Loading page
Privacy Policy
Last updated: October 21, 2026
Vocab Monster is operated from California, United States. This policy explains how Vocab Monster (“we”, “us”) handles information when you use our website and vocabulary learning app, including accounts, dictionary search, saved vocabulary, practice, guided learning, and paid features.
See our Terms of Service for rules on using the service.
Account and profile information: your email address, account identifier, password-based authentication information, and any name, username, learning goals, study interests, and preferences you provide. If you sign in with Google, Supabase receives sign-in information from Google, which may include your email and profile name.
Vocabulary and learning activity: searches, saved or custom words and definitions, favorites, archived words, collections, packs, practice answers and results, streaks, course enrollments, lesson progress, and feedback or reported questions. Game activity records can include mode, start and completion times, duration, attempts, and correct-answer counts.
AI and credit usage: selected models, delivered practice items, credit balances, usage counts, and generation metadata such as provider, token counts, timing, success, and cost. Some usage records are associated with your account identifier.
Billing information: Stripe customer and subscription identifiers, plan and renewal status, purchases, and payment or invoice status. Stripe collects payment details directly; we do not store full card numbers or CVCs.
Technical information: requests to our service and providers can include IP addresses, browser and device information, referring pages, page URLs, timestamps, and security or error logs.
Support information: contact details and the contents of messages or feedback you send us.
We use account and learning information to provide dictionary and practice features, personalize learning, save progress, and sync supported data across devices when you are signed in.
We use billing and usage information to manage subscriptions, purchases, credit limits, and costs; investigate payment issues; and prevent fraud or abuse. We use technical information and activity records to secure, operate, troubleshoot, and improve the service.
We use your email for account-related messages, including authentication and welcome emails, and to respond to support requests. We use Google Analytics to understand visits and app usage, and the Google Ads tag on the marketing website for advertising measurement.
The app uses IndexedDB (through Dexie) to store vocabulary, collections, packs, and practice data in your browser. Browser local storage also holds settings, session information, and sync markers. Security cookies help protect requests. Supabase manages sign-in sessions.
When you are signed in, supported library and progress data are sent to Supabase for account storage and multi-device access. Some features, including billing and course progress, use server-side records. Offline changes may not sync until you reconnect; local storage is not a guaranteed backup.
Clearing browser storage can remove local data and sign you out. It does not by itself delete cloud records or cancel a subscription. Synced information may download again when you sign in. Use account controls or contact us for account-data deletion.
AI practice uses stored questions and pairs where available, and server-side generation when content needs to be created or replenished. Depending on the available or selected model and fallback handling, requests may go to Google Gemini, OpenAI, Anthropic, xAI (Grok), or Moonshot AI (Kimi). Not every practice action sends a new request to an AI provider.
Generation requests include vocabulary context such as the word, definition, part of speech, example, synonyms, and, where supplied, a collection theme. Custom vocabulary can therefore be processed by an AI provider. Do not include confidential information or sensitive personal details in words, definitions, or other learning content.
Generated practice content may be cached for later use. Dictionary-based questions and pairs can be stored in shared pools and reused for other learners; custom-word practice also has account-specific caches.
Providers handle requests under their applicable API terms and account settings. Retention, safety review, and use for model improvement vary by provider and service configuration. We do not promise that all AI processing has zero retention or that no provider uses submitted content for model improvement.
Provider details: Gemini API terms, OpenAI data controls, Anthropic retention, xAI API data handling, and Kimi platform privacy.
Supabase provides authentication and cloud database services and receives account, library, learning, and usage records. Netlify hosts the website and server functions and handles network requests and operational logs.
Stripe processes checkout, payments, subscriptions, and billing portal activity. Resend receives email addresses and message information to deliver welcome emails. Authentication emails are handled through Supabase and its configured email delivery service.
Merriam-Webster receives dictionary and thesaurus lookup terms through our server. When pronunciation audio is loaded from its servers, it also receives the browser request and associated technical information.
AI providers receive the vocabulary context described above. Google receives analytics and advertising measurement information as described below. Providers may also process information for their own security, legal, or other purposes under their policies.
Read the privacy information from Supabase, Netlify, Stripe, and Resend for more about their practices.
Google Analytics 4 runs on our marketing website and app; the Google Ads tag runs on the marketing website. These tags may set or read cookies and send Google page and interaction information, referring or ad-click information, browser identifiers, device information, and IP addresses. Google may combine information with other information it holds under its policies.
The current app does not provide an in-app cookie consent or analytics opt-out control. Google tags load after the page becomes interactive. Browser controls can block or remove cookies and restrict requests; blocking essential storage may affect sign-in, saved data, or other features.
The app does not currently change its Google tag loading in response to browser Do Not Track or Global Privacy Control signals. These signals are different from blocking cookies or using Google's own controls.
