Effective Date:
Welcome to Vocab
At Vocab, we respect your privacy and are committed to protecting it. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.
Data Collection and Usage
Anonymous Analytics
We collect anonymous analytical data to understand how users interact with the app and identify areas for improvement. This includes app usage frequency, session durations, and feature interactions. This data cannot be used to identify you.
Account Information (Optional)
You may choose to sign in to sync your learning progress across devices. You can sign in with Apple or Google, and on the web also with an email sign-in link or a passkey. Sign-in is entirely optional - without it, your learning data stays on your device or in your browser. When you sign in with Apple or Google, we receive and store your email address (only if verified by the provider), display name, and a provider-specific identifier. We verify your account using the provider's secure token but never store the provider's authentication token. When you ask for an email sign-in link, we store your email address and use it to send the link. For a passkey, we store its public key and credential ID - never your fingerprint, face or device PIN, which do not leave your device.
Learning Progress
If you sign in, your learning progress syncs to the cloud so you can access it across devices. This includes your language preferences, topics you have started, custom word lists, phrase practice progress, challenge high scores, and stories you have started.
Device Information
We collect basic device information such as platform, app version, OS version, and device model to ensure compatibility and troubleshoot issues. We also store your approximate country based on your connection.
Using Vocab in a Web Browser
You can use the Vocab web app (app.vocabtech.com) without an account. As a guest, your progress, settings and free daily limit counters are kept only in your browser's storage on that device - we do not create an account or keep guest progress on our servers. Clearing your browser data deletes it, and some in-app browsers may clear it on their own. If you sign in, your guest progress is added to your account. A signed-in browser keeps a secure session cookie and a random browser identifier, so the browser appears once in your account's device list. This storage is needed for the app to work - we do not use advertising or cross-site tracking cookies. If you turn on reminders, we store your browser's push subscription (an address and keys issued by your browser's push service, for example Apple, Google or Mozilla) and send reminders through that service. We delete the subscription when you turn reminders off, when the push service reports it has expired, or when your account is deleted. To protect email sign-in from abuse, we use Cloudflare Turnstile, which checks technical signals from your browser and connection, such as your IP address and browser details, to tell people from bots. We do not use it for advertising.
Purpose of Data Collection
- Improve app functionality and user experience
- Sync your learning progress across devices (if you sign in)
- Ensure compatibility across platforms and devices
- Troubleshoot technical issues
Data Storage and Security
Your data is stored on Cloudflare servers in the European Union. We do not store passwords, precise location data, or authentication tokens from sign-in providers. We do not keep IP addresses in our databases - they are used only briefly to deliver the service, determine your approximate country and limit abuse. We do not store push tokens from our mobile apps; on the web we store a push subscription only if you turn on reminders. Session tokens are stored only as cryptographic hashes.
Data Retention and Deletion
We retain your account and learning data for as long as your account is active. You can delete your account and all associated data directly from the app or the web app at any time. Account deletion includes a 3-day grace period, after which all data is permanently removed.
Third-Party Services
- Apple Sign In and Google Sign In for optional authentication. These providers only verify your account - we do not share your learning data with them.
- Cloudflare for hosting, secure data storage in the EU, sending sign-in emails, and Cloudflare Turnstile to protect sign-in from abuse.
- RevenueCat for subscription management, and Paddle (Paddle.com, merchant of record) for payments made on our website. Paddle processes your payment details, billing address and email to take payments, calculate tax and send receipts; we never see your full card details.
We do not sell or share your personal data with any other third parties.
Your Privacy Rights
Depending on your location, you may have the right to access, correct, or delete your personal data, restrict or object to processing, or request data portability. You can delete your account directly from the app, or contact us at info@vocabtech.com to exercise any of these rights.
Policy Updates
Our Privacy Policy may be updated periodically to reflect changes in our practices or legal requirements. We recommend reviewing this policy regularly to stay informed of any updates.
Contact Information
- If you have any questions or suggestions regarding our Privacy Policy, please feel free to contact us. Contact Us.