Effective date: May 19, 2026 · Last updated: May 24, 2026
Voca-Voca ("we", "our", "Voca-Voca") is a vocabulary-learning service offered as a Chrome extension, an iOS app, and a website at voca-voca.app. You save words you find while reading, look them up, and practice them with spaced repetition. This policy describes what we collect, why, who we share it with, and what you can do about it.
We do not sell your data, we do not run ads in Voca-Voca, and we do not build behavioral profiles for advertisers.
| Category | What it is | Why we have it |
|---|---|---|
| Account | Your email address, display name, and an account ID from Firebase Authentication when you sign in with Google or Apple. | To identify your account and sync your words across devices. |
| Vocabulary | The words you save, their definitions, the sentence where you found each word, and the page address it came from. | To build your personal collection and let you practice it. |
| Learning state | How well you know each word (interval, ease, review history) and which folders you put words in. | To schedule reviews at the right time using spaced repetition. |
| Practice stats | Total sessions, cards reviewed, time practiced, and the date of your last session. | To show you progress over time. |
| Engagement signals | For each day, the minutes you were active in the app, the number of words you saved, and the number of reviews you completed. | To decide when to suggest upgrading to Premium, and to improve the practice algorithm. See "Automated decisions" below. |
| Settings | Your preferences (theme, practice length, daily goal, chosen pronunciation voice, folder defaults, reminder schedule). | To personalize the app. |
| Subscription | Whether you have an active Premium subscription, the plan you bought, the renewal date, and which store charged you (Apple or Stripe). | To unlock paid features on every device you sign into. |
| Waitlist (iOS launch) | If you submit the waitlist form on voca-voca.app, we store the email you typed, the platform you submitted from (iOS, Android, desktop), and where in the site you signed up. | To email you once when the iOS app is available. We delete these records 90 days after the iOS app launches. |
| Product analytics | Anonymous event records covering how the app is used. Described in detail in Section 5. | To find bugs, understand which features matter, and decide what to build next. |
When you sign in with Apple for the first time, Apple sends us your name and email. We use the email and we discard the name. If you choose "Hide My Email", Apple sends us a forwarding address ending in @privaterelay.appleid.com; we treat it exactly like any other email.
The Chrome extension keeps your words on your computer using the browser's storage. The iOS app keeps your words on your phone. If you use the app without signing in, your data never leaves the device.
When you sign in, your words and progress sync to a database provided by Google Firebase. The connection uses TLS, and Google encrypts the stored data with its default at-rest encryption. Per-user security rules prevent any account from reading or writing another account's data.
Pronunciation audio for Premium voices is generated by Google Cloud Text-to-Speech. Generated audio is saved on Google Cloud storage that we control. On iOS, the audio is also saved on your device so it continues to play when your phone has a weak or no internet connection.
Only Voca-Voca's developer has administrative access to the database. That access is used in four specific situations:
The third-party services in Section 4 each receive only what they need to do their job, and process it under their own published terms.
| Service | What we send | Why | Their privacy policy |
|---|---|---|---|
| Google Firebase (Authentication, Firestore) | Your account credentials (via Apple or Google sign-in), your vocabulary, learning state, folders, settings, engagement signals. | Authentication and cloud sync. | Firebase |
| Google Cloud Text-to-Speech & Cloud Storage | The word you want to hear and the voice you chose. The audio is saved on our server and, on iOS, on your device — so it plays back quickly later and continues to play when your phone has a weak or no internet connection. | Premium pronunciation in American, British, Australian, or Indian English. | Google Cloud |
| PostHog | Anonymous event records described in Section 5. Your Firebase account ID once you sign in. Your email address as part of your PostHog profile, so we can answer support tickets you send by email. | Product analytics so we can fix bugs and prioritize features. | PostHog |
| RevenueCat | Your Firebase account ID and the subscription record reported by Apple or Stripe (active, expired, in trial, plan, transaction ID). | Keeping your subscription state consistent across every device you sign into. | RevenueCat |
| Apple (StoreKit) | The purchase transaction. Apple handles payment details; we do not see them. | Processing iOS subscriptions. | Apple |
| Stripe | Payment details (collected by Stripe directly — not by us), your email, and your Firebase account ID. | Processing web subscriptions. | Stripe |
| Free Dictionary API (dictionaryapi.dev) | The word you looked up. | Definitions, phonetics, and example sentences. | dictionaryapi.dev |
| Wiktionary | The word you looked up. | Additional definitions and etymology. | Wikimedia |
| Datamuse | The word you looked up. | Related words and synonyms. | Datamuse |
| Google Translate | The word you want to hear (free-tier pronunciation only). | Pronunciation audio for users without a Premium voice selected. | |
| Google Fonts | Your IP address and browser user-agent when you visit voca-voca.app, so Google can serve our fonts. | Displaying the marketing site's typography. | |
| Apple Smart App Banner | The fact that an iOS Safari user visited voca-voca.app (Apple records the visit when iOS renders the App Store banner at the top of the page). | Showing the "Open in App Store" banner. | Apple |
That is the complete list. We do not embed advertising networks, behavioral-targeting scripts, or social-network trackers.
