Voca — Privacy Policy
1. Who we are
Voca ("Voca", "the App", "we", "us") is an iOS application for learning English vocabulary through video content.
The App is operated by:
Ivan Bannikov, Individual Entrepreneur (ინდივიდუალური მეწარმე) registered in Georgia
- Identification number: 304675625
- Registered address: Nino and Ilia Nakashidze Str. N1, Building N3, Apt. 3, Krtsanisi District, Tbilisi, Georgia
- Email: ivandiv13@gmail.com
- Website: https://ivandiv13.github.io/voca-legal
We are the data controller for the personal data described in this policy. That means we decide why and how your data is processed.
This policy explains what we collect, why, who we share it with, how long we keep it, and what you can ask us to do about it. It applies to the Voca iOS app and to https://ivandiv13.github.io/voca-legal.
2. Summary in plain language
- You can go through the whole intro flow without an account. Until you sign in, your answers stay on your device.
- We ask for an account (Sign in with Apple, Sign in with Google, or a one-time code sent to your email) so your vocabulary progress survives a reinstall or a second device.
- We do not sell your personal data, we do not run advertising in the App, and we do not use the Advertising Identifier (IDFA) or App Tracking Transparency tracking.
- Speaking exercises use your microphone. Audio is processed on your device where iOS supports it; we never upload or store your recordings on our servers — only the recognised text and a score.
- Videos play from YouTube inside the App. Google receives data about that playback under its own privacy policy.
- You can delete your account and all of the learning data attached to it from inside the App at any time.
3. What data we collect
3.1 Account data
Collected when you sign in.
| Data | Source | Why |
|---|---|---|
| Account identifier (UUID) | Generated by us | To link your progress to you |
| Email address | Sign in with Apple or Google, or entered by you when you choose email sign-in | Account identification, delivery of one-time sign-in codes, security notices, support |
| Display name | Entered by you in the intro flow, or supplied by Apple / Google (optional) | To address you in the App |
| Sign-in method and authentication token | Apple, Google, or our own email one-time code | Authentication |
| Account creation date | Generated by us | Account management |
You can sign in three ways: Sign in with Apple, Sign in with Google, or a one-time code sent to your email address. We never issue or store passwords.
If you use Sign in with Apple and choose "Hide My Email", we only ever receive Apple's private relay address, never your real one. If you sign in with a one-time code, we receive the email address you enter, and one-time codes are delivered through our authentication provider (see section 5).
3.2 Learning profile
- Native language
- Measured CEFR level and target CEFR level
- Estimated vocabulary size from the placement test
- Your answers in the intro flow: the name you enter, learning goal, words per day, minutes per day, self-assessed level, how long you have been stuck, your main blocker, preferred genres, and how you heard about Voca
- Date you completed the intro flow
Before you sign in, these answers live only on your device. They are sent to our servers at the moment you create an account, so that they can be restored on a reinstall or another device.
3.3 Learning activity
- Words you are learning and their spaced-repetition state (status, ease factor, interval, repetitions, next due date, last review date)
- Review logs — the outcome and timestamp of individual reviews
- Practice days, practice seconds and streak counters
- Video watch progress
- Speaking exercise attempts: the text recognised from your speech, a match score, and a per-word breakdown of which words were heard correctly
3.4 Voice and microphone data
Speaking exercises ("shadowing", speaking games) require access to your microphone and to iOS speech recognition. You are asked for both permissions the first time and can withdraw either at any time in iOS Settings.
How it works:
- Your speech is captured on your device. In shadowing exercises it is written to a single temporary file in the App's private storage, which each new attempt overwrites, so nothing accumulates. In speaking games the audio is streamed straight to the recogniser and no file is written at all.
- The recording is transcribed using Apple's Speech framework. Where your device and language support on-device recognition, the App requests it and the audio never leaves your iPhone. Where on-device recognition is not available, iOS sends the audio to Apple for processing under Apple's privacy policy — we are not the recipient of that audio.
- Only the resulting text and the scores are sent to our servers and stored against your account.
We never receive, transmit or store your raw audio.
3.5 Product analytics
We record a small set of product events to understand where people get stuck. Every event carries:
- an install identifier (
anon_id) — a random UUID generated on first launch, not tied to your device's hardware identifiers - your account identifier, once you have signed in
- the event name (for example
app_opened,onboarding_step_viewed,sign_in_completed) - event properties limited to structural values: step identifiers, sign-in provider, CEFR bands
- the app version and a timestamp
Event properties deliberately never contain names, email addresses, or anything you typed. Events are queued on your device and sent in batches, so they still arrive after a period offline.
We run this analytics on our own backend. We do not use Firebase Analytics, Mixpanel, Amplitude, AppsFlyer, or any comparable third-party analytics SDK.
