Privacy Policy

This Privacy Policy describes how Wyzie ("we", "us", or "our") collects and handles information when you use Wyzie Subs (the "Service"). Wyzie is operated by an individual based in the United States of America and serves as the data controller for all personal information collected through the Service. We are committed to collecting only the minimum data necessary to operate the Service. We do not sell your personal information to third parties.

2a. Information you provide directly

• Email address, collected at checkout (Stripe) or after a successful cryptocurrency payment. Used to deliver your API key, receipts, low-balance notices, top-up links, and depletion alerts. Email is the only contact channel we use for transactional communication.
• Verification email, the Free plan requires verifying an email address from a supported personal email provider so we can issue one key per person. The 6-digit verification code we email you is single-use and destroyed on use or after 15 minutes. We never use your verification email for marketing, only for the transactional purposes described above.
• Auto top-up settings, if you opt in to auto top-up from your dashboard, we store the trigger threshold, the pack size, and your monthly spend cap. Your card details themselves are stored only by Stripe; we retain only the Stripe customer ID and payment method ID needed to charge you when your balance falls below the threshold. You can disable auto top-up at any time.

2b. Information collected automatically

• API usage data, each API request is logged for the purpose of enforcing rate limits and calculating remaining request quota. Logs may include timestamps, endpoints called, and response codes.
• Browser / device data, standard web server logs (IP address, browser type, referring URL, pages visited) may be retained for security monitoring and abuse prevention. This data is processed by Cloudflare as part of our infrastructure.
• Network type, we check whether the IP address behind API requests belongs to a hosting provider or VPN (using IPinfo, see section 4), so keys sending very high traffic from servers can be paused as described in our Terms. We keep only per-key counts, not the addresses.

2c. Our tools on sub.wyzie.io

• Download page without a key (sub.wyzie.io/download). To keep this free page from being abused, each search first passes a Cloudflare Turnstile check, and we use your IP address to count searches and downloads per address and per network for up to a day, and to check with IPinfo whether it belongs to a hosting provider or VPN (those searches use the free providers only). The download links we give you carry a one-way hash of your network, so they work only from your network, for 6 hours. We don't keep your IP address with your searches.
• Wyzie Synced (sub.wyzie.io/synced). The page reads your video in your browser; the file never leaves your device. We receive only the times at which people speak, use them to time the subtitle, and don't keep them. If you send a media file to our sync API instead, it is written to temporary storage on our server only while we find that timing, and deleted when the request ends. We never keep, view or share your files.
• Title search and translation. Titles you type on our pages are looked up with The Movie Database (TMDB), and subtitles you ask us to translate are sent as text to Google Translate. Neither receives your email address or API key.
• Wyzie Transcribe and Fix Subtitles (sub.wyzie.io/transcribe and sub.wyzie.io/fix). Your browser pulls the audio track out of your file, and only that audio is uploaded. It is kept in temporary storage on our server, sent in short pieces to Cloudflare Workers AI for speech recognition, and deleted as soon as the job ends. When you turn on speaker labels, the audio is processed by Deepgram's speech model through Cloudflare instead. When you turn on sound descriptions (beta, English only), the audio is also classified by a sound model on our own server, and nothing is sent to a third party for that. For Fix Subtitles we also read the subtitle you send or pick. The finished subtitle is kept for one hour so you can download it, then deleted. We never keep, view or share your audio.
• Bulk Transcribe (POST /transcribe/batch). When you give us a podcast feed or a list of media links, our server fetches those public addresses for you and downloads each media file to temporary storage. Each file is deleted once it has been processed. The finished subtitles are kept for 24 hours so you can download them, then deleted. Your API key is held, encrypted, for up to 24 hours while the batch runs so each item can be charged, and is deleted with the batch.
• Search by quote (sub.wyzie.io/quote and GET /quote). We keep a searchable index of the text of subtitles that pass through Wyzie Subs, so a line of dialogue can be matched to a movie or episode. Search results are cached for 10 minutes.
• Reuse of recognised text (Transcribe and Fix Subtitles). We keep the recognised text of audio for 30 days under a hash of the audio. No key, user, job id or file name is attached to it. Anyone who sends the same audio gets the same text back. Add cache=0 to a request to opt out of both reading and writing. The audio itself is still deleted when the job ends, and the subtitle stays for one hour after the job ends.
• Webhooks. If you give a webhook URL, we keep that URL and the payload queued for it in Redis until it is delivered or we give up, at most a few hours. The payload holds the job id, status, cost and a link to the result. It never holds your key or the subtitle.
• Quality scores and browser-safe keys. For subtitle files served through Wyzie we store a quality score and its flags per subtitle file, not per person. If you make a browser-safe key, we store its label, the websites you allow and its limits.
• Extract (POST /extract). The video file you send is read in temporary storage on our server to find its subtitle tracks, and it is deleted when the request ends. It is never kept.
• Usage breakdown and balance webhook (GET /usage). We keep per-key request counts by day, by route and by source for 31 days, under a hash of the key. If you set a balance webhook, we store its URL on your account until you remove it, and send a signed message to it when your balance runs low.

