1. Data controller
The company publishing VocabRecall is the data controller, referred to below as the Publisher. For privacy questions, contact privacy@vocabrecall.app.
2. Data we collect
Account data
- Email address, required to create an account.
- Name and profile image when provided by Google or Apple sign-in.
- A unique account identifier.
Learning and usage data
- Your vocabulary knowledge, including discovered words, learning state, and answer history.
- Your calibration results and learning progress.
- Quiz statistics, such as scores, response time, and streak activity.
- Your preferences, such as sound, haptics, interface language, and active course.
Technical data
- Device type, operating system, app version, and language.
- IP address, used temporarily for security.
- Event logs such as app opens, completed quizzes, and technical errors.
- Installation identifiers and, on Android when available, the advertising identifier used to measure installation attribution and campaign performance.
- Session recordings and interface interactions used to understand product journeys and diagnose problems. Sensitive input fields are masked.
In-app purchases
Payments are processed by the Apple App Store or Google Play. RevenueCat helps us manage subscription entitlements. We receive purchase and subscription-status information, but never your payment-card number.
Technical service providers
Providers process only the data needed for their role: Google and Apple for sign-in and purchases, RevenueCat for subscriptions, PostHog for product analytics and session recordings, GlitchTip/Sentry for error diagnostics, Tenjin for installation attribution, and our hosting provider for service operation. We do not sell your personal data.
3. Why we process this data
- Provide the service: save and synchronize supported learning data and restore it when you sign back in.
- Improve the product: analyze aggregate feature use, identify bugs, and refine the learning experience.
- Measure campaigns: attribute an installation or subscription event without displaying advertising inside the app.
- Security: prevent fraud and abuse.
- Communication: send functional notifications that are actually scheduled when you have allowed them.
4. Legal bases
- Performance of a contract for account, learning, and subscription data.
- Legitimate interests for aggregate analysis and security.
- Consent for push notifications and non-essential processing, including tracking where the law or platform requires it.
5. Retention
- Active account: while you use the service.
- Deleted account: deletion within 30 days, except where retention is legally required.
- Technical logs: up to 90 days.
6. Your rights
Subject to applicable law, you may request access, correction, deletion, portability, restriction, or object to processing. You may withdraw consent for notifications at any time. Contact privacy@vocabrecall.app. You may also lodge a complaint with the CNIL or your competent data-protection authority.
7. Security and international transfers
Data is sent over HTTPS and protected by appropriate technical and organizational measures. Our primary infrastructure is hosted in the European Union. When a provider processes data in another country, we rely on transfer mechanisms recognized by applicable law. Internal access is limited to what is necessary.
8. Children
VocabRecall is not intended for children under 13 or the minimum legal age in their country. If you learn that a child provided data without authorization, contact us so we can delete it.
9. Changes
This policy may change. Material changes will be announced in the app or by email.
10. Contact
For any privacy question, contact privacy@vocabrecall.app.