Privacy Policy

1.At a glance

The short version. Every row is explained in full further down.

We do not run third-party analytics or advertising SDKs, we do not sell or share your personal information, and we do not use your data for advertising or cross-app tracking.

2.Who we are

Vocabee is made by Riyaan Rahman, an independent developer trading as Vocabee (“Vocabee”, “we”, “us”). We make the Vocabee iPhone app and the website at thevocabee.app, and this policy covers both.

For data protection purposes, Riyaan Rahman is the controller of the personal information described here, at 2007 9th St, Lubbock, TX 79401, USA. You can reach us at any time at support@thevocabee.app, or via our support page.

3.Information we collect

Stored on your device

Vocabee is local-first. By default, the words you have seen, your saved collections (“Your Words”), your quiz results, streaks, XP, stats and app settings are stored on your iPhone. We cannot see any of it, and it is included in your device backups according to your own iOS settings.

If you create an account

An account is optional. The free tier is fully usable without one. If you choose to create one, we collect:

• Your email address, so you can sign in and recover your account.
• A password, which is hashed by our authentication provider, Supabase. We never see or store your plaintext password.
• Your synced learning data — the words you have seen, your collections and your progress — so it can appear on your other devices.

If you subscribe to Vocabee Pro

Purchases are processed by Apple. We never receive your payment card details. We receive your subscription status through RevenueCat, which manages entitlements and receives an anonymous app user ID along with purchase and receipt data from Apple.

If you use AI word generation

When you ask Vocabee to generate words, your request is sent to our Supabase Edge Function, which calls Google’s Gemini API. We do not send your account email or other personal details with that request.

If you turn on reminders

Enabling daily notifications or the word alarm stores a device push token so the notification can be delivered to your phone. You can turn notifications off at any time in the iOS Settings app, and we delete the token when it stops being valid.

Crash and performance diagnostics

If you have turned on “Share with App Developers” in iOS Settings → Privacy & Security → Analytics & Improvements, Apple shares crash logs and performance metrics with us. These come to us through Apple in a form that is not linked to your name, email or account. We use them only to fix bugs. You can turn this off in iOS Settings at any time.

What we never collect

Vocabee does not collect your contacts, your location, your calendar, your health data, your microphone input, your photos, your browsing history, or the iOS Advertising Identifier. We do not build a profile of you and we do not track you across other companies’ apps or websites.

4.How we collect it

Apple requires us to be explicit not just about what we collect but about how it reaches us. There are exactly three routes:

• Directly from you. Your email address and password when you choose to create an account; the words and collections you save; the words you ask the app to generate; anything you write to us in a support email.
• Automatically from the app on your device. Your progress, streaks, XP and settings as you use the app — stored locally, and uploaded to Supabase only if you turned on sync. The push token, generated by iOS when you enable notifications.
• From Apple and our service providers. Your subscription and receipt status, passed to us through Apple and RevenueCat when you buy or renew Vocabee Pro; and crash diagnostics, if you opted into sharing them.

We do not buy personal information about you, and we do not receive it from data brokers, advertising networks or social networks.

5.How we use information

We use the information above only to:

• Run the app and show you your daily words.
• Build practice games and quizzes from the words you have actually seen.
• Keep your streaks, XP, levels and stats accurate.
• Sync your words and progress across your devices, if you asked us to.
• Unlock and maintain your Vocabee Pro entitlement.
• Send the reminders you turned on.
• Answer your support emails.
• Keep the service secure and working, and comply with our legal obligations.

We do not use your data to build advertising profiles, and we do not sell it.

6.Third-party services we use

These are the only third parties that receive any of your data. There are no others — no analytics vendors, no advertising networks, no data brokers, and no parent, subsidiary or affiliated company with access to your information.

• Supabase — Authentication, database hosting for optional accounts and sync, and the Edge Function used for word generation. Your account credentials and synced learning data are stored on Supabase infrastructure. Privacy policy.
• Apple — App Store distribution, in-app purchase processing, push notification delivery, and — only if you opted into sharing with developers — crash and performance diagnostics. Apple handles all payment details. Privacy policy.
• RevenueCat — Subscription entitlement management. Receives an anonymous app user ID and purchase/receipt data. Privacy policy.
• Google (Gemini API) — Generates words when you request them, via our Supabase Edge Function. We do not pass your account email or personal data to it. Privacy policy.
• Vercel — Hosts the thevocabee.app website. As with any web host, its servers receive the IP address and browser user-agent of anyone who loads a page, in standard request logs. It does not host the app's account data, and it receives nothing from inside the app. Privacy policy.

Our commitment about these providers

Each third party with whom we share user data — including every service listed above, every third-party SDK in the app, and any parent, subsidiary or other related entity that may have access to user data — is contractually required to provide the same or equal protection of your data as is stated in this Privacy Policy and as required by the Apple App Store Review Guidelines. Each acts as our processor under a written data processing agreement. They may use your data only to perform the service we have asked them to perform, on our documented instructions. None of them is permitted to sell your data, to use it for their own advertising, to build profiles from it, or to repurpose it for anything beyond what this policy describes. If a provider will not accept those terms, we do not use it.

If we ever add, replace or remove a provider, we will update this section and the “Last updated” date before the change takes effect.

7.Permissions on your device

Photos

Vocabee asks for permission to add photos only so it can save the word cards and wallpapers you choose to export to your photo library. The app never reads, browses or scans your photo library, and it never uploads your photos anywhere.

Notifications

Used for the daily reminder and the word alarm, if you turn them on. You can revoke this at any time in iOS Settings, and the rest of the app keeps working.

Speech

Text-to-speech pronunciation runs on your device using the speech synthesis built into iOS. Nothing is recorded, and no audio is sent to us or to anyone else. Vocabee does not use your microphone.