We use PostHog to record anonymous events about how Voca-Voca is used. The goal is to operate and improve the service: spot bugs, see which features matter, measure whether something we shipped helped.
Events are tied to a random anonymous identifier before you sign in, and to your Firebase account ID afterward. When you sign in for the first time, we tell PostHog to merge the two so we can see how pre-sign-in behavior translated into sign-up. Your email is attached to your PostHog profile so we can match a support email to your event history.
If you accept cookies on the website, PostHog records page views, button clicks, scroll depth, your country (from IP), and which UTM parameters or referring site brought you to us. If you submit the iOS waitlist form, we record that you opened it and whether the submission succeeded. If you uninstall the Chrome extension and land on our "uninstalled" page, we record that visit and tie it to the account that owned the extension (so we can see "this signed-in user uninstalled" rather than counting it as anonymous).
The cookie banner defaults to opted out — PostHog does not record anything from the website until you click OK. Browser tools like uBlock Origin or Brave Shields will block PostHog from the website regardless.
Analytics records are kept for 12 months and then automatically deleted by PostHog.
We use analytics only to run and improve Voca-Voca. We do not sell, license, share with data brokers, or combine analytics with data bought from third parties.
Premium subscriptions are processed by:
In both cases, the payment details go straight to the processor. We never see your card or bank information. We receive only what we need to know your subscription is active: a transaction identifier, the plan you bought, the renewal date, and the current status (active, in trial, expired, or past due).
Voca-Voca uses Google Sign-In to authenticate accounts. Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements:
You have these rights wherever you live:
If you are in the EEA, UK, or Switzerland, here is the lawful basis we use for each purpose:
| What we do | Lawful basis (Article 6 GDPR) |
|---|---|
| Store and sync your vocabulary, run practice sessions, manage your subscription | Performance of a contract (Art. 6(1)(b)) |
| Improve the product (analytics, paywall timing, security) | Legitimate interests (Art. 6(1)(f)) — we have weighed this against your privacy and concluded it is proportionate because the data is anonymous in aggregate, you can opt out by signing out, and we do not sell or share it |
| Operational email (receipts, security notices, the iOS-launch waitlist email) | Performance of a contract (Art. 6(1)(b)) for receipts; legitimate interests for waitlist email |
| Respond to law-enforcement requests | Compliance with a legal obligation (Art. 6(1)(c)) |
Under Articles 15–22 GDPR you have the right to access, rectify, erase, restrict, and object to the processing of your personal data, and the right to data portability. You also have the right to lodge a complaint with your local supervisory authority. To exercise any of these rights, email support@voca-voca.app; we respond within 30 days.
If you are a California resident, you have the right to:
Categories of personal information we collect, mapped to the CPRA's enumerated categories: identifiers (email, account ID), customer records (display name), commercial information (subscription state, transaction IDs), internet activity (the bare domain of pages you save words from, in-app event records), geolocation data (the approximate country PostHog derives from your IP), professional or employment information, biometric information, sensitive personal information, sensory data, genetic data, education information, or inferences — none.
To submit a CCPA request, email support@voca-voca.app. We may need to verify your identity before fulfilling it.
If your local law grants additional privacy rights (for example Brazil's LGPD, Canada's PIPEDA, or Australia's Privacy Act), you can exercise those rights by emailing support@voca-voca.app.
The Chrome extension asks for these permissions:
| Permission | What we use it for |
|---|---|
storage | Save your vocabulary, learning progress, and preferences in the browser. |
sidePanel | Display the extension's interface in Chrome's side panel. |
contextMenus | Add a "Look up" option to the right-click menu. |
identity | Enable Sign in with Apple and Sign in with Google. |
Content script (<all_urls>) | Read the text you select on a page when you ask for a lookup, plus the sentence around the selection and the page title. Nothing is transmitted until you confirm the lookup. We do not read pages you do not interact with. |
Voca-Voca is not directed at children. We do not request age information. We do not knowingly collect personal information from anyone under 13 in the United States or under 16 in the EEA, UK, or Switzerland. If you are a parent or guardian and believe your child has provided us with personal data, email support@voca-voca.app and we will delete it within 30 days.
Voca-Voca operates from the United States. Our cloud infrastructure (Google Firebase, Google Cloud, PostHog, RevenueCat) is hosted in the United States and other countries. If you use Voca-Voca from outside the United States, your data is transferred to and processed in the United States. Each of the third-party services in Section 4 maintains Standard Contractual Clauses (SCCs) or an equivalent safeguard for international transfers under their own data-processing agreements, which we have accepted.
When we make material changes to this policy, we will:
Your continued use of Voca-Voca after a change takes effect means you accept the updated policy.
For questions, concerns, or requests about this policy or your personal data:
Email: support@voca-voca.app
We respond within 30 days.