Last updated: 2026-11-12


Twinread is a browser extension published by Giuseppe Castelluccio as Exochard, the publisher named on its store listings. Giuseppe Castelluccio decides what data Twinread handles and is responsible for it. Contact: support@exotools.dev

This policy covers the extension, the Twinread API it talks to (hosted on Cloudflare at api.exotools.dev; older versions call it at exotools-api.exochard.workers.dev, or at gigscope-api.exochard.workers.dev, which forwards to it) and the website https://twinread.exotools.dev. It describes every kind of data Twinread collects, how it is used, where it is stored, how long it is kept and who it is shared with. Twinread collects no data that is not listed here.


Twinread translates the web page you are reading, the captions of a video on it, a PDF you open in its reader, or text you select or type, into another language, and shows the result on the page.

The translating is done on your computer, by the translator built into Chrome or Edge (the Translator and LanguageDetector browser APIs), or in Firefox by an engine bundled in the extension, unless you choose a translation provider of your own for a language pair (see "Text you send to a provider you choose").

At install it has no access to any website. It gets access to the tab you click the toolbar icon on, or press its shortcut on, for as long as that page is open.

If you switch on "Always translate this site", the browser asks you for access to that one site, and you can withdraw it by switching the option off.

The same applies to "Player button on YouTube": the browser asks for access to www.youtube.com when you switch it on, the button then appears in the player of every YouTube video, and switching it off withdraws the access.

Until you press the button, turn subtitles on or use the toolbar icon or shortcut, Twinread only shows the button and reads nothing else on YouTube.

Dual subtitles on Netflix (www.netflix.com), Prime Video (www.primevideo.com, and www.amazon.com under /gp/video) and Disney+ (www.disneyplus.com) work the same way: the browser asks for access to that one site when you switch subtitles on there, you can withdraw it in the browser's extension settings, and Twinread reads only the caption line the site shows and puts its translation above it.

Unless you switch on Card media (Pro, off by default) or press Subtitles from sound, it does not read, copy or change the video, its audio or the site's data requests. With Card media on, it keeps a still of each kept subtitle line and that line's audio on your device, as described under Card media below. Subtitles from sound is described under Subtitles from speech below. In Firefox, subtitles in a video player embedded in another site, such as a Vimeo player, work the same way: the browser asks for access to that player's host when you press the button for it, and you can withdraw it in the browser's extension settings.

• Authentication information: your Pro licence key, sent to the Twinread API to check it and, when you remove or replace it, to free its seat.
• Technical data, if you press Send in Send diagnostics, and the trial marker: the diagnostics report is a short report about your install and translation settings, shown on screen before it is sent (see Technical report below); the trial marker described under Licence check is read when the extension starts and when you press Try Pro, and written when a trial starts.

Twinread does not collect usage statistics, your browsing history, health, financial or payment information, location, or the text of the pages you translate. That text stays on your computer unless you choose a translation provider for a language pair; then the text being translated goes to that provider, as described below. It does not sell data, does not use it for advertising, and does not use it to decide creditworthiness or for any purpose unrelated to translating pages for you.


The extension asks for room beyond the usual storage limit, so a long list of saved words can grow. All of it stays in your browser; only the trial marks described at the end of this section also sync through your browser account.

These stay in your browser's extension storage and are never sent to us:

