Privacy Policy
In short: VocaLoom has no advertising and no tracking. Your words are stored on your iPhone. Words, sentences or photos you add are sent to our server only to create flashcards. An account is optional; with one, a private copy of your words is kept on our server in Germany so it can come back on a new phone. We never sell your data.
1. Who is responsible
The controller under the EU General Data Protection Regulation (GDPR) is the operator named in the legal notice. Contact for all privacy questions: privacy@vocaloom.app.
2. What data we process and why
2.1 Using the app without an account
Your words, translations, notes, progress, settings and statistics are stored only on your iPhone. We do not receive them.
2.2 Creating flashcards
When you add a word, the text you typed or selected, the sentence it came from and your two languages are sent to our server to create a flashcard. When you add words from a photo, the photo and your optional instruction (for example “only highlighted words”) are sent for text recognition. Purpose: providing the feature you asked for. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
- Photos and the sentences around a word are not stored after processing.
- Generated flashcard content (the word, its translation, examples and grammar) is kept in a shared vocabulary database without any link to you, so the same word does not have to be generated twice.
2.3 Your account (optional)
You sign in with your email address and a six-digit code we email to you. There is no password and no phone number. We store your email address, optional first and last name, your learning settings, and a private copy of your words, boxes, review dates, notes and edits so that they come back on a new phone. Your private words are never shown to other learners. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
2.4 Free plan, invitations and preventing misuse
To run the free plan fairly we record how many new words, photo extractions and detailed AI cards an account uses, and the credits it received (including invitation rewards). To prevent misuse — for example many automatically created accounts or fake invitations used to obtain free credits — we store a hashed (not readable) identifier of the app installation, a hashed IP address, and, after an account is deleted, a hash of its email address so that deleting and re-creating an account does not give new free credits. Legal basis: our legitimate interest in protecting the service and keeping the free plan possible (Art. 6(1)(f) GDPR).
2.5 Sign-in codes and security
When a code is requested we store a hash of the code (never the code itself), the time and the IP address of the request, to limit attempts and stop abuse. Legal basis: Art. 6(1)(b) and (f) GDPR.
2.6 Subscriptions
Payments are handled entirely by Apple. We never see your payment details. We receive Apple’s signed confirmation of your subscription (product, status, dates, transaction identifiers, price and currency) and link it to your account so that Premium works. Legal basis: Art. 6(1)(b) GDPR and legal record-keeping duties (Art. 6(1)(c) GDPR).
2.7 Support
If you send a question in the app or by email, we store your message, your app language and — if you give it — your email address, to answer you. Legal basis: Art. 6(1)(b) or (f) GDPR.
2.8 Emails
We send sign-in codes and answers to your questions. Product news or offers are sent only if you separately agreed in Settings → Privacy (Art. 6(1)(a) GDPR). You can withdraw this consent at any time; each change is recorded.
2.9 Server logs
For operation and security our server records technical request data (path, status, response time) without content. Our hosting proxy may briefly process IP addresses to deliver the service. Legal basis: Art. 6(1)(f) GDPR.
2.10 What we do not do
No advertising, no tracking across apps or websites, no analytics SDKs, no selling or renting of personal data, no profiling for marketing. This website uses no cookies and no tracking.
3. Service providers
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Server hosting and database | Germany |
| Anthropic PBC (Claude) | Creating flashcards and recognising text in photos | USA |
| OpenAI (only as a backup if the main AI service fails) | Same as above | USA |
| Brevo (Sendinblue SAS) | Sending sign-in codes and support answers | EU (France) |
| Cloudflare, Inc. | Domain name service (DNS) for vocaloom.app | EU / USA |
| Apple Inc. | App distribution, in-app purchases | Ireland / USA |
Providers process data only on our instructions under data processing agreements. Text and photos sent to the AI providers are used to answer the request; under their API terms they are not used to train their models.
4. Transfers outside the EU
Where data is processed in the USA, the transfer is based on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses.
5. How long we keep data
- Account data and synced words: until you delete your account (Settings → Account → Delete account). Deletion removes them from the server.
- Sign-in codes: a few minutes; request records for rate limiting: up to 30 days.
- Usage counters and credit records: as long as the account exists.
- Hashed installation identifier: as long as the account exists. Hashed IP address: up to 24 months. Hash of a deleted account’s email address: 24 months.
- Subscription records: as required by tax and commercial law (up to 10 years).
- Support conversations: up to 24 months after the last message.
- Daily database backups: 14 days.
6. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest (Art. 15–21 GDPR), and to withdraw consent at any time. You can export all your words in the app (Settings → Account & Backup) and delete your account and all its data at any time. For anything else write to privacy@vocaloom.app. You also have the right to lodge a complaint with a data protection supervisory authority.
7. Security
All connections are encrypted (HTTPS). Sign-in codes and session tokens are stored only as hashes, and the session on your iPhone is kept in the iOS Keychain. Access to the server is restricted to the operator.
8. Children
VocaLoom is intended for users aged 16 and over. Younger users may use it only with the consent of a parent or guardian.
9. Changes
We update this policy when the app changes. The current version is always available at vocaloom.app/privacy and in the app.