Privacy and data handling — KeroTranslate
Last updated: 2026-10-16. Publisher: kurayan. This policy applies to the Chrome Web Store build, which is being prepared for release. The existing GitHub Beta 0.2 download does not yet include the encryption and explicit consent mechanisms described below; that older build stores API keys in plaintext in Chrome local storage.
What the extension handles
- The selected YouTube Live tab's audio after you press Start captions; not microphone audio.
- Speech transcripts, original comments typed in KeroTranslate, edited translations, and translations returned by providers. Comment text is automatically translated after a typing pause, before INSERT or posting.
- Provider API keys, model/language/display settings and explicit data-processing consent.
- The active capture tab ID and URL, capture status/errors, and aggregate session counts/timing (audio bytes, seconds, requests, tokens and failures).
Where data goes
Audio goes directly to the selected speech provider: Deepgram, OpenAI or DeepL Voice. Transcripts and comment text go directly to the selected translation provider: Google Gemini, OpenAI, DeepL or DeepSeek. Back-translation sends the translated text to that same translation provider. Keys authenticate only requests to the matching provider. Providers also receive normal network metadata, such as an IP address. Requests use HTTPS/WSS; OpenAI live audio uses WebRTC's encrypted transport after HTTPS session negotiation.
No KeroTranslate-operated backend, advertising service or analytics endpoint is present in this build. The developer does not receive audio, comment drafts or API keys through the extension. Provider retention, model-training and billing terms depend on your provider, account and plan; this extension cannot guarantee or delete provider-side retention. Read those terms before using sensitive content. Deepgram requests set mip_opt_out=true and OpenAI text requests set store=false; these flags are not a promise of zero retention by every provider.
Storage and deletion
Keys, settings and consent persist locally in this Chrome profile and are not synced by KeroTranslate. Storage access is restricted to trusted extension contexts. API keys are encrypted using AES-256-GCM. A randomly generated automatic-unlock key is saved alongside the ciphertext in the same Chrome profile. No passphrase is required after restart. This prevents direct plaintext persistence but does not protect against someone who can access the complete profile, execute code in the extension, or control the device. It is not an OS-backed credential vault. Existing plaintext keys are removed only after encrypted storage is read back and successfully verified. Deleting all API keys also deletes the automatic-unlock key.
Audio/transcripts/comments are processed in memory rather than intentionally written to a transcript history. Capture metadata and aggregate metrics use Chrome session storage. Stop ends capture; reloading/closing the page clears its displayed drafts and captions. Delete all API keys stops capture and pending requests, removes saved/legacy keys and withdraws processing consent. Settings remain. Uninstalling the extension removes its local data. To revoke a key or request provider-held data deletion, use that provider's account controls.
Your controls and purpose
Agree in Settings before network-backed features can begin. You choose the two providers independently. Start/Stop controls caption capture. INSERT only fills YouTube's chat field; the extension never presses Send. When you manually post a comment, YouTube processes that message under its own terms.
The implementation uses handled data only to provide these visible caption and comment-translation features, not advertising, sale or unrelated profiling. The intended use and transfer of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including Limited Use requirements.
Questions: use the public KeroTranslate issue tracker. Do not include API keys or private audio/text in public reports.
This website: optional analytics
Website analytics updated: 2026-10-25. This section concerns the official website only; Google Analytics is not added to the Chrome extension.
Only after you accept, we load Google Analytics 4 (G-SBMMGFZGFQ) to understand page visits and Chrome Web Store link clicks. Google receives page and browser/device information, cookie identifiers and network information such as your IP address. We disable advertising signals and ad personalization. Do not enter API keys or private information in website URLs.
Declining prevents the Google analytics tag from loading. You can withdraw consent at any time using “Analytics preferences” at the bottom of each page; this stops further analytics collection and removes this site's analytics cookies. Previously collected data is not erased by withdrawal. Our analytics cookies are configured to expire after 90 days without renewal. Your consent choice is stored locally until you change it or clear site data. If browser storage is unavailable, your choice applies only to the current page.
The website does not receive extension audio, comments, API keys or license details for analytics. See Google's Privacy Policy and how Google uses information from partner sites. GitHub Pages hosts this website and may process IP addresses and network information for delivery and security independently of analytics consent: GitHub Privacy Statement.