Privacy Policy

Vocaburn · com.coco.vocaburn

한국어 버전

Vocaburn (the "App") respects your privacy and handles data as described below.

The conditions for using the service are set out in the separate Terms of Use.

1. Information we collect

1-1. Account information (when you sign in with Google or Apple)

• Basic Google profile — email address, name and profile picture URL. The App requests only the email and profile scopes and does not access any other Google account data (contacts, Drive, etc.).
• Apple account information (iOS) — on iOS you can sign in with Apple. The App requests the email and name scopes, and the email address provided by Apple (if you choose "Hide My Email" in Sign in with Apple, the relay address Apple creates) and your Apple account identifier are stored. The name provided by Apple is not stored on the server. To disconnect Sign in with Apple when you delete your account, the refresh token received from Apple when you sign in is also kept on the server. Only the server can read this token; it cannot be viewed from the App, including by you.
• Nickname and emoji — your Google account name is used as the default nickname (if you sign up with Apple, “유저” (Korean for “user”) followed by six random digits) and can be changed freely in the App. Your nickname is shown as the author on word sets you publish (both public and unlisted). In study groups your nickname and emoji are shown to members of the same group, and for groups you own your nickname is also shown in group search (only for groups you keep visible in search) and invite-code previews, which any signed-in user can use (1-6).
• Pass status and purchase records — whether Lifetime is active and your AI Tutor access period are stored so the same benefits apply on all your devices. When you buy or restore Lifetime or the AI Tutor pass, the server checks that the payment is valid and stores the product ID, purchase identifier, order (transaction) ID, purchase state, purchase and verification times (for the AI Tutor pass, also the expiry time and whether it renews automatically) and the purchase details returned by the store (such as the billing region code).
  • Android — checked with Google Play. The purchase identifier is the purchase token and the order ID is the Google Play order ID. If Google Play sends a refund, cancellation or subscription status notification, the purchase state is updated.
  • iOS — the server verifies the transaction information signed by the App Store using Apple's certificates. The purchase identifier is the original transaction ID (originalTransactionId) and the order ID is the transaction ID (transactionId). If the App Store sends a server notification (such as a refund, subscription renewal or expiry), the purchase state is updated.
• Terms of Use and privacy policy consent record — when you agree while signing in, or when you open the App after the Terms of Use or this policy has changed, the document you agreed to (the Terms of Use or this privacy policy) and its version, the time you agreed and the device ID of that device are stored.

1-2. Synced data (when you sign in)

When signed in, the following data is stored on the server and synced with other devices signed in to the same account.

1-3. Shared word sets (when you publish on the web version)

• When you publish a word set on the web version (vocaburn.vercel.app), its title, description, language and a snapshot of the words at that time (words, meanings, notes, examples) are stored on the server.
• A public set can be searched and viewed by other users and shows your nickname as the author. An unlisted set can only be opened by people who know its share code.
• When you import someone else's set, a subscription record (which set, when) is stored. Only you can see your subscriptions.
• You can delete (unpublish) sets you published on the web version. A deleted set disappears from the lists, and the records left on the server (its title, description, copy of the words and so on) are deleted when you delete your account.

1-4. Automatically collected information

• Usage statistics — anonymized events such as screen views and feature usage (Google Analytics for Firebase)
• Crash information — device model, OS version and error logs when the App crashes (Firebase Crashlytics)
• Advertising identifier — the advertising ID and ad interaction data used to show ads to users without Lifetime (Google AdMob)

None of this includes the words, meanings or notes you enter.

1-5. Word auto-fill (whether or not you are signed in)

When you type a term while adding or editing a word, the App sends the following information to the developer's server (Supabase Edge Function) to fill in meanings, notes and examples automatically. Generating or checking for updates to AI study notes on the word detail screen works the same way. This feature is on by default and can be turned off in Settings > Auto-fill words; when it is off, these lookup requests from the App (Information sent and AI generation in the table below) are not made. This setting applies only to requests the App sends; downloading pronunciation audio (Pronunciation audio in the table below) and server processing of words you sync while signed in (last row of the table) happen regardless of this setting.

1-6. Study groups (when you sign in)

When you create or join a study group, the following information is stored on the server.

