Who we are
VocabFlow is built and operated by Caracal Codeworks Inc., a Canadian federal corporation based in Saskatchewan, Canada. In this policy, “we”, “us” and “our” mean Caracal Codeworks Inc.; “VocabFlow”, “the app” and “the service” mean the VocabFlow iOS application.
You can reach us at contact@caracalcw.com for any question about this policy or your data.
The short version
- No ads, ever. We don't show them and we don't sell, rent, or trade your information.
- No behavioural tracking. We don't follow you across other apps or websites.
- No marketing email. We only send essential account mail like password resets.
- You must be 13 or older to use VocabFlow.
- Words you translate leave the app. They're sent to DeepL, and DeepL may keep and learn from them — so please don't type anything personal.
What you type matters
VocabFlow is a free-text app: you decide what goes in it. Anything you enter as a word or phrase may be sent to the third-party services listed below in order to translate or define it.
Please don’t enter personal information. Names, addresses, phone numbers, passwords, health details, or anything you wouldn’t want a third party to hold — keep them out of VocabFlow. Save the app for the vocabulary you actually want to learn.
What we collect
When you create an account:
- Email address — to create the account, sign you in, and send essential account mail.
- Display name — to personalise the app.
- Password — never stored in readable form. It is hashed by Supabase Auth, and we cannot see it.
As you use the app:
- The words and phrases you add, and their translations.
- Learning progress — completion status, review history, study streaks, daily goals.
- Your language preferences (source and target language).
- Your notification preferences — frequency, timing, and whether they're on.
- Basic technical details needed to run the app: device type, iOS version, app version, time zone (for scheduling reminders), and network connectivity status.
What we don’t collect. VocabFlow contains no analytics SDK, no advertising SDK, and no third-party crash-reporting service. We have not integrated Firebase, Crashlytics, Sentry, or any comparable tool. If you have turned on iOS’s own “Share With App Developers” setting, Apple may give us aggregated crash statistics — that is a setting you control in iOS, and you can turn it off at any time.
Who your data goes to
These are every third-party service VocabFlow communicates with. There are no others.
Supabase — hosts your account and your saved vocabulary. Servers are in the United States. Receives your email, display name, hashed password, saved words, and learning progress. Supabase privacy policy.
DeepL — translates the words and phrases you look up. Receives only the text you choose to translate. VocabFlow currently uses DeepL’s free API tier. Under DeepL’s own privacy policy, text submitted through the free tier may be retained for a limited period and used to train and improve their translation models, and DeepL advises against submitting personal data through it. This is why the warning above matters. DeepL privacy policy.
Datamuse — supplies related words and suggestions. Receives only the word being looked up. Datamuse API.
Free Dictionary API (dictionaryapi.dev) — supplies English definitions, examples, and pronunciations. Receives only the word being looked up. dictionaryapi.dev.
Wordnik — supplies additional definitions and word data. Receives only the word being looked up. Wordnik privacy policy.
Apple — handled entirely on your device. Reminder notifications are scheduled locally, pronunciation is spoken locally by iOS, and app settings are stored locally. None of this sends your vocabulary to Apple or to us.
How we use your information
- To run the app: translate and define words, sync your vocabulary between your devices, schedule the reminders you asked for, and track your progress and streaks.
- To manage your account: sign you in, reset your password, and contact you about something essential to your account or the security of the service.
- To fix and improve the app: diagnose problems you report to us and decide what to build next.
What we never do
- Advertising — no ads, and your data is never used for ad targeting.
- Selling data — we never sell, rent, or trade your personal information to anyone.
- Behavioural tracking — we don’t track what you do outside VocabFlow.
- Marketing email — we do not send promotional or marketing messages of any kind, including new-feature announcements. The only email you will receive from us is essential account mail: password resets, email verification, and security notices.
Security
- All traffic between the app and our servers is encrypted in transit using HTTPS/TLS.
- Passwords are hashed by Supabase Auth and are never stored in readable form.
- Database access is restricted by Row Level Security policies, so your rows are reachable only by your own authenticated session.
- API credentials are kept out of the shipped app binary.
We describe only the measures actually in place. No method of transmission or storage is completely secure, and we can’t guarantee absolute security.
Where your data is stored, and for how long
On your device: app preferences, learning goals, notification settings, a cached copy of your vocabulary for offline access, and sync timestamps. Deleting the app removes these.
In the cloud: your account and vocabulary are stored in a Supabase PostgreSQL database in the United States, protected by Row Level Security, and kept for as long as your account exists.
When you delete your account — from Profile → Delete Account in the app — your account and its associated data are removed from our database immediately as part of that request, not on a delayed schedule. Deletion is permanent and we cannot restore the data afterwards. Backup copies are cycled out in the ordinary course. We may retain a limited record where the law requires it.
Your choices and rights
These apply to everyone who uses VocabFlow, wherever you are.
- See your data — all your vocabulary and progress is visible in the app. Email us for a copy of everything associated with your account.
- Correct it — edit your display name, preferences, and any saved word directly in the app.
- Delete it — remove individual words at any time, or delete your whole account from Profile → Delete Account.
- Control notifications — adjust them in the app, or switch them off entirely in iOS Settings.
- Withdraw consent — stop using optional features, or delete your account. Note that we can’t provide the service without the account data listed above.
To make any of these requests, email contact@caracalcw.com. We aim to respond within 30 days.
Age requirement
You must be at least 13 years old to use VocabFlow. This applies wherever you are. The app is not directed to children, and is rated 13+ on the App Store in most regions — a few countries run their own classification systems that have no 13+ tier, so their stores show the nearest equivalent. The 13 year minimum applies regardless.
We do not knowingly collect personal information from anyone under 13. If you are a parent or guardian and believe your child has created an account, email us at contact@caracalcw.com and we will delete the account and its data promptly.
Canadian privacy law
We handle personal information in line with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). In practice: we collect personal information only for the purposes set out in this policy, we ask before using it for a new purpose, you may withdraw consent subject to legal and contractual limits, and you may request access to what we hold about you.
Caracal Codeworks Inc. is accountable for the personal information under its control. If you have a concern we haven’t resolved, you may contact the Office of the Privacy Commissioner of Canada at 1-800-282-1376.
Anti-spam (CASL). We do not send commercial electronic messages. The only email we send is essential account mail you cannot opt out of while holding an account — password resets, email verification, and security notices — because they are required to operate the account you asked us to create.
Changes to this policy
We may update this policy as the app changes or the law does. The date at the top always reflects the current version. If a change materially affects how we handle your information, we’ll tell you in the app or by email before it takes effect.
Contact
Caracal Codeworks Inc.
Saskatchewan, Canada
contact@caracalcw.com