Privacy policy

What leaves your browser, and where it goes

When you point at a word or select a phrase in the subtitles, the extension sends that text to the translator you picked in its settings, and only to it:

• Google, the default: translate.googleapis.com. Google Privacy Policy.
• Bing: www.bing.com. Before the first translation the extension loads Bing's translator page there for the short-lived token its translations need; the list of languages comes from api.cognitive.microsofttranslator.com. Microsoft Privacy Statement.
• DeepL: api-free.deepl.com or api.deepl.com, with your own DeepL API key. So that a word gets the meaning it has in its line, the text of the subtitle lines around your selection is sent too, as context. DeepL Privacy Policy.

Along with the text go the languages to translate from and into and, for DeepL, your key. Like any web request, these requests also show the translator your IP address; what each translator does with them is set by its own privacy policy.

Nothing else is sent anywhere: not the videos you watch, not the pages you visit, not your word list.

What is kept, and where

• Your word list — each saved word or phrase with its translation, the languages, the translator and when you saved it — and the translation cache (the last 5,000 translations, so that the same word is not sent again) and the last list of languages DeepL offered are kept in the browser's local storage for extensions, on this device only.
• A DeepL API key is kept in the same local storage, on this device only, and sent only to DeepL. While the browser asks you to allow access to DeepL, the key you typed is held in the browser's session storage, which is cleared when the browser closes.
• Your settings — the translator, the languages, the look of the translation, the popup's theme — and small notes such as when the extension was installed or updated, whether you closed a tip and whether you answered the request for a rating, are kept in the browser's sync storage. Your browser syncs them between your devices if you use its sync, as it does with its own settings.

What there is not

No account and no sign-in, no analytics or tracking, no ads, and no server of ours: the extension never sends anything to its developers. All of this can be checked in the source code, published under the MIT License.

Permissions, and why each one

• Storage — to keep the word list, the cache, the settings and a DeepL key, as described above.
• Access to youtube.com — to find the subtitles in YouTube's player, show the translation over them and pause the video while you read. It also covers YouTube players embedded on other websites, which are youtube.com pages themselves.
• Access to www.bing.com — optional, asked for when you pick Bing.
• Access to api-free.deepl.com and api.deepl.com — optional, asked for when you connect a DeepL key.

The optional ones can be withdrawn at any time on your browser's page for the extension.

The request for a rating

After you have used the extension for a while, it may ask you to rate it. “Rate” opens the page of the store you installed it from — Chrome Web Store, Firefox Add-ons or Edge Add-ons — in a new tab. That is an ordinary visit to the store; the extension sends it nothing.

Deleting your data

Delete saved words on the Dictionary page of the extension's popup, one at a time or all at once. A DeepL key can be removed in the settings. Removing the extension deletes everything it kept in the browser's local storage: the word list, the cache and the key.

This website

hovertranslate.app sets no cookies and runs no analytics or third-party scripts; everything on it is loaded from the site itself. It is hosted on GitHub Pages, which logs visitors' IP addresses for security purposes. Search engines show us only total numbers of how often the site appeared in their results and was clicked.

Contact

Questions about this policy: hovertranslate@gmail.com, or an issue on GitHub. If this policy changes, the new version is published on this page with a new date.