Privacy Policy — Kaita (Кайта · 凯塔)
Last updated: 13 November 2026 (version 1.0)
Applies to: the “Kaita” browser extension (Russian “Кайта”, Chinese “凯塔”) for Google Chrome and Microsoft Edge from version 1.0 (the “Extension”) and to Kaita accounts.
Who we are (data controller): Begali Khudaiberdiev, an individual based in Bishkek, Kyrgyz Republic (“we”).
Data protection contact: [email protected]
The Russian version of this policy is the original; this is a translation.
1. Summary
- Speech recognition with the built-in “Кайта · Whisper” engine runs on your device. Your voice, recordings and recognised text are never sent to our servers.
- You can try the Extension without an account: during the first sessions (by default 3 practice sessions or 2 days, whichever comes first) nothing about you is sent to a server.
- To keep practising you need a free email account (no password — we email you a one-time code). The account saves your progress and cards across your devices and tells us which modes and languages people need.
- Your account stores your email, practice statistics (mode, languages, video, time, number of phrases, average score) and your cards if you sync them. You can switch statistics off and delete your account right in the Extension.
- No ads and no ad trackers. We do not sell data and share it only with the service providers listed below that run Kaita.
- Speech recognition exception: if “Browser” or “Auto” recognition is selected in Chrome (“Auto” uses the browser recogniser in Chrome), audio is processed by Google’s speech service. See section 5.
2. Data on your device (with or without an account)
| Data | Purpose | Where it is stored |
|---|---|---|
| Microphone audio (only while recording in practice or simultaneous mode) | Recognise what you said and compare it with the phrase | Processed in browser memory on your device (Whisper engine). Kept in memory only so you can replay it; discarded on the next attempt or when the page closes. Never written to disk or sent to our servers. Chrome exception — section 5. |
| Recognised text and scores (accuracy, tone and pronunciation errors) | Show results, tips and your own statistics | chrome.storage.local on your device |
| Saved phrases and cards: phrase and translation text, YouTube video ID and title, timestamps, notes, review schedule | Your review list | chrome.storage.local; sent to the server only if you turn on card sync (section 3) |
| Video history (up to 50 recent videos plus pinned ones): ID and title, position, a copy of the subtitles, thumbnail | Continue where you stopped | chrome.storage.local; never sent to the server |
| Free-trial counter (date of first session, number of sessions and attempts, practised languages) | The free trial without an account | chrome.storage.local; on sign-up only the numbers are copied to your profile (section 3) |
| Settings (language, mode, pinyin, recognition engine, etc.) | Running the Extension | chrome.storage.local |
| Whisper recognition model (~80 MB, or ~250 MB for “High quality”; not your data) | Offline recognition | Downloaded once from Hugging Face (huggingface.co) and cached by the Extension |
3. Account data (only after you sign up)
| Data | Purpose | Legal basis |
|---|---|---|
| Email and account ID (a random identifier), sign-up and last sign-in dates | One-time-code sign-in, running your account, replying to you | Performance of the contract (Terms of Use) |
| Profile: country (derived from the browser time zone and language — not from your IP or location), interface language, native and target language, browser (Chrome/Edge), Extension version, free-trial numbers, “How did you hear about Kaita” (optional) | Understanding who Kaita helps; planning languages and features | Your consent at sign-up |
| Practice statistics: session start and end, mode (watch, shadowing, interpreting, simultaneous, cards), language pair, YouTube video ID, title and channel name, duration, number of phrases (attempts), average score, simultaneous-mode coverage, number of cards reviewed and added, Extension version | Your progress on all devices; improving Kaita (which modes, languages and videos help, where scoring is too strict) | Your consent; switch it off at ⚙ Settings → Account → “Save practice statistics to my account” |
| Cards (if you turn on sync): phrase and translation text, notes, video ID/title and timestamp, review schedule | The same cards on another computer | Performance of the contract, at your request |
| Feedback (“Report a problem / Idea”): your message and — only if the box is ticked — technical details: version, browser, page type, mode, engine, languages | Fixing bugs, replying to you | Your consent (you send it) |
| Consent record: date, version of the consent text, withdrawal date | Proving that consent was given or withdrawn | Legal obligation |
Never sent to our servers: audio or voice recordings, recognised text, subtitle text (except cards you choose to sync), browsing history outside YouTube, content of other websites, precise location, advertising IDs, payment data.
Even without an account, when Kaita accounts are enabled the Extension downloads general settings from our server every few hours (for example, the length of the free trial or a maintenance notice). The request contains no data about you; like any website, the server sees the IP address and time of the request.
