Privacy Policy

1. Who are we?

Vocabingo is a multilingual vocabulary learning app based on spaced repetition, published on a personal basis by an individual (see the Contact page for full legal details). The data controller is the publisher of the Service.

2. Data collected and purposes

2.1 Via Clerk (authentication)

When you create an account, Clerk, Inc. collects and stores your email address, a hashed password (or an OAuth token if you use a third-party provider), your unique Clerk identifier (userId), and creation/login timestamps. This data is stored on Clerk's infrastructure in the United States, covered by the EU Standard Contractual Clauses (SCCs).

Purpose: authentication and session management. Legal basis: Art. 6(1)(b) GDPR – performance of a contract (access to the Service).

2.2 In our PostgreSQL database

For signed-in users, we store in our own database:

• Learning history: word identifier, review stage (6 levels), date learned, next review date, outcome (remembered or forgotten). Linked to your Clerk userId.
• Daily statistics: number of words learned, reviewed, remembered, and forgotten per day.
• Current session state: progress of an interrupted session (words processed, current index), retained for 24 hours to allow resumption.

This data is pseudonymised: only the Clerk userId (an opaque string) appears — no name or email address. Purpose: provision of the spaced-repetition service. Legal basis: Art. 6(1)(b) GDPR.

2.3 Via PostHog (usage analytics)

We use PostHog to measure usage of the Service (page views, user journeys, session completion rates). PostHog receives your pseudonymised Clerk identifier (userId), visited URLs, and functional events (e.g. word learned, review completed). No personally identifiable data (name, email) is sent to PostHog.

Data is hosted on PostHog's European infrastructure (eu.i.posthog.com). Purpose: Service improvement and error detection. Legal basis: Art. 6(1)(a) GDPR – consent (opt-in via cookie banner).

2.4 Via Stripe (payments)

For users subscribed to the Pro plan, payments are processed by Stripe Inc. / Stripe Payments Europe Ltd. Payment data (card number, billing address) is processed directly by Stripe and never passes through our servers. We receive only a Stripe customer and subscription identifier, and the subscription status (active, cancelled, etc.). Purpose: payment processing and subscription management. Legal basis: Art. 6(1)(b) GDPR – performance of a contract. Stripe's privacy policy: stripe.com/privacy.

2.5 Local storage (localStorage)

One preference is stored locally in your browser: soundEnabled (whether sound effects are on). This boolean value is never sent to our servers and does not constitute personal data.

2.6 Guest users

No data is saved server-side for guest sessions. Progress is lost when the tab is closed.

3. What we do not do

• No advertising or ad targeting.
• No sale or sharing of your data with third parties for commercial purposes.
• No third-party advertising trackers (no Google Analytics, Segment, Mixpanel, remarketing pixels, etc.).
• No remarketing pixels.
• Card data never passes through our servers (processed exclusively via Stripe).

4. Cookies

The Service uses strictly necessary cookies:

These cookies are strictly necessary for the operation of the Service (authentication) and secure payment processing. They do not require prior consent under Article 5(3) of the ePrivacy Directive.

5. Data retention

Your learning data is retained for as long as your Clerk account is active. It is automatically deleted shortly after your Clerk account is deleted, or immediately upon explicit request from the Settings.

Temporary session data (enabling session resumption) is automatically deleted after 24 hours of inactivity.

6. Your rights (GDPR)

In accordance with Regulation (EU) 2016/679 (GDPR), you have the following rights:

• Right of access (Art. 15) — you can download all your learning data in JSON format from the Settings.
• Right to rectification (Art. 16) — your identity information (email, name) can be updated in your Clerk account settings.
• Right to erasure (Art. 17) — you can delete all your learning data from the Settings.
• Right to data portability (Art. 20) — JSON export available from the Settings.
• Right to object (Art. 21) — you can stop using the Service and delete your account at any time.
• Right to lodge a complaint — you may contact your national data protection authority. In France: www.cnil.fr.

To exercise your rights other than through the interface, contact us via the Contact.

7. International transfers

Clerk, Inc. is based in the United States. The transfer of identity data to Clerk is governed by the Standard Contractual Clauses (SCCs) adopted by the European Commission, in accordance with Art. 46 GDPR.

Our learning data is hosted on secure cloud infrastructure. Data may transit through servers in the United States or the EU. Our host is a signatory to the EU–US Data Privacy Framework.

PostHog (PostHog Inc.) – Anonymised usage analytics. Analytics data is hosted in Europe (eu.i.posthog.com) and no personally identifiable data is transmitted. Privacy policy: posthog.com/privacy.

Stripe (Stripe Inc. / Stripe Payments Europe Ltd.) – Card payment processing. Payment data is processed directly by Stripe and never passes through our servers. Stripe Payments Europe Ltd. is based in Ireland (EU); Stripe Inc. is based in the United States and covered by the Standard Contractual Clauses. Privacy policy: stripe.com/privacy.

8. Withdrawing consent

You can withdraw your consent to analytics cookies at any time by clicking "Withdraw analytics cookie consent" in the Settings. Navigation data collected before withdrawal will not be deleted automatically — contact us via the Contact.

9. Changes to this policy

We may update this policy at any time. The last-updated date at the top of the page will be revised accordingly. For substantial changes affecting your rights, registered users will be notified by email.