• Your settings: languages, display mode and style, the theme, the sites on your always-translate and never-translate lists, and your glossary.
• Saved words and phrases, from the selection card, a subtitle line, a PDF or the Prepare tab: the text, its translation, the sentence it came from, the language pair, the page title and address, and the time, with your flashcard review progress.
• They are only read by Twinread on your computer and leave it only if you export them, save a backup file or send them to Anki on your own computer (see below).
• Where each saved word was found: the page, video or PDF address and title, the sentence or subtitle line with the text around the phrase, the second in the video, the page of the PDF, or the file name and line of a file you chose in Prepare, with the date, how it was kept and the extension version. At most three places per phrase.
• Your known words: the words you mark as known or import from a list, per language.
• Where you left off in each PDF, EPUB, text or HTML file you opened in the reader: the file's name, size and last-modified date, and the paragraph you reached. The last 50 files are kept; the text of the file is not.
• Card media, only while Card media is switched on in the options page (Pro): for each subtitle line you keep, a still of the video frame on screen (a JPEG, at most 640 pixels on its longer side) and the line's audio (Opus in WebM, or Ogg, at most 15 seconds). At most 300 cards and 150 MB are kept, the oldest first. A card's media is removed when its word is deleted (after the Undo window), when you take the keep back, or when you press Remove card media. It is kept in the extension's own database (IndexedDB), never sent to us, and leaves your computer only when you send the phrase to Anki, as described below.
• Text of a page you send to the Prepare tab from the toolbar: held in the browser's session storage until the tab reads it, for at most 30 seconds, and gone when the browser closes.
• Small counters and notes that stay on your computer: how many times you used each Pro feature, the PDF pages opened in the reader, the dates you dismissed a hint, the rating request or the trial notice, which hints were already shown, whether the What's new note is waiting, and a clock check that keeps the trial dates honest.
• A translation cache that lives in the page's memory only and is gone when you close or reload the tab.
• Subtitle translations for the YouTube videos you watched with subtitles on: the video id, the language pair, the caption lines and their translations, for the last 200 videos, so a rewatch is instant.
• They are kept in the extension's own storage, not in the website's.
• If you use your own translation provider: the key you saved (and, for an OpenAI-compatible endpoint, its address and model name), and which language pairs use which provider.
• The key is read only by the extension's background worker; web pages cannot read it.

Your licence record stays in the same storage:

• Your Pro licence key and pass end date, if you activate Pro.
• The start and end dates of the free trial.
• The random id for this browser.
• Any key whose seat release is still waiting, with the signed pass kept for it.

The licence keys and the random id go to the Twinread API only with the licence check and the seat release described below.

Uninstalling the extension deletes all of it.

In your browser's sync storage, the extension also keeps the start and end dates of your free trial, the latest clock time it has seen, the trial outputs you have used and the number of Free sentence explanations you have used. We never receive the clock time, the trial outputs or that number. The trial dates reach our API only in the trial cookie described under Licence check.

• What is sent: your licence key, the product name, the random id for this browser, and the licence features this version understands.
• Each check adds a one-time random code and its time. For a key already active in this browser, the check adds the seat code our server gave this browser and the signed pass it holds.
• The random id: the extension makes it when the licence first needs it. If the server sees the same id in a copied browser profile, the extension replaces it with a new one.
• Seat release: when you remove a key or enter another one in its place, the extension sends that key, the product name, the random id for this browser, the licence features this version understands and the seat code it holds for that key, to free its seat.
• When you remove a key, it also sends the signed pass it holds for that key. If the server does not confirm the release, the extension sends it again later until the server confirms it.
• It keeps at most the last 10 keys waiting. A new key entered over an active pass with an end date also sends the old key, so the new pass starts where the old one ends.
• Firefox: the browser asks your permission before the key is first sent. Without it, the key and the random id for this browser are not sent.
• When: when you activate Pro or press Check now, then about once a day. After a check that fails or gets no clear answer, the extension tries again about 15 minutes later.
• The free trial starts and ends on your device. Starting a Pro trial stores a small cookie from api.exotools.dev in this browser, holding only the trial's start and end, to the hour, and whether it is an offer trial, for up to 400 days, so a reinstall continues the same trial.
• A trial that already runs is stored the same way the first time the extension reads it after an update. Firefox sets it only if you allow technical data; one set earlier is moved to its new address after the update either way. With no trial on this device, the extension asks api.exotools.dev for that cookie when it starts and when you press Try Pro, so a reinstall shows the trial this browser already had. The request names only the product, in its address, and the browser sends this product's trial cookie with it. Versions before 2.0.1 kept the trial cookies of all exoTools products under one address, so each request carried the others' cookies too. Once after updating to 2.0.1, the extension asks api.exotools.dev to move this product's older cookie to its own address, and the old one is deleted. Until another exoTools extension you use also updates, its older cookie still goes along with this request; the API reads only this product's. Once it has an answer it stops asking at start; with no answer, it asks again at the next start. On Firefox this read asks no permission; pressing Try Pro asks for the technical data permission first, because starting a trial writes the marker.
• It holds no identity, and we keep no copy. Clearing cookies or site data for api.exotools.dev deletes it; uninstalling does not.
• Why: to confirm the key is valid with Payhip, the seller of record for Pro passes, and to count each browser once, so entering the key again in the same browser never takes a second of its 3 seats.
• Where it is kept: the Twinread API files a seat record under a one-way hash of the product name and key. It holds the random id of each browser that uses the key, and when each was last seen.
• It also holds one-way hashes of each browser's current seat code, with its issue time, and of the last code that browser presented, and whether each seat was reported to Payhip.
• The key and the seat codes themselves are not stored. All of it except a marker that the record once existed is deleted at most 400 days after the key was last checked.
• Pass record: the Twinread API also notes which pass the key belongs to, under another one-way hash of the product name and key. It is deleted at most 400 days after the key was last checked or bought.
• Refunded-key marker: When a full refund withdraws a known licence, the API stores a one-way hash of the product and key to keep it disabled. The marker has no automatic expiry; backups can contain it.
• Seat moves: when a key's seat moves to a new browser, the Twinread API notes the time under the seat record's hash and deletes it after 7 days.

