OmniSubs

Browser Extension Privacy Policy

Last updated: June 4, 2026

This document is published in English. The English version is the legally authoritative version. For questions or a courtesy translation, contact us at support@omnisubs.app.

This Privacy Policy applies specifically to the OmniSubs browser extension (the "Extension") published by EGO HERO LLC("EGO HERO", "we", "us", or "our") on the Chrome Web Store and similar distribution channels. It describes what the Extension handles on your device, what it sends off your device, how that data is stored, every party it is shared with, and the permissions it requests. For information about OmniSubs website cookies, advertising, and non-extension account features, see our main Privacy Policy, which applies in addition to this one.

1. What the Extension Does

The Extension adds a side panel to your browser that detects <video> elements on the page you are viewing and lets you transcribe and translate their audio into subtitles that are rendered back on top of the player. The Extension does not capture audio or send page/video data to OmniSubs until you explicitly start a job, use the subtitle-search/download features, or submit a problem report.

2. What the Extension Handles and What Leaves Your Device

The Extension handles website content and web browsing activity only to provide the user-facing subtitle features described on the Chrome Web Store listing and in the side panel. The Extension does not sell this data, does not use it for advertising, and does not create cross-site browsing profiles.

  • Page and media metadata used for video detection. Content scripts inspect the page you are viewing for <video> elements, video duration/dimensions, player source URLs, poster/thumbnail URLs where available, page title, current tab URL/hostname, and nearby media/subtitle network requests such as HLS manifests, DASH manifests, progressive media files, and VTT/SRT/TTML subtitle files. This information is used to list playable videos, apply subtitles to the selected player, discover official subtitle tracks, and estimate job cost. It is kept per tab and is not transmitted to OmniSubs unless you start a job, search/download subtitles, or submit a problem report as described below.
  • Audio from videos you click Start on. When you start a job, the Extension obtains the audio of the selected video, splits it into short chunks, and sends those chunks to https://omnisubs.app/api/transcribe. The original video file (or stream) is never uploaded. Only audio is transmitted, and only for the one video you selected. On supported hosts (YouTube, Vimeo, TikTok, Twitch VODs, Reddit, X, Instagram, Dailymotion, Facebook, SoundCloud) the audio is extracted server-side via https://media-extract.egohero.com/v1/extract (operated by EGO HERO LLC, hosted on our own VPS) so you don't have to keep the tab in the foreground while transcription runs. On other sites the audio is captured directly from the video element in your browser. Either way, only the audio of the one video you selected leaves your machine.
  • Subtitle text for translation. The text produced by transcription is sent to https://omnisubs.app/api/translate to be translated into the language you selected.
  • Subtitle search and downloaded subtitle files. If you use the Subtitles tab to search OpenSubtitles, your search query, selected language, season/episode/year filters, and optional movie hash are sent to https://omnisubs.app/api/extension/subtitles/search. If you choose a result, the selected OpenSubtitles file ID is sent to https://omnisubs.app/api/extension/subtitles/download, which downloads the SRT file server-side and returns it to the Extension so you can apply it locally.
  • Job metadata. Alongside each job we record filename/stream label, duration, target language, chosen tone, success/failure status, and cost signals, via https://omnisubs.app/api/extension/jobs and related billing endpoints. This is used to show job history in the side panel, to bill credits accurately, and to diagnose failures.
  • Your authentication token. Calls to our API use a bearer token issued by your existing omnisubs.app session (see Section 4 below).
  • Problem reports (only if you click the report button). If you choose to report a problematic page using the "Report a problem" button in the side panel, the Extension collects the URL of the page, a short description you type, and diagnostic snapshots (detected video sources, your most recent job for that tab, extension version) and sends them to https://omnisubs.app/api/extension/report so our team can investigate. Your account email and user ID are included so we can follow up with you if needed. Reports are not sent unless you click the report button.

The packaged Extension contains no third-party analytics, ad trackers, third-party scripts, or telemetry pings. Direct requests initiated by the Extension are limited to the following EGO HERO LLC endpoints and to the original media/subtitle URLs needed for the video or subtitle track you selected:

  • https://omnisubs.app/api/extension/token — sign-in token exchange
  • https://omnisubs.app/api/extension/token/refresh — sign-in token refresh
  • https://omnisubs.app/api/transcribe — audio to text
  • https://omnisubs.app/api/translate — text to translated text
  • https://omnisubs.app/api/credits/balance — credit-balance display
  • https://omnisubs.app/api/credits/debit — billing
  • https://omnisubs.app/api/extension/jobs — job history record
  • https://omnisubs.app/api/extension/vtt — final subtitle file upload
  • https://omnisubs.app/api/extension/report — problem reports (only when you press the report button)
  • https://omnisubs.app/api/extension/subtitles/search — subtitle search proxy
  • https://omnisubs.app/api/extension/subtitles/download — subtitle download proxy
  • https://media-extract.egohero.com/v1/extract— server-side audio extraction for the supported hosts listed above. The video's URL is sent so the server can fetch its audio via yt-dlp. No other page content is transmitted.
  • The original website, video host, CDN, or subtitle host for the content you selected — the Extension or our media extractor may fetch the selected media file, manifest, segment, or subtitle URL so subtitles can be generated or applied. We do not send OmniSubs account tokens to those hosts.