• Who can see it — messages, word sets, notices and the member list (nickname, emoji, role, join time) are shown to members of the same group, and the results board (best and latest scores, number of attempts and whether you have taken a test) is shown with nicknames and emoji to members of the same group in groups where the owner keeps test results public, and only to the owner in groups where they are private. In groups where test results are private, members other than the owner are shown only other members' best and latest scores and numbers of attempts, without nicknames or emoji, and only the number of members who have not taken the test. In these groups, notices about test results are not newly posted, and notices already posted are left out when members other than the owner load the chat or group list. In groups where the owner has set the results board to count only first attempts, only each member's first attempt counts toward the board's scores, and test result notices are posted only for first attempts. Each member is shown only the messages and notices posted since they joined the group; they do not receive notifications about messages and notices posted before they joined. If you leave or are removed from a group and join it again, only messages and notices posted since you rejoined are shown, so messages you sent before rejoining are not shown to you either. Your list of missed words is shown only to you, and invite codes and removal lists only to the group owner. The group name, description, member count and owner nickname can be seen by any signed-in user through group search (only for groups the owner keeps visible in search) and invite-code previews. Reports are used for review by the developer and are not shown to other users.
• Removal and leaving — a removed user cannot rejoin until the owner lifts the removal. If you are removed from or leave a group, you can no longer load or send that group's messages, word sets or results and no longer receive its notifications. If you are removed while the chat screen is open, the App closes that screen's real-time connection.
• Notifications — see section 9.

1-7. AI Tutor (when you sign in)

AI Tutor provides chat on the word detail screen, "Why was I wrong?" explanations after a wrong answer in study (dictation and multiple choice), and feedback on sentences you write in the chat's sentence-writing mode. You must be signed in to use it. There is a daily usage limit (2 turns free, 30 turns while your AI Tutor access period is active; a wrong-answer explanation counts as 0.5 turn). Answers are generated automatically by AI and may be inaccurate (this is also always shown in the App).

1-8. Scan a book (camera, Android and iOS)

The App asks for camera permission only in "Scan a book" when adding words, to recognize text in a book and suggest words from it.

1-9. Test sheet PDF (when you sign in)

Make a test sheet on the Study tab turns words from your word list into a test sheet (questions and answer key) as a PDF. You must be signed in and have an active AI Tutor pass to use it.

2. Information we do not collect

• Location — the App neither requests nor uses location permissions.
• Contacts, photos, microphone — the App does not request these permissions (the camera is requested only in "Scan a book" — 1-8). Pronunciation playback uses your device's speech engine or audio files downloaded from the server (Pronunciation audio in 1-5) and does not record audio.
• Payment details — card numbers and other payment information are handled by Google Play (Android) or the App Store (iOS); the App never sees them.

3. Data stored only on your device

• The entire word list, groups, collections, study history and stats of users who are not signed in (for terms sent by word auto-fill, see 1-5)
• Per-attempt study history of users without Lifetime
• AI Tutor conversation history (while you have no pass) — sent to the server with each request to get an answer but not stored there (except an AI answer you report and your preceding message — see Reports in 1-7); while your pass is active it is stored in your account (1-7)
• App settings — theme, language, study options, reminder time, free trial start time

If you are not signed in, this data cannot be recovered when you delete the App or switch devices (it may be included in your Google account backup if Android Auto Backup is on, and on iOS in your iCloud backup if iCloud Backup is on or in a backup of the device made on a computer). Lifetime users can use CSV export in Settings to back it up to a location they choose; the App does not access exported files.

4. How we use the data

• Syncing your word list and stats across devices and restoring them on a new device
• Providing the word set sharing feature
• Providing study groups (joining groups, sharing word sets, group test results boards and chat) and sending group notifications
• Reviewing study group reports and preventing abuse (rate limits)
• Verifying Lifetime and AI Tutor pass purchases and applying their benefits
• Disconnecting Sign in with Apple when an account that signed in with Apple is deleted
• Providing word auto-fill and AI study notes
• Providing AI Tutor (word chat, wrong-answer explanations and sentence feedback), applying its daily usage limit, and reviewing reports of AI answers
• Creating test sheet PDFs
• Confirming your consent to the Terms of Use and this privacy policy
• Fixing errors and improving the App
• Showing ads to users without Lifetime

