Privacy Policy
Last updated: October 13, 2026
Short version: Vocabary is fully usable without an account. If you do not create one, your vocabulary lists, imported files, answers and study history stay on your device and none of them reach our server. The one exception is using the sentence-checking or story feature in the optional Pro subscription — those send your inputs to our server and to a third-party AI provider even without an account (section 9). The app does not use an ad network and does not read your advertising ID.
An optional account exists for Pro's cloud sync (syncing across devices); creating an account by itself does not back up your progress to the server. The app has no feature for downloading a backup as a file; backups are made only through Pro cloud sync. What is stored on the server if you create an account, how long it is kept, how to delete it and how to export it are all listed in section 3.
The app uses Google Firebase to see crash reports, measure basic product flows and send app-related announcements. This notice explains what is processed, why it is processed and how you can contact us about your rights.
1. Controller and contact
For GDPR purposes, the controller is the operator of the Vocabary app.
| App | Vocabary |
|---|---|
| Contact | info@vocabary.com |
| Scope | The Vocabary mobile app and information pages on vocabary.com |
If the legal business name or address is defined separately, this section will be updated.
2. Data categories
Vocabary is fully usable without creating an account. Precise location, contacts and the advertising ID are never collected. Our analytics service (Firebase Analytics) derives only an approximate location at country and city level from your device's IP address; it is used for usage statistics and is not linked to your account. Your name, email address and phone number are processed only if you choose to create an account, and only to the extent you provide them. The table below describes use without an account; everything stored on the server when you have an account is listed in section 3.
| Data | What it contains | Where it is processed |
|---|---|---|
| Crash reports | Technical crash details such as the failing code area, app version, device model, operating system version and time of error | Google Firebase Crashlytics |
| Usage events | Basic product events such as first session completed, set created, import completed and related technical counts. When a catalogue suggestion is shown to you while building a set by hand and when you accept it, the suggested catalogue word is also included in the event. | Google Firebase Analytics |
| Notification token | A Firebase Cloud Messaging token that may be assigned to your device for app announcements | Google Firebase Cloud Messaging |
| Local study content | Vocabulary lists, imported file contents, answers, study history, review schedule, streaks, badges and preferences | Only the on-device database and local settings storage |
Not included in Firebase reports: your imported files, written answers, the words and meanings you write yourself, created sentences and detailed study history.
The single exception: catalogue suggestions. While building a set by hand, if the word you type is found in the word catalogue bundled with Vocabary, a suggestion is shown to you. The fact that this suggestion was shown and that you accepted it reaches Firebase Analytics as a usage event, together with the suggested word. The word sent always comes from Vocabary's own catalogue; the text you type freely, the meanings you give and the sentences you build are not sent. This information is not linked to your identity.
3. What is stored if you create an account
An account is optional. Vocabary works fully without one: you can build sets, import files, study and keep track of your reviews. Without an account, nothing but the measurement data described in section 2 reaches our server — with one exception: using the sentence-checking or story feature in the optional Pro subscription. Those features do not require an account, and they send your inputs to our server and to a third-party AI provider even if you have no account (section 9). This section applies only if you choose to create an account.
An account exists for Pro's cloud sync: creating an account by itself does not back up your progress — syncing across devices is part of the Pro subscription (see section 9). The app has no feature for downloading a backup as a file. An account does not unlock or restrict any other feature of the app — Pro and the AI features work independently of an account, tied to your subscription identifier (RevenueCat).
| What is stored | What it contains | Why |
|---|---|---|
| Account details | Your email address, your name, your phone number if you provide one, your preferred app language, your registration date and your last sign-in date | Identifying your account, letting you sign in and emailing you in the right language |
| Consent record | The version of the privacy policy and terms of use you accepted, the date of acceptance, the IP address at that moment and the browser or app information | Being able to prove which text you accepted, as GDPR and Turkish KVKK require |
| Session records | The device name or browser information of the session, its IP address and its expiry | Keeping sessions secure and letting a suspicious session be revoked |
| Backed-up study data (with Pro cloud sync) | Your sets, words, review history, stories, streak, badges and some synced preferences | So your progress comes with you when you change devices |
What we do not do with backed-up content. Your lists and study history are stored only to be given back to you: we do not publish them, show them to other users, sell them, use them for advertising or use them to train AI models.
Your password and emails. Your password is not stored in readable form on the server; it is kept as an irreversible hash. Password reset and email verification messages are sent through our email provider. Traffic between the app and the server uses an encrypted connection (HTTPS).
Deleting your account. You can delete your account from inside the app; if you cannot reach the app, you can also request deletion by writing to info@vocabary.com. Your account closes immediately and you cannot sign in again. Your backed-up study data is held on the server for 30 days and then permanently deleted. Technical traces of deleted records are pruned within 180 days at the latest. Step-by-step instructions are on the Delete your account page.
Data on your device is separate. Deleting your account does not delete the lists on your device, and deleting the app from your device does not close your account. You need to do both separately.
Exporting your data. You can export your account details and backed-up study data and keep a copy yourself. If you have not opened an account, your data exists only on your device.
