What this policy covers
This Privacy Policy explains how Vocab Monster collects, uses, stores, shares, and protects your personal data. It focuses on data and privacy. Our Terms of Service describe the rules for using the service.
Data we collect
- Account info: email address when you sign up or sign in.
- App activity: words you save, archive, favorite, practice stats, and collections. These may be stored on your device and synced to your account when you are signed in.
- Device/usage data: IP address, browser type, and basic logs that help keep the service secure and reliable.
- Cookies and tokens: authentication cookies/tokens from Supabase to keep you signed in.
- Advertising measurement data: when Google Ads conversion measurement is enabled, Google may receive information such as your browser/device details, IP address, page activity, ad-click information, and conversion events through the Google tag.
- Support messages: information you send when you contact us for help.
- Billing data: Stripe customer IDs, subscription IDs, plan status, invoices/payment status, and limited billing contact details needed to manage paid plans.
How we collect and why
- Directly from you when you sign in, save words, or contact support.
- Automatically through security and reliability logs.
- Through cookies/tokens that keep you authenticated and syncing.
- Through the Google Ads conversion tag to measure campaign performance and understand whether visits from ads lead to actions such as account sign-ups or purchases.
We use this data to provide core features (saving words, collections, practice tracking), sync your data across devices, secure accounts, and improve reliability.
Legal bases for processing
- Performance of a contract: providing the service you request.
- Legitimate interests: securing the service and preventing abuse.
- Consent: where we rely on optional cookies or communications you opt into.
How we share data
- Service providers: we use Supabase for authentication and storage. Providers only receive the data needed to perform their services for us.
- Payment provider: we use Stripe for checkout, payment processing, subscription management, invoice history, and billing portal access. Stripe processes payment details directly; we do not store full card numbers or CVCs.
- No selling of personal information.
- Advertising measurement provider: Google receives the limited information needed to provide Google Ads conversion measurement for us. See Google's advertising technology information.
Cookies and tracking
- We use authentication cookies/tokens to keep you signed in and sync data.
- We use the Google tag for Google Ads conversion measurement. The tag may read or set advertising cookies or use similar technologies, and may send ad-click and conversion information to Google. Google may also use information according to its own policies and your available ad settings.
- Advertising measurement is not required to use Vocab Monster. Where applicable law or Google policy requires consent for optional advertising cookies or similar technologies, we will request that consent before enabling them.
- You can manage advertising choices through your browser settings and Google's My Ad Center.
Data retention
- Local data stays on your device until you clear it via app settings or your browser storage.
- Synced account data remains while your account is active. Deleting items while signed in removes them from Supabase.
- Support communications are kept as needed to respond and maintain records.
- Billing records are retained as needed to provide subscriptions, resolve disputes, comply with financial recordkeeping obligations, and prevent abuse.
Your rights
Depending on where you live (for example under GDPR or CCPA/CPRA), you may have rights to access, correct, delete, or download your data; to restrict or object to certain processing; to opt out of sale or sharing (we do not sell personal data); and to withdraw consent where we rely on it.
To exercise rights, email help@notify.vocabmonster.com. We may need to verify your request and will respond within required timelines (for example, typically 45 days for CCPA/CPRA).
Security and breaches
- We use reasonable technical and organizational safeguards to protect data.
- If a data breach creates a high risk to your rights, we will notify you and regulators when required.
Children's privacy
The service is not directed to children under 13. If you believe a child has provided personal information, please contact us so we can remove it.
Changes to this policy
We may update this policy. Significant changes will be noted in the app. Continued use after changes means you accept the updated policy.