5. Retention and deletion

• Synced data — kept until you delete your account. Words, groups and collections you delete in the App are kept in a deleted state so the deletion can propagate to your other devices, and are periodically removed permanently from the server after 30 days.
• Account deletion — tap Settings > Account > Delete account in the App. Your account, profile, synced data (including device info), Terms of Use and privacy policy consent records, purchase records, the Sign in with Apple refresh token, published word sets and, in study groups, your memberships, the messages you sent, notices showing your nickname, your test results, reports you made, block records (both those you made and those against you) and removal records about you are deleted from the server immediately and cannot be recovered (your account ID in read and removal signals left in the real-time delivery log is deleted within about 4 days; your account ID in processing records for synced words is not deleted — see "Word auto-fill" below). For an account that signed in with Apple, before deletion the server uses the stored refresh token to ask Apple to revoke it, disconnecting Sign in with Apple. The words, groups, collections, study history and stats stored on the device you deleted the account from are deleted as well. Data stored on other devices signed in to the same account, and data on your devices when the account is deleted by email request, is not deleted automatically.
• Purchase records — kept until you delete your account. However, refund records sent by Google Play or the App Store (for Google Play, the notification as received, including purchase token, order ID and refund type; for the App Store, the original transaction ID, transaction ID and the notification and transaction information as received) are used to make sure a refunded purchase is not treated as valid again; they are kept without an account ID and are not deleted when you delete your account.
• Signing out — signing out alone does not delete server data. However, signing out deletes the words, groups, collections, study history and stats stored on that device, and the data synced to the server is restored when you sign in again. Data not synced to the server by the time you sign out cannot be restored; if unsynced words remain, the App shows how many and asks you to confirm before signing out.
• Study groups — study group messages, word sets and test results are kept until the group is dissolved and permanently deleted, but are deleted earlier in the following cases. When the sender or the owner deletes a message, it is removed from the server's message records right away. When the uploader or the owner deletes a word set, it is no longer shown to members, and after 30 days it is permanently deleted from the server, together with its test results, by a weekly cleanup (within about 37 days). Chat notices about that word set being added or updated and about its test results (including the title, word count, scores and nicknames) are not deleted then and stay in the group. When you delete your account, your messages and test results are deleted as described under "Account deletion" above. When a group is dissolved, it is no longer shown to members, and after 30 days its memberships, messages, notices, word sets, test results, removal records and reports are all permanently deleted from the server by a weekly cleanup (within about 37 days). You cannot delete your messages in the App in groups you have left or been removed from (if such a group is still active, they stay until it is dissolved and permanently deleted) or in dissolved groups, or the messages you sent to a group before rejoining it; these messages are deleted from all groups when you delete your account (in the App or by email request). Even after you delete your account, word sets you uploaded to a group stay in the group with only the uploader removed, removal records you made stay with only the remover removed, and reports other users made about you are kept for review. Words that other members saved to their own word lists from a word set or from missed test words ("Save to my wordbook") stay in those members' word lists (and in their synced data if they sync) even if the word set or your account is deleted. For groups you own, ownership passes automatically to the editor who joined earliest, or, if there is no editor, to the member who joined earliest; if there are no other members, the group is dissolved. If you leave a group without deleting your account, the messages you sent, word sets you uploaded and your test results stay in the group. Notification text in the sending queue is deleted by a weekly cleanup once 7 days have passed since it was sent or discarded after 5 failed attempts; notification text that has not been sent is deleted when the original message (for word set notifications, the notice announcing the added set) is deleted or the group is permanently deleted. Rate-limit counters are periodically deleted after 2 days.
• Usage and crash data — retained according to Firebase's default retention policies.
• Word auto-fill — the per-term cache of generated results is shared data not linked to any user, so it is not deleted when you delete your account. Records left from when a daily usage limit applied (device ID, date, lookup count) are no longer created, and records dated more than 7 days ago are deleted by a weekly cleanup. Processing records for synced words (the term, its processing status and the ID of the account that first added the term to the queue — see 1-5) remain even if you delete your account, and are currently not deleted periodically. The pending list for processing-complete notifications (account ID, term, processing result) is deleted once the notification is sent or is no longer needed, and notification text left in the notification queue (including terms) is cleaned up on the same schedule as study group notifications; both are deleted when you delete your account.
• AI Tutor — conversations stored in your account are deleted by a weekly cleanup after 90 days, and are also deleted when you delete a conversation in the App or delete your account. Without a pass, conversations are not stored on the server; if you later get a pass, conversations still on this device are stored in your account. Daily usage limit records (account ID, date, number of turns used) are deleted by a weekly cleanup after 7 days. Daily usage limit records, your AI Tutor access period and your reports of AI answers are deleted when you delete your account. The conversation history stored on your device is all deleted when you sign out, a word's conversation is deleted when you delete that word, and it is gone when you delete the App.
• Test sheet PDF — the server does not store the questions it receives or the PDF it creates (1-9). A PDF you send to or save in an app you choose from the share sheet is managed by that app.

