Lullula reads a page's content to decide whether to show its reading player there, and when you play, summarize or save it.

• Free voices: Firefox's free voices use bundled Piper and Matcha engines to generate speech on your device. The first Play, Preview or explicit model load downloads the selected voice's model data (about 28–78 MB per Piper voice or 130 MB for bilingual Matcha) from Hugging Face (huggingface.co and its model-file CDN), then caches them for offline use. Hugging Face receives the selected public model's name and ordinary connection metadata, including your IP address and browser details. No reading text, page URL, account token or generated audio is sent with the model download. Speech text is not sent to Hugging Face or Lullula for this local synthesis. If you are signed in, the limited reading-history and resume data described below is still synced; language detection, summaries and Listen later also follow the data flows below whichever voice reads.

• Reading history: when you are signed in and start playback, the page or document title, address (URL), favicon when available, content type, playback progress and duration, reading position, and a short text excerpt (up to 80 characters) around that position are sent to the Lullula service. They are stored with your account so history and resume position can sync across devices. This applies to free and premium voices.

• Premium voices (with or without an account; without one, from a one-time free trial): the text to be spoken is sent over HTTPS to the Lullula service and its speech provider solely to generate the audio, then returned to you. The first sentence is sent as soon as you point at the player, so playback can start at once.

• AI summaries (with or without an account): extension 1.9.0 and later send the page's text over HTTPS to the Lullula service, and on to the AI services named in the full policy (Anthropic first; DeepSeek, Alibaba Cloud or OpenAI only when the one before cannot answer), only when you click Summarize, Regenerate, Try again after an error, or, in versions that have it, More detail. Opening, previewing or reopening the panel alone sends nothing for a summary. Show Summary in General settings shows or hides the panel; hiding it does not cancel a request already made. Versions up to 1.8.2 generate summaries automatically when the player appears unless you turn summaries off, until the installation updates.

• Page analysis: to pick a voice and find the article, the extension may send up to 500 characters of a page to detect its language when the browser cannot, and an outline of the page's structure. Formulas on a web page are sent to be put into words.

• Scanned PDFs and equations: pages are recognised in your browser first, with a recognition model downloaded once from lullula.io. A page that cannot be read reliably there is sent as an image to the Lullula service and its text-recognition provider. When you are signed in, an equation in a PDF may be sent as an image for recognition.

• Figures in PDFs: when you are signed in and "Describe figures with AI" is on (Playback settings; on by default), an image of each figure — or of its page, when it cannot tell where the figure is — is sent with its caption, at most one sentence that mentions it and your reading language to the Lullula service, which has Anthropic's Claude describe it in the United States. It is sent a little ahead of the reading, up to 5 sentences before the figure's caption, so a figure you stop just before can still be sent. Nothing is sent when you are signed out or the setting is off.

• Images you choose to read (optional, when available): when you use Read image aloud or choose, paste or drop an image in Read an image, your device redraws it as a smaller JPEG, removing photo metadata such as location. It sends that JPEG, the browser's UI language and your account token or trial identifier to the Lullula service; Anthropic's Claude in the United States reads its text and describes figures. The image-reading endpoint keeps neither the image nor the answer. An unsaved image read keeps no reading history or resume position. Reading the result with premium speech or asking for a summary follows the normal speech and summary retention in the full policy. Save (requires sign-in and library storage) uploads the prepared images to private AWS storage and stores their read text, title, language and figure positions with your library item until you delete it or your account. Images already uploaded by a save that does not finish normally expire within 25 hours; cleanup can be delayed or retried. A web image is normally fetched from its own site with that site's cookies; from a private window, Firefox container or excluded image host it is fetched without cookies or the HTTP cache. Images are sent through this feature only when it is available to you and you choose to use it.

• Listen later (optional, requires sign-in): when you press Listen later, the page's title, its address (http/https only) and the text Lullula reads aloud are sent over HTTPS to the Lullula service and stored with your account until you delete the item or your account, so you can play it later on your signed-in devices. On a premium plan the text is also turned into audio ahead of time by our speech provider and the audio is stored with the item; on the free plan nothing is rendered, and your devices read the text with their own speech engine. While you are signed in, the address of each page where the Lullula player appears is also sent to the Lullula service to show whether that page is already saved; this lookup is not stored with your account.

• Page subscriptions (optional, requires sign-in): when you click Subscribe to page updates in the toolbar menu, the current page's address (without its in-page anchor or tracking parameters) is sent over HTTPS to the Lullula service and stored with your account. The service then checks that public page, or the site's RSS/Atom feed, daily by default, from its own servers and without your cookies, and keeps the public text it finds so it can show you new articles and changes. Lullula never offers this on private-network, sign-in or banking pages, on sites you turned it off on, on shared documents (Google Docs and Drive, SharePoint, OneDrive, Dropbox, Box, iCloud), or for addresses that carry a sign-in code or key. To stop following a page, write to support@lullula.io or use the Lullula web app's Subscriptions page where it is available. This option appears only once Lullula turns page subscriptions on.

