Privacy Policy

Who We Are

Flash Translate is independently operated by developer Hao Zhang (not a company or organization), who acts as the data controller for your personal information. For any data-related questions, contact support@flashtranslate.net.

What We Collect

If you create an account, we collect the email address and unique ID provided by your sign-in method (Google/Apple OAuth or email/password), plus your subscription status. For subscribers only, we also store your LLM API key(s), encrypted, so they can sync across your devices. We do not collect your translation text, your API usage logs, or your browsing history; those are generated and stored only on your local device.

How We Protect Your API Key

Free-tier and guest users: your API key is encrypted on-device with AES-256-GCM before being saved to local browser storage; it is never uploaded to our servers, and the local encryption key never leaves your device. Subscriber users: your API key is transmitted end-to-end encrypted (JWE) and stored on our servers re-encrypted at rest; it is never written to disk or logs in plaintext on either end.

Browser Permissions and What Each Is Used For

• storage — saves your settings, LLM configurations, and login state locally on your device.

• tabs — used only to detect when a new tab is opened, so we can silently attempt to restore your login session; we do not read tab content with this permission.

• activeTab — used only when you actively trigger selection or full-page translation, to temporarily read the current page's text for content and language detection; no background monitoring.

• identity — opens the system authorization window for Google/Apple sign-in (OAuth); used for no other purpose.

• alarms — schedules periodic retries when a cloud config sync fails, so syncing can resume even after the background service worker goes to sleep.

• Preset LLM provider domains (api.openai.com, generativelanguage.googleapis.com, api.anthropic.com, openrouter.ai) — lets the Extension connect directly to the official API you selected in settings to perform translation requests.

• Optional custom-domain access — requested once, only if you configure a custom API endpoint outside the preset list, and used solely to connect to that endpoint.

Data Storage Location & Cross-Border Transfer

Your account data is stored on Supabase infrastructure located in the United States. By using this service, you consent to this cross-border transfer of your data. Our current user volume is well below the threshold that would trigger a mandatory cross-border data-transfer security assessment under applicable law.

Third-Party Data Flow

The text you select, or the page/subtitle content you choose to translate, is sent directly from your device to the LLM provider you configured (e.g. OpenAI, Google, Anthropic, OpenRouter, or your custom endpoint) using your own API key. This traffic never passes through or is retained by Flash Translate servers; we cannot see your translation content. Please avoid translating highly sensitive or confidential personal information, and review your chosen LLM provider's data retention policy (e.g., whether they use your inputs to train their models). Please also review your chosen LLM provider's own privacy policy, since your text is subject to their data-handling practices.

Your Rights

You can delete your account at any time from the settings page, which permanently removes your account, subscription status, and cloud-stored (encrypted) LLM configuration data. When you sign out, you can choose to keep or clear your locally stored LLM configurations. Your local translation logs are retained on-device regardless of sign-in state, since they are never account-bound, and can be cleared manually from the Logs page at any time.

Cookies & Analytics

This website uses Cloudflare Web Analytics, a privacy-preserving analytics tool that does not use cookies and does not track individual visitors. We do not run advertising trackers or third-party analytics scripts that build a profile of you.