In short
- Two subtitle lines work without an account and without sending anything to us. Your settings stay in your browser.
- When you click a word or line for an explanation, that text and its subtitle line go to our server and to Google’s Gemini model to write the explanation. We don’t store it.
- An account keeps your email address, your plan, today’s explanation count and, with Pro, the words you save. Nothing else.
- No advertising, no tracking cookies, no analytics in the extension. We never sell data and never use it for advertising or to train AI models.
Controller
Sascha Heyer, hello@duosubs.com. Postal address: see the legal notice.
The Chrome extension
The extension asks for two permissions: access to https://www.youtube.com/*, to show the subtitle lines on YouTube’s player, and storage, to keep your settings. On YouTube it reads the list of subtitle tracks of the video you watch and loads those subtitles from YouTube, in your browser, as YouTube’s own player does. It does not read your YouTube account, your history, comments or anything outside the player, and it does not download video or audio.
Stored in your browser: your settings (language, size, position, shortcuts) in Chrome’s extension storage, which Chrome may sync to your other computers if you use Chrome sync; and, when you sign in, a sign-in token so the extension can call our server for you. Legal basis: § 25 (2) no. 2 TDDDG, these are needed for the feature you asked for.
Sent to us, only when you ask: when you click a word or use “Explain this line”, the extension sends the word, the subtitle line, the two language codes and your sign-in token to our server. When you save a word (Pro), it sends the word, its explanation, the line, the video’s ID and the second in the video where the line starts.
Explanations (Gemini)
Explanations are written by Google’s Gemini model on Google Cloud Vertex AI (Google Cloud EMEA Limited, Dublin, Ireland), which we call from our server. Gemini receives the word, the subtitle line and the language names, nothing about you. We don’t store this text after the explanation is sent back, and under Google Cloud’s terms Google does not use it to train its models. We count how many explanations your account used today, to enforce the free limit of 5 a day, and, per month, how many AI tokens your explanations used and with which model (numbers only, no text), to keep track of what the service costs. These counts are deleted with your account. Legal basis: Art. 6(1)(b) GDPR (providing the service you asked for).
Account
Sign-in runs on Firebase Authentication (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). It processes your email address and, if you sign in with Google, your name and profile picture as Google provides them. We store your account data in Google Cloud Firestore in the europe-west1 region (Belgium): your plan and subscription status, today’s explanation count and, with Pro, your saved words with their context. Legal basis: Art. 6(1)(b) GDPR.
Deleting your account: on the account page, “Delete account” removes your account, your saved words and your counters straight away. A running subscription has to be cancelled first, so you are not charged for an account that no longer exists.
Emails
We send only emails you need: the sign-in link you ask for, one welcome email after you create an account, and confirmations of a purchase, a cancellation, a refund or a failed payment. No newsletters and no tracking pixels. They are sent through Resend (Plus Five Five, Inc., San Francisco, USA) from its EU sending region. Resend processes your email address and the content of the email. Legal basis: Art. 6(1)(b) GDPR. Resend is certified under the EU-U.S. Data Privacy Framework, and its data processing agreement includes the EU standard contractual clauses.
Payments
Pro is paid through Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). Stripe collects your payment details and processes them under its own privacy policy; we never see your card number. We store your plan, the subscription status, the end of the current period and Stripe’s customer ID for your account. Invoices are kept as tax and commercial law requires (up to ten years). Legal basis: Art. 6(1)(b) and (c) GDPR.
Website and hosting
The website and the server run on Google Cloud Run (Google Cloud EMEA Limited, Dublin, Ireland) in the europe-west1 region (Belgium). Each request is logged with its time, the page, the status code, the browser’s user agent and the IP address, to run the service securely and to find errors. The logs are deleted after 30 days. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a secure, working service.
Our own visitor statistics: the website (not the extension) sends a small cookieless request when a page opens: the page, the referring site without its parameters, campaign parameters, your time zone and browser language, and a hash of your IP address and user agent that changes every day; the IP address itself is not stored, and nothing is stored in your browser. The records are kept in Google BigQuery in the EU and deleted after 24 months. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in knowing how the site is found and used. You can object at any time by email.
There is no Google Analytics, no advertising and no consent banner, because nothing on this site needs one.
Google API Services and Chrome Web Store user data
DuoSubs’s use of information complies with the Chrome Web Store User Data Policy, including the Limited Use requirements, and, where Google sign-in is used, with the Google API Services User Data Policy, including the Limited Use requirements. In plain words: the data described above is used only to provide the features you see in DuoSubs; it is not sold, not transferred to third parties except the processors named on this page to provide the service, not used for advertising, not used to determine creditworthiness, and not used to train AI models. No person at DuoSubs reads it, unless you ask us to (for example in a support email) or the law requires it.
Transfers outside the EU
Google, Stripe and Resend may process data in the United States. These transfers are based on the EU-U.S. Data Privacy Framework and on the EU standard contractual clauses.
Your rights
You have the right to access, rectify and erase your data, to restrict its processing, to data portability, and to object to processing based on our legitimate interests. Write to hello@duosubs.com. You can also lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work.
Updated: 11 November 2026