Privacy Policy

Last updated: October 19, 2026

Effective date: March 21, 2026

Privacy at a Glance

Where your data is stored: on servers in the United States. Section 7 sets out the safeguards we apply to these transfers.

1. Introduction

This Privacy Policy explains how Tathros GmbH ("we," "us," "our," "Tathros") collects, uses, stores, shares, and protects your personal data when you use Vokabulo, as the app for iPhone and iPad or as the web app at app.vokabulo.com (together the "App," "Service").

It also covers the Vokabulo website at www.vokabulo.com (the "Website"). Unless a section refers to the Website explicitly, the practices described in this policy relate to the App. Section 10.2 sets out everything we process when you visit the Website.

The web app is the same service in your browser: the same account, the same words and progress, and the same subscription. Where it works differently from the iPhone and iPad app, this policy says so, and Section 10.4 sets out what the web app stores in your browser and what it sends us. If you buy Vokabulo Pro in the web app, Stripe sells the subscription to you under its Link brand. Section 9.6 explains what that means for your data.

We are committed to protecting your privacy. We only process what is strictly required to operate the App. We do not sell your data. We do not serve advertisements.

This Privacy Policy applies to all users of the App worldwide and addresses the specific requirements of the following data protection laws:

• EU: General Data Protection Regulation (GDPR)
• Germany: TDDDG, BDSG
• Italy: Codice della Privacy (D.Lgs. 196/2003)
• France: Loi Informatique et Libertés, CNIL Recommendations
• Spain: LOPDGDD (Ley Orgánica 3/2018)
• Brazil: LGPD (Lei nº 13.709/2018)
• United Kingdom: UK GDPR, Data Protection Act 2018, PECR
• United States: CCPA/CPRA, state privacy laws, COPPA

Please read this Privacy Policy carefully. By using the App, you acknowledge that you have read and understood this policy.

2. Data Controller

The data controller responsible for your personal data is:

Tathros GmbH, Zum Quellenpark 38, 65812 Bad Soden am Taunus, Germany

Email: privacy@vokabulo.com, Website: www.vokabulo.com

Managing Director: Wolfgang Männel

Commercial Register: Königstein HRB 7391, VAT ID: DE264657778

Data Protection Officer: not appointed. We are not required to appoint one (Art. 37 GDPR, § 38 BDSG). For any privacy question, write to privacy@vokabulo.com.

3. What Data We Collect

We collect and process the following categories of personal data:

3.1. Account Data (provided by you at registration)

3.2. Learning Data (generated through your use of the App)

3.3. Sets Data (generated when you use Sets features)

3.4. Technical Data (collected automatically)

3.5. Data Processed by Third-Party Services on Our Behalf

Three further parties are involved only if you choose them, and none of them acts on our behalf when it does: YouTube (Google), which plays the videos on the Website and in the web app and receives nothing until you press play (Sections 10.2 and 10.4); Stripe, which sells Vokabulo Pro to you if you buy it in the web app (Section 9.6); and your browser's speech service, such as Google's in Chrome, if you dictate in the web app (Section 10.4).

3.6. Our YouTube Channel (YouTube API Services)

We publish videos on our own YouTube channel, Vokabulo (@vokabulo-app). To upload them and manage their titles, descriptions, subtitles, thumbnails and playlists, we use the YouTube API Services through an internal tool, Tube Studio, which runs on our own computer and is used only by us. For you, this means:

• it only accesses YouTube channels we manage ourselves, which we sign in to with our Google account: our Vokabulo channel and two further channels we run. It never accesses anyone else's channel or account;
• it processes no data about you. It does not collect, store or share data about viewers of our videos, other YouTube users, visitors to the Website or users of the App;
• what it keeps are the video IDs, titles and upload status of our own videos, and statistics of our own videos such as view counts. These are totals and contain nothing about individual viewers.

YouTube's Terms of Service at www.youtube.com/t/terms apply to the YouTube API Services, and Google's privacy policy at policies.google.com/privacy applies to the data YouTube processes. Access granted to an application through the YouTube API Services can be revoked at any time on Google's security settings page at security.google.com/settings/security/permissions.

4. What We Do NOT Collect

We want to be explicit about what we do not collect:

• No advertising identifiers (IDFA/GAID)
• No precise location data (GPS, Wi-Fi triangulation, or Bluetooth beacons)
• No browsing history or activity outside the App
• No contacts, calendar, or photo library data
• No health or biometric data
• No card numbers or bank details: in the iPhone and iPad app you pay Apple, and in the web app you pay Stripe on Stripe's own checkout page. We never receive your full card number or your bank details
• No advertising networks or ad SDKs
• No cross-app or cross-site tracking
• No visitor profiles on the Website (we count visits only as totals, without cookies or identifiers; see Section 10.2)
• No audio recordings: we never receive or store your voice. In the iPhone and iPad app, Apple's speech recognition turns it into text, on your device or on Apple's servers, depending on your device, the feature and your connection (hands-free study uses Apple's servers whenever you are online). In the web app your browser does this, usually through its maker's online service (Section 10.4). We receive only the text

These statements describe what we collect. Two things work differently, and only if you choose them. Starting one of the videos on the Website or in the web app connects your browser to YouTube, and Google may then set cookies and advertising identifiers of its own. Nothing is sent before you press play, we receive none of it, and Section 10.2 sets out exactly what happens. Dictating in the web app lets your browser send your voice to its maker's speech service, as Section 10.4 explains.

5. How We Use Your Data

We use your personal data for the following purposes:

We do not use your data for advertising, profiling for marketing purposes, or automated decision-making that produces legal effects concerning you.

