Toldya
Privacy policy
This policy describes how Toldya processes data when you use the Chrome extension, the Toldya backend, or Toldya’s optional Discord server integration.
Who we are
Toldya is operated by Friendly Alien Studio. Toldya helps users hear selected Discord messages aloud instead of continuously watching Discord.
For privacy questions or requests, contact support.
How Toldya works
Toldya currently supports two ways of receiving Discord alerts:
- Discord Web: the Chrome extension reads new message content from the Discord channel you selected in
discord.com, prepares that text, and speaks it using Chrome and your operating system’s installed voices. - Discord server integration: a server administrator can add the official Toldya bot and select channels. New messages in those configured channels can then be relayed to licensed Toldya users who connect their Discord account and are authorized for that server.
Toldya is designed to process new alerts, not to create a searchable archive of your Discord history.
Data Toldya processes
Discord Web message data
When you use Toldya with Discord Web, the extension reads new message text that is already visible in the one Discord channel you selected on discord.com. That text can include message accessories and embed text. The extension also keeps, on your device, an optional author filter and small pronunciation hints used to make speech more intelligible. Those two items are not sent to the backend.
For each new matching message, the extension calls POST /alerts/prepare. That request sends the extracted message text, the selected channel ID, any ignore-phrases you configured, and a short-lived session token. The backend removes ignore-phrases and display-only formatting, then returns cleaned text. That message text is processed to prepare speech. It is not written to Toldya’s configuration database.
The extension watches only the channel you selected. Messages already on screen when watching starts are not replayed, and messages older than about 30 seconds are skipped.
Discord server integration
A server administrator can install the official Toldya bot and save the channels Toldya may relay. This is separate from the single channel selected for Discord Web. A licensed installation that has connected Discord and is authorized for that server receives new alerts from the administrator’s selected channels, not only from the channel chosen in the extension.
The bot uses Discord’s message-content gateway. Discord can deliver new message events for channels the bot is allowed to view. Before a message is prepared, Toldya checks it against the saved allowlist: the channels stored for that server, together with any server and channel list configured on the backend. Messages outside that allowlist are discarded. They are not prepared, relayed, or written to the configuration database.
An allowlisted message is cleaned the same way as a Discord Web message, including embed title, description, fields, and footer text. Toldya then sends it over an authenticated WebSocket to licensed installations authorized for that server. Each relay includes the cleaned message text, the Discord server ID, channel ID, message ID, author ID, and author display name. The extension uses the cleaned text for speech.
Discord account connection
Connecting Discord uses the identify and guilds OAuth scopes. During that request, Toldya receives your Discord user ID and the IDs of servers your account belongs to. It retains only your user ID and the IDs of Toldya-configured servers you belong to. That subset is placed in a signed binding stored in the extension. Toldya does not store your Discord username or the full server list.
The OAuth access token is used for that connection check and then dropped from backend memory. It is not stored in the extension or the configuration database, and it is not put in a URL. Toldya does not call Discord to revoke the token, so Discord may continue to treat the authorization as active until it expires under Discord’s own rules. The binding ticket is not itself live membership proof. When the extension exchanges a license session, Toldya asks Discord whether that user is still a member of the configured servers.
When a server administrator sets up Toldya, Discord OAuth is used to confirm that the administrator can manage the selected server and to display the server name and the channels the bot can access. Those names are held in backend memory for that setup, for up to 10 minutes. They are not columns in the configuration database. A previously selected channel ID can remain stored if the bot can no longer see that channel and the administrator saves again.
Licensing and device activation
Toldya uses Dodo Payments for checkout, license issuance, and license activation. The extension may store on your device:
- your Toldya license key
- a random installation/device identifier created by Toldya
- signed activation and Discord-binding tickets
- selected channel and author-filter settings
- ignore-phrases and speech settings
These values stay in Chrome local extension storage on your device. Toldya does not copy that set into the configuration database. The activation ticket does not expire by itself. It carries a hash of the license key, the device identifier, and the license instance, not a second copy of the raw key. License and activation information is sent to the Toldya backend and, where needed, to Dodo Payments to activate, validate, or deactivate the license. Toldya does not store raw license keys in its database.
Speech on your device
Speech is produced locally with Chrome’s text-to-speech API and the voices installed on your operating system. Language, voice, rate, and pitch stay in extension storage. Toldya does not send message text to a third-party text-to-speech provider.
