Vocabie — Privacy Policy

Welcome to Vocabie ("we", "our", "us", or the "App"). Vocabie is developed and operated by Cengiz Kuscu, an individual developer, and published under the "CygoLabs" brand name. Vocabie is a language learning and flashcard application designed to help users build and retain foreign language vocabulary through spaced repetition (SM-2) and AI-assisted dictionary services.

We are committed to protecting your privacy and ensuring you have a transparent understanding of how your personal data is collected, used, stored, and shared when you use our mobile and desktop applications and related services (collectively, the "Services").

Please read this Privacy Policy carefully. By accessing or using Vocabie, you acknowledge that you have read and understood this Privacy Policy.

1. Information We Collect

We collect information in three ways: information you provide directly, information collected automatically, and information from third-party authentication providers.

A. Information You Provide to Us

• Account Information:
• When you sign in with Google or Apple, we receive your name, email address, and authentication user identifier provided by the identity provider. If you use Apple's "Hide My Email" feature, we receive a privacy-relayed email address.
• When using Guest (Anonymous) Mode, no personal identifier such as name or email is collected; we create a random anonymous user ID so your flashcards and progress remain synced across your active session.
• Learning & Study Data: Words you add to your personal dictionary, flashcard study history, repetition intervals, ease factors, review dates, streak counts, daily activity timestamps, and word quotas.
• User Feedback & Reports: Content of feedback messages or dictionary error reports you submit regarding word definitions or example sentences.
• Support Tickets: If you contact us through the in-app support form, we collect the contact email address you provide, the ticket category, subject, and message text. To help us diagnose technical problems, your app version and device/operating system type are automatically attached to the ticket. Support tickets are stored in our database and delivered to our support inbox by email (see Section 3).
• Clipboard & Shared Text (Quick Capture): The App may read text from your device clipboard or receive text shared from other apps (via the system share sheet) to suggest adding it as a new word or phrase. This feature is enabled by default and can be turned off at any time in Settings. This text is processed locally on your device to extract candidate words; it is only transmitted to our servers if you choose to add the suggested word to your dictionary.

B. Information Collected Automatically

• Device & Technical Data: Device model, operating system and version (iOS, Android, macOS), unique device identifiers, default language and locale settings, app version, and IP address.
• Usage & Diagnostic Data: Application performance metrics, session duration, feature interaction timestamps, error and crash logs used to maintain app reliability.

C. Purchase and Transaction Information

• Subscriptions and in-app credit purchases are processed directly by the Apple App Store (Apple Inc.) and Google Play Store (Google LLC).
• We do not collect or store your payment card details, bank information, or billing address. We only receive purchase confirmation tokens, transaction IDs, entitlement statuses (e.g., Free, Plus, Pro tier), and subscription expiration timestamps.

2. How We Use Your Information

We process your information for the following legitimate purposes:

1. Provide and Personalize the Services:

• Manage your user account and authenticate your identity.
• Synchronize your vocabulary list, flashcard reviews, and spaced repetition schedules across devices.
• Tailor dictionary definitions and example sentences to your selected native and target language pairs.

1. Process Purchases & Manage Entitlements:

• Validate and grant access to premium tiers, subscription features, and word generation credit packages.

1. App Improvement & AI Content Quality:

• Improve dictionary accuracy based on user error reports.
• Optimize application performance, fix bugs, and enhance user experience.

1. Communication & Support:

• Respond to your inquiries, support requests, and bug reports.

1. Security, Fraud Prevention & Legal Compliance:

• Protect our systems against unauthorized access, abusive scraping, or fraudulent behavior.
• Comply with applicable legal obligations and store platform guidelines.

