Privacy Policy

Clooney (a working codename) is operated by Cosmo Suite. This policy explains what data we collect when you use Clooney, why we collect it, where it lives, and what control you have over it. Contact for anything privacy-related: admin@cosmosuite.io.

• Email and name — to create your account, sign you in, and send you sign-in codes. If you use Google sign-in, we also receive your Google profile picture.
• Voice samples — the short recording or upload you provide, used solely to create your cloned voice.
• Generated audio — the speech you generate, stored so you can replay and download it.
• Usage records — which voices you have, what you generated and when, and your remaining free credits, so the product works and limits are enforced fairly.
• Purchase records — if you buy a credit pack, we store which pack, how many characters it granted, the amount and currency, its status, the date, and a Stripe customer id that links you to your receipts. That is all we keep about a payment.
• A hashed IP address — for rate limiting on anonymous uploads. We store a one-way hash, not the raw IP.

That is the whole list. We do not collect browsing history, contacts, location, or anything else — and we never receive or store card numbers.

• Audio files (voice samples and generated speech) are stored in private Vercel Blob storage. They are not publicly accessible; playback and downloads use short-lived signed URLs tied to your account.
• Account and usage data lives in a Neon Postgres database.

We use a small set of service providers, each only for what is listed:

• Cartesia — the voice AI provider. Your voice sample is sent to Cartesia to create the clone, and your text is sent there to generate speech.
• Vercel — hosts the application and stores audio files (private Blob storage).
• Resend — delivers sign-in code emails to your address.
• Google OAuth — if you choose Google sign-in, Google confirms your identity to us.
• Stripe — processes payments for credit packs. When you buy, checkout is hosted by Stripe, and Stripe receives your email address, the name on the card, your billing and payment details, and the purchase amount. Your card details go straight to Stripe and never pass through our servers. We store only the purchase record and a Stripe customer id. Stripe acts as its own controller for payment processing, so its handling is governed by the Stripe Privacy Policy.
• Meta— measures our advertising. Through Meta’s Conversions API we share the event that happened (page view, recording, sign-up, checkout, purchase), the purchase amount, your IP address, your browser’s user agent, and the _fbp / _fbc cookie values. Your email address and approximate location are hashed (SHA-256) before they leave our servers, so Meta cannot read them — they can only be compared against hashes Meta already holds. This tells us which ads work. Meta acts as its own controller for this, governed by the Meta Privacy Policy.

These providers act on our instructions. We do not sell your data to anyone, and we do not share it with data brokers. If you would rather we sent none of your activity to Meta, email us at admin@cosmosuite.io and we will exclude your account.

Clooney uses advertising cookies from Meta (_fbp and _fbc), which let us tell whether an ad led to a sign-up or a purchase. They are set by the Meta Pixel and last up to 90 days. The only other cookies are the ones that keep you signed in (auth session cookies) and a short-lived cookie linking an anonymous recording to you until you sign up.

• Anonymous voice samples (recorded on the homepage before signup) are automatically deleted after 24 hours if you do not create an account.
• Account data, voices, and generated audio are kept until you delete them. Deleting a voice in the studio removes it from our storage and from Cartesia. Deleting your account removes everything.

You are in control:

• Delete in-product — remove any voice, or your entire account, from the studio at any time.
• Access, export, or delete by email — email admin@cosmosuite.io and we will send you a copy of your data or erase it. We respond to every request.

Depending on where you live (for example, the EU/UK under GDPR or California under CCPA), these may be legal rights — we honor them for everyone regardless.

Clooney is not intended for children under 13, and we do not knowingly collect data from them. If you believe a child under 13 has created an account, email us and we will delete it.

If we change how we handle your data — for example, if we add another measurement or analytics provider — we will update this page and change the date at the top. Material changes will be flagged clearly, not buried.