Lullula reads a page's content to decide whether to show its reading player there, and when you play, summarize or save it.

• Free voices: the text is spoken by your browser's own speech engine (Web Speech API) rather than sent to the Lullula speech service. If you are signed in, the limited reading-history and resume data described below is still synced, and a page you save with Listen later is stored as described below.

• Reading history: when you are signed in and start playback, the page or document title, address (URL), favicon when available, content type, playback progress and duration, reading position, and a short text excerpt (up to 80 characters) around that position are sent to the Lullula service. They are stored with your account so history and resume position can sync across devices. This applies to free and premium voices.

• Premium voices (with or without an account; without one, from a one-time free trial): the text to be spoken is sent over HTTPS to the Lullula service and its speech provider solely to generate the audio, then returned to you. The first sentence is sent as soon as you point at the player, so playback can start at once.

• AI summaries (with or without an account): extension 1.9.0 and later send the page's text over HTTPS to the Lullula service and the AI provider only when you click Summarize, Regenerate, or Try again after an error. Opening, previewing or reopening the panel alone sends nothing for a summary. Show Summary in General settings shows or hides the panel; hiding it does not cancel a request already made. Versions up to 1.8.2 generate summaries automatically when the player appears unless you turn summaries off, until the installation updates.

• Page analysis: to pick a voice and find the article, the extension may send up to 500 characters of a page to detect its language when the browser cannot, and an outline of the page's structure. Formulas on a web page are sent to be put into words.

• Scanned PDFs and equations: pages are recognised in your browser first, with a recognition model downloaded once from lullula.io. A page that cannot be read reliably there is sent as an image to the Lullula service and its text-recognition provider. When you are signed in, an equation in a PDF may be sent as an image for recognition.

• Listen later (optional, requires sign-in): when you press Listen later, the page's title, its address (http/https only) and the text Lullula reads aloud are sent over HTTPS to the Lullula service and stored with your account until you delete the item or your account, so you can play it later on your signed-in devices. On a premium plan the text is also turned into audio ahead of time by our speech provider and the audio is stored with the item; on the free plan nothing is rendered, and your devices read the text with their own speech engine. While you are signed in, the address of each page where the Lullula player appears is also sent to the Lullula service to show whether that page is already saved; this lookup is not stored with your account.

• Your own voice provider (optional): if you connect ElevenLabs, an OpenAI-compatible endpoint, Azure Speech, Google Cloud TTS, Amazon Polly or Alibaba Cloud Qwen-TTS with your own API key, the text you play with that provider's voices is sent from your browser straight to that provider under its terms. The key is stored only in your browser and is never sent to Lullula, and the requests for those voices' audio do not pass through Lullula. Summaries and reading history work as described above whichever voice reads.

• Product events: the extension sends a few first-party product events (an install confirmation and whether a reading played for ten seconds, how long, and how it ended), keyed to random identifiers and never carrying a page address, title, text or email. Verified trial/install records can link these identifiers to your account. The full list is in the privacy policy.

• Observed uninstall feedback: where the browser supports it, uninstalling the extension may open https://lullula.io/uninstalled. That first-party page records the existing random install identifier, but no reading content or email. If you choose to answer its optional one-question survey, only a selected reason from a fixed list is sent. The identifier is in a URL fragment removed before other resources load, and the page has no third-party analytics. The page may not open on every uninstall; this is not a complete uninstall count. An installation/trial can be connected to a signed-in account.

• Optional player design measurement (only in experiment-capable releases): off by default, separately from website cookie consent. A focused install/update screen offers allow/off choices, and General settings keeps the control. After explicit consent, first-party events to api.lullula.io carry random installation/exposure/event/attempt/reading/session identifiers, optional existing install/trial identifiers, client/browser/store/cohort/document/mode fields and bounded player/start/listening/summary/save/recovery outcomes. They contain no page address, title, text, selection, summary, audio, provider key, auth token, email, location or free-form error. Verified trial/install records may link them to an account; they are not described as anonymous. Validated JSON configuration selects bundled code only. Turning measurement off clears the local 500-event/48-hour queue and stops new measurement; reading and ordinary product events continue. It cannot recall a dispatched request or delete received reports. Experiment events/conflicts are retained for 90 days after receipt; verified account deletion removes linked units, with hashed tombstones preventing delayed recreation, while unlinked records expire by retention. A reading that crosses opt-out remains unmeasured after re-enable. Current production capability and public enrollment remain disabled; preparing or pasting this disclosure does not enable measurement.

• Account: if you sign in, an authentication token is stored locally to access your account and premium voices. Your voice pick for each language and your blocked sites follow your account; other settings (speed, volume, theme, highlighting, summaries) stay in the browser's own extension storage, which Firefox Sync carries if you use it.

• Lullula does not sell your data. It stores reading history only for content you choose to play, and library items only for content you choose to save; summary requests and page analysis work as described above. It does not monitor unrelated pages or build a general browsing profile. Known banking, payment and sign-in sites are excluded, the player stays off video and live-stream sites, and you can block any site.

• No page screenshots: Lullula does not capture images of the pages you visit. In Firefox, versions 1.0.0 to 1.7.1 could, for signed-in users; that stopped on 27 September 2026, and the privacy policy describes what they did.

Contact: support@lullula.io. Full policy: https://lullula.io/privacy