At most once a day, the extension checks twinread.exotools.dev/rules.json for a signed settings file and keeps its built-in defaults when none is published. The request sends no cookies and no data from the extension.

• What happens: Twinread reads the text of the page in your browser, hands it to an on-device translator (the browser's built-in one in Chrome and Edge, the bundled engine in Firefox), and puts the result back on the page.
• It sends no page text, selections, typed text, captions, page addresses or translations to us. Text goes to a provider only as described under the provider section, and caption requests go to YouTube as described below.
• Language models: the browser itself downloads a language model the first time you use a language pair. Chrome downloads it from Google, Edge from Microsoft, and the download contains no text from your pages.
• See Google's and Microsoft's documentation of the built-in AI APIs for how each browser handles it.
• Firefox: Firefox has no built-in translator, so Twinread translates with an engine bundled in the extension. The first time you use a language pair it downloads that pair's model from Mozilla's model servers (firefox.settings.services.mozilla.com and firefox-settings-attachments.cdn.mozilla.net), checks it and keeps it on your computer.
• The request names the language pair and contains no text from your pages. Uninstalling the extension deletes them.
• Marked phrases: with "Mark saved words on pages" on, saved words are marked through the browser's page highlight list, which the page's own scripts can read.
• A page can learn which of its words match your saved words, and can read the translation shown while you hover a marked phrase.
• It cannot read your other phrases or translations. Turn the setting off to stop it.

• What is sent: if you save a key for DeepL or for an OpenAI-compatible endpoint and choose it for a language pair, the text being translated for that pair (page text, a selected word or phrase, a caption line, text from a PDF) is sent from your browser to that provider's server, with your own key.
• The provider receives the text, the source and target language (as codes for DeepL, as a short instruction for an OpenAI-compatible endpoint), your key and, for an OpenAI-compatible endpoint, the model name. Twinread sends nothing else to it and nothing to us.
• When: for the language pairs you route to a provider, and for Explain (next section), and only after you save the key and the browser asks for access to that provider's server.
• Other pairs stay on your device. If the provider fails and your browser can translate the pair itself, Twinread uses the on-device translator instead.
• Who receives it: DeepL (https://www.deepl.com/privacy), Google (https://policies.google.com/privacy) when you use the Gemini preset with a Google AI Studio key, or the server whose address you typed, under that operator's own terms. Remove the key in the options page to stop; this also withdraws the browser's access to that server.

