Privacy Policy
1. Who We Are
VocabFlow ("we", "us", "our") is a vocabulary learning platform developed and operated by Anatolii Krotov.
Data Controller
Anatolii Krotov
Email: privacy@vocabflow.net
For all privacy-related requests, contact us at the email above. We aim to respond within 30 days (the GDPR statutory deadline).
2. Scope of This Policy
This Privacy Policy applies to all personal data we collect when you:
- Download and use the VocabFlow mobile application (iOS or Android).
- Create an account or interact with the Service in any way.
- Contact us by email or through in-app feedback.
It does not apply to third-party websites or services that may be linked from within the app; those are governed by their own privacy policies.
3. Data We Collect
3.1 Data You Provide Directly
| Data | When collected |
|---|---|
| Email address | Account registration (email/password flow) |
| Password (stored as a one-way hash — never in plain text) | Account registration (email/password flow only) |
| Display name (optional) | Profile setup |
| Profile photo (optional) | When you add one in the app (see §3.6) |
| Language pair preferences | Onboarding |
| Custom word lists, personal notes, and content reports | During use |
| Word group names (optional) — names you give to groups of your words, for example "Travel" | When you create or rename a group in the app |
| Feedback or support messages | When you contact us |
3.2 Data Received from Social Login Providers
If you choose to sign in with Sign in with Apple or Sign in with Google, we receive a limited set of data from that provider to create or link your account:
| Provider | Data received | Notes |
|---|---|---|
| Apple | Email address (or Apple-relayed private address), full name (first sign-in only), a unique Apple user identifier | Apple may provide a private relay email that forwards to your real address. We store the identifier and the email we receive. |
| Email address, display name, profile picture URL, a unique Google user identifier | Received via OAuth 2.0 / OpenID Connect. |
We do not receive or store your Apple or Google password. The identity token is verified server-side and then discarded. We keep the provider's user identifier and the email address we receive, and use the name we receive as your display name. From Google we also keep the profile picture URL, which is shown as your profile photo until you replace or remove it; if your account already has a profile photo when you first sign in with Google, we keep yours.
You can revoke VocabFlow's access to your Apple or Google account at any time through your Apple ID settings (Settings → [Your name] → Password & Security → Apps Using Apple ID) or Google account settings (myaccount.google.com → Security → Third-party apps with account access). Revoking access does not delete your VocabFlow account; use the in-app deletion flow for that.
3.3 Data Collected Automatically
| Data | Purpose |
|---|---|
| Learning session logs (words reviewed, ratings, timestamps) | Spaced repetition scheduling (FSRS algorithm) |
| Review statistics (streaks, retention rates, session counts) | Progress dashboard |
| Device type and operating system version | Compatibility and bug fixes |
| App version | Compatibility and bug fixes |
| Crash reports and error logs | Service reliability |
| IP address (transient, not stored long-term) | Security, abuse prevention |
3.4 Subscription and Purchase Data
If you subscribe to Premium, we (via our subscription management provider, RevenueCat) receive and store your subscription status, the product purchased, and its renewal/expiry date, linked to your VocabFlow account ID. See §7.1 for details on RevenueCat's role.
3.5 Data We Do NOT Collect
- We do not collect payment card data — all purchases are processed by Apple or Google.
- We do not collect precise geolocation. Location data embedded in a profile photo is removed before the photo is stored (see §3.6).
- We do not build advertising profiles or sell your data to advertisers.
- We do not use third-party advertising SDKs.
3.6 Profile Photo
Adding a profile photo is optional.
- How it is chosen: You pick the photo from your device's photo library through the system photo picker. VocabFlow receives only the photo you select. The app does not ask for access to your camera or to your whole photo library.
- What we store: Before storing it, we crop the photo to a square, reduce it to at most 300 × 300 pixels and re-encode it. Re-encoding removes the metadata embedded in the original file, including location (GPS) data and camera details.
