Lullula reads a page's content to decide whether to show its reading player there, and when you play, summarize or save it.

• Free voices: the text is spoken by your browser's own speech engine (Web Speech API) rather than sent to the Lullula speech service. If you are signed in, the limited reading-history and resume data described below is still synced, and a page you save with Listen later is stored as described below.

• Reading history: when you are signed in and start playback, the page or document title, address (URL), favicon when available, content type, playback progress and duration, reading position, and a short text excerpt (up to 80 characters) around that position are sent to the Lullula service. They are stored with your account so history and resume position can sync across devices. This applies to free and premium voices.

• Premium voices (with or without an account; without one, from a one-time free trial): the text to be spoken is sent over HTTPS to the Lullula service and its speech provider solely to generate the audio, then returned to you. The first sentence is sent as soon as you point at the player, so playback can start at once.

• AI summaries (with or without an account): extension 1.9.0 and later send the page's text over HTTPS to the Lullula service, and on to the AI services named in the full policy (Anthropic first; DeepSeek, Alibaba Cloud or OpenAI only when the one before cannot answer), only when you click Summarize, Regenerate, Try again after an error, or, in versions that have it, More detail. Opening, previewing or reopening the panel alone sends nothing for a summary. Show Summary in General settings shows or hides the panel; hiding it does not cancel a request already made. Versions up to 1.8.2 generate summaries automatically when the player appears unless you turn summaries off, until the installation updates.

• Page analysis: to pick a voice and find the article, the extension may send up to 500 characters of a page to detect its language when the browser cannot, and an outline of the page's structure. Formulas on a web page are sent to be put into words.

• Scanned PDFs and equations: pages are recognised in your browser first, with a recognition model downloaded once from lullula.io. A page that cannot be read reliably there is sent as an image to the Lullula service and its text-recognition provider. When you are signed in, an equation in a PDF may be sent as an image for recognition.

• Listen later (optional, requires sign-in): when you press Listen later, the page's title, its address (http/https only) and the text Lullula reads aloud are sent over HTTPS to the Lullula service and stored with your account until you delete the item or your account, so you can play it later on your signed-in devices. On a premium plan the text is also turned into audio ahead of time by our speech provider and the audio is stored with the item; on the free plan nothing is rendered, and your devices read the text with their own speech engine. While you are signed in, the address of each page where the Lullula player appears is also sent to the Lullula service to show whether that page is already saved; this lookup is not stored with your account.

• Page subscriptions (optional, requires sign-in): when you click Subscribe to page updates in the toolbar menu, the current page's address (without its in-page anchor or tracking parameters) is sent over HTTPS to the Lullula service and stored with your account. The service then checks that public page, or the site's RSS/Atom feed, daily by default, from its own servers and without your cookies, and keeps the public text it finds so it can show you new articles and changes. Lullula never offers this on private-network, sign-in or banking pages, on sites you turned it off on, on shared documents (Google Docs and Drive, SharePoint, OneDrive, Dropbox, Box, iCloud), or for addresses that carry a sign-in code or key. To stop following a page, write to support@lullula.io or use the Lullula web app's Subscriptions page where it is available. This option appears only once Lullula turns page subscriptions on.

• Your own voice provider (optional): if you connect ElevenLabs, an OpenAI-compatible endpoint, Azure Speech, Google Cloud TTS, Amazon Polly or Alibaba Cloud Qwen-TTS with your own API key, the text you play with that provider's voices is sent from your browser straight to that provider under its terms. The key is stored only in your browser and is never sent to Lullula, and the requests for those voices' audio do not pass through Lullula. Summaries and reading history work as described above whichever voice reads.

• Product events: the extension sends a few first-party product events (an install confirmation; whether a reading played for ten seconds, how long, and how it ended; and whether the page shown after install offered any of your open tabs and whether you picked one), keyed to random identifiers and never carrying a page address, title, text or email. The titles and addresses of the open tabs that page offers are read on your device only (a tab you pick is then read like any other page). Verified trial/install records can link these identifiers to your account. The full list is in the privacy policy.

• Observed uninstall feedback: where the browser supports it, uninstalling the extension may open https://lullula.io/uninstalled. That first-party page records the existing random install identifier, but no reading content or email. If you choose to answer its optional survey, the page sends a reason from a fixed list and, only if you type one, your comment (up to 2,000 characters). The comment is kept with our feedback records without the install identifier and deleted within 90 days; we do not link it to your installation or account, although its timing and details could match them. Please do not include your name, email address or health details in it. The identifier is in a URL fragment removed before other resources load, and the page has no third-party analytics. The page may not open on every uninstall; this is not a complete uninstall count. An installation/trial can be connected to a signed-in account.

• Optional player design measurement (only in experiment-capable releases): off by default, separately from website cookie consent. A focused install/update screen offers allow/off choices, and General settings keeps the control. After explicit consent, first-party events to api.lullula.io carry random installation/exposure/event/attempt/reading/session identifiers, optional existing install/trial identifiers, client/browser/store/cohort/document/mode fields and bounded player/start/listening/summary/save/recovery outcomes. They contain no page address, title, text, selection, summary, audio, provider key, auth token, email, location or free-form error. Verified trial/install records may link them to an account; they are not described as anonymous. Validated JSON configuration selects bundled code only. Turning measurement off clears the local 500-event/48-hour queue and stops new measurement; reading and ordinary product events continue. It cannot recall a dispatched request or delete received reports. Experiment events/conflicts are retained for 90 days after receipt; verified account deletion removes linked units, with hashed tombstones preventing delayed recreation, while unlinked records expire by retention. A reading that crosses opt-out remains unmeasured after re-enable. Current production capability and public enrollment remain disabled; preparing or pasting this disclosure does not enable measurement.

• Account: if you sign in, an authentication token is stored locally to access your account and premium voices. Your voice pick for each language and your blocked sites follow your account; other settings (speed, volume, theme, highlighting, summaries) stay in the browser's own extension storage, which Firefox Sync carries if you use it.

• Lullula does not sell your data. It stores reading history only for content you choose to play, and library items only for content you choose to save; summary requests and page analysis work as described above. It does not monitor unrelated pages or build a general browsing profile. Known banking, payment and sign-in sites are excluded, the player stays off video and live-stream sites, and you can block any site.

• No page screenshots: Lullula does not capture images of the pages you visit. In Firefox, versions 1.0.0 to 1.7.1 could, for signed-in users; that stopped on 27 September 2026, and the privacy policy describes what they did.

Contact: support@lullula.io. Full policy: https://lullula.io/privacy