2d. News emails

If you subscribe to Wyzie news at sub.wyzie.io/news, we store your email address and when you signed up and confirmed. We email you only after you click the confirmation link we send, only about the Service, and never share the address. Every news email has a one-click unsubscribe link, and unsubscribing deletes your address. Sign-ups that are never confirmed are deleted after 7 days. The sign-up form passes a Cloudflare Turnstile check and is limited per IP address, so no one can sign up other people in bulk.

2e. Cookies & data stored in your browser

We use your browser's localStorage to hold a small number of functional values on the device you use. We do not use advertising cookies, analytics cookies, tracking pixels, or browser fingerprinting.

• wyzieFreeKey stores your free-plan API key after you redeem one, so the redeem page can display it to you again without requiring a second verification. Remains in your browser until cleared.
• wyzieDashboardKey stores the API key you enter on the dashboard so you remain signed in to your dashboard on that device. It is removed when you sign out of the dashboard, and otherwise remains until cleared.
• wyziePaymentId stored after checkout as a fallback reference for payment verification. Remains in your browser until cleared.
• wyzieUserEmail stored after checkout, including after a cryptocurrency payment, to assist with order lookups. Remains in your browser until cleared.
• wyzie_key on sub.wyzie.io/synced and sub.wyzie.io/transcribe stores the Pro API key you enter there, so you don't have to type it again. It stays in your browser until cleared.

Two of these values, wyzieFreeKey and wyzieDashboardKey, contain your API key. When stored, the key is held only in your own browser on the device you used; we never transmit it to advertisers or data brokers. Storing it locally is a convenience so you do not have to re-enter or re-verify the key, and it does not relieve you of your responsibility to keep the key secure. If you clear this data, we cannot recover the key for you. You can remove all of these values at any time by clearing your browser's site data for this domain, or by using the sign-out control on the dashboard. By using the Service you consent to this functional use of localStorage; it exists solely to support the key delivery, dashboard sign-in, payment verification, and order-lookup workflows described above, and is not used for advertising or cross-site tracking.

Our infrastructure provider, Cloudflare, may set a strictly necessary security cookie (such as __cf_bm) and a Turnstile CAPTCHA challenge cookie to distinguish humans from automated traffic and protect the Service from abuse. These cookies are controlled by Cloudflare, are required for the Service to operate securely, and are not used by Wyzie for tracking or advertising.

We use the information we collect for the following purposes:

• To issue and manage your API key.
• To process and verify payments via Stripe and NOWPayments.
• To send transactional emails (API key delivery, usage alerts), and news emails only to people who subscribed and confirmed at sub.wyzie.io/news. We send no other marketing emails.
• To enforce rate limits and detect abusive usage patterns.
• To comply with legal obligations and protect the security of the Service.
• To measure the Service's uptime. Our public status page and Status API (sub.wyzie.io/status) show only the health of our systems and subtitle providers, never anything about you.