Legal Bases for Processing (GDPR Art. 6 / KVKK Art. 5)

3. How We Share Your Information

We respect your privacy and do not sell, rent, or trade your personal information. We only share information with trusted third-party service providers who assist us in operating the Services under strict confidentiality agreements:

Ad attribution (campaign measurement): We do not sell your data, do not show third-party ads, and do not track you across other companies' apps or websites. To measure the effectiveness of our own promotional campaigns (Apple Search Ads, Google Ads) we use the platforms' own attribution mechanisms: on iOS, the app obtains an Apple AdServices attribution token (it contains no personal identifier and does not require App Tracking Transparency permission) and passes it to RevenueCat, which asks Apple which campaign, if any, led to the install; the resulting campaign source and campaign name may be stored with your account. Google Ads install and purchase conversions are measured through Firebase Analytics' integration with Google Ads; on Android this may use the Advertising ID according to your device's ad settings. The app does not read the iOS advertising identifier (IDFA). Should we ever introduce cross-app tracking, we will update this Privacy Policy and first request your permission via App Tracking Transparency.

4. AI & Dictionary Processing

Vocabie uses the DeepSeek V3.2 artificial intelligence (AI) model, accessed through the OpenRouter routing service from our servers, to generate word definitions, parts of speech, native translations, and example sentences:

• Shared Dictionary Pool: Word definitions and example sentences are cached in a communal shared dictionary so other users learning the same word can benefit without regenerating content.
• Zero Personal Data Exposure: Prompts sent to AI models contain only the dictionary word and target/source language codes. Your personal account information and study history are never shared with AI providers.
• No Training on Personal Data: We do not use your personal vocabulary lists or private learning data to train foundational public AI models.

5. Data Retention and Account Deletion

Retention Policy

We retain your personal data as long as your account remains active or as needed to provide you with the Services.

Inactive Guest accounts: Guest (Anonymous) accounts that have not been used for 90 days may be deleted, together with their server-side data, to limit storage of abandoned data. If you want to keep your vocabulary, link your Guest account to Apple or Google.

Account & Data Deletion

You have the right to delete your account and all associated data at any time directly within the application:

1. Open Vocabie and navigate to Settings > Account.
2. Tap Delete Account and confirm your decision.
3. Upon confirmation, your user profile, personal vocabulary lists, flashcard review history, wallet balances, and authentication records are permanently and irreversibly deleted from our active databases.
4. Guest (Anonymous) accounts can be deleted the same way, directly from the App. Deleting a Guest account permanently removes its server-side data (vocabulary, review history, wallet balance) in addition to the local session. Simply uninstalling the App or clearing local storage removes the on-device session but does not delete any data already synced to our servers.

Limited Exceptions to Deletion

A small set of records is retained after account deletion because they are required for legitimate business, legal, or security purposes. These records are disassociated from your account identifier where technically feasible:

• Support tickets you previously submitted, retained to maintain a record of correspondence and resolved issues. The link to your user account is severed upon deletion.
• Purchase and transaction records required for tax, accounting, refund, and chargeback obligations.
• Technical service logs and error diagnostic records (such as dictionary generation performance metrics and Edge Function operational error logs) that record system events. While your account is active, these entries are linked to your user ID for abuse rate limiting and technical troubleshooting; upon account deletion this link is removed (set to NULL), and the remaining entries contain no personal identifiers.
• Internal audit records documenting administrative actions, retained for security and accountability.
• A one-way fingerprint of your sign-in identity (a SHA-256 hash of your Apple or Google account identifier), retained only to prevent the one-time welcome credit from being claimed again by deleting and re-creating an account. It contains no email address, name, or account ID and cannot be reversed to identify you; it is not used for any other purpose.
• A record that an account with your sign-in identity was deleted (the same one-way fingerprint described above, plus the deletion timestamp), kept solely as an internal audit trail of account deletions. It cannot be reversed to identify you and is not used for any other purpose.

Entries in the communal dictionary are not personal data and remain available to all users, as described in Section 4.

6. Your Rights & Choices (GDPR, UK GDPR, CCPA/CPRA)

Depending on your jurisdiction, you have specific rights regarding your personal data:

• Right of Access & Portability: Request a copy of the personal data we hold about you.
• Right to Rectification: Update or correct inaccurate personal information.
• Right to Erasure ("Right to be Forgotten"): Request the complete deletion of your personal data.
• Right to Restrict or Object to Processing: Object to or restrict certain types of data processing.
• Right to Withdraw Consent: Where our processing relies on your consent (for example, if we introduce optional marketing communications in the future), you may withdraw that consent at any time.
• Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a data protection supervisory authority — in the EU/EEA, the authority of your country of residence, place of work, or the place of the alleged infringement; in the United Kingdom, the Information Commissioner's Office (ICO); in Türkiye, the Personal Data Protection Board (KVKK Kurulu). We would appreciate the chance to address your concern first at vocabie@cygolabs.com.

