Your text stays
on your Mac.

Text and reading history

Selected text, spoken audio, reading history and your pronunciation dictionary stay on the Mac. The app does not upload text, titles, source app names, URLs from what you read, text fingerprints, hashes or summaries. Speech uses installed system voices or the downloaded local natural voice.

Ordinary saved readings expire after 7 days. Recovery files left by an interrupted or damaged write can remain longer; Clear history removes those too. Turn off Remember reading history in Settings → General to delete it and stop saving new readings. Clear history deletes the saved readings. These controls do not delete account data or counts already reported to the server.

Your account and this installation

A verified RambleProof account is required. Sign-in uses the existing account service, with email verification or Google sign-in. On this Mac, Keychain holds the reporting credential and account identity. An owner-only local account file also holds the confirmed account identifier and email, offline authorization, and numeric usage ledger. That file is excluded from backups. The local authorization lets reading continue when Keychain or the network is temporarily unavailable.

The server keeps a random HoverSpeech installation identifier, the account identifier, a hash of the reporting credential, and creation, linking, last-report and revocation dates. A temporary sign-in request also keeps the public challenge, confirmation code, a hash of the one-time grant your browser hands to the app when you connect with one click, installation identifier, approval account and creation, expiry and completion times. Its approval window lasts ten minutes. Expired requests become eligible for cleanup one day after expiry.

HoverSpeech has its own installation and usage records. It does not consume RambleProof words or device allowances, change a plan, sync a pronunciation dictionary, or subscribe you to marketing email.

The exact daily usage fields

Usage reports contain a days list. Each entry contains only these seven fields. The reporting credential identifies the installation separately; it is not part of the daily entry.

day

The calendar date in UTC, such as 2026-10-09. This can differ from the date in your local time zone.

voiceKind

Either system or natural. No specific voice name is sent.

appVersion

The HoverSpeech version, such as 0.1.0.

macOSVersion

The macOS version, such as 26.5.1.

readsStarted

How many requested readings began producing audio. Samples, pause, resume and skip do not count as new readings.

minutesListened

Active playback time at the current playback rate, excluding pauses, preparation, seeking, samples and sleep. Time crossing UTC midnight is split between the two dates.

charactersRead

A numeric count of the source text accepted when a reading first produces audio, measured in Unicode scalar values. Stopping early does not reduce it, so it is not a claim that every character was heard.

Counts are cumulative for each UTC day, voice kind and version combination. Repeated reports do not add the same counts twice. There are no per-reading timestamps or content fields. These counts help Moe understand use of HoverSpeech; they are not added to RambleProof usage totals.

Offline use and retention

After a successful sign-in, reading keeps working offline without a time limit. An unavailable server or a revoked reporting credential does not stop an already authorized reader. The app asks you to reconnect when reporting needs fresh authorization.

Pending usage counts stay on the Mac for the latest 90 UTC days, including today. While the app is running, it attempts to report about once an hour and retries when a connection becomes available. Unsent counts older than that are discarded and are not recovered later. Server-side counts and installation records remain until you delete HoverSpeech server data or the shared account is deleted.

Accessibility and the clipboard

Accessibility access lets HoverSpeech read selected text in other apps and listen for its reader key. It does not record everything you type. The reader key watches modifier changes; it handles playback keys while you hold that key during a reading. macOS may prevent the key from working while secure keyboard input is active.

When an app does not expose its selection, HoverSpeech can temporarily copy that selection and restore the previous clipboard when safe. A newer clipboard change takes priority. You can turn off this fallback in Settings → General. Without Accessibility, the clipboard and Services menu remain alternatives after sign-in.

Voice downloads and updates

The optional natural voice downloads model files from Hugging Face only after you press its download button. That request reveals normal connection information, including your IP address, to the download host. It contains no reading text. Downloading extra system voices through System Settings is handled by Apple.

HoverSpeech checks its own update feed on this website. You can turn automatic update checks off in Settings and check manually. Update checks and installer downloads make ordinary network requests to the website and download host, which can receive your IP address, request time, path and client information. The app checks signed updates before installation. Update requests are separate from daily reading counts.

Diagnostics and support

There is no automatic crash reporting. Copy diagnostics in Settings → Advanced copies settings and recent events to your clipboard, without the text you read. Nothing is sent to support unless you choose to send it. Email and diagnostic information you send are used to answer the request and investigate the issue.

Sign-out, export and deletion are different

Signing out in HoverSpeech clears this Mac's authorization and pending counts and attempts to revoke its reporting credential. It does not delete counts already on the server, reading history on your Mac, or your shared account. Regular reading requires sign-in again; the sample remains available.

The HoverSpeech account page lets you export your HoverSpeech server records, disconnect reporting installations, or delete HoverSpeech server data. Your RambleProof account remains. Disconnecting or deleting server data does not remotely stop reading on a Mac that was already authorized offline, and does not erase that Mac's local history. Reconnecting can upload locally retained counts again. Sign out in the app to clear pending counts and remove its local authorization.

To delete your complete shared account, use Delete your account on the website or Delete Account in HoverSpeech for iPhone. It is deleted at once, HoverSpeech included. For an export of your complete shared account, or to ask about personal data, email hello@rambleproof.com. Shared account deletion also affects access to the other product; purchase records are kept for accounting without your name or email.

The web demo

On the web demo you can hear your own words before installing anything. Unlike the Mac app, the demo sends the text you ask it to read, at most 500 characters at a time, to our own speech server (Kokoro, on a server we rent from Hostinger) to turn it into audio. That server does not record the text from this page. It logs each request's time, length and voice with a short fingerprint of the text, kept for up to 90 days, and it keeps the audio it makes in a cache for at most four hours, so a repeated line plays sooner. The audio comes back to your browser and stays in that tab; nothing is added to an account. To limit use, the website counts requests per visitor under a salted fingerprint of the IP address for up to a day. Please do not paste anything private into the demo.

To see how the demo is used, it counts what happens on it, never what is said: when the page is opened and from which site or campaign link, each read (its voice, length in characters and whether it was your own text, a highlighted part or the sample), how long the first sound took, whether a read finished or failed, speed changes, clip and app downloads, and for each piece the speech server made, its length, voice, result and timings. These counts go to PostHog from our server, together with the country and a rough device type (for example Mac or iPhone). The demo loads no analytics script, sets no cookie and stores nothing in your browser. Instead of a name or an address, the counts carry a code made on our server from the day, your network address and your browser's user agent, so visits on one day can be grouped but the code changes every day and cannot be turned back into either. Your words and your IP address are never sent. If your browser sends Do Not Track or Global Privacy Control, nothing is counted.

This website

HoverSpeech pages do not load website analytics scripts or use session replay, and apart from the web demo's anonymous counts described above they do not record page visits or interactions. They do not add HoverSpeech visits to RambleProof marketing attribution. Other RambleProof pages have their own analytics controls, described in the website privacy details below.

Supabase provides account authentication and stores account and usage records. Vercel hosts the website and keeps ordinary operational logs, including IP address, request time and path. Verification emails use the account service's email provider. Website analytics and these connection logs are separate from native reading counts. See the website privacy details for the shared website controls and providers.

HoverSpeech is made by Zena Labs LLC in California, USA. You can ask to access, correct or delete personal data we hold, or object to its use. Applicable rights in your country still apply.