3. What the Extension Stores on Your Device

  • Authentication tokens are kept in chrome.storage.session in supported Chrome builds, which is automatically cleared when you close your browser. If a non-Chrome Chromium build does not expose session storage, the Extension may fall back to chrome.storage.local until you sign out, uninstall the Extension, or clear extension storage.
  • Language and tone preferences, last-used target language, and your side-panel UI state are kept in chrome.storage.local so the panel remembers your choices next time you open it.
  • Applied-subtitle state per tab (which video has subtitles, and the VTT text of the last job) is kept in chrome.storage.local so that refreshing a page or navigating within a site can re-apply the subtitles without re-running the job.
  • Diagnostic breadcrumbs — a short rolling log of what the Extension did recently (phases entered, errors caught) — are kept in chrome.storage.local purely to help you debug locally and to attach to a problem report if you choose to send one. They are not transmitted unless you submit a report.

You can clear all of this at any time by uninstalling the Extension or by clearing site storage forchrome-extension:// in your browser settings.

4. Sign-In

The Extension signs you in using your existing omnisubs.app account. When you sign in from the side panel, the Extension calls the /api/extension/token endpoint on omnisubs.app, which issues a short-lived bearer token bound to your account and returns your Supabase user ID and email address to the Extension UI. Token refresh happens automatically in the background (using the alarms permission) so long jobs do not stall mid-pipeline. Tokens are not shared with websites you caption and are cleared from memory and session storage when the browser closes.

5. Permissions and Why We Need Them

The Extension requests the minimum set of permissions necessary to operate. Chrome displays these permissions at install time; here is what each one is used for:

  • storage — saves preferences, applied-subtitle state, and the session-only authentication token. Described in Section 3.
  • activeTab / scripting — the content script reads <video>elements in the tab you are actively using and injects the subtitle overlay onto that page. The service worker keeps separate per-tab video descriptors so one tab's selected video is not mixed with another tab.
  • alarms — refreshes the short-lived authentication token every 30 minutes so long transcription jobs do not stall.
  • webNavigation — clears the per-tab video registry when you navigate away, so stale thumbnails from the previous page do not show up in the side panel.
  • webRequest — observes (does not modify or block) media-asset network requests so we can recognize HLS manifests, DASH manifests, and progressive MP4s sitting alongside <video>elements. This lets us offer a faster "direct file" path on sites that serve audio as a plain file.
  • sidePanel — the Extension's UI is a side panel so it can stay open while you interact with the player.
  • Host permission <all_urls> — the Extension must be able to detect <video> elements on whatever site you choose to caption. Users bring their own sites; we cannot enumerate every legitimate website ahead of time. The Extension performs no cross-site correlation. Each tab is handled in isolation, and page/video data is not transmitted to OmniSubs unless you press Start on a specific video in that tab, use subtitle search/download, or submit a problem report.

6. What the Extension Does NOT Do

  • It does not read passwords, form fields, keystrokes, or the general text content of pages.
  • It does not inject advertising, affiliate links, or third-party scripts.
  • It does not attempt to bypass DRM, paywalls, watermarks, or access controls. Streams protected by Encrypted Media Extensions (Netflix, Disney+, Prime Video, HBO Max, etc.) are detected up front and refused.
  • It does not send page data to advertising networks, analytics services, data brokers, or hosts unrelated to the user-facing subtitle workflow. The parties that receive data are listed in Sections 2 and 7.
  • It does not use your content to train machine-learning models. OpenAI API data is processed under OpenAI's API data terms, which state that API inputs and outputs are not used to train OpenAI models by default. Other translation fallback requests are limited to the text needed for that translation as described in Section 7.
  • It does not contain remote code. Every script that runs is contained in the packaged Extension and was reviewed by the Chrome Web Store.

7. Third-Party Processing

The Extension and OmniSubs servers share user data only with the parties below, and only for the purpose listed. We do not transfer Extension user data for personalized advertising, retargeting, data brokerage, creditworthiness, or any purpose unrelated to generating, translating, syncing, finding, billing for, storing, or supporting subtitles.

