Privacy Policy

Information we collect

We collect and may retain data you submit to, generate in, or create through Vokab, including account and authentication details, profile settings, optional birth year, language goals, generated learning material, personal library state, hosted lexical word records, study cards, review history, progress reports, subscription status, Stripe customer identifiers, support messages, and technical logs. Ordinary imported source text is saved to your browser-local private graph and, when you enable or unlock Private sync, to end-to-end encrypted private sync; it is not saved to Vokab's shared corpus by default. Stripe handles payment card details; Vokab does not store card numbers.

How we use it

Vokab is an MVP-stage product. To the fullest extent allowed by law, we use this information to authenticate users, prepare vocabulary and pronunciation material, schedule reviews, show progress, operate billing, prevent abuse, debug errors, secure the service, respond to support requests, improve the product, develop features, measure product-market fit, perform business administration, and meet legal obligations. Optional birth year is used to decide whether mature or offensive language visibility can be enabled; the setting remains hidden unless the saved birth year shows the user is 18 or older and the user turns it on. If you do not agree to this broad use, do not use Vokab. Imported material, words, and generated learning requests may be sent to AI and text-to-speech providers to generate learning content, and those providers may process or retain requests under their own terms and policies.

Who receives it and how it is disclosed

Data is disclosed through secure service integrations to Supabase for authentication and database storage, Stripe for billing, Inngest for background jobs, Vercel for hosting and logs, and AI or text-to-speech providers for generation. Ordinary imported sentences, ordered content, and private translations stay in browser-local private storage or, when enabled, end-to-end encrypted private sync. Private sync stores an encrypted key envelope and encrypted snapshots in your account; Vokab does not receive or recover the passphrase or decrypted private graph. Existing browsers remember the unlocked sync key where the browser allows it, and new browsers need your private sync passphrase. If you do not set or unlock that passphrase, private imports remain local to browsers where they already exist and are unavailable on new browsers. Vokab admins and support operators can access hosted operational systems when needed, including account records, billing state, logs, shared corpus rows, hosted lexical word records, user library links, study cards, review history, and progress records. By default they cannot inspect browser-local private imports or decrypt Private sync snapshots, and hosted study records for shared-backed words do not include private source text, private sentence text, source order, or private translations. Shared corpus material is limited to safe lexical records, builder-seeded material, or material explicitly submitted through public import or publicize.

Security practices

We use Supabase authentication, database access controls, server-only service-role credentials, HTTPS, provider-side payment handling, scoped environment variables, and operational logging. No internet service can be guaranteed perfectly secure, so do not submit confidential, sensitive, or regulated information to Vokab imports.

Retention and choices

Account, subscription, library, progress, generated, usage, and technical data may be kept for as long as we reasonably need it for the purposes above, including product development, debugging, billing, legal, security, audit, backup, and abuse-prevention needs. You can ask for access, correction, deletion, or export of personal data, and we will handle requests as required by applicable law. Some records may be retained when required or permitted for billing, security, legal, audit, backup, or legitimate business reasons.

• Learning text processing

  deepseek/deepseek-v4-flash, openai/gpt-5.4-mini

• Import text preparation

  openai/gpt-5.4-mini

• Lexical entries

  xai/grok-4.3

• Speech playback

  openai/gpt-4o-mini-tts