If your Pro subscription ends. If your Pro subscription ends — through cancellation, trial expiry or a failed payment — cloud sync stops; everything accumulated on your device up to that point stays on your device and nothing is deleted. Your cloud copy on the server is kept for 90 more days — if you resubscribe within that time, sync resumes where it left off; after 90 days only the server-side cloud copy is deleted, data on your device is not affected. Stories you generated with AI stay on your device and are not deleted when the subscription ends. The app has no feature for downloading a backup as a file.
4. Purposes of processing
- Finding and fixing crashes and technical problems
- Understanding where users get stuck and improving the app experience
- Sending important app announcements, such as new content or relevant updates
- Running spaced repetition, daily goals, streaks, badges and reminder features on your device
- Managing your account, if you choose to create one; carrying your progress between your devices through cloud sync, if you also have Pro
- Keeping accounts secure and preventing abuse
- Responding to privacy or support requests
5. Collection method and GDPR legal bases
Data is collected or stored electronically through automatic technical records, Firebase services, the on-device database, local settings storage and files that you choose to import.
| Processing activity | GDPR legal basis |
|---|---|
| Crash reports and basic technical usage measurement | Article 6(1)(f) legitimate interests: keeping the app secure, stable and sustainable |
| Notification delivery for app announcements | Article 6(1)(f) legitimate interests and, where required by the operating system, your device-level notification permission |
| Vocabulary lists, study history and preferences stored on the device | Article 6(1)(b) performance of the app service and Article 6(1)(f) legitimate interests in providing the requested learning features |
| Account details, if you create an account; backed-up study data, if you also use Pro's cloud sync | Article 6(1)(b) performance of the account and (for Pro) cloud sync service you asked for |
| Consent record (version, date, IP address, browser information) | Article 6(1)(c) compliance with a legal obligation and Article 6(1)(f) legitimate interests in establishing and defending legal claims |
| Support emails you send us | Article 6(1)(f) legitimate interests in responding to your request and protecting legal rights |
6. Data that stays on your device
Your vocabulary lists, study history, review schedule, streaks, badges, daily goal, theme, language and reminder preferences are stored on your device. If you do not create an account, Vocabary does not upload this study content to its own server. If you are a Pro subscriber with an account (cloud sync), a copy of this content is also stored on the server as described in section 3.
On Android, Vocabary's data is excluded from the phone's system backup (Google Backup) and from device-to-device transfer. On iPhone, if iCloud Backup is enabled, app data may be backed up to your iCloud account; that backup is not stored on a Vocabary server and Vocabary cannot see its contents. To move your data to a new phone, use Pro cloud sync.
On Android, when you uninstall the app or clear its data from device settings, locally stored content is deleted and does not come back on reinstall. On iPhone, deleting the app removes locally stored content from the device; however, if you restore your phone from an iCloud backup the data may come back. Uninstalling the app stops new Firebase data from being sent.
7. Imported files
When you select an Excel, CSV or JSON file, the file is read on your device and converted into your vocabulary list. The file or its contents are not uploaded to a Vocabary server. Invalid rows, if any, are shown on the device before import.
8. Pronunciation and device services
When you tap the pronunciation button, the relevant word is passed to your device's text-to-speech engine. Vocabary does not use its own server for this. Your device's text-to-speech engine may be provided by Google, Apple, the device manufacturer or another third party, and its behavior is outside Vocabary's control.
9. AI-assisted sentence checking and stories
These features are part of the Pro subscription; free users may also be offered a limited number (daily or total) of free trial uses, enforced on our server; once that trial limit is reached, the feature cannot be used without Pro. Sentence checking and stories send your inputs to third-party AI providers to process them: for sentence checking, the English sentence you write and the word being checked; for stories, the target words, the list of words you already know and your level.
Provider-agnostic architecture. Vocabary is not tied to a single AI provider; it can choose among several providers (for example OpenAI, Anthropic, Google, or other OpenAI-compatible services) and the provider used may change over time. These providers' servers may be located outside Türkiye or the European Union/European Economic Area; in that case the relevant data is transferred abroad under Turkish KVKK Article 9. Such a transfer abroad is made only where permitted by Turkish KVKK Article 9 and, for EU/EEA users, GDPR Chapter V — that is, when a transfer safeguard such as standard contractual clauses or an adequacy decision is in place.
IP address — abuse limit. To prevent abuse (excessive requests) of these two features, the IP address of the requesting device is processed only temporarily to enforce a daily request limit; it is not retained beyond that purpose.
Purpose. Used only to check whether the target word is used correctly in your sentence, and to generate a story personalized with your words.
Identifier. The provider is never sent your name, email, account id or subscription id — only the text needed to perform the task (your sentence/target word, or the word list and level for a story). Quota and abuse control happen only on our own server, keyed to your subscription identifier (RevenueCat); that identifier is never shared with the AI provider, is not used for advertising and is not shared with ad networks.
Retention. Call traces (which request was sent, when, and which provider responded) are kept for at most 90 days for quality checks, reviewing user complaints and debugging, then deleted. When you flag a response as wrong or rate it, that flag (and your note, if any) is attached to the record. Usage logs (how many times a feature was used, token/character counts) are kept separately for quota and cost tracking for at most 12 months and then deleted; these logs do not contain the text of your sentence or story.
