Technical Verification — NOT a contract

This document is NOT a contract or a legal commitment. It is only a technical appendix showing the source code locations where statements in the Terms of Service and Privacy Policy can be verified. The binding texts are the Terms of Service and Privacy Policy.

Binding texts: Terms of Service, Privacy Policy.

Repository: youdub; commit: a1dc003 (full: a1dc00309c3fe169d2fcd132f30fa5c805921fa4); date: 2026-09-10. Line numbers are valid ONLY for this commit. They do not describe later versions. Paths such as src/…, manifest.json are relative to the extension package (under youdub-chrome/ in the repository).

Generated by node tools/yasal-atif-ayir.mjs from the annotated Git snapshot. Source lines below also refer to that snapshot.

Source: docs/yasal/en/terms.md

YouDub Studio Terms of Service and License Agreement / 1. What is YouDub Studio and how does it work?

• Source line 14: “YouDub Studio is a Google Chrome browser extension that reads accessible subtitles/closed captions from videos playing in your web browser and synthesizes real-time, synchronized dubbing and voiceovers locally.” — manifest.json:4-5

• Source line 17: “Operational model: The Extension is not an independent media player or content hosting provider. It only monitors accessible closed-caption tracks on web pages the user is already authorized to view and plays back…” — src/dubber.js:80-120, src/content.js:165-240

YouDub Studio Terms of Service and License Agreement / 2. Model sales and AI model licenses

• Source line 21: “WE DO NOT SELL MODELS. YouDub Studio does not sell neural network models, weights, or model compute access. The product is strictly a client-side interface that connects open-source libraries running on the user's local…” — docs/local-speech.md:3

• Source line 26: “Model license: Governed by the OpenRAIL-M license (https://huggingface.co/Supertone/supertonic-3).” — docs/local-speech.md:72

• Source line 27: “Example code: Licensed under the MIT license.” — docs/local-speech.md:72

• Source line 28: “Model weights are not bundled in the extension package. When the user enables local speech in settings, model files are downloaded directly from Hugging Face via HTTP GET requests and saved to IndexedDB (YouDubStorage /…” — docs/local-speech.md:3, tools/derle.mjs:28, src/supertonic.js:8, src/supertonic.js:477-483, src/supertonic.js:569-570, src/supertonic.js:4-6, src/supertonic.js:96-134

• Source line 30: “Source & Upstream License: Governed by the MIT license (https://github.com/openai/whisper/blob/main/LICENSE).” — src/local/catalog.js:9-10, src/local/catalog.js:19-20

• Source line 31: “Repositories: Pinned revisions of onnx-community/whisper-tiny and onnx-community/whisper-base.” — src/local/catalog.js:7, src/local/catalog.js:17

• Source line 32: “Model weights are not bundled in the package. They are downloaded to Cache Storage under youdub-asr-models-v1 only when the user explicitly triggers "Download / start model".” — tools/prepare-asr.mjs:1, src/local/catalog.js:1, docs/gizlilik.md:47, src/local/catalog.js:29, src/local/worker.js:15-18

• Source line 34: “Bundled client runtimes include Transformers.js (Apache-2.0), ONNX Runtime (MIT), Jinja (MIT), and Tokenizers (Apache-2.0). The respective open-source license texts are embedded into the package under…” — tools/prepare-asr.mjs:40-43, tools/prepare-asr.mjs:44-47, tools/prepare-asr.mjs:48-51, tools/prepare-asr.mjs:52-55, tools/prepare-asr.mjs:40-55, docs/local-speech.md:77

YouDub Studio Terms of Service and License Agreement / 3. Compliance with platform rules and technical boundaries

• Source line 43: “No downloading or recording of video or audio streams: The Extension does not extract, download, transcode, or save video or audio streams from host platforms. The manifest explicitly omits the tabCapture permission. The…” — manifest.json:4-5, docs/gizlilik.md:5, manifest.json:7-13, docs/gizlilik.md:117, docs/local-speech.md:37

