WordCraft is a spaced-repetition vocabulary learning app available at https://wordcraft.info and as mobile applications. This policy explains what data we collect, why we collect it, and what you can do about it.
The data controller is Dmitrii Sirotin. Contact us at support@wordcraft.info.
| Data | Purpose |
|---|---|
| Email address | Signing in, confirming your address, resetting your password, service emails |
| Password (if you sign in with one) | Stored only as a cryptographic hash (argon2). We do not store and cannot recover your plaintext password. An account created through Google or Apple sign-in may have no password at all — you can set one via "Reset password" |
| Account creation date | Service records and support requests |
| Email confirmation and password reset tokens and their expiry times | Confirming your address and resetting your password; tokens are single-use and short-lived |
| Linked Google / Apple accounts: the provider name, a technical identifier of your account with the provider, and the email address the provider has verified | Signing in with Google or Apple and linking that sign-in to your account by verified email address |
We use this data to decide which words to show you next, to compute your per-library statistics, and to time repetition reminders.
If you send us a message through the in-app feedback form, we store the message text, the screen it was sent from, the app version, and your browser or device User-Agent string. We use this to reproduce the issue and reply to you.
If you purchase a subscription, we store your subscription status, the end date of the paid period, and your Stripe customer and subscription identifiers.
Your payment card details never reach our servers and are never stored by us. Payments are handled entirely by Stripe.
The app stores the following in your browser's localStorage: your session token, basic account data, your chosen colour theme, your settings (pronunciation voice, interface language, time zone), and the in-progress state of your current learning session, so that you do not lose progress if the page reloads. This is technical storage required for the service to function; it is not used for tracking and is not shared with third parties. It is cleared when you sign out or clear site data.
Signing in with Google or Apple is optional — instead of, or in addition to, a password. You authenticate on the provider's side, on its own consent screen; you never give us your Google or Apple password and we never receive it. The provider sends us a signed token from which we take your email address, whether it is verified, and a technical account identifier. If that address is already verified on an existing WordCraft account, the sign-in is linked to it; otherwise a new account is created. Apple may give us a hidden relay address instead of your real one — service emails then go through that relay. To unlink a provider, delete your account (section 8).
We do not ask for your name, phone number, precise location, or contacts, and we do not access your microphone, camera, or device files. We use no third-party web analytics, ad networks, or trackers. When you sign in with Google or Apple, the provider may pass along your name and profile photo — we do not store them.
We do not sell personal data. We share it only with the service providers below, and only to the extent needed to run the service.
| Recipient | What they receive | Why |
|---|---|---|
| IONOS Inc. (hosting) | Data stored in our database and server logs | Hosting the application and database |
| IONOS (email delivery) | Your email address and the contents of the service email | Sending confirmation and password reset emails |
| Stripe, Inc. (payments) | Your email address and the payment details you enter on Stripe's side | Processing payments and managing subscriptions |
| Google LLC / Apple Inc. (sign-in provider) | Only if you choose this sign-in: the fact that you signed in to WordCraft and the data you enter on the provider's side. We receive your email address, its verification status, and an identifier | Signing in to your account, at your choice. The provider processes data under its own policy: Google — policies.google.com/privacy, Apple — apple.com/legal/privacy |
Google Cloud Text-to-Speech. Word pronunciations are pre-generated audio files. We generate them with a separate maintenance script, outside of normal app operation, and only dictionary words are sent to Google. None of your data is ever sent to Google Cloud TTS — neither during generation nor while you use the app. The app serves you the finished audio files from our own server.
If an audio file has not been generated yet, the app may fall back to your browser's built-in speech synthesiser (the Web Speech API). In that case processing happens within your browser or operating system under its vendor's policy; we are not involved in that exchange.
We may also disclose data where required by law, court order, or a lawful request from a competent authority, and to protect the rights, safety, and property of our users and of the operator.
If EU or UK law applies to you, we process your data on these bases: performance of a contract (providing the service, your account, your subscription), legitimate interests (security, anti-spam and anti-abuse measures, responding to your messages), compliance with legal obligations (tax and accounting records for payments), and consent where consent is required.
Our servers are located in the United States. Stripe processes payments in the United States and in other countries where it operates. By using the service you understand that your data may be transferred to and processed outside your country of residence, subject to appropriate safeguards.
You can:
We respond to such requests within 30 days. If you are in the EU, the UK, or California, you may have additional rights under the GDPR, UK GDPR, or CCPA/CPRA, including the right to lodge a complaint with a supervisory authority.
We do not sell or "share" personal information as those terms are defined by the CCPA/CPRA.
We do not track users across third-party websites and we use no trackers, so your browser's "Do Not Track" signal does not change our behaviour: we do not collect the kind of data it would apply to. No third parties collect information about your activity over time and across other websites on our site.
California's "Shine the Light" law (Cal. Civ. Code § 1798.83) lets California residents request, once a year, details of any disclosure of their personal information to third parties for those parties' direct marketing purposes. We do not disclose personal information to third parties for their direct marketing.
Passwords are stored as argon2 hashes. Traffic between the app and our servers uses HTTPS. Access to our servers and database is restricted and protected. Sensitive operations are rate-limited to make password guessing and email spam harder.
No service can guarantee absolute security. Please use a unique password and do not share it.
The service is not directed to children under 13, and we do not knowingly collect their data. If you are in the EU or the UK, the minimum age to register on your own is 16, or such other age as your national law sets; younger users need a parent's or guardian's consent. If you believe a child has given us data without that consent, email support@wordcraft.info and we will delete it.
We may update this policy. The date of the most recent change is shown at the top of this page. We will notify you of material changes by email or by an in-app notice at least 14 days before they take effect.
Privacy questions: support@wordcraft.info
Dmitrii Sirotin