Operational analytics
Toldya records limited operational events so we can understand whether the relay is working and diagnose failures. The backend writes each accepted event as one structured line to its process log. An event may include the random installation identifier, whether an alert came from Discord Web or the server integration, extension version, operating-system category, latency, and a limited failure or skip reason.
The analytics layer is designed to reject message text, prepared speech text, Discord message IDs, server IDs, channel IDs, author identities, raw license keys, session tokens, and Discord OAuth tokens. These product events are not sent to Google Analytics. Setting TOLDYA_ANALYTICS=false on the backend stops this output. The application does not define how long the host keeps those log lines.
Website and infrastructure logs
The Friendly Alien Studio website is hosted by Netlify. The Toldya backend is hosted by Render. These providers may process ordinary request and operational logs, such as IP address, user agent, timestamps, requested paths, and error information, under their own policies. Netlify Analytics continues to run as part of hosting. Toldya does not set a retention period for those provider logs.
The extension does not request device location. The backend keeps short-window rate-limit counters in memory, keyed by IP address or by a hash of the license key. Those counters are not a location profile and are not written to the configuration database. An IP address may still appear in Render’s hosting logs.
The public marketing pages, including Toldya, guides, and growth pages, also load Google Analytics 4 (measurement ID G-LCM4D1XSE7) to count visits, pages, and traffic sources. Google may store analytics cookies in the browser for that measurement. These pages do not include a cookie banner or other consent control. Browser controls that block analytics cookies or the Google tag will stop that measurement.
Why we process this data
- to extract, clean, relay, and speak the alerts you chose to hear
- to determine whether a licensed installation is authorized to receive a Discord server’s alerts
- to let server administrators choose which channels Toldya may relay
- to activate and validate Toldya licenses
- to prevent abuse, rate-limit the service, diagnose failures, and improve reliability
Toldya does not sell Discord message data or use it to serve targeted advertising.
Storage and retention
Toldya’s application database does not have a table for Discord message content. Message text is handled in memory to clean it, relay an allowlisted server alert, and return cleaned text for speech. Toldya does not promise that every transient copy, host log, or provider backup is deleted immediately. Supabase Postgres stores the Discord server ID, the selected channel IDs, whether relaying is enabled, and installation and update timestamps. It does not store a message archive.
Operational analytics and infrastructure logs may be retained by the host for service reliability, security, and troubleshooting. The application code does not set that retention period. Local extension settings remain on your device until you change them, clear extension storage, disconnect the installation where applicable, or uninstall Toldya.
Dodo Payments retains payment and license records under its own policies. Discord retains Discord account and server data under its own policies.
Third-party services
- Discord — source platform for messages, OAuth account/server authorization, and the official Toldya bot.
- Render — hosts the Toldya backend and operational logs.
- Supabase Postgres — stores Discord server and channel configuration for the server integration. The Render-hosted backend connects to this database.
- Dodo Payments — checkout, subscriptions, license issuance, activation, validation, and deactivation.
- Google / Chrome — extension distribution, local extension storage, browser APIs, and local text-to-speech.
- Netlify — hosts the Friendly Alien Studio website and provides Netlify Analytics.
- Google Analytics — measures visits to the public marketing site. This is separate from Chrome extension data described above.
Your choices
- Choose whether to use Discord Web, connect Discord server alerts, or neither.
- Choose which Discord Web channel Toldya watches and, where available, which author to hear.
- Turn TTS off at any time.
- Change or clear local speech and ignore-phrase settings.
- Disconnect Discord from the extension.
- Disconnect a licensed device to release its activation slot.
- Uninstall Toldya to remove its local extension storage.
- Contact support for privacy questions or requests.
Chrome Web Store Limited Use
Information received through Chrome and Google APIs is used only to provide and improve Toldya’s user-facing functionality and related security and reliability. We do not sell that information, use it for targeted advertising, or transfer it for unrelated purposes.
Security
Toldya uses HTTPS for normal backend requests and authenticated WebSocket sessions for server-relayed alerts. Short-lived signed sessions are used so the extension does not need to send the raw license key with every alert. No system is perfectly secure, and users should protect their browser profile, Discord account, and license key.
Children
Toldya is not directed to children. Users must satisfy Discord’s applicable minimum-age requirements and any legal requirements for entering into a paid subscription.
Changes
We may update this policy as Toldya changes. When we make material changes, we will update this page and its effective date.
Contact
Questions about this policy? Contact Toldya support.