- Where it is stored: In Google Cloud Storage in the European Union (europe-west1), under a long, randomly generated web address. That address is not listed or shown to other users, and VocabFlow has no feature that shows your photo to other users. Anyone who obtains the exact address can view the image for as long as it is stored, so do not share it if you want the photo kept private.
- How we use it: Only to show it in your profile. We do not use your photo for facial recognition or any other biometric processing, we do not send it to our AI provider (§6), and we do not share it with advertisers or other third parties.
- Your control: You can replace or remove the photo at any time (Profile → tap your photo). Replacing or removing it deletes the previous file from our storage immediately. See §9 for retention.
4. How We Use Your Data
| Purpose | Data used |
|---|---|
| Provide and operate the Service | Account data, learning logs |
| Authenticate you via social login (Apple / Google) | Social provider identifier, email |
| Personalise your learning schedule | Review history, FSRS scheduling data |
| Show your profile photo in the app | Profile photo (see §3.6) |
| Organise your words into groups | Word group names and which of your words are in each group. Group names are visible only to you and are not sent to our AI provider (§6) |
| Generate AI-powered word content | The word or phrase you are studying (sent to our AI provider — see §6) |
| Send progress notifications (in-app) | Email address, in-app notification records |
| Provide and manage Premium subscriptions | Account ID, subscription/purchase status (see §3.4, §7.1) |
| Respond to support requests | Email address, message content |
| Detect and prevent fraud and abuse | IP address, account activity |
| Improve the Service | Aggregated, anonymised usage statistics |
| Comply with legal obligations | As required by applicable law |
5. Legal Bases for Processing (GDPR)
We process your personal data under the following legal bases as defined in Article 6 GDPR:
| Processing activity | Legal basis |
|---|---|
| Creating and managing your account | Contract (Art. 6(1)(b)) — necessary to provide the Service |
| Social login (Apple / Google) — verifying identity and creating/linking your account | Contract (Art. 6(1)(b)) |
| Delivering spaced repetition scheduling | Contract (Art. 6(1)(b)) |
| Storing and showing a profile photo you choose to add | Contract (Art. 6(1)(b)) — an optional feature you request; you can remove the photo at any time |
| In-app review reminders and notifications | Contract (Art. 6(1)(b)) — necessary to provide the Service |
| Sending service emails (password reset, account notices) | Legitimate interest (Art. 6(1)(f)) — necessary for account security |
| Managing Premium subscriptions | Contract (Art. 6(1)(b)) — necessary to provide the Service |
| Crash reporting and error logging | Legitimate interest (Art. 6(1)(f)) — maintaining service reliability |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interest, you may object at any time (see §11).
6. AI-Powered Features
VocabFlow uses Google Gemini (operated by Google LLC) to generate word definitions, example sentences, pronunciation hints, and other educational content.
What we send to Google Gemini: Only the word or phrase being studied — no email addresses, user IDs, or other personal identifiers are included in AI requests. We take reasonable technical measures to minimise the personal data in prompts.
Google's data handling: Requests are processed subject to Google's Privacy Policy and their Gemini API terms. Google may process data outside the EEA; where this occurs, Google relies on Standard Contractual Clauses (SCCs) as an appropriate transfer mechanism.
7. Data Sharing and Third Parties
We do not sell your personal data. We share data only in the following limited circumstances:
7.1 Infrastructure Providers
| Provider | Role | Location |
|---|---|---|
| Google Cloud Run / Cloud SQL / Cloud Storage | Hosting, database, and profile photo storage | EU (europe-west1) |
| Google Gemini API | AI content generation | See §6 |
| Sentry (Functional Software, Inc.) | Crash reporting and diagnostics — receives device information and error/performance data to help us detect and fix bugs | United States |
| RevenueCat, Inc. | Subscription management — receives your VocabFlow account ID and subscription/purchase status to manage Premium entitlements. When you delete your VocabFlow account, we request deletion of your RevenueCat customer profile (see §9) | United States |
| Brevo (Sendinblue SA) | Transactional email delivery — receives your email address to send verification and password-reset emails | EU (France) |
All infrastructure providers act as data processors under a Data Processing Agreement (DPA) with us.