• What happens: when you press Explain on a selected sentence of at most 400 characters, Twinread first asks the built-in language model of Chrome or Edge, on your computer. It uses that model only when the browser already has it ready; Explain does not start a download. If there is no such model, it fails or takes too long, the sentence is explained by the OpenAI-compatible endpoint you saved.
• What is sent to the endpoint: the selected sentence, with a short instruction that names the language of the explanation, your key and the model name. This happens even when no language pair is routed to that endpoint. Nothing goes to us. A DeepL key is not used for Explain.
• When: only when you press Explain, after you saved an OpenAI-compatible key and allowed access to its server. With no key and no on-device model, nothing is sent and Explain says so.
• On Free: the number of sentence explanations you have used is kept as described under Data stored only in your browser.

• What happens: with Twinread subtitles on for a YouTube video, the extension asks youtube.com for that video's page and its caption file, with your YouTube session.
• Where it goes: the request goes to youtube.com only. The captions are translated on your computer and are not sent to us.

• What happens: when you click "Read this PDF", the extension downloads that PDF from its own address, as your browser would, or you drop in a saved file.
• Where it goes: the request goes to the site that hosts the PDF only. The PDF is read and translated on your computer and is not sent to us.

• What is sent: for a phrase you send, its text, translation, sentence, the page title and the page address, to AnkiConnect, the Anki add-on that listens on http://127.0.0.1:8765 on your own computer. Nothing goes to us or to any other server.
• Card media: with Card media on, the still and the audio of a kept line are sent with the card, as files in Anki's media folder. They go only to that local address, and only when you press Send to Anki.
• When: only when you press Send to Anki. The browser first asks for access to that local address, and you can withdraw it in the browser's extension settings.

• What is read aloud: the word on a word card, or the selection on a page card, by a voice installed on your computer. Twinread uses only voices that run on the computer, never the browser's online voices, so the text goes to the computer's speech engine and nowhere else.
• When: only when you press Hear.

• What happens: in Chrome and Edge, when you press Subtitles from sound on a video that has no captions, or open a video file in Twinread's Video file page, Twinread reads the sound of that video and a speech model bundled in the extension writes the lines.
• Where it runs: on your computer. For a video on a page, the model runs in a hidden page of the extension (the offscreen permission), which closes when no video uses it.
• What is kept: the sound is not stored. The lines stay in the page's memory and go when you leave or reload the page.
• On Free: two counts are kept in your browser, the seconds of sound subtitles used and the reading-aid lines used, so the amount left can be shown. They hold no address, title or text, and they are not sent anywhere.
• What leaves your browser: nothing from the sound. The lines are translated like any other text, as described under Text you translate.
• When: only after you press Subtitles from sound or open a file in the Video file page.

• What is sent: product and version, browser name and major version, operating system family, language and plan (free, trial, pass or lifetime). For failure classes it says whether the built-in translator is missing or blocked in your browser.
• Settings sent: mode, style, subtitle size, display and position, and on-or-off choices for subtitle swap, highlight saved, pause after line, phrases come back, hide translations and player button.
• It also says yes or no for whether you set a provider of your own.
• Never in it: text of pages you translate, site lists, glossary entries, deck names, provider keys, your account, licence key or email.
• When: only after you open Send diagnostics, read the report on screen and press Send. Copy sends nothing. Twinread sends no report by itself.
• Firefox: the browser asks for its technical data permission at the first Send and when you press Try Pro free.
• Where it is kept: the Twinread API keeps the report for 30 days, then deletes it. Backups do not include reports. The API does not store your network address with the report.
• Deleting: the panel shows a reference after sending, and a report is found only by that reference. Write to support@exotools.dev with it to have the report deleted before the 30 days end.

When you remove the extension, the browser opens https://twinread.exotools.dev/bye. The address carries nothing: no version, no id. The page links to the store page for a review and to our email address. The uninstall page sends nothing.


