Privacy Policy

Information we collect

We collect and may retain data you submit to, generate in, or create through Vokab, including account and authentication details, profile settings, optional birth year, language goals, generated learning material, personal collection state, hosted lexical word records, study cards, review history, progress reports, subscription status, Stripe customer identifiers, support messages, and technical logs. Ordinary imported source text is saved to your browser-local private graph and, automatically, to encrypted private sync; it is not saved to Vokab's shared corpus by default. Stripe handles payment card details; Vokab does not store card numbers.

How we use it

Vokab is an MVP-stage product. To the fullest extent allowed by law, we use this information to authenticate users, prepare vocabulary and pronunciation material, schedule reviews, show progress, operate billing, prevent abuse, debug errors, secure the service, respond to support requests, improve the product, develop features, measure product-market fit, perform business administration, and meet legal obligations. Optional birth year is used to decide whether mature or offensive language visibility can be enabled; the setting remains hidden unless the saved birth year shows the user is 18 or older and the user turns it on. If you do not agree to this broad use, do not use Vokab. Imported material, words, and generated learning requests may be sent to AI and text-to-speech providers to generate learning content, and those providers may process or retain requests under their own terms and policies.

Who receives it and how it is disclosed

Data is disclosed through secure service integrations to Supabase for authentication and database storage, Stripe for billing, Inngest for background jobs, Vercel for hosting and logs, and AI or text-to-speech providers for generation. Vercel Web Analytics counts page views on every page, without the part of the address after the question mark. It uses no cookies and keeps no IP address: it records the page, the referring site, the country and city, and the browser, system and device type, and tells visitors apart by a hash of the request that it deletes after 24 hours. When you import, your text goes to Vokab's server and on to the AI providers that make your cards. Vokab sends these import requests through the Vercel AI Gateway with zero data retention, so they go only to AI providers that agree not to keep them. Private sync encryption protects the stored copies, not this step. Ordinary imported sentences, ordered content, and private translations stay in browser-local private storage or encrypted private sync. Private sync encrypts snapshots in your browser. With standard protection, Vokab keeps your encryption key in Supabase Vault, so your collection opens after sign-in on any device. This also means Vokab can technically decrypt stored snapshots. Vokab promises never to do so, unless the law requires it. You can enable end-to-end encryption in Settings: then only your passphrase and your unlocked browsers can open the current synced collection. Nobody else can, Vokab included. If you lose both, Vokab cannot recover it; your study cards and review history stay on Vokab's server. Switching protection does not retroactively protect earlier backups. Existing browsers remember unlocked keys where browser storage allows it. Vokab admins and support operators can access hosted operational systems when needed, including account records, billing state, logs, shared corpus rows, hosted lexical word records, user collection links, study cards, review history, and progress records. Browser-local private imports are not directly accessible to support, and end-to-end encrypted snapshots cannot be decrypted with server-held keys. Hosted study records for shared-backed words do not include private source text, private sentence text, source order, or private translations. Shared corpus material is limited to safe lexical records, builder-seeded material, or material explicitly submitted through public import or publicize.

Security practices

We use Supabase authentication, database access controls, server-only secret credentials, HTTPS, provider-side payment handling, scoped environment variables, and operational logging. No internet service can be guaranteed perfectly secure, so do not submit confidential, sensitive, or regulated information to Vokab imports.

Retention and choices

Account, subscription, collection, progress, generated, usage, and technical data may be kept for as long as we reasonably need it for the purposes above, including product development, debugging, billing, legal, security, audit, backup, and abuse-prevention needs. You can ask for access, correction, deletion, or export of personal data, and we will handle requests as required by applicable law. Some records may be retained when required or permitted for billing, security, legal, audit, backup, or legitimate business reasons.

• Learning text

  DeepSeek, Google, OpenAI, Typesafe AI

• Speech playback

  xAI

• Story writing

  xAI

• Photo reading

  Anthropic