Legal
Privacy Policy
Your voice is the most personal thing you could hand a piece of software. Here is exactly what we do with it, and what we never do.
Last updated 9 August 2026
The short version
We store your uploaded audio, your reference voice, your consent recording and the narration you generate — because the service can't work otherwise. We do not train models on your voice, we do not sell it, and we do not give it to anyone else. You can delete all of it whenever you like.
Who controls your data
EKO SOLAR LLC, 1018 Ferndale St, Stone Mountain, GA 30083, USA. Reach us at privacy@timbre.app.
What we collect
Account details. Your email address, and your name and profile picture if you sign in with Google. A password hash if you sign up with email — we never see the password itself.
Audio you upload. The video or audio file you give us to build a voice from, and the reference clip we cut out of it.
Your consent recording. The short clip you record in the browser to prove the voice is yours, plus the date and the IP address it came from. This is evidence that you gave permission, so we keep it for as long as the voice exists.
Narration you generate. The scripts you type and the audio we produce from them.
Usage. How many minutes you've generated this billing period, so we can enforce plan limits.
Payment details. Handled entirely by Square. Card numbers never reach our servers — we store only a customer reference and your subscription status.
What we never do
We do not use your voice, your uploads or your generated audio to train or fine-tune any model. The speech model we run is a fixed, pre-trained one that reads your reference clip at the moment of generation and forgets it afterwards.
We do not sell your data. We do not share it with advertisers. We do not licence your voice to anyone.
Who processes it for us
We use a small number of providers to run the service. Each of them only sees what they need to:
Supabase — accounts, database, file storage. Modal — the GPU that generates your audio; clips pass through it during generation. Square — payments and subscriptions. Google — only if you choose to sign in with Google, and only to confirm who you are.
How long we keep things
Voices and their audio — until you delete them, or 60 days after you close your account.
Consent recordings — for as long as the voice exists, then deleted with it. These exist to protect you as much as us.
Generated takes — until you delete them, or 90 days, whichever comes first. Download anything you want to keep.
Billing records — seven years, because tax law requires it.
Deleted data leaves our backups within 30 days.
Your rights
You can see, correct, export or delete your data from Account → Settings, or by emailing us. If you're in the EEA or UK you have rights under GDPR; if you're in California you have rights under the CCPA. We apply the same standard to everyone rather than sorting people by geography.
We respond to requests within 30 days.
Security
Everything is encrypted in transit and at rest. Access to your voices is restricted at the database level — one account cannot read another's data even if the application layer has a bug.
If a breach ever affects your data, we will tell you what happened and what we're doing about it, without waiting to be asked.
Children
Timbre is not for under-18s and we don't knowingly collect their data. If you believe a child has an account here, email us and we'll remove it.
Changes
If we make a material change to this policy we'll email you before it takes effect. The date at the top always reflects the current version.