Users in Türkiye (KVKK — Law No. 6698)

For users in Türkiye, the data controller under the Turkish Personal Data Protection Law No. 6698 ("KVKK") is identified in Section 12. Your personal data is processed for the purposes and on the legal bases listed in Section 2 (KVKK Art. 5). Under KVKK Art. 11 you have the right to learn whether your data is processed, request information about it, learn the purpose of processing and whether it is used accordingly, know the third parties in Türkiye or abroad to whom it is transferred, request correction or deletion, request that third parties be notified of such corrections or deletions, object to outcomes against you arising exclusively from automated analysis, and claim compensation for damages caused by unlawful processing. Requests can be sent to vocabie@cygolabs.com and will be answered within 30 days at the latest. Transfers abroad are described in Section 9.

Please note that essential analytics and crash-reporting data is processed under our legitimate interest in maintaining, securing, and improving the Service, rather than on the basis of consent, and cannot currently be disabled from within the App. You may still object to this processing by contacting us, and we will assess your request in accordance with applicable law.

You can exercise your right to erasure directly in the App at any time via Settings > Account > Delete Account. To exercise any other right — including access, portability, rectification, restriction, or objection — please contact us at vocabie@cygolabs.com and we will respond within the period required by applicable law.

7. Children's Privacy (COPPA & GDPR-K)

Vocabie is not directed to children under the age of 13 (or under 16 in certain jurisdictions within the European Economic Area / United Kingdom). We do not knowingly collect personal information from children under these ages. If we become aware that we have inadvertently collected personal data from a child under the applicable age limit, we will take prompt steps to delete such information from our records.

8. Data Security

We implement industry-standard administrative, physical, and technical safeguards to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• TLS/HTTPS encryption for all data in transit.
• Row-level security policies ensuring that, through the application, each user can access only their own private records.
• Secure, tokenized authentication managed via enterprise-grade cloud infrastructure.

Internal Administrative Access

Vocabie operates an internal administration console that is not accessible to users. Authorized personnel may access account records — including your email address, language pair, personal vocabulary list, study statistics, entitlement and credit wallet balances, purchase history, and support correspondence — strictly for the following limited purposes:

• Responding to your support requests and diagnosing reported issues.
• Resolving billing, subscription, or credit balance discrepancies.
• Investigating fraud, abuse, or violations of our Terms of Service.
• Meeting legal or regulatory obligations.

Administrative access is restricted to authorized personnel, and changes made to user records through this console are written to an internal audit log. We do not browse user data for any purpose outside those listed above.

While we strive to use commercially acceptable means to protect your data, no method of electronic transmission or storage is 100% secure.

9. International Data Transfers

Your information may be transferred to and maintained on servers and databases located outside your country of residence, where data protection laws may differ from those in your jurisdiction:

• Primary database and authentication (Supabase): hosted in the European Union (Frankfurt, Germany).
• Analytics and crash reporting (Firebase), subscription management (RevenueCat), support email delivery (Brevo), and AI routing (OpenRouter): these providers may process data in the United States, the EU, or other countries where they or their sub-processors operate.

We rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses or adequacy decisions. For users in Türkiye, transfers abroad are carried out in accordance with Article 9 of KVKK.

10. Third-Party Links & External Services

Our Services may contain links to third-party websites or services (e.g., Apple App Store, Google Play Store). We are not responsible for the privacy practices or content of third-party platforms. We encourage you to read the privacy policies of any third-party services you visit.

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technologies, or legal obligations. When we post updates, we will revise the "Last Updated" and "Effective Date" at the top of this page. If we make material changes, we will provide noticeable notice within the App or via email prior to the changes taking effect.

12. Data Controller & Contact

The data controller responsible for your personal data is Cengiz Kuscu, an individual developer based in the Republic of Türkiye, publishing Vocabie under the "CygoLabs" brand name.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

• Email: vocabie@cygolabs.com