4. Who processes data (processors)
- Supabase (Supabase Inc., USA) — database and email sign-in. Data is stored in the Frankfurt, Germany (EU) data centre on Amazon Web Services infrastructure. Supabase processes data only on our instructions.
- Resend (Resend Inc., USA) — sends sign-in code emails from [email protected]. Resend receives your email address and the code email.
- Cloudflare (Cloudflare Inc., USA) — hosting of getkaita.com, DNS and attack protection. When you visit the website, Cloudflare processes your IP address and technical request data. The website uses no advertising or analytics cookies.
- Hugging Face — download of the recognition model files (IP address and technical request data; no voice or texts).
Data may be transferred outside your country (Germany, USA). We choose processors that use standard contractual clauses and modern protection (encryption in transit and at rest).
5. Browser speech recognition and other services
Built-in browser speech recognition (Chrome, “Browser” or “Auto”). This mechanism (Web Speech API) is server-based: audio is sent to Google’s speech service and handled under Google’s terms. If you do not want this, choose “Recognition: Кайта · Whisper” in the panel settings so audio stays on your device. In Microsoft Edge the Extension always uses Whisper.
“AI analysis” in the Library only builds a text prompt and copies it to your clipboard; the button opens an AI chat website (claude.ai). You decide what to paste and send; the Extension sends nothing itself.
YouTube. The Extension runs only on www.youtube.com and reads the subtitles YouTube provides to the player on the page you opened. Video thumbnails load from i.ytimg.com. Google’s terms apply.
Extension stores (Chrome Web Store, Microsoft Edge Add-ons) collect installation data under their own terms; we receive only aggregate statistics.
6. Browser permissions
- Microphone: the browser asks for permission on www.youtube.com at the first recording. You can revoke it in the browser’s site settings.
- storage, unlimitedStorage: keeping your data (including video history with subtitles) locally.
- Access to www.youtube.com: showing the panel on video pages.
- offscreen: running Whisper recognition in a background document of the Extension.
- The Extension does not request access to any other website. Requests to our account server need no extra permission.
7. Retention
- Account, profile, cards — as long as you have an account. If you do not sign in for 24 months, we may delete the account after a 30-day email notice.
- Practice statistics — no longer than 24 months, then deleted.
- Feedback — as long as needed to reply and fix the issue, at most 24 months.
- Code emails — sending logs are kept by Resend under its terms (usually up to 30 days).
- Database backups (if enabled) are overwritten within 30 days after deletion.
- Data on your device — until you delete it (in the Library or by removing the Extension).
8. Deleting data and switching statistics off
- Switch statistics off: Kaita panel → ⚙ Settings → Account → “Open” → “Save practice statistics to my account”. Collected but unsent data is removed from the device.
- Delete statistics on the server: same place → “Delete my statistics”.
- Delete your account: same place → “Delete account and data” → “Yes, delete forever”. Your account, email, profile, statistics, cards and feedback on the server are deleted immediately. Data on your device stays until you delete it.
- If you cannot access the Extension, email [email protected] from your account address — we will delete the account within 30 days.
- “Export” in the Library saves your data to a JSON or CSV file on your computer.
9. Your rights
Depending on where you live (the Kyrgyz Law on Personal Information, the EU GDPR, Russian Federal Law 152-FZ, China’s PIPL, etc.) you have the right to know what data we hold about you, get a copy, correct it, delete it, restrict processing, withdraw consent (without affecting processing before withdrawal) and complain to your data protection authority. You can exercise most rights yourself in the Extension; for the rest email [email protected] — we reply within 30 days.
10. Children
The Extension and accounts are not intended for children under 13 (or under the age of digital consent in your country) without the consent of a parent or guardian. If you learn that a child created an account without such consent, contact us and we will delete it.
11. Security
All server traffic uses HTTPS. The database enforces row-level security: each user can access only their own data; only the Kaita administrator, signing in with a one-time code, can see overall statistics. Sign-in is passwordless, so we store no passwords. All executable code (JavaScript and WebAssembly) ships inside the Extension package; no remote code is executed.
12. Limited Use (Chrome Web Store)
The use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements: data is used only for the Extension’s single purpose (shadowing and interpreting practice on YouTube videos and keeping your progress), is not sold, not used for advertising or credit-worthiness, and not transferred to third parties except the processors in section 4, as required by law, or with your consent. Humans do not read your data except when you contact support, for security, or when the law requires it.
13. Changes
We publish new versions on this page and update the date above. We announce material changes (new data types, purposes or processors) in the Extension before they take effect and ask for consent again where required. Paid features, if any, will be described here before launch.
14. Contact
Begali Khudaiberdiev, Bishkek, Kyrgyz Republic · [email protected]