3.6 Purchase and subscription data
Subscriptions are sold through the Apple App Store and managed with Adapty. In connection with a purchase we or our processors receive:
- Subscription status, product identifier, trial and renewal dates
- Transaction identifiers issued by Apple
- The Vendor Identifier (IDFV) and basic device / OS / app-version information collected by the Adapty SDK
We never receive your payment card details, bank details or billing address. Those are handled entirely by Apple.
3.7 Technical data
- IP address and standard request metadata in our server logs, kept for security and abuse prevention
- Device model, operating system version and app version
- Error and crash context where an operation fails
3.8 Content you request explanations for
When you ask the App to explain a word or a line of subtitles, the App does not send us the text. It sends a reference to the content — a video identifier and the position of the line, or an identifier for a word sense — and our server looks the text up and forwards it to a language model provider to generate an explanation or translation.
Like every other request to our backend, this call is authenticated with your account's session token, so our server knows which account asked. What we send onward to the language model provider is only the content being studied — no account identifier, no email, no name, and nothing you have typed.
3.9 What we do not collect
- No advertising identifier (IDFA), no App Tracking Transparency prompt, no cross-app or cross-site tracking
- No precise or coarse location
- No contacts, photos, calendar, health or biometric data
- No payment instrument data
- No stored audio recordings
- No sensitive-category data as defined by the Law of Georgia on Personal Data Protection or Article 9 GDPR
4. Why we process your data, and our legal basis
For users in the EEA and the UK, our legal bases under the GDPR are:
| Purpose | Data | Legal basis |
|---|---|---|
| Create and maintain your account | Account data | Performance of a contract (Art. 6(1)(b)) |
| Deliver the learning service, sync progress across devices | Learning profile, learning activity | Performance of a contract (Art. 6(1)(b)) |
| Personalise difficulty and review scheduling | Learning profile, learning activity | Performance of a contract (Art. 6(1)(b)) |
| Run speaking exercises and score pronunciation | Microphone access, recognised text | Consent, given via the iOS permission prompt (Art. 6(1)(a)); withdrawable at any time |
| Process subscriptions, trials and restores | Purchase data | Performance of a contract (Art. 6(1)(b)) |
| Improve the product and diagnose where people drop off | Product analytics | Legitimate interests (Art. 6(1)(f)) — improving a service you use, using structural data only |
| Keep the service secure and prevent abuse | Technical data | Legitimate interests (Art. 6(1)(f)) |
| Meet accounting and consumer-law obligations | Purchase records | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have weighed those interests against your rights and concluded that the processing is limited, expected, and does not override them. You may object at any time — see section 8.
For users in Georgia, the corresponding grounds are those set out in the Law of Georgia on Personal Data Protection: your consent, performance of a contract to which you are a party, and our legitimate interests.
5. Who we share data with
We share personal data only with service providers who process it on our instructions ("data processors"), and only to the extent needed to run the App. We do not sell personal data and we do not share it for cross-context behavioural advertising.
| Processor | Role | Location |
|---|---|---|
| Supabase, Inc. | Authentication, database, server functions, delivery of one-time sign-in codes — our core backend | Company: United States. Database hosted in the European Union (Ireland) |
| Adapty Tech, Inc. | Subscription state, paywalls, purchase validation | United States |
| Apple, Inc. | App distribution, payments, Sign in with Apple, speech recognition (where not on-device), local notifications | United States and global |
| Google LLC | Sign in with Google; YouTube embedded video playback | United States and global |
| OpenRouter, Inc. and the model provider it routes to (currently Google) | Generating word explanations and translations from app content | United States |
We may also disclose data:
- where we are legally required to, by a competent authority acting lawfully;
- to establish, exercise or defend legal claims;
- to a successor entity in a merger or sale of the business, in which case you will be notified and this policy will continue to apply until replaced.
5.1 YouTube
Video content is played from YouTube inside the App. We do not host the video. When you play a clip, Google receives request data — including your IP address — and processes it as an independent controller under the Google Privacy Policy (https://policies.google.com/privacy) and the YouTube Terms of Service (https://www.youtube.com/t/terms). We do not control that processing.
6. International transfers
We operate from Georgia.
Your account and learning data are stored in our primary database, which is hosted in the European Union (Ireland). That data is not routinely moved out of the EU. However, our backend provider is a US company that may access the database for support and maintenance, and some of our other processors are located in the United States, so transfers outside the EEA, the UK and Georgia do occur.
For transfers from the EEA and the UK we rely on:
- the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable) incorporated into our agreements with processors, or
- the processor's certification under the EU–US Data Privacy Framework where it holds one.
For transfers out of Georgia we comply with the transfer requirements of the Law of Georgia on Personal Data Protection, including appropriate safeguards in our contracts with processors.
You may request a copy of the relevant safeguards by writing to ivandiv13@gmail.com.