This data is not used for advertising, is not sold, and is not used by us to train another AI model. That a provider may apply its own model-training policy to requests it receives is taken into account when selecting providers.
If you do not use this feature — if you never open the sentence-checking or story screen — none of your input reaches a third-party AI provider; not using the feature is how you avoid this.
10. Third-party sharing and international transfer
Vocabary does not use an ad network, does not read the advertising ID, does not create behavioral ad profiles and does not sell your data.
We operate the account and backup service on our own server; data belonging to your account is not shared with ad networks or data brokers.
The main third-party infrastructure we use is Google Firebase:
- Firebase Crashlytics: crash and error reports
- Firebase Analytics: basic usage events and product improvement measurement
- Firebase Cloud Messaging: app announcements and notification delivery
These services are operated by Google. Relevant technical data may be processed on Google's servers outside your country. Google's privacy policy is available at policies.google.com/privacy.
Details of the third-party AI providers used for Pro's sentence-checking and story features, and their cross-border transfer, are in section 9.
Crashlytics and Analytics cannot be disabled inside the app. You can disable notifications from your device's system notification settings.
11. Retention
- Vocabulary lists, study history and preferences stored on your device remain there until you delete them or clear app data.
- If you create an account, your account details and backed-up study data are kept for as long as the account exists. Once you request deletion the account closes immediately and the data is held for 30 days before being permanently deleted and technical traces of deleted records are pruned within 180 days at the latest.
- If your Pro subscription ends, your cloud copy on the server is kept for 90 more days and then deleted; data on your device is not affected (see section 3).
- AI call traces are kept for at most 90 days; usage logs kept for quota/cost purposes (which contain no text) are kept for at most 12 months and then deleted (see section 9).
- The consent record is kept while your account exists, because we need it to prove which text you accepted, and is deleted on the same schedule when the account is deleted.
- Technical records and usage events processed by Firebase are retained according to Google Firebase retention and deletion policies.
- If you contact support by email, the correspondence may be retained for a reasonable period to resolve your request and protect legal rights.
12. Children's privacy
Vocabary does not knowingly collect identity information from children. Because the app works without an account, no identity records are kept for children in account-free use. Creating an account requires you to be at least 13 years old; if you are under 18, you should create the account with the knowledge and consent of your parent or guardian. If we learn that an account belongs to a child below the age limit, we delete the account and its data.
13. Your privacy rights
If GDPR or another privacy law applies to you, you can contact us at info@vocabary.com about access, correction, deletion, objection or restriction requests.
If you have an account, you can exercise most of these rights directly inside the app: you can see and correct your details, export your data and delete your account. Section 3 has the details.
If you do not have an account, we do not keep a user record that directly identifies you, so we cannot access your vocabulary lists, imported files, answers or study history. That content is stored on your device.
To delete the data stored on your device, clear Vocabary app data from device settings or uninstall the app. For information you send to us by support email, we can review access, correction or deletion requests.
Technical crash and usage records created through Firebase are not connected to a Vocabary account that directly identifies you, so it may not be technically possible for us to find or delete those records for a specific person.
14. Security
If you create an account, traffic between the app and the server uses an encrypted connection (HTTPS), your password is not stored in readable form and session tokens are not stored in plain form.
Vocabary follows data minimization by keeping study content on the device, avoiding unnecessary personal data collection, not using advertising IDs and limiting crash and usage measurement to basic technical purposes.
15. Changes to this policy
Change of September 11, 2026: an optional account with backup was added to the app. Account-free use continues exactly as before and nothing you create reaches the server without an account; if you create one, what is stored, how long it is kept, how it is deleted and how it is exported is written in the new section 3. Earlier section numbers therefore shifted by one.
Change of September 26, 2026: an optional Pro subscription (cloud sync, working the Words You Struggle With set, tap-to-learn reading) and AI-assisted sentence checking / story features were added. Your sentence-checking and story inputs are sent to third-party AI providers; details are in the new section 9, and what happens to your data when a Pro subscription ends is in section 3. Earlier sections 9-16 therefore shifted to 10-17.
Change of September 28, 2026: the text was clarified: an account exists for Pro's cloud sync, and file backup does not need an account and is always free (section 3); international transfers are made only where the law permits, and IP addresses are processed only temporarily for the AI quota (section 9); stories were added to the backed-up study data table.
Change of October 10, 2026: the in-app file backup (save to phone / restore) was removed; backups are now made only through Pro cloud sync (sections 3 and 6).
Change of October 13, 2026: we now state explicitly that our analytics service derives an approximate location at country and city level from the IP address; precise location is still never collected (section 2).
If payments, subscriptions or additional third-party services are added, this policy will be updated again. You can track updates from the "Last updated" date on this page.
16. Turkey / KVKK note
For users in Turkey, Vocabary also provides a Turkish KVKK notice. You can read it here: Turkish KVKK notice.
17. Contact
For questions about this privacy policy, your rights or Vocabary's data processing activities, contact us at: