Vocabulary Builder: Flashcards Privacy Policy

This Privacy Policy explains how we collect, use, disclose, and protect information when you install or use the Vocabulary Builder: Flashcards mobile application, visit the page on which this Policy is published, or use related services (collectively, the "Services").

This Policy is intended to help you understand what information is collected, why it is needed, how it is handled, and what choices and rights are available to you. We collect only the information described in this Policy and use it to provide, secure, personalize, and improve the Services.

Please read this Policy carefully before using the Services. By accessing or using Vocabulary Builder: Flashcards, you acknowledge that you have read and understood this Policy. If you do not agree with it, please do not use the Services.

We may update this Policy when the Services, applicable laws, or our data practices change. The date shown above identifies the latest version. Where required by law, we will provide additional notice or request your consent before material changes take effect.

This Privacy Policy should be read together with our Terms of Service, which govern your use of Vocabulary Builder: Flashcards and the related Services.

1. Definitions

Website or Site means the website or webpage on which information about Vocabulary Builder: Flashcards, this Privacy Policy, the Terms of Service, and related materials are published.

Vocabulary Builder: Flashcards or the Mobile Application is a language-learning application that lets users study vocabulary with flashcards, create and manage card sets, complete training activities, track learning progress, and use optional image-based word recognition.

Services means the Mobile Application, the Website, and the related features, content, software, infrastructure, and support services provided for Vocabulary Builder: Flashcards.

Developer, we, our, or us means Bondarenko Yevhenii, the individual developer who owns and operates the Services.

User or you means an individual who accesses or uses the Mobile Application, the Website, or any related Service.

Account means the record created when you register using an email address or Sign in with Apple and used to provide and synchronize the Services.

Registration means creating an Account using an email address or Sign in with Apple.

Personal Data means information relating to an identified or identifiable person. It does not include information that has been irreversibly anonymized.

Controller means the person or entity that determines why and how Personal Data is processed. Bondarenko Yevhenii is the Controller of the Personal Data described in this Policy.

Processor means a person or organization that processes Personal Data on behalf of the Controller, such as a hosting, storage, analytics, email, or artificial-intelligence service provider.

2. Information We Collect

2.1 Information you provide

• Account information: email address and password credentials when you use email authentication. Passwords are stored in hashed form. If you use Sign in with Apple, we may receive your Apple account identifier, email address, relay email address, first name, and last name, depending on the information Apple makes available and the permissions you grant.
• Learning preferences: the language you know, the language and regional course you choose to learn, proficiency level, daily learning goal, onboarding answers, selected card sets, and other course settings.
• Learning activity: cards selected for learning, card status and memory level, training modes, answers, correct and incorrect results, words marked as already known, review dates, session duration, streak, and learning progress.
• User content: card sets, card titles, words, translations, transcriptions, examples, parts of speech, custom cards, custom cover images, and card images that you create or upload.
• Photos: photos you choose from your library or take with the camera for a card, a card-set cover, or image-based word recognition. We access a photo only when you choose to use the relevant feature and grant the required system permission.
• Reports and support: your email address, support messages, card problem reports, the selected report reason, and any other information you include in a request.
• Purchase information: product identifier, subscription status, transaction and original transaction identifiers, purchase and expiration dates, trial or refund status, and App Store receipt information required to validate and restore purchases. Payment-card details are processed by Apple and are not received by us.

2.2 Information collected automatically

• Device and application information: operating system and version, device model or name, application version, application language, time-zone offset, interface theme, and device-generated identifiers used to maintain authentication sessions, synchronize data, prevent fraud, and operate the Services.
• Network information: IP address, request date and time, requested endpoint, response status, and related server logs. An IP address may indicate an approximate country or region.
• Usage and analytics information: app launches, screens viewed, onboarding completion, sign-in or sign-up method, training completion, aggregate training counts and duration, whether a word was marked known or unknown, and purchase events.
• Technical information: Firebase installation identifiers and limited SDK diagnostic information used to operate and improve Firebase services.

2.3 Image recognition information

When you use image-based word recognition, the selected image is resized, converted to a metadata-free image, and sent to our server. Our server sends the image to Google Cloud Vertex AI and may use OpenAI as a fallback provider to recognize vocabulary. We do not intentionally retain the original recognition image on our server after the request has been processed. We retain operational information about the recognition attempt, such as the selected languages, provider, image size, result counts, processing status, duration, and error details. Words that are not found in our vocabulary database, together with suggested translations, may be retained to improve vocabulary coverage and recognition quality.

If you separately choose an image as a custom card image or card-set cover, that image is stored as User Content as described below.

2.4 Required and optional information

Some information is required to create and operate your Account and provide the core Services, while other information is needed only when you choose to use a particular feature:

• Account and authentication information is required. You must create an Account and authenticate using either an email address and password or Sign in with Apple. If you do not provide the information required for either authentication method, you cannot create an Account or use the Mobile Application.
• Core learning information is required. We need your selected learning and base languages, course settings, selected learning content, and learning activity to configure your course, provide training, save your progress, and synchronize it across devices. Without this information, we cannot provide the core learning features.
• Device and application information is collected automatically. Device-generated identifiers and limited technical information are required to maintain your authenticated session, synchronize data, secure the Services, and provide a compatible application experience.
• Photos and User Content are optional. You may use the Services without uploading photos, custom images, cards, or card sets. If you do not provide a photo or the corresponding system permission, image recognition and other image-based features will not be available, but you may continue using the other Services.
• Support requests and card problem reports are optional. If you choose to contact support or report a card, we need the information required to investigate and respond to that request.
• Purchases are optional. You are not required to purchase a subscription to create an Account. If you make a purchase, the related transaction information is required to validate the purchase, provide subscription features, and restore your entitlement.

You are generally not subject to a statutory obligation to provide Personal Data to us. However, after a purchase or another relevant transaction, we may be legally required to retain certain records as described in this Policy.

3. How We Use Your Information

We use the information we collect to operate Vocabulary Builder: Flashcards and provide the features available in the application. In particular, we use it:

• to provide the learning experience: operate your Account, provide vocabulary cards and training activities, personalize your course, and apply spaced repetition and daily learning goals;
• to save and synchronize your progress: keep your selected card sets, card statuses, study sessions, and learning statistics available across your devices;
• to manage your content: store and display the custom cards, card sets, words, translations, examples, and images that you create or upload;
• to provide image recognition: process a photo you select or take, recognize vocabulary in it, and match recognized words with available cards;
• to manage purchases and communications: validate and restore subscriptions, provide purchased features, and send verification codes, password-reset messages, and other necessary service communications;
• to support and protect the Services: respond to your requests, investigate reported card problems, prevent fraud and abuse, and diagnose technical or security issues;
• to understand and improve the application: analyze how features are used, improve learning content and user experience, and measure conversions from our Google Ads campaigns;
• to comply with applicable law: meet legal obligations and establish, exercise, or defend legal claims.

We use your email address to create or link your Account, verify that the email address belongs to you, let you sign in, send password-reset information, respond to support requests, and send other communications necessary to operate your Account. We do not use your email address to send marketing messages.

We use device and application information to maintain your authenticated session, synchronize your data, apply your language and time-zone settings, determine application compatibility, diagnose technical problems, respond to support requests, and protect the Services against fraud and abuse.

3.1 Automated recommendations and learning decisions

Vocabulary Builder: Flashcards uses automated rules to personalize the learning experience. These rules use information such as your selected course, card status, previous answers, memory level, review dates, and learning activity to schedule spaced-repetition reviews, select or order cards for training, calculate learning progress, and recommend card sets or learning activities.

These automated features affect only how learning content is presented within the Mobile Application. We do not use Personal Data to make solely automated decisions that produce legal effects or similarly significant effects concerning you.

4. Legal Bases for Processing

Where the General Data Protection Regulation (GDPR), UK GDPR, or similar law applies, the legal basis we rely on depends on the purpose and context of the processing:

• Performance of a contract: to create and operate the Account required to use the Mobile Application, authenticate you through an email address or Sign in with Apple, provide the learning features and image-recognition requests you choose to use, save and synchronize your learning data and User Content, manage subscriptions, and send communications necessary to provide the Services.
• Legitimate interests: to maintain and secure the Services, prevent fraud and abuse, diagnose technical problems, respond to support requests and card problem reports, understand and improve service performance, and measure conversions from our Google Ads campaigns where applicable law permits us to do so without consent. We rely on this basis only where our interests are not overridden by your rights and freedoms.
• Legal obligation: to comply with applicable tax, accounting, consumer-protection, law-enforcement, and other legal requirements.

An Account and authentication using an email address or Sign in with Apple are required to use the Mobile Application.

A system permission to access your camera or photo library allows the Mobile Application to use that device feature. The legal basis for processing the photo depends on the feature you request and is not determined by the system permission alone.

5. Analytics and Advertising Measurement

We use Google Analytics for Firebase to understand use of the Mobile Application and to measure conversions from Google Ads campaigns. Analytics collection is disabled by default in the application and is enabled only after you accept the applicable Terms and Privacy Policy.

Firebase may process a Firebase installation identifier, our public user identifier for your Account, device and application information, approximate location derived from IP address, and product-interaction events. We do not send email addresses, card text, translations, search text, uploaded images, or internal database identifiers to Firebase Analytics.

We do not display third-party advertisements in the Mobile Application. We do not access the iOS advertising identifier (IDFA), and advertising-personalization signals are disabled. Analytics data may be linked to Google Ads for conversion measurement and campaign reporting, but it is not used by us to create personalized advertising audiences.

For more information, see Google's Privacy Policy and Privacy and Security in Firebase.

6. When We Share Information

We do not sell your Personal Data. We disclose information only as described in this Policy, including to the following recipients:

• Cloudflare: private storage and delivery of user-uploaded card and card-set images through Cloudflare R2 and related infrastructure. Private images require authorization before they can be accessed.
• Google: Firebase Analytics for product analytics and Google Ads conversion measurement; Google Cloud Vertex AI for image-based word recognition.
• OpenAI: fallback processing for image-based word recognition when the primary provider cannot complete the request.
• Apple: Sign in with Apple, App Store subscriptions, purchase processing, receipt validation, and purchase restoration.
• Amazon Web Services (AWS): hosting of our application servers and database.
• Namecheap: delivery of account-verification, password-reset, and support emails through Namecheap Private Email.
• Legal and regulatory authorities: We may disclose Personal Data when required by applicable law, a court order, or another valid legal process. We review such requests and disclose only the information reasonably necessary to comply with them. Where legally permitted and appropriate, we may notify affected users about requests for their Account information.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, subject to appropriate safeguards.

Third-party providers process information under their own terms and privacy notices. We take reasonable steps to work with providers that offer appropriate privacy and security protections.

7. Data Storage and Retention

We retain Personal Data only for as long as necessary for the purposes described in this Policy. Unless a longer period is required by law, needed to resolve a dispute, or necessary to establish, exercise, or defend legal claims, the following retention periods apply:

• Account and learning data: Account information, course settings, selected learning content, learning progress, and study history are retained while your Account remains active. After you request Account deletion, deletion from active systems is completed within 30 days, subject to the exceptions below.
• User Content and uploaded images: custom cards, card sets, words, translations, examples, and uploaded images are retained until you delete the relevant content or your Account. Permanent removal from active storage may take up to 30 days after deletion is requested.
• Authentication information: active authentication tokens are retained until they expire, are revoked, or your Account is deleted. Email-verification and password-reset codes expire after the period stated when they are issued and are removed or rendered unusable within 24 hours after expiration.
• Support messages and card problem reports: retained for up to three years after the request is resolved or the report is last acted upon, unless longer retention is necessary to resolve a dispute, prevent abuse, or establish, exercise, or defend legal claims.
• Image-recognition records: operational information about image-recognition attempts and linked unknown-word suggestions is retained for up to 12 months. Vocabulary suggestions that have been irreversibly de-identified may be retained for longer because they are no longer Personal Data.
• Purchase and subscription records: retained while a subscription is active and afterwards for up to seven years where necessary for accounting, tax, fraud-prevention, customer-support, or legal-compliance purposes.
• Security and server logs: retained for up to three years, unless a particular log is required for longer to investigate a security incident, fraud, abuse, or a legal claim.
• Firebase Analytics information: event-level analytics information is retained for up to 14 months, subject to our Firebase and Google Analytics settings. Aggregated reports that no longer identify an individual user may be retained for longer.
• Account-deletion records: a limited record that an Account was deleted may be retained for up to three years to document the request, prevent abuse, and resolve disputes.
• Backups: Personal Data removed from active systems may remain in encrypted backups for up to one year before being overwritten or deleted through the normal backup cycle. Backup data is not restored except when necessary for disaster recovery.

You can request Account deletion from the Account screen in the Mobile Application. If you cannot access the Account deletion feature because your Account is locked or suspended, you may contact us at [email protected] to request deletion. Account deletion removes or anonymizes the Account, authentication credentials, active tokens, user-created cards and card sets, learning progress, study sessions, and uploaded images that are not required or used elsewhere. Information covered by an exception above is isolated from normal use and retained only for the stated purpose before being deleted or irreversibly anonymized.

8. Data Security

We use reasonable technical and organizational safeguards designed to protect Personal Data, including encrypted network connections, access controls, authentication tokens, password hashing, private storage for user-uploaded images, and restrictions on employee and contractor access.

No method of transmission or storage is completely secure. Although we work to protect your information, we cannot guarantee absolute security. Please contact us promptly if you believe your Account or information has been compromised.

9. Your Rights and Choices

Depending on where you live, you may have the right to:

• request access to or a copy of your Personal Data;
• request correction of inaccurate or incomplete Personal Data;
• request deletion of your Personal Data;
• request restriction of or object to certain processing;
• receive certain Personal Data in a portable format;
• withdraw consent where processing is based on consent;
• lodge a complaint with a competent data-protection authority.

You may update certain Account information in the Mobile Application and delete your Account from the Account screen. You may also manage camera and photo-library permissions in your device settings and manage subscriptions through your Apple App Store account.

To exercise another privacy right, contact us at [email protected]. We may need to verify your identity before completing a request. We will respond within the period required by applicable law.

10. Children's Privacy

The Services are not directed to children under 13, and we do not knowingly collect Personal Data from children under 13. Where local law sets a higher minimum age for a child to consent to online data processing, a parent or legal guardian must provide any required authorization. If you believe a child has provided Personal Data without appropriate authorization, contact us and we will take reasonable steps to delete it.

11. International Data Transfers

Our application servers and database are located in the United States, where our users' Personal Data is stored and processed. Personal Data may also be processed in the European Union and other countries where we or our service providers operate. Those countries may have data-protection laws different from the laws of your country. Where required, we use appropriate safeguards for international transfers, such as contractual protections or other legally recognized transfer mechanisms.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes to the Services, technology, legal requirements, or our data practices. The revised Policy will display a new "Last updated" date. Where required by law, we will provide additional notice or request consent before a material change takes effect.

13. Developer Details

The Services are owned and operated by Bondarenko Yevhenii, an individual developer based in Ukraine.

Privacy and support inquiries: [email protected]