1. Why we use data

FalaLume obtains the audio message you select in WhatsApp Web to transcribe it. When you request a translation, it sends the original text and selected languages. Data is used to provide the requested feature, not for advertising, data sales or credit assessment.

2. What leaves your computer

The FalaLume developer runs no intermediary server, receives none of this audio or text, and includes no telemetry. The extension does not send whole conversations, contact names or profile photos as part of these requests. Selected audio or text itself may contain personal information.

Selected audio: sent over HTTPS to Cloudflare's API using the account you configured.
Original text and languages: sent to Cloudflare when you click Translate.
Account ID and token: used to identify your account and authorize Cloudflare requests.
Connection test: sends only the sample phrase “Hello.” for translation, along with authentication details.

3. What stays in your browser

Saved credential: the Account ID and token are encrypted in your local browser profile.
Encryption key: generated in the browser and stored locally for automatic use. There is no FalaLume password.
Entered details: valid-format ID and token are saved separately, encrypted in local storage, even before activating the connection.
Preferences, consent version and reminder timing stay local. The extension does not sync these data.
Local history: transcripts, up to five translations per message, languages and the message identifier are encrypted in this profile to restore text beside the same audio. The extension does not save audio. A local technical index keeps hashed identifiers, size and update time.
Manual backup: an encrypted file contains only transcripts, translations, languages and message identifiers. It excludes the token, Account ID, profile encryption key and preferences. The password is used only in memory and is neither sent to Cloudflare nor stored by the extension.

4. How long data is kept

The credential and encryption key remain in your profile until you delete configuration or extension data. Replacement overwrites the previous credential. Partial entries remain until activation, discarding the fields, cancelling replacement or deleting configuration. Closing the browser does not delete these fields or lock the connection. Texts survive closing and restarting the browser. The limit is 500 messages or 4 MB of encrypted records; the oldest are removed when either limit is reached. Delete text for this audio removes its record; Delete saved texts in the panel removes all history. Delete configuration also removes history. Deleting a WhatsApp message does not guarantee local history deletion: use these controls to remove it. Backup files remain where you chose to download them. Deleting history, configuration or the extension does not delete exported files. Anyone with the file and password can read its texts. Matching audio depends on WhatsApp retaining the same identifier in the destination profile.

5. How credentials are protected

The Account ID, token and draft use AES-GCM encryption. The encryption key is stored in the same profile for automatic use by the extension. The cryptography API cannot export it, but this does not create an access barrier for someone who controls the profile or computer. Encryption avoids storing the token as plaintext; it does not replace operating-system account security. Anyone using this profile can transcribe with the configured account. The interface does not offer a way to reveal or copy the saved token.

6. Cloudflare and other services

Cloudflare processes requests and may receive technical metadata such as IP address, account, time and usage. Its processing and retention follow its own policies. FalaLume does not configure AI Gateway, history storage or intermediary services. External links and the bank you use to donate are subject to those services' policies.

7. Your choices

Capture may mark audio as played in WhatsApp. Cancel may not stop processing that Cloudflare has already started.

Do not click Transcribe or Translate if you do not want to send data.
Delete text for this audio removes its displayed text and saved record. Copy accesses the clipboard only when requested.
Replace credential changes the Account ID and token without revealing the previous key.
Delete configuration removes the credential, encryption key, draft, preferences and all local history.
Revoke the token in Cloudflare to prevent remote use. Deleting configuration or uninstalling the extension does not revoke it.
In the icon panel, Save new texts automatically can be turned off. Older records remain available. Manage texts and backup shows used space, warns at 80% and lets you delete texts for one conversation.

8. Donations and reminders

Donations are optional. The Pix QR code is a local file without tracking. You choose the amount and confirm payment in your banking app. The extension does not confirm payments or collect donor details. Reminders appear only when you open a configured panel, at most once every 48 hours; you can dismiss or disable them. Donations do not change your Cloudflare quota.

9. This version and contact

This is a test version of an independent extension, with no affiliation to WhatsApp, Meta or Cloudflare. For support, questions or privacy requests, email suportefalalume@gmail.com. Material changes to data handling should be disclosed before taking effect.

Your privacy in FalaLume