Privacy & Data Transparency
Last updated: September 25, 2026
Client-Side File Parsing
Your .srt and .vtt files are parsed directly inside your browser memory.
Subtitles Never Stored
Dialogue cues are processed in transient memory for translation and never saved to a database.
AES-256 Key Encryption
Optional custom Gemini API keys are encrypted at rest with AES-256-GCM and deletable anytime.
1. Overview and Scope
SriSubs (“we”, “our”, or “us”), published by Akash Makes and accessible at srisubs.com, is an AI-assisted linguistic productivity utility designed to translate English subtitle files (.srt and .vtt) into natural, colloquial spoken Sinhala. We value your privacy and believe in complete technical transparency about how data is received, processed, secured, and retained when you use our service.
2. Subtitle Processing & Zero File Storage
We have architected SriSubs with a privacy-first workflow so that your media scripts and subtitle files are not hoarded on our servers:
- Client-Side File Parsing: When you upload a subtitle file, parsing of file headers, cue numbers, and timestamps occurs locally inside your web browser via JavaScript.
- Transient AI Translation: Subtitle dialogue text lines requiring translation are sent securely over encrypted TLS (HTTPS) connections to our backend translation endpoint and forwarded to Google Gemini AI models for translation into colloquial Sinhala.
- No Subtitle Content Storage: We do not store, index, catalog, or archive your subtitle files, uploaded scripts, dialogue texts, or translated output files in any database, disk storage, or permanent repository. Once an API translation batch finishes and the translated lines are returned to your browser session, transient server memory is immediately released.
3. Information We Collect and Store
Depending on how you interact with SriSubs, we collect and store the following specific categories of information:
A. Google Sign-In Profile Data (NextAuth)
If you choose to sign in using Google OAuth, NextAuth retrieves basic profile details provided by Google, including your name, email address, profile picture URL, and Google user ID. This information is used strictly to authenticate your account session and display your avatar and name in the application. Sessions are maintained via JSON Web Tokens (JWT) stored in secure HTTP cookies.
B. Personal Gemini API Keys (Encrypted at Rest)
Authenticated users may optionally save their own personal Google Gemini API key to bypass shared quota limits. When you submit an API key:
- The key is immediately encrypted server-side using authenticated AES-256-GCM encryption with unique initialization vectors.
- The encrypted ciphertext is stored in our Upstash Redis datastore associated with your user ID. Raw plaintext keys are never written to disk or permanent logs.
- In the user interface, only a masked representation (for example,
AIzaSy...7890) is shown. - You can delete your stored key at any time from your Account Settings, which instantly purges the record from our database.
C. In-Memory Rate Limiting Counters
To protect our service and free-tier quotas from automated abuse, our translation API maintains temporary, sliding-window request timestamps per client IP address (or user account ID) in server memory. These timestamps expire automatically after 60 seconds and are not stored in any permanent database or user log file.
D. Anonymous Aggregate Usage Statistics
To display live platform activity, our client tracker generates a pseudorandom visitor identifier (UUID) stored locally in your browser’s localStorage. This identifier sends an anonymous heartbeat ping every 20 seconds to determine concurrent active users via short-lived records (expiring in 60 to 120 seconds). When a file finishes translating, an anonymous global counter is incremented. No personally identifiable information or subtitle text is linked to these metrics.
E. User Feedback and Ratings
Submitting translation feedback requires signing in with an authenticated account. Each account may submit a maximum of one rating and optional comment. All submissions are moderated and reviewed before appearing publicly on the platform. When submitting, choosing “Show my name and photo” displays your Google profile name and profile picture publicly alongside your review. If unchecked, your review is saved as “Anonymous” with no photo, and receives a randomly generated illustrative geometric avatar completely unrelated to your personal identity. Comments should not include personal, confidential, or sensitive information since approved testimonials are shown publicly. If you wish to have your submitted feedback removed, you can request removal at any time by contacting us at support@srisubs.com.
4. Advertising and Cookies
SriSubs displays third-party advertisements served by Google AdSense to help fund and maintain free access to our translation tools. Please review the following information regarding how advertising and cookies operate on our platform:
Google AdSense & Third-Party Cookies:
- Google, as a third-party vendor, uses cookies (including the DoubleClick cookie) to serve ads to users based on prior visits to SriSubs and other websites on the internet.