If you can no longer access the App, you can request account deletion by email. See Delete Your Account and Data for details.

6. Third-party services

The App uses the following services, each of which may process limited data on its own servers:

• Supabase — hosts account authentication, the synced, shared and study group data, real-time delivery of study group chat, the word auto-fill, AI Tutor and test sheet PDF server (Edge Function), pronunciation audio files and the study group notification sending server. The server is located in the Seoul, South Korea region (ap-northeast-2); synced data can be accessed only by the signed-in owner, and the server returns study group data only to members of that group (for what group search and invite-code previews show, see 1-6; for real-time chat, membership is checked when the connection is opened, and if you are removed or the group is dissolved while the chat screen is open, the App closes that connection). (Supabase Privacy Policy)
• Google Sign-In — account authentication. Only your email, name and profile picture are provided.
• Sign in with Apple (iOS) — account authentication. Your email address (Apple's relay address if you hid it) and Apple account identifier are provided; your name is not stored. To disconnect Sign in with Apple when you delete your account, the developer's server receives a refresh token from Apple when you sign in, keeps it, and asks Apple to revoke it when you delete your account. (Apple Privacy Policy)
• Google AdMob — shows ads to users without Lifetime. To serve ads it may collect the advertising identifier and ad interaction data and share them with Google's ad network. In regions that require consent (e.g. the EEA) a consent screen is shown on first launch and can be changed later in Settings > Privacy options.
• Google Play Billing (Android) — processes Lifetime (a one-time purchase) and the AI Tutor pass (an auto-renewing subscription). The developer's server verifies payments with the Google Play Developer API and receives refund, cancellation and subscription status notifications from Google Play. You can cancel or manage the subscription in Google Play's subscription settings. Google Play keeps the original purchase history; the server stores the purchase records described in 1-1.
• App Store In-App Purchase (iOS) — processes Lifetime (a non-consumable purchase) and the AI Tutor pass (an auto-renewing subscription). The developer's server verifies the transaction information signed by the App Store to confirm that the payment is valid, and receives App Store server notifications (such as refunds, subscription renewals and expiry). You can cancel or manage the subscription in your device's App Store subscription settings. Apple keeps the original purchase history; the server stores the purchase records described in 1-1.
• Google Analytics for Firebase — anonymized usage statistics, used only to improve the App.
• Firebase Crashlytics — crash information, used only to improve stability.
• Firebase Remote Config — downloads configuration values such as update notices. No personal data is sent.
• Firebase Cloud Messaging — issues a device token for receiving push notifications and delivers study group notifications and word-info-ready notifications to your device. The App stores this token on the server only when you are signed in; when a notification is sent, the device token, the notification text (the group name and the sender's nickname with the beginning of the message or the word set title) and group and message identifiers are passed to Firebase; for word-info-ready notifications, the notification text, the terms concerned (up to 20 ready and up to 20 unrecognized) and their counts, and your account ID (used to group the notifications) are passed. On iOS, Firebase delivers notifications to your device through the Apple Push Notification service (APNs), so this information is also passed to Apple.
• Google ML Kit (Android) — text recognition for "Scan a book". Recognition is done on your device, and the recognition model is downloaded by Google Play services. ML Kit sends Google the usage statistics described in Google's ML Kit data disclosure (1-8). It is used only on Android; on iOS, text is recognized with Apple's Vision framework.
• Google Cloud Text-to-Speech (Gemini TTS) — creates pronunciation audio files (Pronunciation audio in 1-5). The server sends terms (including terms of words you sync while signed in — see 1-5) and AI-generated example sentences as the text to be read; example sentences you wrote yourself are not sent, and neither are your account ID, device ID or email. The audio files created are shared by all users and stored in Supabase.
• Anthropic — generates word auto-fill results and AI study notes. Only the term you type may be passed to the Anthropic API, and only when the server has no stored result; your device ID and account information are not passed on. When the operator prepares or checks study information for words you sync while signed in (1-5), the term may also be passed to Anthropic.
• OpenAI — generates AI Tutor answers, and study information such as meanings and examples for words you sync while signed in (1-5). For AI Tutor, the word information, messages, recent conversation, wrong answers and sentences described in 1-7 are passed to the OpenAI API, and for study information only the term is; your account ID, device ID and email are not passed on.
• TypeSafe AI (Jev) — in AI Tutor, checks whether a message is a word-study question, classifies the type of wrong answer and scores sentences. It also checks whether words you sync while signed in are correctly spelled English words or typos (1-5). In AI Tutor the term and meanings, the current message (or wrong answer or sentence) and the generated AI answer, and in the word check only the term, are passed on; your account ID, device ID and email are not passed on.