8.Analytics, advertising and tracking

To be completely direct about this:

• We do not currently run any third-party analytics SDKs in the app.
• We do not run advertising SDKs, and there are no ads in Vocabee.
• We do nottrack you across other companies’ apps or websites, and we do not use the iOS Advertising Identifier.
• We do not sell or share your personal information.

If this ever changes, we will update this policy and, where the law requires it, ask for your consent first.

The thevocabee.app website

This policy covers the website as well as the app, so to be equally direct about it: the site sets no cookies of any kind. There is no analytics script, no advertising pixel, no session tracker, no embedded social widget and no consent banner — because there is nothing to consent to. Fonts are served from our own domain rather than from Google, and the pages load nothing from any third-party server. You can browse the site without being counted.

The site is hosted by Vercel. As with any web host, its servers keep standard request logs — your IP address, the page requested, the time, and your browser’s user-agent string — which are generated automatically by the act of serving any web page. They exist for security and reliability, we do not use them to build profiles or identify individuals, and they are rotated out on a rolling basis. The website has no login and no forms, so the only personal information you can send us through it is an email you choose to write.

9.Retention, deletion and withdrawing consent

How long we keep things

Data stored on your device stays there until you delete it or delete the app. Deleting the app removes its local data from your iPhone.

How to delete your account and your data

• In the app: Settings → Account → Delete account. This deletes your account and the learning data synced to it from our systems. It is a permanent, one-step deletion — we do not require you to email us, wait for approval, or visit a website.
• By email: write to support@thevocabee.app from the address on your account and we will delete it for you within 30 days.
• Without an account: delete the app, or use Settings → Reset in the app. Nothing of yours is on our servers to begin with.

We may retain limited records after deletion only where the law requires it — for example, the transaction records described above. Those records do not include your learning data.

How to withdraw your consent

Wherever we rely on your consent, you can take it back at any time, and withdrawing it does not affect the lawfulness of anything we did before you withdrew it. The rest of the app keeps working:

• Notifications: iOS Settings → Vocabee → Notifications, or in the app under Settings → Reminders. We stop sending them and delete your push token.
• Photos: iOS Settings → Vocabee → Photos. Exporting cards stops working; nothing else changes.
• Sync: turn sync off in the app, or delete your account, and your data stays on your device only.
• Crash diagnostics:iOS Settings → Privacy & Security → Analytics & Improvements → Share with App Developers.
• Everything at once: delete your account and delete the app.

10.Children

Vocabee is rated 4+ but is not directed at children under 13, is not submitted to the App Store Kids Category, and we do not knowingly collect personal information from anyone under 13. We do not serve ads, and we do not use third-party analytics — so there is no behavioural advertising or tracking of minors to speak of.

If you believe a child under 13 has given us personal information, email support@thevocabee.app and we will delete the account and its data promptly. Parents and guardians can also use the deletion routes in section 9 at any time.

11.Your rights (GDPR and UK GDPR)

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the right to:

• Access the personal data we hold about you.
• Rectify data that is inaccurate or incomplete.
• Eraseyour data (“right to be forgotten”).
• Port your data to another service in a machine-readable format.
• Restrict or object to certain processing.
• Withdraw consent at any time, where we rely on consent.
• Complain to your local data protection authority.

Our lawful bases

• Performance of a contract — running the app, providing sync, and delivering your Pro subscription.
• Consent — push notifications and the Photos permission, both of which you opt into and can revoke.
• Legitimate interests — keeping the service secure, preventing abuse, and responding to support requests.
• Legal obligation — where we must keep records or respond to lawful requests.

To exercise any of these rights, email support@thevocabee.app. We will respond within the time limits the law sets, normally one month.

12.California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use it, the right to request deletion of it, the right to correct inaccurate information, the right to limit the use of sensitive personal information, and the right not to be discriminated against for exercising any of these rights.

Categories we have collected in the last 12 months

We collect these for the business purposes described in sections 5 and 6. We retain them for the periods set out in section 9. We have not collected personal information from any source other than you, your device and Apple.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months. Because we do not sell or share personal information, we do not offer a “Do Not Sell or Share My Personal Information” link — there is nothing to opt out of.

We also do not use or disclose sensitive personal information for purposes that would require an opt-out under the CPRA, and we do not use personal information for automated decision-making or profiling.

To make a request, email support@thevocabee.app or use the in-app deletion described in section 9. We may need to verify your identity, usually by confirming control of the email address on your account. We will respond within 45 days. You may use an authorised agent, who will need written permission from you.

13.International data transfers

Our service providers — Supabase, Apple, RevenueCat, Google and Vercel — operate infrastructure in several countries, including the United States. We are based in the United States. If you use Vocabee from outside those countries, your information may be transferred to and processed there.

Where we transfer personal data out of the EEA or the UK, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and the UK Addendum, incorporated into our agreements with those providers.

14.Security

Traffic between the app and our backend is encrypted in transit with TLS. Passwords are hashed by Supabase and are never visible to us. Access to production systems is limited to the people who need it.

No system is perfectly secure, and we cannot guarantee absolute security. If we ever become aware of a breach affecting your personal data, we will notify you and the relevant authorities where the law requires it.

15.Changes to this policy

We may update this policy as the app changes. When we do, we will revise the “Last updated” date at the top of this page. If a change materially affects how we handle your personal information, we will give you notice in the app or by email before it takes effect.

16.Contact us

Questions, requests, or something in here that does not match your experience of the app? Email support@thevocabee.app and a human will reply. This is also the address for any privacy request under section 11 or 12, and for account deletion.

Data controller: Riyaan Rahman
Postal address: 2007 9th St, Lubbock, TX 79401, USA
Email: support@thevocabee.app

See also our Terms of Service.