6. Legal Bases for Processing

6.1. EU/EEA, UK, and Switzerland (GDPR / UK GDPR)

We process your data based on the following legal bases under Article 6 GDPR:

• Performance of contract (Art. 6(1)(b)): Processing necessary to provide the Service you signed up for, including account management, vocabulary storage, quiz functionality, sync, Sets features, AI-powered features, and subscription management, as well as steps taken at your request before entering into a contract, such as answering a request for an offer.
• Consent (Art. 6(1)(a)): Processing for optional features that require your explicit opt-in, including push notifications, voice input (microphone access), and subscribing to our newsletter on the Website. You may withdraw consent at any time (see Section 11).
• Legitimate interest (Art. 6(1)(f)): Processing necessary for our legitimate interests, including ensuring app stability and security, fraud prevention, answering inquiries that people send us on behalf of their company, running a secure and reliable Website and web app, counting visits to the Website as totals and keeping it fast, counting how many people open Vokabulo each day and week (our own statistics), timing our emails to when you last used Vokabulo, showing learners' rankings to each other on the leaderboard (you can opt out at any time), sending our newsletter to account holders (you can unsubscribe at any time), and protecting the Website's newsletter signup form and business inquiry forms from automated abuse. We have balanced these interests against your rights and freedoms and determined that processing is proportionate and does not override your interests.

6.2. Brazil (LGPD)

Under the LGPD, we process your data based on: consent (Art. 7(I)), performance of contract (Art. 7(V)), and legitimate interest (Art. 7(IX)), as described in Section 5 above.

6.3. United States

In the United States, we process your data as described in this Privacy Policy to provide the Service under our Terms and Conditions. For California residents, see Section 15.

7. Data Storage and Security

7.1. Where Your Data Is Stored

Your data is stored in the following locations:

7.2. International Data Transfers

Your account data and learning data are stored and processed in the United States. Our backend provider (currently Convex) hosts our database on Amazon Web Services infrastructure located in the United States, our authentication provider (currently Clerk) also processes data in the United States, Cloudflare, which hosts the Website and the web app, processes requests to them on its worldwide network and the signals from the checks on our forms and the Website statistics in the United States, our subscription management provider (currently RevenueCat) processes data in the United States, and Stripe processes purchases made in the web app in Ireland, the United States and other countries. Our other service providers may process data in the United States or in other countries where they maintain infrastructure. These countries may have data protection laws that differ from those in your jurisdiction.

For transfers from the EEA, we rely on:

• EU-U.S. Data Privacy Framework, for providers certified under it (Clerk, Cloudflare and Stripe are certified);
• Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914), incorporated into our data processing agreements with providers that are not certified under the Data Privacy Framework, including our backend provider;
• Adequacy decisions where available.

For transfers from the UK, we rely on:

• UK International Data Transfer Agreements (IDTAs) or the UK Addendum to EU SCCs, or the UK Extension to the EU-U.S. Data Privacy Framework where the provider is certified under it.

For transfers from Brazil, we rely on:

• the standard contractual clauses adopted by the ANPD under Resolução CD/ANPD nº 19/2024, or other appropriate safeguards under Article 33 of the LGPD.

Videos are sent by your browser, not by us. If you press play on a video, your browser connects to Google directly and Google processes what it receives as its own controller, in the United States and in other countries where it operates. Google LLC is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework. If you do not press play, nothing is sent.

Dictation in the web app is sent by your browser, not by us. When you dictate in the web app, your browser may send the audio to its maker's speech service, which processes it as its own controller, in the United States or in other countries. Nothing is sent unless you tap the microphone.

Requesting a copy of the safeguards. You may request a copy of the safeguards in place for these transfers, including the relevant contractual clauses, by emailing privacy@vokabulo.com.

Transfer risk assessment. Before transferring personal data to the United States, we assessed whether local law or government access powers could undermine the protection these safeguards are intended to provide. That assessment takes into account the nature of the data (account details and vocabulary study records, with no special-category data), the sector in which our providers operate, and the transparency information our providers publish. Alongside the contractual safeguards, we apply technical measures including encryption in transit (TLS), encryption at rest (AES-256), isolated per-customer databases with unique credentials, and role-based access controls. We review this assessment periodically, and we will suspend transfers to a provider if we conclude that these measures no longer provide a level of protection essentially equivalent to the one guaranteed within the EEA.

7.3. Security Measures

We implement appropriate technical and organizational measures to protect your data, including:

• Encrypted data transmission (TLS/HTTPS) for all network communications;
• Encryption of data at rest on our backend infrastructure (AES-256);
• Encrypted local storage via Apple's data protection framework (iPhone and iPad app);
• Authentication tokens stored in iCloud Keychain with hardware-backed security (iPhone and iPad app);
• Sign-in tokens kept in secure cookies managed by our authentication provider (web app);
• Backend infrastructure with SOC 2 Type II compliance (Convex);
• Role-based access controls for internal systems;
• Regular security reviews of third-party dependencies.

In the web app, what is stored in your browser (Section 10.4) is only as safe as your browser profile. On a shared computer, sign out when you are done and clear the site's data in your browser settings: signing out removes your recent results, but not the offline copy of your words or the pronunciation audio.

No system is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

8. Data Retention

When you delete your account, we perform a soft deletion immediately and permanently purge all personal data within 30 days, unless longer retention is required by applicable law (e.g., tax or financial regulations).

9. Data Sharing and Disclosure

9.1. We Do NOT Sell Your Data

We do not sell, rent, or trade your personal data to any third party. This applies globally, including under the definitions of "sell" and "share" in the California Consumer Privacy Act (CCPA/CPRA).

9.2. Service Providers (Data Processors)

We share data with the following categories of service providers who process data on our behalf, under contractual obligations to protect your data:

We may change service providers at any time. We will update this Privacy Policy to reflect material changes.

YouTube (Google) is deliberately not in this table. It does not process data on our behalf: if you press play on a video, it receives data as its own controller, as described in Section 10.2.

Stripe is in the table only for what it does for us in our Stripe account. When it sells you Vokabulo Pro, takes the payment and handles taxes, fraud checks, receipts and support, it acts as its own controller (Section 9.6).

9.3. Other Users

New accounts appear on the leaderboard. As long as you do, the following data is visible to other users:

• Your username and profile photo (if set);
• Your streak data and points.

You can hide yourself from the leaderboard at any time in Settings > Privacy (in the web app, Settings > Study).

Words you share by link. If you create a share link for words, anyone who has the link can see those words and the sender name shown with them. The link expires after seven days and is deleted within a day after that.

9.4. Legal Disclosure

We may disclose your data if required to do so by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to: (a) comply with a legal obligation; (b) protect our rights or property; (c) prevent fraud or address security issues; or (d) protect the safety of our users or the public.

9.5. Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity. We will notify you via email and/or prominent notice within the App of any change in ownership or use of your personal data and your choices regarding your data.

9.6. Buying Vokabulo Pro in the Web App (Stripe)

In the iPhone and iPad app you buy Vokabulo Pro from Apple. In the web app at app.vokabulo.com you buy it from Stripe, which sells it to you as the merchant of record under its Link brand ("Sold through Link"). Stripe is then the seller: it takes the payment, charges and pays the VAT or sales tax, sends your receipts and invoices, checks the payment for fraud and handles payment questions, refunds and disputes through Link's support. Your card statement shows "LINK.COM* VOKABULO SUB".

What we send to Stripe. When you choose a plan, our backend opens a checkout at Stripe and gives it the email address of your Vokabulo account (you can change it on the checkout page), your Vokabulo user ID, the plan you chose and the language you use the App in. The user ID is how the purchase finds its way back to your account. Your browser then goes to Stripe's own checkout page.

What happens on Stripe's page. You enter your payment details on Stripe's page, not in the web app. They go to Stripe and never pass through us. Stripe may offer to save them in a Link account; that is your choice and a service of Stripe's. For the sale, the payment, taxes, fraud prevention, receipts and support, Stripe acts as its own controller under its privacy policy at stripe.com/privacy. The payment itself takes place on Stripe's own page; the web app never sees your card or bank details.

What we receive. After you pay, Stripe sends you back to the web app and tells our backend that the purchase is complete. We pass the identifier of your Stripe subscription to our subscription management provider (currently RevenueCat), which records it, and Pro is switched on in your account. In our Stripe account we can see the details of your purchase: the name and email address given at checkout, your country, the plan, the amounts paid and refunded, the tax, and the status of the payment and the subscription. Stripe does not show us your full card number. We use these details to switch Pro on and off, to help you when you contact us, and to refund or change a subscription when you ask us to. We do not copy them into our own database, which stores only whether you have Pro, until when, and whether it is paid.

Legal basis. Passing your details to Stripe and receiving the result is necessary so that you can buy the subscription from Stripe and so that we can provide Vokabulo Pro to you under our Terms (Art. 6(1)(b) GDPR).

Emails from Link. Receipts, invoices, refund confirmations and some subscription notices, such as a reminder before an annual subscription renews, are sent to you by Link, not by us.

Managing and cancelling. You can change or cancel a subscription bought in the web app under Settings > Subscription > Change or cancel your plan, which opens Stripe's customer portal, or in your Link account at link.com. Deleting your Vokabulo account does not cancel it, so cancel it first.

Deleting your data at Stripe. You can ask Link to delete the data it holds about purchases sold through Link and about your Link account. Stripe then also cancels the subscriptions it sold you and deletes that data from our Stripe account as well, except what it has to keep by law.

10. Cookies and Tracking Technologies

10.1. The iPhone and iPad App

The iPhone and iPad app does not use cookies, web beacons, pixel tags, or similar browser-based tracking technologies. What the web app stores in your browser is described in Section 10.4.

The iPhone and iPad app stores data locally on your device using:

• SwiftData (Apple's local database framework): for vocabulary, quiz sessions, and other app data;
• UserDefaults: for app preferences and settings;
• iCloud Keychain: for authentication tokens (cross-device sync).

These are standard, on-device storage mechanisms and do not constitute tracking technologies. They are strictly necessary for the operation of the Service.

10.2. The Website

The Website at www.vokabulo.com sets no cookies of its own and uses no pixel tags or advertising trackers. Reading the Website stores nothing on your device. While you read, the only thing that runs is a small statistics script that counts visits without cookies, described first below. Anything more happens only if you press play on one of our videos, and only for as long as you watch it.

The Website builds no profiles of its visitors. Every visit passes through our host, Cloudflare. Beyond that, four things on the Website process data, and all of them are set out in full below: the website statistics, what happens when you play a video, what happens if you subscribe to our newsletter, and what happens if you send us a business inquiry.

Hosting. The Website is hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, United States, on its worldwide network. When you open a page, Cloudflare's servers process what your browser sends with every request: your IP address, the date and time, the page requested, the page you came from, and your browser and operating system. Cloudflare uses this to deliver the Website and to protect it against attacks and abuse, and keeps security logs for a short period. Requests handled by our own server code, such as the forms described below, are also logged in our Cloudflare account for up to seven days so that we can find and fix errors; after that they are deleted automatically. We do not evaluate any of these logs to identify visitors.

The legal basis is our legitimate interest in running a secure and reliable Website (Art. 6(1)(f) GDPR). Cloudflare acts as our processor. It may process data in the United States; the safeguards are the EU Standard Contractual Clauses in Cloudflare's data processing addendum and Cloudflare's certification under the EU-U.S. Data Privacy Framework (Section 7.2).

Website statistics. To learn which pages are read, which sites send readers to us and how quickly our pages load, the Website uses Cloudflare Web Analytics, a service of our host. It works without cookies:

• on each page, your browser loads a small script from static.cloudflareinsights.com. It sends Cloudflare the address of the page (without anything after a question mark), the page you came from, your browser user agent, from which Cloudflare derives the browser, operating system and type of device, your screen size, and timing measurements of how quickly the page loaded. Like every connection on the internet, the request carries your IP address, which Cloudflare uses to determine your country;
• the script sets no cookies, uses no local storage and stores nothing on your device. Cloudflare creates no identifier for you, neither from your IP address nor from your browser, so it cannot recognise you on a later visit or follow you to other websites;
• we see only totals in our Cloudflare dashboard, such as page views per page, country or referring site. We never see an IP address or anything about an individual visit;
• Cloudflare keeps the individual measurements for seven days and after that only aggregated samples; we can see the totals for up to six months. Cloudflare processes this data on our behalf and does not use it for advertising.

The legal basis is our legitimate interest in knowing which of our content is useful and in keeping the Website fast (Art. 6(1)(f) GDPR). You can object at any time. The simplest way is to block static.cloudflareinsights.com with a content blocker: the Website works exactly the same without it. Cloudflare, Inc. is in the United States and is certified under the EU-U.S. Data Privacy Framework; Section 7.2 sets out the transfer safeguards.

Videos. Some pages show a video that is hosted on YouTube, a Google service. We embed those videos behind a click, which is the whole point of how they are built:

• while you read the page, nothing is requested from Google. The still image you see is a file served from www.vokabulo.com and the play button is our own markup. No connection to YouTube is opened, nothing is stored on your device and nothing is read from it;
• the player is created only when you press play. At that moment your browser connects to YouTube directly and sends it your IP address, your browser user agent, the address of the page the video sits on, and information about your device and screen. YouTube may then store and read cookies and similar identifiers in your browser, including ones it uses for advertising, and if you are signed in to a Google account it can link the playback to that account;
• we receive none of this. We do not learn who watched a video or whether one was watched at all, and playback is not connected to your App account.

The legal basis is your consent (Art. 6(1)(a) GDPR), and pressing play is how you give it, for that video, at the moment you ask for it. If you never press play, no data goes to Google. You can withdraw your consent with effect for the future simply by not starting further videos, and you can delete the cookies YouTube has set through your browser settings.

We are responsible for embedding the videos and for the transmission your click sets off. What Google does with the data afterwards is its own processing, as its own controller, under Google's privacy policy at policies.google.com/privacy. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for visitors in the EEA and Switzerland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States, for everyone else.

Links to our YouTube channel, in the footer and elsewhere on the Website, are ordinary links. They send nothing to Google until you follow them, and once you do, you are on YouTube and Google's own policy applies.

The newsletter signup form. The Website offers a newsletter. Subscribing is entirely optional, it unlocks nothing in the App, and nothing on the Website is gated behind it.

If you subscribe, we process:

• your email address, which is required;
• your first name, only if you choose to give one, and only so that we can greet you by name;
• the language you selected, so that you receive the newsletter in that language.

We use double opt-in. When you submit the form we send a single confirmation email, and you are added to the list only when you click the link in it. This protects you from being signed up by somebody else. If you never confirm, your address is deleted automatically after 90 days. A first name you give is stored as plain text with any markup characters removed, and it is never used for anything but the greeting.

The legal basis is your consent (Art. 6(1)(a) GDPR). You may withdraw it at any time, with effect for the future, using the unsubscribe link at the bottom of every newsletter or by emailing privacy@vokabulo.com. Withdrawing does not affect the lawfulness of what we sent before.

If you have a Vokabulo account, we also send you the newsletter without a separate signup. The legal basis is our legitimate interest in telling the people who use Vokabulo about it (Art. 6(1)(f) GDPR). Every issue has an unsubscribe link, and you can also unsubscribe by emailing privacy@vokabulo.com.

The subscriber list lives in our own backend (currently Convex, in the United States), and we write the messages ourselves. Delivery is handled by our email provider (currently Resend, United States), which receives your address and the message in order to send it. We use no newsletter or email marketing platform, and we never sell, rent or share the list. We do not track whether you open our emails or which links you click in them.

To stop the form being used to send unwanted mail to other people, we limit how often a single internet connection can submit it. For that we store a salted one-way hash of the IP address a submission came from, never the address itself, and the hashes are purged automatically every day.

The business inquiry forms. Companies and other organisations can contact us through inquiry forms on the Website, for example to ask for an offer for their staff or, as a relocation agency, to request a free test code. We may add further forms of this kind; all of them work as described here. Sending any of them is entirely optional.

If you send one, we process:

• your name and your work email address, so that we know whom to answer;
• the name of your company or organisation and the further details the form asks for, such as the number of seats for an offer, so that we can handle your request;
• your message, only if you write one;
• the language of the page you used, so that we can answer in it.

The forms do not write anything to the App's database. When you press send, our server checks the form (see the bot protection below) and passes your details, in a single email, to our email delivery provider (currently Resend, United States), which delivers it to our own mailbox. You receive no email from the form itself, and we do not add your address to the newsletter or to any other mailing list. We answer you from our mailbox like any other business email.

The legal basis is Art. 6(1)(b) GDPR, because answering a request for an offer, a test code or a similar request is a step taken at your request before a contract is entered into. Where you write to us on behalf of your employer, it is also our legitimate interest in answering business inquiries (Art. 6(1)(f) GDPR). We keep the inquiry for as long as we need it to answer and follow it up; if it leads to a contract, the correspondence is kept for as long as commercial and tax law requires. You can ask us to delete it at any time by emailing privacy@vokabulo.com, unless a legal retention duty applies.

Bot protection on the forms. The newsletter signup form and the business inquiry forms are protected by Cloudflare Turnstile, a bot check that replaces a traditional CAPTCHA. It is worth being precise about what it does:

• it loads only when you interact with one of the forms. If you read the page without touching a form, no check runs and nothing is sent to Cloudflare for it;
• when it does run, your browser sends Cloudflare signals including your IP address, browser user agent and TLS fingerprint, which Cloudflare uses to distinguish a person from an automated script;
• the check runs inside a frame served by challenges.cloudflare.com and may store and read information on your device within that frame in order to work. It sets no cookie on www.vokabulo.com, and we do not use Cloudflare's pre-clearance feature;
• Cloudflare does not use these signals to show you advertising, and states that it cannot identify individuals from them. Cloudflare acts as our processor for the check itself, and as controller when it uses aggregated insight to improve its own bot detection, on the basis of its legitimate interest;
• our own server sends Cloudflare the IP address your request arrived from, so that the check can be scored against it. In return we receive only a pass or fail result, never the underlying signals.

The legal basis is our legitimate interest in keeping our forms from being turned into a tool for mailing strangers or flooded with automated submissions (Art. 6(1)(f) GDPR). Cloudflare, Inc. is in the United States; Section 7.2 sets out the transfer safeguards, and Cloudflare is certified under the EU-U.S. Data Privacy Framework.

10.3. Why There Is No Cookie Banner

Under § 25 TDDDG (Germany) and PECR (UK), consent is required to store information on, or gain access to information already stored on, your device, unless doing so is strictly necessary to provide a service you have explicitly requested.

The App's local storage described in Section 10.1 is strictly necessary and is therefore exempt from that consent requirement. The same applies to what the web app stores in your browser (Section 10.4): the sign-in cookies, your settings, the offline copy of your words, answers not yet sent and the pronunciation audio are all needed to provide the service you have asked for, and the automatic bot check on the sign-up page exists only to protect it. When the web app tells our backend which browser and kind of device you opened it on, it reads only technical details of your browser, such as its version and screen size, to keep the web app working on the devices our learners use and to help you when you contact support. We consider all of this covered by the exemption in § 25(2) No. 2 TDDDG and the equivalent exemption in PECR, so it does not require consent.

Reading the Website stores nothing on your device. The only thing that runs while you read is the statistics script (Section 10.2). It stores nothing, sets no identifier and reads nothing that could recognise you: what it reads are technical details of the page you are viewing, such as its address and how quickly it loaded. We use it only to count visits as totals and to keep the Website fast, and we consider it covered by the exemption in § 25(2) No. 2 TDDDG and by the exemption for statistical purposes in PECR, so it does not require consent. If you prefer it not to run, you can block it, and the Website works the same.

Two further things on the Website can store or read information on your device, and neither of them happens while you are simply reading a page.

The first is the YouTube player (Section 10.2). Nothing is requested from Google until you press play, and that press is your consent under § 25(1) TDDDG and the equivalent PECR provision: given for one video, in the moment you ask for it, and never in advance for videos you may never start. That is precisely why the videos are built this way, and why they need no banner: a banner would ask you about something that has not happened and may never happen. The video in the web app's First Steps tour is built the same way (Section 10.4).

The second is the bot check on the newsletter signup form and the business inquiry forms (Section 10.2), which may store and read information on your device while it runs. It runs only when you use one of those forms, it exists solely to establish that a person and not a script is submitting it, and it is therefore strictly necessary to provide a service you have explicitly requested. It falls under the exemption in § 25(2) No. 2 TDDDG and the equivalent exemption in PECR, and does not require consent.

For these reasons, neither the iPhone and iPad app, the web app nor the Website asks you to accept cookies.

10.4. The Web App

The web app at app.vokabulo.com is the same service as the iPhone and iPad app, in your browser. It uses no advertising or tracking cookies. The only statistics are the cookie-free visit counts described under "Statistics" below, the same ones the Website uses. Like the iPhone and iPad app, it keeps on your device what it needs to work, in this case in your browser.

What it stores in your browser

None of this is used to recognise you on other websites or for advertising. Signing out removes your recent results. The copy of your words and the pronunciation audio stay until you clear the site's data, so on a shared computer, clear it in your browser settings after you sign out.

Installing the web app. You can add the web app to your home screen or install it from your browser. It then opens in its own window and uses the same storage in your browser. It sends no push notifications: notifications such as study reminders exist only in the iPhone and iPad app.

Signing up. When you create an account in the web app, our authentication provider may run an automatic check, using Cloudflare Turnstile, to make sure that a person and not a script is signing up. It runs only on the sign-up page and only for that purpose.

When you open the web app, it tells our backend, at most once a minute, the time and what kind of device you are using: the browser and its version, the operating system (with its version on iPhone, iPad and Android), whether it is a computer, phone or tablet, the screen size, the language of the web app, and whether you opened it as an installed app. We use this to keep the web app working and to help you when you contact support; to count how many people open Vokabulo each day and week, on iPhone and iPad and in the browser (our own statistics, which never leave our backend); and to time our emails to how long ago you last used Vokabulo. We keep the time of your last visit for each platform (iPhone and iPad, and web), the device details from your most recent visit, and running counts of sign-in checks; earlier visits are not stored one by one. The record is deleted with your account. The legal basis is our legitimate interest in a web app that works reliably on your device, in knowing how many people use Vokabulo and in timing our emails sensibly (Art. 6(1)(f) GDPR).

Dictation. You can dictate words, describe a Scene by voice and, in hands-free study, answer by voice. For this the web app uses the speech recognition built into your browser. Your browser asks for your permission before the microphone is used, and the microphone is on only while you dictate. Most browsers do not recognise speech on your device but send the audio to their maker's online service: Chrome, for example, sends it to Google, and Edge to Microsoft. That service returns the text, and the text is all the web app receives, just as if you had typed it. The browser maker processes the audio as its own controller under its own privacy policy, not on our behalf. Dictation is never required; you can always type.

The video in the First Steps tour. The last card of the First Steps tour shows a video about Vokabulo that is hosted on YouTube. It works like the videos on the Website (Section 10.2): until you press play, the still image comes from the web app itself and nothing is sent to Google. Pressing play loads the player from youtube-nocookie.com, and from then on everything Section 10.2 says about the videos applies, including that pressing play is your consent.

Buying Vokabulo Pro in the web app is described in Section 9.6. The payment itself takes place on Stripe's own page; the web app never sees your card or bank details.

Hosting. The web app is hosted by Cloudflare, like the Website. When you use it, Cloudflare's servers process what your browser sends with every request: your IP address, the date and time, the address requested, the page you came from, and your browser and operating system. Cloudflare uses this to deliver the web app and to protect it against attacks and abuse, and keeps security logs for a short period. Requests handled by the web app's server code are also logged in our Cloudflare account for up to seven days so that we can find and fix errors; after that they are deleted automatically. The legal basis is our legitimate interest in running a secure and reliable web app (Art. 6(1)(f) GDPR). Cloudflare acts as our processor; Section 7.2 sets out the transfer safeguards.

Statistics. Like the Website, the web app uses Cloudflare Web Analytics to count, as totals, how often it is opened, from which browsers and countries, and how quickly it loads. It works exactly as described in Section 10.2: your browser loads a small script from static.cloudflareinsights.com, which sends Cloudflare the address of the screen you are on (without anything after a question mark), the page you came from, your browser user agent, your screen size and timing measurements of how quickly the screen loaded. Your IP address, which every connection carries, is used by Cloudflare only to determine your country. The script sets no cookies and stores nothing in your browser, Cloudflare creates no identifier for you, and the measurements are not linked to your Vokabulo account: Cloudflare sees the address of a screen, never what you enter or study there, and we see only totals, never who opened the web app. Cloudflare keeps the individual measurements for seven days and after that only aggregated samples, processes them on our behalf and does not use them for advertising. The legal basis is our legitimate interest in knowing how the web app is used and in keeping it fast (Art. 6(1)(f) GDPR). You can object at any time by blocking static.cloudflareinsights.com with a content blocker: the web app works exactly the same without it.

11. Your Data Protection Rights

You have the following rights regarding your personal data. The specific rights available to you depend on your location.

11.1. Rights Available to All Users

Regardless of your location, you can:

• Access your data: View your account information, vocabulary, and learning data within the App at any time.
• Correct your data: Edit your profile, vocabulary, and other content directly in the App.
• Delete your account: Use Settings > User Account > Delete Account, in the iPhone and iPad app or in the web app, to permanently delete your account and all associated data. Deleting your account does not cancel a subscription, so cancel it first: in your Apple account if you bought it in the iPhone and iPad app, or as described in Section 9.6 if you bought it in the web app.
• Export your data: Use the export feature in language pair settings to download your vocabulary data.
• Control notifications: Enable or disable push notifications in your device settings (the web app sends no push notifications).
• Control leaderboard visibility: Toggle leaderboard participation in Settings > Privacy (in the web app, Settings > Study).
• Revoke permissions: Disable microphone and speech recognition access in your device settings or, for the web app, in your browser's site settings.

11.2. Additional Rights Under EU/EEA Law (GDPR)

If you are in the EEA, you also have the right to:

• Restriction of processing (Art. 18): request that we limit how we process your data;
• Data portability (Art. 20): receive your data in a structured, commonly used, machine-readable format;
• Object to processing (Art. 21): object to processing based on legitimate interests;
• Withdraw consent (Art. 7(3)): withdraw consent for optional features at any time, without affecting the lawfulness of processing based on consent before withdrawal;
• Lodge a complaint with your local supervisory authority (see Section 14).

We will respond to GDPR rights requests within one month, extendable by two further months for complex requests.

11.3. Additional Rights Under German Law

• All rights under Section 11.2 apply.
• Under § 34 BDSG, you have the right to obtain information about data stored about you.
• Under § 35 BDSG, you have the right to correction, deletion, and restriction of processing.

11.4. Additional Rights Under Italian Law

• All rights under Section 11.2 apply.
• You may lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it).
• Under the Codice della Privacy (D.Lgs. 196/2003, as amended by D.Lgs. 101/2018), you may seek judicial remedy before the ordinary courts.

11.5. Additional Rights Under French Law

• All rights under Section 11.2 apply.
• You may lodge a complaint with the CNIL (www.cnil.fr).
• Under the Loi Informatique et Libertés (Loi n° 78-17), you have the right to define directives regarding the storage, deletion, and communication of your personal data after your death (Article 85).

11.6. Additional Rights Under Spanish Law

• All rights under Section 11.2 apply.
• You may lodge a complaint with the Agencia Española de Protección de Datos (AEPD) at www.aepd.es.
• Under Title X of the LOPDGDD, you benefit from digital rights including the right to digital security and the right to digital education.

11.7. Additional Rights Under Brazilian Law (LGPD)

If you are in Brazil, you have the following rights under Article 18 of the LGPD:

• Confirm the existence of data processing;
• Access your personal data;
• Correct incomplete, inaccurate, or outdated data;
• Anonymize, block, or delete unnecessary or excessive data;
• Request portability of your data to another service provider;
• Delete personal data processed with your consent;
• Obtain information about third parties with whom data is shared;
• Obtain information about the possibility and consequences of denying consent;
• Withdraw consent at any time.

Encarregado (Art. 41 LGPD): requests and questions about your data can be sent to privacy@vokabulo.com.

Response Time: We will respond within 15 days, extendable by an additional 15 days.

You may file complaints with the ANPD at www.gov.br/anpd.

11.8. Additional Rights Under UK Law

• You have the same rights as listed in Section 11.2, as adapted under the UK GDPR and Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025).
• You may lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk.
• The age of digital consent in the UK is 13.

11.9. Additional Rights Under US Law

(a) California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information is collected, used, and disclosed;
• Delete your personal information;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of personal information;
• Limit the use of sensitive personal information;
• Non-discrimination for exercising your rights.

We do not sell or share your personal information as defined by the CCPA/CPRA. We do not use sensitive personal information for purposes other than providing the Service.

Categories of Personal Information Collected (preceding 12 months):

Categories of Personal Information Sold or Shared: None. We have not sold or shared any personal information in the preceding 12 months.

Categories of Personal Information Disclosed for Business Purposes:

We do not knowingly collect personal information from consumers under 13.

(b) Other US State Privacy Laws

If you reside in Virginia, Colorado, Connecticut, Texas, or another state with a comprehensive privacy law, you may have rights including access, correction, deletion, data portability, and the right to opt out of targeted advertising, profiling, and the sale of personal data. We honor applicable rights. Contact us at privacy@vokabulo.com.

(c) COPPA

The App is not directed at children under 13 in the United States. We do not knowingly collect personal data from children under 13. If we learn we have collected such data, we will promptly delete it. If you believe a child under 13 has provided us with personal data, contact us at privacy@vokabulo.com.

12. Children's Privacy

12.1. Vokabulo is meant for learners aged 13 and over. Nobody under 13 may create an account. If you are under 16, or under the age of digital consent where you live if that is lower, you need the consent of a parent or guardian (see Section 4 of our Terms and Conditions).

12.2. We do not use advertising networks of any kind. The Website counts visits only as totals, without cookies or identifiers, and builds no profiles. The bot check on our newsletter signup form and our business inquiry forms is used only to tell a person from an automated script, never for advertising or for profiling you across sites. The videos on the Website load nothing from Google until someone presses play, which is why we build them that way: a child who reads a page is not exposed to Google at all. Once a video is started, Google's own processing applies, as described in Section 10.2. The web app counts visits the same cookie-free way and has no advertising either, and its First Steps video is built the same way. This keeps the Service a safe environment for all users, including younger learners.

12.3. Account Creation: Most features need an account. We do not knowingly collect personal data from children under 13. If you are under 16, or under the age of digital consent where you live if that is lower, please create an account only with the consent of a parent or guardian.

12.4. If we learn we have collected personal data from a child without appropriate consent, we will promptly delete it. If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us at privacy@vokabulo.com.

13. AI-Powered Features and Data Processing

13.1. The App uses third-party AI language models to power the AI Translate Service (automatic translation and context generation) and Scenes (situation-based vocabulary generation).

13.2. What we send to AI providers: Only the text content necessary to generate the requested output (e.g., a word to translate or a situation description). We do not send your username, email, user ID, or any other personal identifiers to AI providers.

13.3. Multiple providers: We use multiple AI providers and may change, add, or replace providers at any time. The choice of AI provider is an implementation detail that does not affect your privacy rights.

13.4. No training on your data: We do not permit AI providers to use your prompts or outputs to train their models. We use API-level access with data processing agreements that prohibit training use.

13.5. EU AI Act (Article 50): Content generated by AI is disclosed as AI-generated within the App interface. We comply with the transparency obligations of the EU AI Act regarding the labeling and marking of AI-generated content.

13.6. Automated Decision-Making (GDPR Art. 22): The App uses automated processing for spaced repetition scheduling (determining when to show a word for review) and AI-generated content suggestions. These automated processes do not produce legal effects or similarly significant effects on you. All AI-generated content is presented as suggestions that you review and choose to accept or discard.

14. Supervisory Authorities

If you believe we have violated your data protection rights, you have the right to lodge a complaint with the competent supervisory authority:

15. California-Specific Disclosures (CCPA/CPRA)

This section provides additional disclosures required under California law:

15.1. Right to Know: See Section 11.9(a) for categories of personal information collected.

15.2. Right to Delete: You may delete your account and personal data through Settings > User Account > Delete Account, or by emailing privacy@vokabulo.com.

15.3. Right to Correct: You may correct your personal information through the App, or by emailing privacy@vokabulo.com.

15.4. Right to Opt Out of Sale/Sharing: We do not sell or share your personal information. No opt-out mechanism is required.

15.5. Sensitive Personal Information: We collect email addresses as account identifiers. We do not use sensitive personal information for purposes other than providing the Service.

15.6. Financial Incentives: We do not offer financial incentives related to the collection of personal information.

15.7. Shine the Light (Cal. Civ. Code § 1798.83): We do not share personal information with third parties for their direct marketing purposes.

15.8. Accessibility: This Privacy Policy is provided in a format accessible on mobile devices and is designed for readability.

15.9. How to Submit Requests: Email privacy@vokabulo.com or use the in-app account management features. We will verify your identity before fulfilling requests. We will respond within 45 days, extendable by an additional 45 days for complex requests.

15.10. Authorized Agents: You may designate an authorized agent to make requests on your behalf. Agents must provide a signed written authorization or power of attorney.

16. Germany-Specific Provisions

16.1. TDDDG Compliance (§§ 19–26)

The App constitutes a "digital service" under the TDDDG. We comply with the following:

• § 25 TDDDG: We do not store information on or access information from your device beyond what is strictly necessary for the provision of the Service. The local storage mechanisms described in Section 10.1 are exempt from the consent requirement, as they are strictly necessary for providing the Service you explicitly requested. The bot check on our newsletter signup form and our business inquiry forms may store and read information on your device while it runs, but only when you use one of those forms and only to establish that it is being submitted by a person. That is strictly necessary for a service you have explicitly requested and is exempt under § 25(2) No. 2 TDDDG. The cookieless statistics script on the Website (Section 10.2) stores nothing on your device and reads only technical details of the page you are viewing, such as how quickly it loaded, solely to count visits as totals; we rely on the same exemption for it, as Section 10.3 explains. The web app's storage in your browser and the technical details it reads when you open it (Section 10.4) are strictly necessary in the same way, and we rely on the same exemption for them.
• § 19 TDDDG: We implement appropriate technical and organizational measures to protect your personal data.
• § 20 TDDDG: We apply additional safeguards for the processing of minors' data.

16.2. BDSG Compliance

We comply with the Federal Data Protection Act (BDSG), including:

• § 26 BDSG: Employee data processing (applicable to our internal operations only);
• § 34 BDSG: Right to information;
• § 35 BDSG: Right to correction, deletion, and restriction;
• § 38 BDSG: We are not required to appoint a Data Protection Officer and have not appointed one. Privacy questions can be sent to privacy@vokabulo.com.

17. France-Specific Provisions (CNIL Compliance)

In accordance with the CNIL's recommendations on mobile applications (April 2025):

17.1. Privacy by Design: Data protection has been integrated into the App from the earliest design stages. We minimize data collection to what is strictly necessary for each feature.

17.2. Data Processing Map: We maintain a comprehensive record of all processing activities, including identification of data types, purposes, legal bases, recipients, and retention periods, as set out in this Privacy Policy.

17.3. SDK Transparency: All third-party SDKs integrated into the App and their data processing activities are disclosed in Section 3.5 and Section 9.2. In the web app, the only third-party code is the libraries of our authentication provider (Clerk), our backend provider (Convex) and our subscription management provider (RevenueCat); on the sign-up page only, Cloudflare Turnstile, which our sign-in provider Clerk loads to keep out bots; and, only once you press play, the YouTube player. No SDK processes data for purposes that are not strictly necessary for the Service without your explicit consent.