- Google’s use of advertising cookies enables it and its partners to serve personalized or non-personalized ads to users based on their browsing history across the web.
- Ads Shown Only on English Pages: SriSubs strictly restricts Google AdSense code to English-language pages. Advertising scripts are never loaded on Sinhala-language pages (
/si/*) or within user account settings (/settings).
Your Choices and Opt-Out Mechanisms:
- You may opt out of personalized advertising by visiting Google’s Ad Settings at https://adssettings.google.com.
- Alternatively, you can opt out of third-party vendor cookies for personalized advertising by visiting the Digital Advertising Alliance Consumer Choice page at https://www.aboutads.info.
- To understand how Google manages and uses data when you use partner websites and applications, please review Google’s Partner Sites policy at https://policies.google.com/technologies/partner-sites.
Essential First-Party Cookies: We also use essential, first-party session cookies generated by NextAuth to manage your login state and safeguard against Cross-Site Request Forgery (CSRF). These cookies are necessary for core site security and authentication.
5. Third-Party Service Providers
We engage reputable third-party service providers to facilitate infrastructure, artificial intelligence processing, and advertising:
- Google Gemini API: Processes subtitle line translations via HTTPS. How Google handles data sent to the Gemini API is governed by Google's Gemini API terms, which can differ between free and paid usage: https://ai.google.dev/gemini-api/terms.
- Google AdSense: Delivers display advertising on English-language pages.
- Upstash Redis: Provides secure cloud-based data storage for encrypted API keys, user feedback records, and ephemeral usage statistics.
- Vercel: Hosts our web application, serverless API routes, and edge network distribution.
6. Data Retention Policy
- Subtitle Files and Dialogue Text: 0 days. Subtitles are retained in volatile RAM only for the duration of the translation batch execution and are discarded immediately afterward.
- Encrypted Gemini API Keys: Retained in our database until you delete the key via Settings or request full account deletion.
- Authentication Sessions: NextAuth JWT sessions expire after 30 days unless renewed.
- Rate Limiting & Presence Metrics: Expire automatically within 60 to 120 seconds.
- Approved User Feedback: Approved feedback is retained in our secure datastore until removal is requested via support@srisubs.com.
- Rejected Feedback: Rejected feedback submissions are deleted immediately from all database records, not merely hidden.
- Feedback Prompt Flag: The “already prompted” flag associated with your account ID is retained in Redis to avoid re-prompting the same account across future sessions and devices.
7. Your Privacy Rights & Data Deletion
Depending on your location, you have rights regarding your personal information, including the right to know what data we hold, request a copy, or request its deletion:
- Self-Service API Key Removal: You can permanently delete your stored Gemini API key at any time by navigating to Account Settings and clicking “Remove Key”.
- Account Deletion & Data Inquiries: To request complete deletion of your account record, email us at akashdealwis3@gmail.com. We will fulfill legitimate deletion requests within 30 days.
- Feedback Removal: You may request removal of any approved testimonial or rating submitted under your account at any time by emailing support@srisubs.com.
8. Children’s Privacy
SriSubs is a general-audience subtitling productivity utility and is not structured or directed to children under 13 years of age (or under 16 in certain jurisdictions). We do not knowingly solicit or collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately at akashdealwis3@gmail.com so we can promptly delete the relevant information.
9. International Visitors
SriSubs is accessible globally, with servers and database infrastructure situated in regions optimized for cloud performance. If you access SriSubs from the European Economic Area (EEA), United Kingdom, Switzerland, or other regions with data protection laws governing international data transfers, please note that information may be processed in facilities located outside your country of residence, under appropriate contractual and security safeguards.
10. Updates to This Policy
We may update this Privacy Policy periodically to reflect technological adjustments, legal requirements, or operational changes. The revised version will be indicated by the “Last updated” date at the top of this page. We encourage users to review this page periodically.
11. Contact & Privacy Inquiries
For any questions, concerns, or data rights requests regarding this Privacy Policy or our security practices, please contact us: