Privacy Policy

We process your email and sign-in details, preferences, cards and sets, learning history, and sharing or class memberships to provide Vocabista. A sign-in provider sends us the details needed to authenticate your account. The legal basis is performance of our agreement with you (GDPR Article 6(1)(b)). Without the necessary account data, we cannot provide an account or synchronize your learning.

We process connection and diagnostic data, such as IP addresses, session details, request timing, errors, and app versions, to prevent abuse and keep the service secure and reliable. This is our legitimate interest (Article 6(1)(f)). We also process data where required by law (Article 6(1)(c)).

We do not sell personal data or use it for third-party advertising. We do not use an external account-attributed analytics service.

When you use AI, translation, image recognition, or speech features, relevant text, images, or card content is sent to the service providing that feature. We process the result to display or save it for you. Google Cloud provides generated speech; audio may be stored in Cloudflare R2 and on your device.

Ordinary vocabulary is not necessarily personal data, but submitted text or images can identify people, and saved cards and study history are linked to your account.

People allowed by your sharing choices can view and download shared content. Public content is visible to other users. Removing content cannot retrieve screenshots, exports, or other copies made outside Vocabista.

The table below explains how we use named providers and links to their data-processing terms or privacy notices. AI, translation, and image-recognition providers also receive the text, images, or card content needed for the generation features you use, as described above.

Google, Apple, and Telegram process information under their own privacy notices when you choose their sign-in, linking, or messaging features.

Providers may process data outside the European Economic Area. Our providers' agreements include EU standard contractual clauses for covered transfers. You can contact us to ask which safeguards apply to your data and obtain a copy.

We use necessary authentication cookies and local storage for sign-in, preferences, and app functions. Blocking them may prevent those functions from working.

The mobile app stores learning data, pending changes, and audio for offline use. Clearing app data or uninstalling can erase unsynchronized changes. Account deletion revokes server access; an offline installation's local data is cleared when it next contacts the service or you clear the app.

We keep account and learning data while your account is active, and operational records for as long as needed to run and protect the service or meet legal obligations.

Request account deletion in Settings. Once accepted, we revoke access and remove your account and content from active systems. Database backups may keep copies for up to eight days. A deletion record containing your account identifier is kept for at least 45 days so deletion can be reapplied after a backup restore; its removal may take longer.

External providers and older caches may retain some copies for longer. We cannot verify deletion or give a fixed retention period for every copy. Contact us for details about a particular service.

You can contact us to request access, correction, erasure, restriction, or a portable copy of your personal data where the GDPR provides these rights. You can object to processing based on legitimate interests and withdraw consent where processing relies on consent, without affecting earlier lawful processing. We may need to verify your identity.

You can complain to a data-protection authority, including the authority where you live or work, or the Berlin Commissioner for Data Protection and Freedom of Information.

Vocabista is for users aged 13 and over. Parents or guardians can contact us about their child's account; we may verify their authority before acting. If we learn that an account belongs to a child under 13, we will close it and delete its personal data under the retention and deletion rules above.

We will update this page when our practices change and give any notice required by law.