7.2 Social Login Providers
When you sign in using a third-party identity provider, that provider acts as an independent data controller for your account with them. We receive only the data described in §3.2.
| Provider | Their privacy policy |
|---|---|
| Apple (Sign in with Apple) | apple.com/legal/privacy |
| Google (Sign in with Google) | policies.google.com/privacy |
7.3 App Distribution Platforms
Apple (App Store) and Google (Play Store) have access to data associated with your purchases and device, governed by their own privacy policies.
7.4 Legal Requirements
We may disclose your data if required to do so by law, court order, or a competent regulatory authority, or where necessary to protect the rights, property, or safety of VocabFlow, its users, or the public.
7.5 Business Transfers
In the event of a merger, acquisition, or sale of all or substantially all of our assets, your data may be transferred to the successor entity. We will notify you before your data is subject to a different privacy policy.
8. International Data Transfers
Our primary infrastructure is hosted in the European Union (europe-west1). Where data is transferred outside the EEA, the transfer is subject to appropriate safeguards under Art. 46 GDPR:
| Transfer | Mechanism |
|---|---|
| Google Gemini API (AI content generation) | Google's Standard Contractual Clauses (SCCs) |
| Sign in with Apple — token verification | Apple's SCCs / adequacy-equivalent safeguards |
| Sign in with Google — OAuth token verification | Google's SCCs |
| Sentry (crash reporting and diagnostics) | Sentry's Standard Contractual Clauses (SCCs) |
| RevenueCat (subscription management) | RevenueCat's Standard Contractual Clauses (SCCs) |
You can obtain copies of the relevant SCCs by contacting us or through the respective provider's data transfer documentation.
9. Data Retention
| Data category | Retention period |
|---|---|
| Account data (email, hashed password or social provider identifier, display name) | For the life of your account, then deleted within 30 days of account deletion |
| Profile photo | Until you replace or remove it, or delete your account. The stored file is deleted at that moment rather than after 30 days. The app may keep a cached copy on your own device for up to 24 hours. |
| Learning history and progress data, including word groups (names and which words they contain) | For the life of your account, then deleted within 30 days of account deletion. Deleting a group removes its name immediately; the words in it are kept. |
| Subscription and purchase records | For the life of your account, then deleted within 30 days of account deletion, except where longer retention is required for tax/accounting purposes. As part of the account-deletion process we also ask RevenueCat to delete the customer and subscription profile linked to your account ID (see §7.1). Deleting your VocabFlow account does not cancel an App Store or Google Play subscription: billing remains managed through Apple or Google, so cancel it there |
| Records of the legal documents you accepted (which version of the Terms and Privacy Policy, and when) | For the life of your account. After you delete your account, a pseudonymised copy is kept for 12 months and then deleted: your internal account number, the document and its version, and the acceptance date, with no email address, name or sign-in identifier. We keep it so that we can show that you agreed to the Terms and Privacy Policy if that is ever questioned (our legitimate interest in establishing, exercising or defending legal claims, Art. 6(1)(f) GDPR). |
| Record that your account was deleted (account-deletion record) | Kept for 90 days after the deletion has been completed, then deleted. It holds your internal account number, whether you or an administrator requested the deletion, the dates, and the technical status of each deletion step (including any retries and error codes). It does not contain your profile, learning content, email address, name or sign-in identifier. We keep it to complete and retry the deletion if a step fails, to diagnose failed deletion jobs, and as short-term operational and audit evidence that the deletion was carried out (our legitimate interest in running the Service securely and reliably, Art. 6(1)(f) GDPR). |
| Crash logs and error logs | 90 days, then automatically purged |
| Support correspondence | 2 years from last contact |
| Aggregated, anonymised analytics | Indefinitely (no personal data retained) |
When you delete your account (see §11), we delete your personal data within 30 days, except where a longer retention period is required by applicable law (e.g., financial records for tax purposes) and except for the pseudonymised record of accepted legal documents (12 months) and the account-deletion record (90 days after the deletion is completed) described in the table above.
10. Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- Encryption in transit: All communication between the app and our backend uses HTTPS/TLS.
- Encryption at rest: Data stored on Google Cloud is encrypted at rest by default.
- Hashed passwords: Passwords are stored as irreversible hashes using a strong hashing algorithm (bcrypt). We never store plain-text passwords. Social login users have no password stored with us at all — authentication is delegated entirely to Apple or Google.
- Access controls: Only authorised personnel can access production systems; access is logged and audited.
- JWT authentication: Session tokens are short-lived and invalidated on password change.
No system is 100% secure. If you believe your account has been compromised, contact us immediately at privacy@vocabflow.net.
Data breach notification: In the event of a personal data breach that is likely to result in high risk to your rights and freedoms, we will notify you without undue delay as required by Art. 34 GDPR.
11. Your Rights Under GDPR
As a data subject in the European Union (or where equivalent rights apply), you have the following rights:
| Right | What it means |
|---|---|
| Access (Art. 15) | Request a copy of the personal data we hold about you |
| Rectification (Art. 16) | Ask us to correct inaccurate or incomplete data |
| Erasure (Art. 17) | Ask us to delete your data ("right to be forgotten") |
| Restriction (Art. 18) | Ask us to limit how we process your data |
| Portability (Art. 20) | Receive your data in a structured, machine-readable format |
| Objection (Art. 21) | Object to processing based on legitimate interest |
| Withdraw consent (Art. 7(3)) | Withdraw consent at any time where processing relies on consent |
How to exercise your rights:
- In-app account deletion: Open Settings → Delete Account to permanently erase your account and all associated data, including your profile photo. Full instructions, including how to request deletion by email if you no longer have the app, are on our Delete Account page.
- Removing your profile photo: Open Profile, tap your photo and choose Remove photo. The file is deleted from our storage immediately.
- Email requests: Send your request to privacy@vocabflow.net. We will respond within 30 days. We may ask you to verify your identity before fulfilling the request.
We will not discriminate against you for exercising any of these rights.
12. Children's Privacy
The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you become aware that a child under 16 has provided us with personal data without appropriate parental consent, please contact us at privacy@vocabflow.net and we will delete the data promptly.
13. In-App Notifications
VocabFlow can show you in-app notifications (e.g., review reminders) while you are using the app. These are generated and delivered entirely within the app itself — VocabFlow does not currently send OS-level push notifications to your device, and no device push token is collected. If this changes in a future version, we will update this Privacy Policy before enabling that capability.
14. Analytics and Crash Reporting
We collect crash reports and diagnostic data (via Sentry, see §7.1) and aggregated, anonymised usage statistics solely to improve the reliability and performance of the Service. We do not use third-party advertising analytics or cross-app tracking SDKs.
We do not participate in Apple's App Tracking Transparency framework for advertising purposes. No advertising identifier (IDFA/GAID) is collected.
15. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will:
- Update the "Last updated" date at the top of this document.
- Notify you via in-app notification or email.
- Where required by law, seek your renewed consent.
Continued use of the Service after the updated policy takes effect constitutes acceptance of the changes.
16. Contact and Supervisory Authority
For privacy-related questions or to exercise your rights:
Email: privacy@vocabflow.net
Response time: within 30 days
Supervisory authority:
If you are not satisfied with our response, you have the right to lodge a complaint with your local EU data protection supervisory authority. A list of EU supervisory authorities is available at: edpb.europa.eu