Privacy Policy
Last updated 1 October 2026
Tokd turns writing into speech and speech into writing. Doing that means handling the things you ask it to read and the things you say, so this page sets out exactly what is collected, where it goes, and how to get rid of it. It describes the service as actually built, not as a category of product.
1. Who we are
Tokd is operated by Ali Eslami, based in Vancouver, Canada. For questions about this policy or your data, write to privacy@tokd.ai.
2. What we collect
Your account
An email address and, if you set a password, a bcrypt hash of it — never the password itself. If you sign in with Google we store the identifier Google assigns your account and the address it gives us; we never receive your Google password.
When you create an account we also record how you signed up (email or Google), which part of Tokd you signed up from (the website, the browser extension or an app), your browser's language and time zone, and when you accepted these terms.
What you ask Tokd to read
When you queue an article, a selection or a PDF, we store its text, its source URL, its title and any preview image, so the queue survives a reload and can be resumed on another device. This is the most personal thing here: it is a record of what you chose to read.
What you say
Dictation audio is written to a temporary file, sent to the transcription engine you selected, and deleted as soon as the request finishes. We do not keep recordings of your dictation. The resulting text is returned to your device and is not stored on our servers unless you separately save it.
Generated audio, and voice clones
Speech we generate for you is stored in object storage so it can be replayed without paying to synthesise it twice. If you create a voice clone, the sample you upload is stored until you delete the clone. A voice sample can identify you; treat it as you would a photograph.
Your own API keys
On the free plan you bring your own keys for the engines you use. They are encrypted before they are written down and decrypted only to make the request you asked for. Nobody at Tokd reads them, and they are never sent anywhere except the provider they belong to.
Usage and billing
For each job we record which engine ran, how long it took and what it cost, so the meter on your account is accurate. If you subscribe, our payment processor holds your card and we store only its customer reference and what each payment came to. Card numbers never reach our servers.
How you use Tokd
Each time you use Tokd we record that you did: when, which part of Tokd (the website, the extension or an app, and its version), what kind of use (dictating, listening, saving something to your queue, reading a page, translating, signing in), which engine and language, how much (characters, seconds or words), and whether it worked. We also note when you were last active. This includes use that never passes through our servers, such as listening with your browser's own voices or dictating with your own API keys, which the extension and the apps report to us.
These records never contain what you dictated, heard or read: no text, no titles, no audio and no web addresses. We use them to understand how Tokd is used, to fix what fails and to decide what to build. The Tokd keyboard on iPhone reports nothing.
Email from us
We email you about your account when we need to, such as to confirm your address. We send email about new features and offers only if you said yes, in the box on the sign-up form or on your settings page. We record your answer and when you gave it, and you can change it there at any time.
3. Who else sees it
Tokd runs some engines itself, the Tokd AI Engines, and uses other companies' for the rest. To do the work you ask for, the relevant text or audio is sent to the engine you picked or, where you have not picked one, to one Tokd chooses:
| Purpose | Who receives it |
|---|---|
| Dictation | AssemblyAI, OpenAI, Deepgram, Google, ElevenLabs, Groq, Fish Audio, SiliconFlow, or the Tokd AI Engine — whichever you pick |
| Listening | ElevenLabs, OpenAI, Google, Amazon Web Services, Fish Audio, SiliconFlow, or the Tokd AI Engines |
| Cleaning | Groq or Anthropic, which Tokd chooses, to take captions, navigation and other clutter out of what you ask it to read |
| AI polish | Anthropic, OpenAI, DeepSeek, SiliconFlow, Google, Groq, or the Tokd AI Engine — whichever you pick |
| Translation | DeepSeek, which Tokd chooses, when you ask to hear something in another language |
| Pronunciation | DeepSeek, which Tokd chooses, once per article when you listen in English with a Kokoro Voice, to find the words that are hard to say, how to say them, and which words to stress; what it finds is kept only with your own Queue item, and a listen read by Heart (Higgs) sends nothing for this |
| Hosting, database, storage | Railway, Cloudflare R2 |
| Payments | Stripe |
| Resend, for the confirmation message only |
Each of these companies has its own privacy policy governing what it does with what it receives. We do not sell your data, and we do not use what you read or dictate to train any model.
4. Why we are allowed to
We process your data to provide the service you asked for, to bill you accurately, to keep accounts secure, to improve Tokd from records of how it is used, and to meet legal obligations. Where the law requires consent — a voice clone, or email about new features and offers — we ask for it, and you can withdraw it: by deleting the item, or in your settings.
5. How long we keep it
| What | How long |
|---|---|
| Dictation audio | Deleted when the request finishes |
| Queue items, library, books, voice clones | Until you delete them, or your account closes |
| Account and usage records, including your email answer | While the account exists; billing records are kept as long as tax law requires |
6. What you can ask for
You can see your data, correct it, take a copy of it, or have it erased. Most of it you can delete yourself from within the app; for the rest, or to close your account entirely, write to privacy@tokd.ai and we will act within 30 days. If you are in the EEA or the UK you may also complain to your data protection authority; in Canada, to the Office of the Privacy Commissioner.
7. Security, honestly stated
Passwords are hashed with bcrypt, your API keys are encrypted at rest, everything travels over TLS, and signing out invalidates outstanding sessions immediately. No system is perfectly secure, and we would rather say so than imply otherwise.
8. Children
Tokd is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has given us data, write to us and we will delete it.
9. Where your data lives
Our servers and storage are in the United States, and the engines listed above operate in several countries. Using Tokd means your data is processed outside your own country, including in jurisdictions whose privacy laws differ from yours.
10. Changes
If this policy changes materially we will say so in the app before the change takes effect. The date at the top always reflects the current version.