confirm that you own the address.

Renarrator isn’t directed at children. If you think a child has created an account, tell us and we will delete it.

Changes to this notice

The date at the top identifies this version. If what we collect changes, we will update this page before the change takes effect.