We share limited information with third parties only as necessary to provide the Service:

• Stripe processes card payments. Stripe may collect billing information and payment data directly. We receive only confirmation of payment and your email address. Stripe's privacy policy is available at stripe.com/privacy.
• NOWPayments processes cryptocurrency payments. Your selected currency and wallet address are handled by NOWPayments. We receive payment status and no wallet details. Their privacy policy is at nowpayments.io/privacy-policy.
• Cloudflare provides DNS, CDN, DDoS protection, Turnstile CAPTCHA, Pages hosting, and speech recognition for Wyzie Transcribe and Fix Subtitles (Workers AI, including Deepgram's speech model when speaker labels are on). Cloudflare may process request metadata as part of this service. Their privacy policy is at cloudflare.com/privacypolicy.
• Resend delivers our emails: your email address is shared with it to send your API key, receipts and usage notifications and, if you subscribed, news emails. It acts as a data processor on our behalf and does not use your address for its own marketing.
• IPinfo tells us whether an IP address belongs to a hosting provider or VPN. We send it the IP addresses of API requests and of keyless download-page searches, nothing else. Its privacy policy is at ipinfo.io/privacy-policy.
• TMDB and Google Translate receive only the titles you search on our pages (TMDB) and the text of subtitles you ask us to translate (Google Translate).

We do not sell, rent, or trade your personal information to advertisers or data brokers.

Wyzie is operated from the United States, and the third-party processors listed above operate global infrastructure. As a result, your information may be processed in the United States and in other countries whose data protection laws may differ from those of the country in which you reside. Where personal information is transferred or processed across borders, we rely on the contractual and technical safeguards maintained by these processors. By using the Service, you acknowledge and consent to this cross-border processing of your information.

Your API key is a secret credential. We display it once at issuance and email it to the address provided at checkout. After that, we do not have a way to recover it for you without regeneration. You are solely responsible for keeping your API key secure. If your key is exposed, for example by committing it to a public code repository, sharing it in a forum, or failing to restrict access, all requests made with that key are your responsibility. We will not reimburse, compensate, or restore request credits consumed through unauthorized use of a key that was not adequately secured by you.

We retain your email address and associated API key record for as long as your API key remains active, or until you request deletion. API usage logs are retained for up to 90 days for operational and security purposes, after which they are deleted or anonymized. Email verification codes expire 15 minutes after issuance and are invalidated once used; a minimal record that a code was issued is retained for up to one hour solely to enforce anti-abuse rate limits. Keyless download-page counters and network hashes last at most 2 days. Media files sent to Wyzie Synced are deleted when the request ends. Audio sent to Wyzie Transcribe or Fix Subtitles is deleted when the job ends, and the finished subtitle after one hour. For a bulk batch, each media file is deleted once it is processed, the subtitles are kept for 24 hours, and the API key held during the batch is deleted with it after at most 24 hours. The index used for quote search keeps subtitle text. News subscribers are kept until they unsubscribe, and unconfirmed sign-ups are deleted after 7 days. Transcribe from URL fetches the link you give, keeps the audio only while the job runs, and deletes it when the job ends. Video files sent to Extract are deleted when the request ends. Per-key request counts by day are kept for 31 days under a hash of the key. A balance webhook URL stays on your account until you remove it or ask us to delete your data. You may contact us at [email protected] to request deletion of your data.

Recognised text kept for reuse is deleted after 30 days. Webhook URLs and their queued payloads are removed once delivered or given up, and within a few hours at most. Quality scores are kept with the subtitle file they describe. Browser-safe keys and their allowed websites are kept with your account.

We implement reasonable technical and organisational measures to protect the information we hold. All data in transit is encrypted via HTTPS. However, no system is completely secure. We cannot guarantee the absolute security of your information and are not liable for breaches that are outside our reasonable control, including breaches resulting from your own failure to secure your API key.