You can reset your advertising ID or opt out of personalized ads in your device settings. On iOS, the advertising identifier (IDFA) is used only if you allow this app to track in your device's tracking settings (Settings > Privacy & Security > Tracking); if you do not, ads are shown without the IDFA. See the Google Privacy Policy for how Google services process data. We do not sell your personal information to third parties.

7. International transfers

The Supabase server that stores synced and shared data is located in South Korea (Seoul). Google Sign-In, AdMob, Firebase (including delivery of study group notifications), Google ML Kit usage statistics (Android, 1-8) and Google Cloud Text-to-Speech run on Google's global infrastructure, and Sign in with Apple, App Store purchases and APNs push delivery (iOS) run on Apple's infrastructure, so your data may be processed on servers outside your country. Terms passed to Anthropic and OpenAI by word auto-fill and server processing of synced words (1-5), and information passed to OpenAI by AI Tutor, may be processed on servers in the United States, and information passed to TypeSafe AI by AI Tutor and by the check of synced words (1-5) may be processed on servers outside Korea.

8. Security

All communication between the App and the server is encrypted (HTTPS). Server data is protected by row-level access control so that only the signed-in owner can access their synced data, and shared word sets are exposed only according to the visibility you chose. The server returns study group data only after checking that the requesting user is a member of that group (the information shown in group search and invite-code previews can be seen by any signed-in user, as described in 1-6, and for real-time chat, membership is checked when the connection is opened), and invite passwords are stored only as irreversible hashes.

9. Notifications

Study reminders, word alerts and the autoplay media notification are local notifications scheduled and shown on your device. The push notifications sent from the server are study group notifications about new messages and new word sets, and notifications telling you whether information for words you saved without a meaning or AI study notes is ready (or could not be recognized) (at most twice a day), delivered through Firebase Cloud Messaging. You are not notified about messages you send or word sets you upload, groups you have muted, or messages and word sets from users you have blocked. You can mute group notifications for each group on the group screen, and turn off all notifications at any time in your device settings.

10. Your rights

You can view, edit and delete your data in the App (editing your word list, CSV export (Lifetime), account deletion), stop syncing by signing out, delete your messages, leave groups, mute group notifications, and block and report users in study groups, and stop auto-fill and AI study notes lookup requests by turning off word auto-fill in Settings (pronunciation audio for English words is still downloaded from the server when a user with an active AI Tutor pass plays it, and server processing of words you sync while signed in still happens, regardless of this setting — see 1-5). For any other access, correction or deletion request, contact us at the email below and we will respond without undue delay.

11. Children's privacy

The App does not knowingly collect personal information from children under 14. If we learn that such information has been collected, we will delete it promptly.

12. Changes to this policy

If this policy changes, we will notify you through this page and an App update.

13. Contact

For privacy questions or deletion requests, please contact:

Email: philleeran@gmail.com

Effective date: 2026-10-02