• Source line 44: “Caption capture mechanism: The Extension does not fetch caption URLs itself; however, it may programmatically click or select caption tracks on the player, which may trigger the player's own timedtext requests. The…” — src/inject.js:500-530, src/inject.js:684-726, src/inject.js:731-765, src/inject.js:767-796, src/inject.js:742, src/inject.js:759, docs/gizlilik.md:11, src/platforms/html5.js:4-8, docs/gizlilik.md:113

YouDub Studio Terms of Service and License Agreement / 6. License tiers, device limits, and terms of use

• Source line 63: “Active for 3 days starting from first run / invocation (DENEME_GUN = 3).” — src/license.js:83, src/license.js:236-246

• Source line 64: “During trial, all features (local LLM, Supertonic on-device voice, custom API keys, and persistent archive) are accessible without a daily video limit.” — src/license.js:6-7, src/license.js:292

• Source line 66: “Applies automatically after the trial period expires if no license key is activated.” — src/license.js:286

• Source line 67: “Limited to 5 unique videos per calendar day (UCRETSIZ_GUNLUK_VIDEO = 5). Replaying, refreshing, or seeking within the same video on the same day does not consume additional quota.” — src/license.js:99, src/license.js:318-321, src/license.js:347-356, src/license.js:92-94, src/license.js:343-345

• Source line 68: “Operates with the browser's on-device translation (Chrome Translator API) or existing captions, paired with operating system built-in voices.” — src/license.js:5-6, src/options.html:688-690

• Source line 70: “Available via Polar.sh as Annual or Lifetime plans.” — src/license.js:63-67

• Source line 71: “Pro removes the daily video limit, enables local LLM integration, unlocks on-device Supertonic TTS, enables custom cloud API providers, and activates the persistent video archive.” — src/license.js:313, src/license.js:3-5, src/background.js:68-75

• Source line 76: “What Happens Upon Discontinuation and Verification Limits: License validation depends on the Polar server infrastructure. The client code incorporates an offline tolerance grace period: when the validation server cannot…” — src/license.js:89-90, src/license.js:265-270, src/license.js:425-435, src/license.js:500-540, src/license.js:89-90, src/license.js:265-270, src/license.js:89, src/license.js:265-266, src/license.js:90, src/license.js:267-270, src/license.js:286-288

• Source line 80: “Definition and Scope: Promotional licenses (provided via launch giveaways, forum and community events, early access, or direct distribution) are granted free of charge. Unless explicitly specified otherwise in the…” — src/license.js:376-380

• Source line 84: “Revocation for Abuse Without Prior Notice: In the event of abuse or fraudulent activity, the licensor reserves the right to cancel and revoke promotional licenses immediately without prior notice. Examples of abuse…” — src/license.js:376-380, src/license.js:438-441

• Source line 91: “Same Product, Same Limitations, and No SLA: A promotional license unlocks the Extension's Pro features; however, all limitations set forth in Section 6, Item 4 for Lifetime licenses apply equally to promotional licenses…” — src/license.js:89-90, src/license.js:265-270

• Source line 94: “The Annual license provides a 1-year period of validity starting from the date of purchase (kayit.gecerlilikSonu).” — src/license.js:255, src/license.js:431-435, src/license.js:469

• Source line 95: “If the annual subscription is not renewed at the end of the term (gecerlilikSonu <= t.olcum), licensed status ceases and the Extension automatically transitions to the Free Tier, disabling Pro features and restoring the…” — src/license.js:252-255, src/license.js:286

• Source line 98: “License keys are bound to individual devices via a unique activation_id managed through Polar.” — src/license.js:448-457

• Source line 99: “Licenses are personal and non-transferable; they may not be shared publicly, resold, or leased.” — src/license.js:438-440

• Source line 100: “The device activation limit for Annual and Lifetime licenses is 5 devices. Promotional licenses distributed as special offers or gifts are subject to their own specific promotion terms (a fixed device count is not…” — src/license.js:376-380

