This Privacy Policy describes how Vocable (“Vocable,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards information when you use the Vocable mobile application (the “App”) and related services. By installing or using the App, you agree to the practices described below.

If you do not agree with this Policy, please do not use the App.

1. Who we are

Vocable is the controller of personal information processed in connection with the App. You can contact us at any time at privacy@dailyvocable.com.

2. Information we collect

We collect only the minimum information needed to operate the App. We organise this information into three categories.

2.1 Information you provide

• Account information (optional). If you choose to enable cloud sync, we collect your email address and an authentication token. You can use the App without creating an account; in that case, no account information is collected.
• Communications. If you contact us by email, we receive your email address and the content of your message.

2.2 Information collected automatically

• Learning data. Cards reviewed, scheduled intervals, due dates, study session metadata, ease factors, and other information generated by the spaced‑repetition algorithm. This data is stored on your device. If you enable cloud sync, it is also stored on our servers and linked to your account.
• App preferences. Settings such as theme, daily target, and selected language. Stored on your device, and synced if you have enabled cloud sync.
• Diagnostic information. If the App crashes, your operating system may send anonymous crash reports to us through Apple or Google. These reports do not contain personal information and are used solely to improve the App’s stability.

2.3 Information from third parties

• Subscription status. When you purchase or restore a subscription, RevenueCat (our subscription management provider) and Apple or Google share with us your entitlement status (whether you are a premium subscriber) and an anonymous user identifier. We never receive your full payment details.

We do not collect: your name, address, phone number, contacts, location, photos, microphone, camera, browsing history, or advertising identifiers.

3. How we use information

We use information to:

• Provide, maintain, and improve the App and its features.
• Schedule your flashcards using the spaced‑repetition algorithm.
• Sync your progress across your devices when you have enabled cloud sync.
• Process and validate subscriptions, and provide premium features.
• Respond to your support requests and communications.
• Detect, prevent, and address fraud, abuse, and security incidents.
• Comply with legal obligations.

We do not use your information for advertising, profiling, or automated decision‑making that produces legal effects.

4. Legal bases for processing (EEA / UK users)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract — to provide the App and the features you request.
• Legitimate interests — to improve the App, prevent fraud, and ensure security, where these interests are not overridden by your rights.
• Consent — for any optional processing where we ask for your consent (you may withdraw it at any time).
• Legal obligation — where we are required by law to retain or disclose information.

5. How we share information

We do not sell or rent your personal information. We share information only with the following categories of recipients, and only to the extent necessary:

Recipient	Purpose	Information shared
Supabase, Inc.	Cloud database hosting for optional sync (US/EU regions)	Email, auth token, learning data
RevenueCat, Inc.	Subscription management	Anonymous user ID, entitlement status
Apple Inc. / Google LLC	App distribution, in‑app purchases, crash reports	As determined by their platforms

These providers process information on our behalf under written agreements that require appropriate confidentiality and security measures. Apple and Google process information under their own privacy policies.

We may also disclose information when we believe in good faith that disclosure is necessary to (i) comply with a law, regulation, legal process, or governmental request; (ii) enforce our Terms of Service; (iii) protect the rights, property, or safety of Vocable, our users, or others; or (iv) in connection with a merger, acquisition, or sale of assets, in which case we will require the recipient to honour this Policy.

6. International data transfers

If you use cloud sync, your information may be transferred to and processed in countries outside your country of residence, including the United States. Where required, we use Standard Contractual Clauses or other lawful transfer mechanisms to protect your information.

7. Data retention

• Local data. Stays on your device until you delete the App or reset your progress.
• Cloud‑synced data. Retained for as long as your account is active. If you delete your account, all cloud data associated with it is deleted within 30 days, except where retention is required by law (for example, to comply with tax or accounting obligations).
• Support emails. Retained for up to 24 months after the last interaction.
• Subscription records. Retained as required by Apple, Google, and applicable law.

8. Your rights and choices

Depending on where you live, you may have the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to correct inaccurate information.
• Deletion — request deletion of your personal information.
• Portability — receive a copy of your information in a structured, machine‑readable format.
• Restriction or objection — restrict or object to certain processing.
• Withdrawal of consent — withdraw consent where processing is based on consent.
• Complaint — lodge a complaint with your local data protection authority.

You can exercise most of these rights directly in the App:

• Settings → Account → Export data — download all your learning data as a file.
• Settings → Account → Delete account — permanently delete your account and all cloud data.

You can also contact us at privacy@dailyvocable.com and we will respond within 30 days.

California residents (CCPA/CPRA). You have the right to know what categories of personal information we collect, the purposes for which we collect them, the categories of third parties with whom we share them, and to request access, correction, or deletion. We do not sell or share personal information for cross‑context behavioural advertising.

9. Security

We use industry‑standard administrative, technical, and physical safeguards to protect your information, including encryption in transit (TLS), encryption at rest, access controls, and security review of third‑party processors. No method of transmission or storage is 100% secure, but we work to protect your information using reasonable safeguards.

10. Children

The App is not directed to children under 13 (or under 16 in the EEA / UK), and we do not knowingly collect personal information from such children. If you believe a child has provided us with personal information, please contact us and we will delete it.

11. Third‑party services

Our App relies on Apple’s App Store, Google Play, RevenueCat, and Supabase. Their use of your information is governed by their own privacy policies:

• Apple — apple.com/legal/privacy
• Google — policies.google.com/privacy
• RevenueCat — revenuecat.com/privacy
• Supabase — supabase.com/privacy

12. Do Not Track

Our App does not use cookies or tracking technologies, and does not respond to Do Not Track signals because we do not engage in tracking across services.

13. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, notify you within the App or by email before the change takes effect. Your continued use of the App after a change becomes effective constitutes acceptance of the revised Policy.

14. Contact

For privacy questions, requests, or complaints:

• Email: privacy@dailyvocable.com
• General support: hello@dailyvocable.com

We will respond to verifiable requests within the timeframes required by applicable law (typically 30 days).