17.4. Role Clarification: Except where stated below, Tathros GmbH is the data controller for the processing described in this policy. Our service providers (Clerk, Convex, AI providers, Google for text-to-speech, RevenueCat, Cloudflare for hosting the Website and the web app, website statistics and bot protection, Resend) act as data processors under appropriate data processing agreements. Cloudflare additionally acts as a controller in its own right when it uses insight from bot checks to improve its detection systems, as described in Section 10.2. Stripe acts as our processor for the records in our Stripe account, and as a controller in its own right when it sells Vokabulo Pro in the web app (Section 9.6). For the videos on the Website and in the web app, Google is not our processor: it acts as its own controller, and only from the moment a visitor presses play (Section 10.2). Browser makers' speech services act as their own controllers when you dictate in the web app (Section 10.4).

17.5. Post-Mortem Directives (Art. 85 Loi Informatique et Libertés): French users have the right to define directives regarding the storage, deletion, and communication of their personal data after death. You may submit such directives to privacy@vokabulo.com.

18. Italy-Specific Provisions

18.1. Processing of your personal data complies with the Codice della Privacy (D.Lgs. 196/2003, as amended by D.Lgs. 101/2018) and the GDPR.

18.2. In accordance with the Garante's guidelines on cookies and tracking tools (Provvedimento n. 229/2021), we confirm that the App does not use cookies or tracking technologies beyond the strictly necessary storage on your device or, for the web app, in your browser described in Sections 10.1 and 10.4, and that the Website itself uses no cookies, profiling tools or analytics identifiers, as described in Section 10.2. The statistics script on the Website stores nothing on your device, sets no identifier and produces only aggregated figures for this Website, so under those guidelines it is treated like a technical tool. Only two further technologies on the Website can store or read information on your device, and neither runs while you read a page. The embedded YouTube player runs only when you press play, and that press is your consent. The bot check on the newsletter signup form and the business inquiry forms is a technical tool, used solely for security, and under those guidelines it does not require consent.

18.3. You have the right to lodge a complaint with the Garante per la protezione dei dati personali and to seek judicial remedy before the ordinary courts.

19. Spain-Specific Provisions

19.1. Processing of your personal data complies with the LOPDGDD (Ley Orgánica 3/2018) and the GDPR.

19.2. In accordance with the LSSI-CE (Ley 34/2002), we do not send unsolicited commercial communications. Push notifications are sent only with your explicit consent and can be disabled at any time.

19.3. You benefit from digital rights under Title X of the LOPDGDD, including the right to digital security and the right to digital education.

19.4. You may file complaints with the AEPD at www.aepd.es.

20. Brazil-Specific Provisions (LGPD)

20.1. We process personal data in accordance with the LGPD (Lei nº 13.709/2018). All processing is based on the legal bases identified in Section 6.2.

20.2. Encarregado (Art. 41 LGPD): Questions about the processing of your personal data, and communications from the ANPD, can be sent to privacy@vokabulo.com.

20.3. International Transfer: Your data is transferred to and stored in the United States. We rely on the standard contractual clauses adopted by the ANPD under Resolução CD/ANPD nº 19/2024, or other appropriate safeguards permitted by Article 33 of the LGPD.

20.4. Data Breach Notification: In the event of a security incident that may create risk or relevant damage to data subjects, we will notify the ANPD and affected individuals within a reasonable timeframe, as required by Article 48 LGPD.

20.5. Consumer Protection: This Privacy Policy complies with the transparency requirements of the Código de Defesa do Consumidor (Lei nº 8.078/1990).

21. United Kingdom-Specific Provisions

21.1. Your data is processed in accordance with the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.

21.2. PECR Compliance: In accordance with the Privacy and Electronic Communications Regulations 2003, we confirm:

• The App does not use cookies or equivalent tracking technologies beyond strictly necessary storage on your device or, for the web app, in your browser (Section 10.4);
• The Website sets no cookies of its own, and reading it stores nothing on your device. While you read, only the cookieless statistics script runs (Section 10.2). It reads only technical details of the page you are viewing, such as how quickly it loaded, solely for statistical purposes that do not significantly affect you, falls under the exemption for statistical purposes added to PECR by the Data (Use and Access) Act 2025, and can be blocked at any time without any effect on the Website. Two further things can store or read information on your device, and neither runs while you read: the embedded YouTube player, which loads only when you press play and rests on the consent that press gives; and the bot check on the newsletter signup form and the business inquiry forms, which runs only when you use one of those forms and is strictly necessary for a service you have requested, and is therefore exempt from the consent requirement;
• Push notifications are sent only with your explicit consent;
• We do not send direct marketing communications without consent.

21.3. International Transfers: Where your data is transferred outside the UK, we rely on UK adequacy regulations or UK International Data Transfer Agreements (IDTAs).

21.4. You may lodge a complaint with the ICO at www.ico.org.uk.

22. Apple App Store and Privacy Labels

22.1. In accordance with Apple's App Privacy requirements, we provide accurate privacy nutrition labels for the App on the App Store. These labels disclose the types of data linked to your identity and the purposes for which data is used.

22.2. Apple processes certain data in connection with App Store transactions, including your Apple ID, purchase history, and device information. Apple's data practices are governed by Apple's Privacy Policy at www.apple.com/legal/privacy.

22.3. Subscriptions bought in the iPhone and iPad app are paid to Apple. Subscriptions bought in the web app are sold and paid through Stripe (Section 9.6). In neither case do we receive your card details.

23. Changes to This Privacy Policy

23.1. We may update this Privacy Policy from time to time. Material changes will be communicated through the App and/or by email at least 30 days before they take effect.

23.2. The "Last updated" date at the top of this policy indicates when it was most recently revised.

23.3. Your continued use of the App after changes take effect constitutes your acceptance of the updated Privacy Policy. Where applicable law requires explicit consent for material changes, we will obtain such consent.

23.4. We encourage you to review this Privacy Policy periodically.

24. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Tathros GmbH, Zum Quellenpark 38, 65812 Bad Soden am Taunus, Germany

Email: privacy@vokabulo.com, Website: www.vokabulo.com

For data protection inquiries specifically: privacy@vokabulo.com.

For Brazilian users (Encarregado): privacy@vokabulo.com.

Appendix: Summary Table of Data Processing Activities