• Source line 101: “Users can click "Remove from this device" in Settings at any time; if online, the extension attempts to release the activation slot on Polar. However, removal does not guarantee slot release under all conditions; if the…” — src/license.js:591-602, src/license.js:580-609, src/license.js:517-535

• Source line 103: “An activated Pro license continues to function without internet connectivity for up to 5 days (CEVRIMDISI_TAM_GUN = 5).” — src/license.js:89, src/license.js:265-266

• Source line 104: “Between days 5 and 7, an in-app warning requests online re-validation (CEVRIMDISI_KAPANMA_GUN = 7).” — src/license.js:90, src/license.js:267-270

• Source line 105: “If unverified after 7 consecutive offline days, Pro features pause until the device connects to the internet and validates successfully.” — src/license.js:88-90, src/license.js:288

• Source line 107: “License keys found to be published in public forums, distributed unauthorized, or subjected to cryptographic tampering may be revoked unilaterally.” — src/license.js:376-380, src/license.js:438-441

YouDub Studio Terms of Service and License Agreement / 7. Payment, delivery, withdrawal, and refund terms

• Source line 111: “Payment Processing and Merchant of Record: Orders and billing are processed by our authorized Merchant of Record, Polar.sh (Polar Software, Inc., https://api.polar.sh/*, checkout: https://buy.polar.sh/...). All billing,…” — src/license.js:50-67, src/license.js:56-67, docs/gizlilik.md:123

YouDub Studio Terms of Service and License Agreement / 9. Termination, modifications, and effective date

• Source line 126: “Software Version: v0.3.1” — package.json:3

Source: docs/yasal/en/privacy.md

YouDub Studio Privacy Policy / 1. Core principle and absence of telemetry to developers

• Source line 16: “No telemetry or analytics code: Across product code under src/ (excluding vendor libraries under src/lib/), the tokens analytics, telemetry, sentry, gtag, mixpanel, amplitude, posthog, sendBeacon, and setUninstallURL do…” — docs/gizlilik.md:11

• Source line 17: “Strictly limited network requests: Active fetch( calls in the codebase are limited exclusively to the Polar licensing endpoint, Hugging Face model downloads, user-configured translation/TTS providers, and caption files…” — src/license.js:395, src/supertonic.js:483, src/supertonic.js:570, src/providers/llm.js:290, src/providers/llm.js:325, src/providers/cloudtts.js:95, src/platforms/udemy.js:152, src/platforms/udemy.js:188, docs/gizlilik.md:11

• Source line 18: “No media capture permissions: The manifest completely omits the tabCapture permission. The Extension does not capture, record, or stream tab or system audio; it only processes accessible subtitle text.” — manifest.json:7-13, docs/gizlilik.md:117, docs/local-speech.md:37

YouDub Studio Privacy Policy / 2. Page content and caption capture mechanism

• Source line 22: “YouDub Studio synthesizes synchronized speech from the accessible subtitles already present in the user's browser session. It does not download video or audio files; the Transcription tab processes only files chosen by…” — manifest.json:4-5, src/local/offscreen.js:5-10

• Source line 24: “YouTube caption capture: Captions are retrieved by inspecting the page's own /api/timedtext requests. Patches to XMLHttpRequest, window.fetch, and Response.prototype.json/text selectively clone response payloads whose…” — src/inject.js:10, src/inject.js:684-726, src/inject.js:731-765, src/inject.js:767-796, src/inject.js:684-726, src/inject.js:731-765, src/inject.js:767-796, src/inject.js:705, src/inject.js:716, src/inject.js:752, src/inject.js:774, src/inject.js:787, src/platforms/youtube.js:4-8, docs/gizlilik.md:11, src/inject.js:742, src/inject.js:759, docs/gizlilik.md:11

• Source line 25: “Other platforms and HTML5 video: On Udemy, captions are fetched from https://www.udemy.com/api-2.0/... and VTT tracks via vtt-c.udemycdn.com. On generic HTML5 web players, subtitles are read directly from the browser DOM…” — src/platforms/udemy.js:31, src/platforms/udemy.js:143-188, src/platforms/html5.js:4-8, src/sites.js:18-23