See how Google uses information from sites and apps, its advertising technology information, the Google Analytics opt-out browser add-on, and My Ad Center. These controls have different scopes and do not delete your Vocab Monster account.
Local information remains in your browser until removed by app cleanup, your browser, or you. Copies on other devices and files you have exported are not remotely erased by clearing one browser.
Synced library and progress records are kept for your account. Deletions may need a successful sync, and deletion markers can be retained to prevent deleted items from reappearing.
If you deactivate your account, access is locked and saved data is kept during a 30-day recovery window. Contact us within that window to request restoration. After the window, the account is scheduled for permanent deletion; completion depends on the deletion process running successfully.
Permanent account deletion removes saved vocabulary, collections, packs, and learning progress through the deletion process and cannot be undone. It does not erase every record held by us or our providers.
We retain an internal account record, sign-up date, plan, purchase and subscription records, credit and usage records, and AI usage and cost metadata. The deletion process clears profile names and contact fields, replaces authentication identifiers with hashed values, and retains internal account and Stripe identifiers. These records should not be treated as fully anonymous.
The deletion process removes name and email from the Stripe customer record. This does not remove all transaction records held by Stripe. Logs, support messages, backups, and provider-held records may remain separately; retention depends on the record, provider settings, and applicable obligations. This policy does not promise a fixed deletion deadline for those records.
You can edit supported profile and library information in the app. Account Settings includes controls to reset practice statistics, delete your library, deactivate your account, or request permanent account deletion. These actions have different scopes: deleting a library or clearing local storage does not close your account or cancel billing.
Depending on the law that applies to you and to our processing, you may have rights to access, correct, delete, or obtain a copy of personal information; object to or restrict processing; withdraw consent where processing relies on it; or opt out of legally defined sale, sharing, or targeted advertising. You may also have rights to complain to a privacy regulator and to exercise rights without unlawful discrimination.
For requests, use the contact address below. We may need to verify your identity and clarify the request. Applicable exceptions and response deadlines depend on the request and law. Google's collection through its tags is described above; this policy does not characterize that collection as exempt from legal sale or sharing rules.
The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives California residents rights when a business and its processing are covered by that law. Being based in California does not by itself establish CCPA coverage; the law has business coverage thresholds and exceptions.
The information described above includes identifiers (such as email and account IDs), commercial information (such as purchases), internet activity, and learning or preference information. Account sign-in credentials can qualify as sensitive personal information. The sections above explain the sources, purposes, recipients, and retention of this information.
Submit requests using the email in Contact below. Where CCPA deadlines apply, requests to know, correct, or delete generally require acknowledgment within 10 business days and a response within 45 calendar days, with a permitted additional 45 days if you are notified. Applicable sale/sharing opt-outs and sensitive-information limitation requests must be handled as soon as feasible, within 15 business days.
Covered businesses must honor qualifying opt-out preference signals such as Global Privacy Control for applicable sale or sharing. Our current Google tag behavior and missing in-app controls are disclosed in Cookies and analytics; this notice does not claim those technical controls are implemented.
Learn more from the California Attorney General's CCPA guidance. You can also submit a privacy complaint to the California Privacy Protection Agency.
The EU General Data Protection Regulation (GDPR) and UK GDPR may apply to particular processing even when a service operates from the United States. Coverage depends on the relevant law and activities, including offering services to people in the relevant territory or monitoring their behavior there. This section describes rights where those laws apply.
Submit requests using the email in Contact below. Applicable GDPR rights requests generally require a response without undue delay and within one month, subject to identity checks and extensions permitted by law. For complex or numerous requests, an extension of up to two further months may be allowed, with notice and reasons within the initial one-month period.
You may complain to a competent supervisory authority without contacting us first. See the EEA data protection authorities or the UK Information Commissioner's Office. The European Commission's privacy rights guide explains these rights and their conditions.
Other US state or national privacy laws may provide additional rights, including access, correction, deletion, portability, certain opt-outs, or an appeal of a denied request. Rights and exceptions depend on your location and whether the law covers our processing. Use the contact email below to make a request or ask about an appeal; identify the request you want reviewed.
Our providers may process information in countries other than where you live, with different data-protection laws. Contact us with questions about where your information is processed.
We use account authentication and access controls to protect information. No storage or transmission system is completely secure. We will provide breach notices when applicable law requires them.
Our Terms set a minimum age of 13, or a higher age where required locally. The service is not intended for children under 13. If you believe a child under 13 has provided personal information, contact us to request review and deletion. This statement does not mean that we verify every user's age or provide parental-consent tools.
Updates will appear on this page with a revised date. Please review it for changes to our practices. This policy provides information about data handling; using the service or reading an updated policy does not by itself give consent where separate consent is legally required.
For privacy questions or requests, contact Vocab Monster at help@vocabmonster.com.