• Your own voice provider (optional): if you connect ElevenLabs, an OpenAI-compatible endpoint, Azure Speech, Google Cloud TTS, Amazon Polly or Alibaba Cloud Qwen-TTS with your own API key, the text you play with that provider's voices is sent from your browser straight to that provider under its terms. The key is stored only in your browser and is never sent to Lullula, and the requests for those voices' audio do not pass through Lullula. Summaries and reading history work as described above whichever voice reads.

• Product events: the extension sends a few first-party product events (an install confirmation; whether a reading played for ten seconds, how long, and how it ended; whether the page shown after install offered any of your open tabs and whether you picked one; for each reading, the time from pressing Play to the first sound, where Play was started, the kind of voice and, from a fixed list, why it ended or was turned down; which choice you made on the trial-ended banner; and the first time the player and the toolbar menu appeared), keyed to random identifiers and never carrying a page address, title, text or email. The titles and addresses of the open tabs that page offers are read on your device only (a tab you pick is then read like any other page). Verified trial/install records can link these identifiers to your account. The full list is in the privacy policy. In version 2.3.1 and later, playback_requested and playback_audio_started report a reading request and its first engine-start signal immediately, without waiting for the reading to close; playback_voice_selected reports up to sixteen distinct voice contexts per reading. Bounded playbackContext fields include engine/adapter, technical voice and model IDs and provenance, content/declared/detected/requested/voice language tags, voice-language compatibility, locally derived script-presence and prepared-text length buckets, and requested rate/pitch/volume. Native voice display labels are replaced by locally derived identifiers. These reports exclude raw reading text, audio, page URL/title, personal display labels, provider keys/endpoints and account/resource configuration. Pending playback reports use a bounded 500-report local outbox with retries for up to 24 hours; browser exit or uninstall may still prevent delivery. These fields help diagnose playback quality and language matching; they do not measure acoustic quality or prove that the spoken language is correct.

• Observed uninstall feedback: where the browser supports it, uninstalling the extension may open https://lullula.io/uninstalled. That first-party page records the existing random install identifier, but no reading content or email. If you choose to answer its optional survey, the page sends a reason from a fixed list and, only if you type one, your comment (up to 2,000 characters). The comment is kept with our feedback records without the install identifier and deleted within 90 days; we do not link it to your installation or account, although its timing and details could match them. Please do not include your name, email address or health details in it. The identifier is in a URL fragment removed before other resources load, and the page has no third-party analytics. The page may not open on every uninstall; this is not a complete uninstall count. An installation/trial can be connected to a signed-in account.

• Optional player design measurement (only in experiment-capable releases): off by default, separately from website cookie consent. A focused install/update screen offers allow/off choices, and General settings keeps the control. After explicit consent, first-party events to api.lullula.io carry random installation/exposure/event/attempt/reading/session identifiers, optional existing install/trial identifiers, client/browser/store/cohort/document/mode fields and bounded player/start/listening/summary/save/recovery outcomes. They contain no page address, title, text, selection, summary, audio, provider key, auth token, email, location or free-form error. Verified trial/install records may link them to an account; they are not described as anonymous. Validated JSON configuration selects bundled code only. Turning measurement off clears the local 500-event/48-hour queue and stops new measurement; reading and ordinary product events continue. It cannot recall a dispatched request or delete received reports. Experiment events/conflicts are retained for 90 days after receipt; verified account deletion removes linked units, with hashed tombstones preventing delayed recreation, while unlinked records expire by retention. A reading that crosses opt-out remains unmeasured after re-enable. Current production capability and public enrollment remain disabled; preparing or pasting this disclosure does not enable measurement.

• Account: if you sign in, an authentication token is stored locally to access your account and premium voices. Your voice pick for each language and your blocked sites follow your account; other settings (speed, volume, theme, highlighting, summaries) stay in the browser's own extension storage, which Firefox Sync carries if you use it.

• Lullula does not sell your data. It stores reading history only for content you choose to play, and library items only for content you choose to save; summary requests and page analysis work as described above. It does not monitor unrelated pages or build a general browsing profile. Known banking, payment and sign-in sites are excluded, the player stays off video and live-stream sites, and you can block any site.

• No page screenshots: Lullula does not capture images of the pages you visit. In Firefox, versions 1.0.0 to 1.7.1 could, for signed-in users; that stopped on 27 September 2026, and the privacy policy describes what they did.

Contact: support@lullula.io. Full policy: https://lullula.io/privacy