• Source line 26: “Site permissions: YouTube is declared as a static content script. On any other site, the Extension runs no code until the user explicitly grants permission via "Activate on this site" in the popup UI. Permissions are…” — manifest.json:40-75, src/sites.js:3-7, src/popup.js:243-247, src/sites.js:181-192

• Source line 27: “Security headers (COOP/COEP): Manifest headers cross_origin_opener_policy: same-origin and cross_origin_embedder_policy: require-corp enforce browser process isolation required for Web Workers to execute multi-threaded…” — manifest.json:100-105

YouDub Studio Privacy Policy / 3. Data stored locally on the device and deletion methods

• Source line 34: “Target language, voice selection, playback speed, panel position, and subtitle style are synchronized with the user's signed-in Google account.” — src/settings.js:23-54, src/background.js:163-179

• Source line 37: “Custom translation and TTS API keys are stored exclusively in chrome.storage.local.” — src/providers/keys.js:3-8, src/providers/keys.js:53-72

• Source line 38: “Keys are never synced to Google servers, are not transmitted via runtime messages to content scripts or host web pages, and never reach the developer or any intermediate proxy.” — src/providers/keys.js:7-8, src/background.js:3-5

• Source line 39: “How to delete: The user can clear API keys at any time via the Settings UI (Translation or Voice tabs) by erasing the inputs and saving.” — src/options.js:80-110

• Source line 41: “The licensing record (licenseState) and device quota tracker (licenseDevice) reside in local storage.” — src/license.js:34-35, src/license.js:166-186

• Source line 42: “The license state stores the license key, Polar activationId, and the timestamp of the last online validation. The device state stores the first execution timestamp and the list of video IDs dubbed that day.” — src/license.js:109-120, src/license.js:122-129, src/license.js:338-356

• Source line 43: “How to delete: Clicking "Remove from this device" in Settings > License clears the licenseState record (license key and validation status). However, to prevent abuse and repeated trial restarts, licenseDevice (initial…” — src/license.js:591-609, src/options.html:713-715, src/license.js:34-35, src/license.js:580, src/license.js:607

• Source line 45: “Processed subtitle cues and synthesized audio segments are stored in the origin's YouDubCache database. Re-opening a previously processed video reuses this cache to prevent duplicate computation.” — src/cache.js:18-21, src/cache.js:368-426, src/cache.js:658-695, src/content.js:816, src/background.js:552

• Source line 46: “To generate a return link, only the scheme + host + safe path components are saved. Query parameters, authentication tokens, session cookies, and JWTs are stripped, with the sole exception of the 11-character YouTube v…” — src/content.js:38-94, src/cache.js:42-109, src/cache.js:55-67

• Source line 47: “When and how deleted: If "Keep archive on disk" is disabled in Settings > Archive (default: disabled), cached records exist only temporarily for the active video and are erased when switching videos. If the browser…” — src/providers/keys.js:30-35, src/background.js:587-589, src/background.js:487-501, src/options.html:670-671, src/options.js:1018-1035, src/cache.js:675-690

• Source line 49: “Supertonic model weights reside in IndexedDB YouDubStorage / supertonic_data and can be deleted via Settings > Voice.” — src/supertonic.js:4-6, src/supertonic.js:96-134, src/options.js:572-593

• Source line 50: “Local audio/video files chosen for transcription are stored temporarily in IndexedDB youdub-local-preparation and deleted immediately once ingested. Generated subtitle cues can be deleted using "Delete generated…” — src/local/store.js:1-4, src/options-local.js:201-211, src/local/offscreen.js:254-255, src/local/offscreen.js:177, src/options-local.js:385-395

• Source line 51: “Whisper ASR model weights reside in Cache Storage under youdub-asr-models-v1 and can be removed via "Delete model".” — src/local/catalog.js:29, src/local/worker.js:15-18, src/local/offscreen.js:385-399