7. How long we keep data
| Data | Retention |
|---|---|
| Account and learning data | Until you delete your account, then removed as described in section 9 |
| Product analytics events | 24 months from the event date |
| Server and security logs | 30 days |
| Purchase and subscription records | For as long as required by applicable accounting and tax law, and in any case no longer than 10 years |
| Support correspondence | 24 months from the last message |
| Temporary speech recording on your device | Overwritten by the next attempt; removed when you delete the App |
8. Your rights
Depending on where you live, you have some or all of the following rights:
- Access — a copy of the personal data we hold about you
- Rectification — correction of inaccurate or incomplete data
- Erasure — deletion of your data ("right to be forgotten")
- Restriction — to have us pause processing while a dispute is resolved
- Portability — your data in a structured, machine-readable format
- Objection — to processing based on legitimate interests, including a general right to object at any time
- Withdrawal of consent — where processing is based on consent, without affecting processing already carried out. Microphone and speech-recognition consent can be withdrawn in iOS Settings → Voca.
- Complaint — to a supervisory authority (section 12)
To exercise any of these, email ivandiv13@gmail.com from the address associated with your account. We respond within 30 days, and will tell you if we need to extend that period for a complex request. We do not charge for these requests unless they are manifestly unfounded or repetitive.
We may ask you to confirm control of your account before acting on a request, in order to avoid disclosing your data to someone else.
8.1 Automated decision-making
The App schedules your reviews and estimates your vocabulary level algorithmically. This affects which exercises you are shown and when and nothing else. It produces no legal effects and no similarly significant effects on you within the meaning of Article 22 GDPR. You can always override the estimate by retaking the placement test or adjusting your target in Settings.
9. Deleting your account
You can delete your account from inside the App: Settings → Delete account.
Deletion removes your authentication record and, by cascade, everything attached to it: your profile and intro-flow answers, word progress, review logs, practice history, watch progress and speaking-exercise results. This is immediate and irreversible — there is no restore.
Two things survive account deletion, and neither identifies you:
- Product analytics events are retained in de-identified form (your account identifier is cleared; only the random install identifier remains) for the retention period in section 7.
- Purchase records retained to meet accounting and tax obligations.
Deleting the App from your device does not delete your account. Your App Store subscription is managed by Apple and must be cancelled separately in iOS Settings → your name → Subscriptions.
10. Security
We apply measures appropriate to the risk, including:
- Encryption in transit (TLS) for all communication with our servers
- Encryption at rest for our database
- Row-level security on every table holding user data, so a signed-in account can only ever read and write its own rows
- Passwordless authentication throughout — Apple and Google sign-in are handled by those providers, and email sign-in uses short-lived one-time codes. We never issue, store or see a password.
- Access to production data limited to those who need it
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it, and notify you directly without undue delay where the risk to you is high.
11. Children
Voca is intended for users aged 13 and over. We do not knowingly collect personal data from children under 13.
In countries where the digital age of consent under Article 8 GDPR is higher than 13 (it ranges from 13 to 16 across the EEA), users below that local age must have the consent of a holder of parental responsibility before using the App.
If you believe a child under 13 has provided us with personal data, write to ivandiv13@gmail.com and we will delete the account and its data promptly.
Note that video content plays from YouTube. While we curate the catalogue, we do not control YouTube's platform, its recommendations, or any content beyond the clips we select.
12. Supervisory authorities and complaints
If you have a concern, please contact us first at ivandiv13@gmail.com — most issues can be resolved directly. You also have the right to complain to a supervisory authority:
- Georgia: Personal Data Protection Service of Georgia — https://personaldata.ge
- EEA: the data protection authority of the member state where you live, work, or where the alleged infringement occurred. A list is maintained at https://edpb.europa.eu/about-edpb/board/members_en
- United Kingdom: Information Commissioner's Office — https://ico.org.uk
13. California residents
We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined by the California Consumer Privacy Act as amended by the CPRA. We do not use or disclose sensitive personal information for purposes beyond those permitted without a right to limit.
California residents may request to know, delete, or correct their personal information, and will not be discriminated against for exercising those rights. The categories of personal information we collect, the purposes, and the categories of recipients are set out in sections 3 to 5 above. To make a request, email ivandiv13@gmail.com.
14. Changes to this policy
We may update this policy as the App changes. When we do, we will update the "Last updated" date at the top and publish the new version at https://ivandiv13.github.io/voca-legal/privacy.
If a change materially affects how we use your personal data, we will notify you in the App or by email before it takes effect, and where the law requires it we will ask for your consent.
15. Contact
Questions, requests, or complaints about this policy or your data:
Ivan Bannikov, Individual Entrepreneur
- Nino and Ilia Nakashidze Str. N1, Building N3, Apt. 3, Krtsanisi District, Tbilisi, Georgia
- Identification number: 304675625
- Email: ivandiv13@gmail.com