Privacy Policy

Phrasa is a teleprompter. It stores your scripts so it can scroll them, and as little else as possible. There are no ads or third-party trackers on this site. If limited first-party product analytics are enabled, they record only a short list of product events with a random session identifier — never your scripts, account identity, or microphone audio.

If you create an account, we store your email address, your optional display name, and a securely hashed password. Authentication is handled by Supabase, which also sets the session cookies that keep you signed in.

If you sign in with Google, Google shares your email address and name with us. Separately, if you choose to import a document from Google Drive, your browser asks Google for read-only Drive access at that moment so you can pick the file — we never browse, modify, or store anything else from your Drive.

You can use Phrasa without an account at all — see “Guest mode” below.

• With an account: scripts are stored in our database (hosted by Supabase) and protected by row-level security, so only your account can read them.
• Without an account (guest or local mode):scripts live only in your browser’s localStorage. They never leave your device unless you use an AI feature on them.

You can delete any script at any time from your library. Deleted cloud scripts are removed from the database.

Voice-following uses your browser’s built-in Web Speech API. Your microphone audio is processed by the browser, and depending on the browser it may be sent to that browser vendor’s speech recognition service (for example, Google’s service in Chrome). Phrasa itself never receives, records, stores, or transmits your audio. The recognized words are used in your browser, in the moment, to keep the script aligned with where you are — they are not saved.

When you use an AI feature (AI Script Studio, or AI auto-advance in Outline mode), the text involved — your prompt, script, or outline — is sent to xAI’s Grok API to produce the result. This happens only when you invoke an AI feature; nothing is sent otherwise. xAI processes that text under its own terms and privacy policy.

To keep the AI endpoints from being abused, we apply rate limits keyed on your IP address. These counters are held briefly in memory and are not stored as a log.

Paid subscriptions are sold through Lemon Squeezy, which acts as the merchant and handles checkout. Your card details go to Lemon Squeezy and its payment processors — they never touch Phrasa’s servers. We store only your subscription status (plan, state, and renewal dates) so we can unlock the features you paid for.

• Supabase auth cookies — keep you signed in (only when you have an account).
• ap_guest — a single first-party cookie that marks your browser as a guest session, so you can use the app without an account. It expires after about a year and is cleared when you sign in. It identifies nothing about you.

There are no advertising cookies. Optional product analytics use a random identifier kept in sessionStorage for the current browser tab, not a tracking cookie.

Phrasa can use limited, first-party product analytics to understand whether core flows such as creating a script and completing a read are working. This is off by default and, when enabled, records only a fixed set of event names, short non-sensitive properties, and a random identifier that lasts for the current browser tab. It does not include your script text, email address, account ID, or microphone audio. Phrasa honors your browser’s Do Not Track setting.

Analytics events are sent only to Phrasa’s own endpoint and stored in Supabase. There are no advertising pixels, cross-site analytics services, or browser fingerprinting.

The services that process data on our behalf:

• Supabase — authentication and the cloud script database.
• xAI — processes text you submit to AI features.
• Lemon Squeezy — checkout and subscription billing.
• Google — sign-in and Drive imports, if you choose to use them; speech recognition if you use voice mode in Chrome.

• Use guest mode and your data never leaves your browser (outside of AI features you invoke).
• Delete scripts at any time from your library.
• Update your display name and password from your account page. Email changes are not currently supported there.
• Delete your account yourself from the account page — this permanently removes your scripts, folders, settings, subscription record, and the account itself from the database.

If this policy changes, we will update this page and the date at the top. Significant changes will be called out in the product changelog.