YouDub Studio Privacy Policy / 4. Mandatory external connections: License validation and model downloading

• Source line 57: “The following outbound connections are declared in manifest.json host_permissions for foundational extension functionality:” — manifest.json:14-19

YouDub Studio Privacy Policy / 4. Mandatory external connections: License validation and model downloading / License Management: Polar.sh (https://api.polar.sh/*)

• Source line 63: “Licensing interactions use the Polar customer portal API.” — src/license.js:50-53

• Source line 64: “Outbound calls target POST https://api.polar.sh/v1/customer-portal/license-keys/{activate|validate|deactivate}.” — src/license.js:392-399

• Source line 66: “activate: { key, organization_id, label: "YouDub Studio / Chrome" }.” — src/license.js:448-452

• Source line 67: “validate: Under standard validation { key, organization_id, activation_id }; except during HTTP 404 diagnostics where a secondary check transmits only { key, organization_id } without an activation ID to confirm device…” — src/license.js:500-504, src/license.js:536-540

• Source line 68: “deactivate: { key, organization_id, activation_id }.” — src/license.js:595-599

• Source line 69: “Data NEVER transmitted to Polar: Video URLs, video titles, subtitle contents, translated sentences, custom API keys, or browsing activity are never shared with Polar.” — docs/gizlilik.md:58-60

• Source line 70: “Payment Information: Checkout is hosted directly on Polar's domain. Payment data (credit cards) is collected directly by Polar and is governed by Polar's Privacy Policy.” — src/license.js:56-67, docs/gizlilik.md:123

YouDub Studio Privacy Policy / 4. Mandatory external connections: License validation and model downloading / Model Weights: Hugging Face (https://huggingface.co/*, https://*.hf.co/*)

• Source line 73: “Weights for the local Supertonic speech synthesizer and Whisper speech recognizer are fetched via HTTP GET requests only when the user explicitly triggers model download.” — src/supertonic.js:8, src/supertonic.js:477-483, src/local/catalog.js:2-22

• Source line 74: “No user text, identity, or data is uploaded to Hugging Face; requests solely retrieve public model files. CDN redirects are handled by the *.hf.co permission.” — docs/gizlilik.md:70, manifest.json:18, docs/gizlilik.md:77-80

YouDub Studio Privacy Policy / 5. Optional third-party AI and cloud providers

• Source line 78: “YouDub Studio allows users to supply their own API keys to access third-party cloud services. These permissions are requested at runtime only when the user configures the respective provider in Settings.” — manifest.json:20-34, src/options.js:3-7, src/options.js:47-54

• Source line 80: “When configured, API calls are transmitted directly from the browser extension service worker to the provider's official endpoint without passing through any intermediate proxy:” — src/background.js:3-5, src/providers/keys.js:7-8

Complete provider table — docs/yasal/en/privacy.md, line 82:

• Source line 98: “The default translation pipeline (D-20260910-CEVIRI) requires no external API keys: it uses existing video captions where available or Chrome's on-device translator (Chrome Translator API), keeping all processing local…” — src/inject.js:236-242, src/provider-client.js:40-89

YouDub Studio Privacy Policy / 6. Children's privacy, data security, CWS Limited Use, and rights

• Source line 102: “Chrome Web Store Limited Use and Single Purpose Disclosure: YouDub Studio complies strictly with the Chrome Web Store User Data Policy, including all Limited Use requirements. The single purpose of the Extension is to…” — manifest.json:5

• Source line 106: “Data Security: Data stored on the local device is protected within Chrome's extension sandbox. The integrity of licensing state against local tampering is verified using HMAC-SHA256 signatures.” — src/license.js:105-107, src/license.js:157-168

• Source line 107: “User Rights and Data Deletion Limits: Users can delete their settings, custom API keys, cached media, local AI models, and active license state (licenseState) directly via the Settings UI. However, anti-abuse records…” — src/license.js:34-35, src/license.js:607