The roadmap page at https://twinread.exotools.dev/roadmap shows planned and shipped changes. Loading it asks the API for the list of items and sends only the product name. The website sets no cookies. The theme you pick with the theme button stays in this browser (localStorage) and is never sent. It counts page views per page and country, except on the uninstall page, with Cloudflare Web Analytics, which sets no cookies and keeps nothing that identifies you.


You buy Pro on Payhip, which handles the payment, your name, your email address and the licence key under its own privacy policy.

Payhip then sends the Twinread API a notice about the order. The API keeps the order number, the product code of the pass and the price in a log for 30 days.

For 400 days it keeps an order record: the order number, the product, a one-way hash of each licence key and any refund amount.

It also keeps a daily count of sales for 400 days. When a pass renews an earlier one, it also keeps a one-way hash of each of the two licence keys with the pass start and purchase dates and the length of the earlier pass.

This link is deleted about two years (766 days) after the renewal starts. The API keeps a pass record under a one-way hash of the product and licence key.

It expires 400 days after it is written; its expiry is periodically refreshed when the key is used. Nightly cloud backups may include order records, renewal links and pass records.

These backups are normally kept for 30 days. They can be kept longer when newer complete backups are not available. Your name, email address, network address and licence key are not stored by Twinread, except when you withdraw (below).

If you withdraw from a purchase on the withdrawal page, Twinread keeps the name, email address, order number and order date you type, a reference and the time, for 24 months, then deletes them. They are used only to handle that withdrawal. Withdrawal backup copies are scheduled for deletion after 30 days, even when other backup records are kept longer. The withdrawal page loads Cloudflare Turnstile to block bots; Cloudflare sees your network address and browser signals. No other page loads it.


We share data only with the services that run Twinread, and only for the purposes above:

• DeepL, Google for the Gemini preset, or the OpenAI-compatible server you enter, only if you choose one for a language pair or, for the OpenAI-compatible server, press Explain: it receives the text being translated for that pair, or the sentence being explained, as above.
• Google (Chrome) or Microsoft (Edge), which provide the built-in translator and download its language models to your browser: https://policies.google.com/privacy and https://privacy.microsoft.com/privacystatement
• Mozilla (Firefox only), whose model servers send the language model for a pair to your browser; they receive the language pair and your network address, and no text from your pages.
• YouTube, which receives the request for a video's page and caption file when Twinread subtitles are on for that video.
• The site that hosts a PDF you choose to read in the Twinread reader.
• Payhip, to check licence keys and sell passes: https://payhip.com/privacy
• Cloudflare, which hosts the Twinread API and the website: https://www.cloudflare.com/privacypolicy/

We do not sell or rent data, do not share it with advertisers or data brokers, and do not transfer it for any other purpose. We would disclose data only if the law requires it.


Traffic between the extension and the Twinread API, Payhip, Cloudflare, DeepL and Google uses HTTPS. A PDF at an http address, an OpenAI-compatible server you run on your own computer and AnkiConnect use plain HTTP to the address you chose. The Twinread API keeps licence keys and network addresses only as one-way hashes.

• See or delete your local data: uninstall the extension, or clear its data in your browser's extension settings.
• Exports and backup files you made stay where you saved them; delete them yourself if you no longer want them.
• Remove card media: press Remove card media in the options page, beside the Card media switch. It deletes every stored still and audio; your saved words stay. Switching Card media off does not delete them; use the button for that.
• Ask a question or free a licence seat: write to support@exotools.dev. We answer within 30 days.
• Delete a technical report: write to support@exotools.dev with the reference shown after sending.
• Delete a withdrawal record: write to support@exotools.dev with the reference shown after sending.
• If you live in the EU or the UK, you also have the rights the GDPR gives you, including the right to complain to your data protection authority.

Twinread is a general-purpose tool and is not directed at children under 16. We do not knowingly collect data from them.


When this policy changes, we update this page and the date at the top. A change that adds a new kind of data ships only with an extension update whose store listing describes it.


Exochard, support@exotools.dev