Privacy policy
WayTutor is a Chrome extension that reads the academic portal material aloud and generates a spoken summary of that material. This page describes which data the service handles, why, for how long, and who it is shared with.
Who is responsible
WayTutor is operated by Márcio Júnior, a Waypoint Labs project. The contact for anything in this policy, including deletion requests, is privacidade@marcio.run.
What we handle
| Data | Why |
|---|---|
| Google account identifier, email, name and profile picture URL | To identify who is using the service and to grant access. The picture is not displayed anywhere today. |
| Text of the material passages, while reading | To generate the audio and the summary. It is the content the extension sent from the page you had open. |
| Generated audio | To play it back and to reuse it when someone else reads the same passage. |
| Usage counters: characters synthesised and summaries per month | To apply the monthly limit and to estimate the cost of the service. |
| Access log: session creation and last use, browser identifier | To keep the login for up to 7 days and to allow revoking access. |
The material text is not stored as text. What remains is the audio generated from it and the counters. Your Google password never reaches us: the login happens at Google.
What we store in your browser
The extension stores in Chrome local storage the access token, your preferences (voice, speed and figure pause) and the reading position of each material. We use no cookies, we do not track browsing, and we do not read pages outside the portal addresses.
Who we share with
- Google, to authenticate your account and to turn text into speech.
- Vercel AI Gateway, which forwards the text to the model providers we use: Google for speech, OpenAI for the summary. Those providers process the text to return the audio or the summary.
- Cloudflare, which stores the audio files.
- Fly.io, which hosts the server, and Neon, which hosts the database.
We do not sell data, we do not use your data for advertising, and we do not share it with third parties for their own purposes. Use of data obtained through Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
Transfer outside Brazil
The providers above process data in other countries, mainly the United States. The transfer happens to deliver the service you asked for, under article 33 of the Brazilian LGPD.
How long we keep it
- Account and counters: for as long as the account exists.
- Access session: 7 days, renewed on each use, ended on logout.
- Login code: 2 minutes, single use.
- Audio: indefinitely. The file is identified by a code computed from the text, the voice and the model, not by account, so the cache does not record who listened to what.
Your rights
You may ask for confirmation of processing, access, correction, anonymisation, portability, deletion and withdrawal of consent. Write to privacidade@marcio.run. We answer within 15 days. Deleting the account removes access, sessions and counters; audio already generated stays in the cache, because it cannot be linked to a person.
Security
All traffic uses HTTPS. The access token is stored on the server only as a hash, and each account is released manually. Access can be paused or revoked at any time.
Children and teenagers
The service targets higher-education students and is not directed at people under 18.
Changes to this policy
If the data handling changes, this page is updated and the date at the top changes with it.