The Service is not directed to individuals under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

Depending on your jurisdiction, you may have the right to:

• Access, request a copy of the personal data we hold about you.
• Correction, request correction of inaccurate or incomplete data.
• Deletion, request deletion of your personal data, subject to legal or operational retention obligations.
• Restriction, request that we restrict the processing of your data pending a correction or objection.
• Portability, receive your personal data in a structured, commonly used, machine-readable format.

To exercise any of these rights, contact us at [email protected]. We will respond to verifiable requests within 45 days. We may need to verify your identity before processing a request.

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you additional rights:

• Right to Know, the categories and specific pieces of personal information we have collected about you, the purposes for collection, and with whom we share it.
• Right to Delete, request deletion of personal information we have collected, subject to certain exceptions (e.g., completing a transaction, security, legal obligations).
• Right to Correct, request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing, we do not sell or share personal information with third parties for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information, we do not collect sensitive personal information beyond what is described in this policy.
• Right to Non-Discrimination, we will not deny you service, charge you a different price, or provide a different level of service for exercising your CCPA rights.

To submit a California privacy request, email us at [email protected] with the subject line "California Privacy Request". We will respond within 45 days as required by law.

In the event of a data breach that is reasonably likely to result in harm to affected individuals, we will notify impacted users without unreasonable delay and in accordance with applicable US state breach notification laws. Notification will be sent to the email address associated with your account and will include: a description of the nature and scope of the breach, the categories of personal data affected, the likely consequences, and the measures we have taken or propose to take to address and mitigate the breach.

TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, WYZIE AND ITS OPERATORS SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, DATA, GOODWILL, OR OTHER INTANGIBLE LOSSES, ARISING OUT OF OR IN CONNECTION WITH ANY SECURITY BREACH OR ANY OTHER SECURITY INTRUSION. IN NO EVENT SHALL OUR TOTAL AGGREGATE LIABILITY TO YOU EXCEED THE AMOUNT YOU PAID TO US IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM.

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Your continued use of the Service after any changes constitutes acceptance of the revised policy.

The Wyzie Subs browser extension keeps your Wyzie key and display settings in your browser's local extension storage. It reads the title and video details of the tab you open it on to suggest a title. That reading happens on your device, and page addresses are not sent to us.

When you use it, the extension sends the following to Wyzie: your key, the title you search for, the season, episode and language you choose, and the file name of the video when one is available, which is used to rank matching subtitles. These requests are logged and kept as described under data retention in this policy.

Poster images load directly from TMDB, so TMDB receives your IP address when they appear. Subtitle files you load yourself stay on your device and are never uploaded.

Removing your key in the extension's settings deletes the key from your browser. Uninstalling the extension deletes everything it stored.

The extension also stores your subtitle style choices (font, size, colour, background, position and similar) in the same local extension storage. These choices never leave your browser. The extension runs only on the tab you open it on, after you open it, and only reads that page to find the video.

The setup quiz at quiz.wyzie.io has no accounts, no cookies and no tracking scripts. Your answers stay in your browser: they are kept in the page address after the # sign, which your browser does not send to our servers, and in nothing else. Sharing the result link shares those answers with whoever you send it to.

The quiz is served by Cloudflare, which may keep ordinary request logs (such as IP address and page requested) for security and reliability, as described elsewhere in this policy. The quiz reads prices from the store; it sends no personal data when it does.

For any privacy-related questions or data requests, contact us at [email protected] · (315) 898-1257 or via our contact page.

Support you send by email or Discord is handled by our AI support assistant. To classify your message and draft a reply, its content (and any account details you choose to include) is processed by a third-party AI provider, xAI, the maker of Grok. If you share an API key so the assistant can look up your account, that key is used only for the lookup and is never sent to the AI model. We keep support conversations for up to 30 days for quality, debugging, and abuse prevention, then delete them. We do not sell your messages or use them for advertising. For more detail, see our Support Assistant page.