Privacy policy

This policy explains what data Vocabcraft (“we”, “us”) collects when you use vocabcraft.com, why we collect it, where it's stored, and what rights you have over it. If you have questions, email accounts@vocabcraft.com.

Information we collect

From Sign in with Google

When you sign in with Google, Google sends us the following information from your Google account:

• Email address — used as your account identifier and to contact you about your account.
• Name — displayed in the app interface as your display name.
• Profile picture URL — displayed as your avatar in the app interface.
• Google account ID (the OpenID sub claim) — a stable unique identifier we store to link your authenticated session to your account.

We request no OAuth scopes beyond the basic authentication scopes (openid, email, profile). We do not access your Gmail, Drive, Calendar, YouTube data, or any other Google service. We do not store your Google password — authentication is handled entirely by Google.

From email magic-link sign-in

If you sign in with an email magic link instead of Google, we collect only the email address you submit. The sign-in link is generated and delivered by our authentication provider (Supabase).

Information you provide through the app

• Learning data — cards reviewed, ratings, streaks, and study session metadata, used to power spaced repetition scheduling and sync your progress across your devices.
• App preferences — settings you choose in the app.

Information collected automatically

• Vercel Web Analytics — we use Vercel's privacy-friendly web analytics to count page views and understand feature usage. Vercel Analytics uses no cookies, no advertising identifiers, and no cross-site tracking. To count unique visitors, Vercel hashes your IP address and user-agent with a daily-rotated salt; the raw IP is processed at request time only and is not persisted. The page path, referrer, country (derived from IP), and browser family are recorded. None of this data is linked to your account.
• Essential cookies / local storage — used to maintain your authenticated session and to cache content for offline use. We do not use advertising or tracking cookies.

How we use your information

• To create, authenticate, and maintain your account.
• To sync your learning progress across your devices.
• To display your name and avatar within the app interface.
• To respond to your support requests.
• To improve the app via aggregate, anonymous usage analytics.

We do not use your data for advertising. We do not sell or rent your data. We do not share data received from Google with third parties for their own purposes, and we use Google user data only in the ways described in this policy. Vocabcraft's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Where your data is stored

Your account and learning data are stored on Supabase infrastructure, hosted on Amazon Web Services in the EU (Ireland) region. Supabase acts as our data processor under a Data Processing Agreement. The web app is hosted by Vercel, which also provides our analytics. Data in transit is encrypted via TLS; data at rest is encrypted by the underlying storage layer.

Sub-processors

We rely on the following service providers to operate Vocabcraft. We share only the information strictly necessary for each service to perform its function:

• Supabase — authentication and database.
• Vercel — application hosting and web analytics.
• Google — identity provider (only when you choose to sign in with Google).

Data retention

We retain your account data for as long as your account is active. We do not currently offer in-app account deletion — to delete your account and all associated personal data, email accounts@vocabcraft.com and we will process the request within 30 days, except where we are required to retain limited records for legal, tax, or accounting reasons.

Security

Data is transmitted over HTTPS and stored on Supabase infrastructure with industry-standard authentication and access controls.

Children's privacy

Vocabcraft is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.

Your rights

If you are in the EU, UK, or another jurisdiction with similar data-protection laws, you have the right to:

• Access a copy of your personal data
• Correct inaccurate or incomplete data
• Delete your data (“right to be forgotten”)
• Restrict or object to processing
• Receive your data in a portable, machine-readable format
• Withdraw consent where processing is based on consent

To exercise any of these rights, email accounts@vocabcraft.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data-protection authority.

Changes to this policy

We will update this page if our data practices change. The “Last updated” date at the top of this page reflects the most recent revision. Material changes will be communicated through the app prior to taking effect.

Contact

For privacy questions, data-access requests, or account-deletion requests: accounts@vocabcraft.com.