  • EGO HERO LLC — operates the OmniSubs Extension, omnisubs.app, and the media-extract.egohero.com media extractor. We receive the page/video metadata, audio chunks, subtitle text, job metadata, account identifiers, and reports described in Section 2.
  • OpenAI, LLC — receives audio chunks selected for transcription through our server-side /api/transcribe route and returns transcript data.
  • Kie.ai and Google LLC — receive subtitle text and translation prompts through our server-side /api/translate route so Google Gemini 2.5 Flash can produce translated subtitle text. Kie.ai is the API proxy we use for the Gemini model endpoint.
  • Google LLC — in rare fallback cases, receives a single subtitle line through the public translate.googleapis.com endpoint when Gemini refuses that individual line after all internal retries.
  • Supabase Inc. — provides authentication, database, object storage, and signed storage URLs. Supabase stores account identifiers, job records, generated VTT files, credit ledger records, and temporary audio chunks created by the media extractor.
  • Vercel Inc. — hosts the OmniSubs web application and API routes. Vercel may process standard request logs and serverless execution metadata for requests to omnisubs.app.
  • Stripe, Inc. — processes credit purchases, subscriptions, invoices, refunds, and payment-related customer records for your OmniSubs account. The Extension reads and debits your OmniSubs credit balance, but card details are entered on Stripe-hosted pages and never touch the Extension.
  • OpenSubtitles.com— receives subtitle search parameters and selected file IDs when you use the Extension's Subtitles tab to search or download community subtitle files. These requests are proxied by OmniSubs so our API key stays on the server.
  • The original website, video host, CDN, or subtitle host whose content you select — receives ordinary HTTP(S) requests for the selected media file, stream manifest, stream segments, or subtitle file when the Extension or the EGO HERO media extractor needs to fetch that selected content.
  • EGO HERO's self-hosted n8n workflow and Telegram — receive problem report details only if you click the report button. We use this to notify the operator/support channel about the issue you reported.
  • Legal, safety, and corporate transaction recipients — we may disclose Extension data if required by law, to protect users or the Service from abuse/security threats, or as part of a merger, acquisition, or sale of assets after obtaining any consent required by law or Chrome Web Store policy.

The Extension does not contain Google Analytics, Google AdSense, or advertising scripts. If you visit public pages on omnisubs.app in a normal browser tab, the website-level cookie, analytics, and advertising disclosures in our main Privacy Policy apply to that website visit; they are not part of the packaged Extension.

8. Data Retention

The per-job records created by the Extension are stored in your OmniSubs account and follow the retention rules in the main Privacy Policy. You may delete individual jobs and generated subtitles at any time from your generations history, and you may delete your account, which removes associated job records and subtitles subject to short backup-window persistence.

Problem reports submitted through the Extension are retained as internal support records for as long as needed to investigate and resolve the reported issue. They are not used for any other purpose.

Raw audio sent directly to /api/transcribe is not stored by OmniSubs after the transcription response is produced. For supported-host server extraction, temporary MP3 chunks are cached in Supabase Storage for up to approximately 24 hours so the Extension can fetch them through 30-minute signed URLs and so repeat requests for the same URL do not re-download the same media immediately.

9. Children

The Extension is not intended for children under 13 (or the equivalent minimum age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If we learn that we have done so, we will delete it.

10. Your Rights

The same rights described in our main Privacy Policy — including access, correction, deletion, objection, restriction, and portability, as applicable under GDPR, CCPA/CPRA, or similar laws — apply to any personal data we process in connection with the Extension. To exercise them, contact privacy@omnisubs.app.

11. International Data Transfers

Data transmitted by the Extension to omnisubs.app and processed by our third-party providers may be stored and processed in countries other than your own. See the International Data Transfers section of our main Privacy Policy for details.

12. Security

All network traffic between the Extension and omnisubs.app, media-extract.egohero.com, Supabase signed storage URLs, OpenSubtitles, OpenAI, Kie.ai, Google, Stripe, and selected media hosts is transmitted over HTTPS where those hosts provide HTTPS. Authentication tokens are kept in chrome.storage.session rather than on disk so they do not persist across browser restarts in supported Chrome builds. However, no method of transmission or storage is 100% secure and we cannot guarantee absolute security.

13. Changes to this Policy

We may update this Policy from time to time. Material changes will be reflected in the "Last updated" date above and may also be announced in the Extension's release notes on the Chrome Web Store listing or via the side panel itself.

14. Contact

Questions about this Policy or about data processed by the Extension may be sent to EGO HERO LLC at privacy@omnisubs.app.

See also our main Privacy Policy and our Terms of Service.