Privacy Policy

What we collect

• Account: email, display name, authentication identifiers (via Supabase Auth).
• Study data: vocabulary, FSRS scheduling state, review history (stored locally; synced to our servers if you have Pro).
• Billing: subscription status via the Apple App Store or Google Play (managed through RevenueCat) — we never see or store card numbers. Historical web subscriptions were billed through Stripe; those records are retained as required by tax law.
• Product analytics: usage events linked to your account when signed in (e.g. sign-in, session start, reviews completed). We do not upload audio recordings.
• Device & technical data: IP address, device model, operating system and app version. Our servers log these as part of ordinary request handling and security monitoring.
• Crash diagnostics: when crash reporting is enabled in a build, a crash sends the app version, device model, OS version and a stack trace to our self-hosted error tracker. Study content and audio are never included.

We do not collect your location, contacts, photos, or the contents of other apps. We do not use your data for advertising, and we do not track you across other apps or websites.

Microphone, speech recognition & audio

Vocabula never uploads or stores your audio recordings on its servers, and no recording is kept after a pronunciation attempt is scored. What happens to the audio while it is being scored depends on which recogniser you use:

• The on-device speech models (Whisper and the phoneme recogniser) process the audio entirely on your device — it never leaves it.
• You can instead use the speech recogniser built into your phone. That recogniser belongs to Google or Apple, not to us: depending on your device and settings it may send the audio to their servers to transcribe it, underGoogle'sorApple'sown privacy policy. We receive only the resulting text. You can avoid this entirely by using the on-device models, or by declining the microphone permission — pronunciation practice is then unavailable, and the rest of the app works normally.

We store only study results such as review ratings, timestamps, and progress when sync is enabled. If this ever changes for a future cloud feature, we will update this policy before enabling it.

AI & accuracy

Pronunciation scores, speech recognition, translations, definitions, examples, and other AI-assisted study aids are learning tools, not guarantees. They may be incomplete or inaccurate. These features run on your device and depend on your device and enabled settings.

Why we collect it, and on what basis

• Provide the vocabulary learning service and sync across devices (Pro) — performance of our contract with you.
• Process subscriptions and support requests — contract, and our legal obligations for tax and accounting records.
• Keep the service secure and diagnose faults — legitimate interest in a working, non-abused service.
• Improve the product and understand usage — legitimate interest, and your consent where the law requires it.

Data stored on your device & analytics

The app stores data on your device to keep you signed in and to hold your study deck offline. That is not optional — the app cannot work without it — and it is not used for advertising.

Our own usage events (which screens are used, how many reviews are completed) go to analytics infrastructure we host ourselves. The apps contain no third-party advertising or tracking SDKs.

Who we share it with

We do not sell personal data and we do not share it with data brokers or advertisers. We share it only with the service providers that run the product on our behalf — hosting, authentication, payments, email delivery — each listed with its purpose and location in ourSubprocessors list, along with links to their data-processing terms. We may also disclose data where the law requires it, or to protect the rights and safety of our users and the service.

International transfers

We host the service in New Zealand. Some providers listed in ourSubprocessors list operate in the United States or globally, so your data may be processed outside your country. Where GDPR applies, those transfers rely on the providers' Standard Contractual Clauses or an adequacy decision; New Zealand itself holds an EU adequacy decision.

How we protect your data

• All traffic between your device and our servers is encrypted with TLS 1.2+.
• Passwords are stored only as salted hashes, never in readable form; session tokens are kept in the platform keystore (Android Keystore / iOS Keychain).
• Databases and backups live inside a private cluster network with no public internet exposure, reachable only through the application's own authenticated API.
• Access to production data is limited to the operator of AimDev, over authenticated, audited channels, and secrets are held in a dedicated secret store rather than in code.
• We keep dependencies patched and monitor the service for faults and abuse. No system is perfectly secure, so if a breach ever affects your personal information we will notify you and the relevant regulator as the law requires.

Retention

We keep your account and study data while your account is active. When you delete your account we remove your database rows, end any active entitlements, and revoke auth access — normally immediately, and within 30 days at the outside. Copies held in routine backups are overwritten as those backups age out. Billing records are kept for as long as tax and accounting law requires (seven years in New Zealand), and crash diagnostics are kept for 90 days.

Your rights & choices

Under the New Zealand Privacy Act 2020 and, for users in the EU/UK, the GDPR, you can ask for access to your data, correction, a portable export, deletion, restriction of processing, or to object to processing based on legitimate interest. Where processing rests on consent, you can withdraw it at any time.

You do not need to ask us for the two most common ones: in the app,Profile → Export my data downloads everything we hold about you, andProfile → Delete account deletes your account and its data immediately. If you no longer have the app installed, emailprivacy@aimdev.site from your account email and we will run the export or deletion for you. You can also revoke the microphone permission at any time in your device settings. For anything else, emailprivacy@aimdev.site and we will respond within 30 days. General help: Support.

Children

Vocabula is a general-audience learning app. It is not directed at children under 13, and we do not knowingly collect personal information from them. Where a child uses Vocabula in a classroom or at home, the account should be held and managed by a parent, guardian, or teacher. If you believe a child has given us personal information, emailprivacy@aimdev.site and we will delete it.

Changes to this policy

If we change how we handle personal information, we will update this page and the "last updated" date above. Material changes — a new category of data, or a new purpose — will be announced in the app before they take effect.

Contact & complaints

Privacy enquiries: privacy@aimdev.site. General support: Support. If you are not satisfied with our response you can complain to theNew Zealand Office of the Privacy Commissioner, or, in the EU/UK, to your local data-protection supervisory authority.