This Privacy Policy explains how Sofiia Triasko ("we", "us", "our") collects, uses, discloses, and protects your information when you use the VocaBoost mobile application (the "App"), the website at vocaboost.app (the "Website"), and the VocaBoost Chrome extension (the "Extension").
Please read this policy carefully. By downloading, accessing, or using the App, you acknowledge that you have read and understood it. Our Terms of Use also apply.
Contact: hello@vocaboost.app
1. Data controller
The data controller responsible for your personal data is:
Sofiia Triasko
Website:
https://vocaboost.app
Email:
hello@vocaboost.app
We are an independent developer, not a company, based in Ukraine. The App's API and primary database run on Railway in the United States. Transactional email is sent from noreply@vocaboost.app via Resend. If you have any question about this policy or about how your data is handled, email us at the address above and we will respond within 30 days.
2. Summary of what we collect
| Category | Examples | Linked to you? | Used for tracking? |
|---|---|---|---|
| Contact info | Email address; optional display name | Yes | No |
| User content | Words, sentences, translations, practice answers, optional voice clips; in-app feedback messages; page URL and title when you save a word from the Extension | Yes | No |
| Identifiers | Account ID, analytics device ID, Expo push token, session tokens | Yes | No |
| Usage data | Screens viewed, features used, session length, session replays of the App UI | Yes | No |
| Purchases | Subscription status, product identifier, store, expiry; receipts via RevenueCat | Yes | No |
| Diagnostics | Crash logs, performance data, device model, OS and app version | Yes | No |
| Coarse location | Country or region inferred from IP address | Yes | No |
We do not collect: precise GPS location, contacts, photo or camera library access, health data, financial account details, or browsing history. The Chrome extension does not read pages in the background; it only sends a word you choose to save, its surrounding sentence, and that page's URL and title. We never receive your payment card number, billing address, or Apple ID / Google password.
We do not sell your personal data. We do not use your data for third-party advertising. We do not track you across other companies' apps or websites, and we do not use Apple's Identifier for Advertisers (IDFA). We therefore do not request App Tracking Transparency permission.
3. App Privacy details (App Store)
The following matches the data types declared in our iOS privacy manifest and in App Store Connect. All types below are linked to your identity. None are used for tracking.
| Apple data type | What that is in VocaBoost | Purposes |
|---|---|---|
| Email Address | Account email, including Apple private relay addresses | App Functionality |
| Name | Optional display name; name from Apple or Google if you share it | App Functionality |
| User ID | VocaBoost account ID; RevenueCat app user ID | App Functionality, Analytics |
| Device ID | Amplitude device identifier; Expo push token | App Functionality, Analytics |
| Purchase History | Subscription status, product, store, expiry | App Functionality |
| Other User Content | Library words, sentences, translations, AI feedback; on-screen content in session replays | App Functionality, Analytics |
| Audio Data | Optional microphone clips (max 20 seconds) for spoken practice | App Functionality |
| Product Interaction | Screens, buttons, practice and paywall events | Analytics |
| Crash Data | Sentry crash reports | App Functionality |
| Performance Data | Launch time, errors, and related diagnostics | App Functionality |
| Coarse Location | Country or region from IP (host / analytics) | Analytics |
We do not collect advertising data, precise location, contacts, photos, health or fitness data, or financial account numbers. Payments are processed by Apple or Google. This policy, together with the in-app account-deletion control, is intended to satisfy Apple App Store Review Guidelines 5.1.1 (privacy) and 3.1.2 (subscription disclosures in the Terms of Use).
4. Information we collect
4.1 Information you provide
Account information. When you create an account we collect your email address and a password (stored only as a one-way hash — we cannot read the password back). You may optionally provide a display name. If you sign in with Apple or Google, we receive an authentication token and, depending on your choices, your name and email. If you use Sign in with Apple and choose Hide My Email, we receive only Apple's private relay address. We never receive your Apple or Google password.
Learning content. Words you add to your library, context sentences, translations you enter or accept, sentences you write during practice, AI feedback and scores stored with those attempts, your target and native languages, app interface language, self-reported proficiency, daily goal, streak, and spaced-repetition schedule. Words saved from the Chrome extension also store the source page URL and title.
Voice recordings. If you choose to use voice input, we capture a short audio clip (maximum 20 seconds) of the sentence you speak. See section 6.
In-app feedback. Messages you send through the App's feedback screen, plus a snapshot of app version, platform, subscription tier, and active learning language so we can answer in context. We may email a copy of new messages to our support inbox.
Communications. If you email us, we retain your message and address to respond. If you create an account we may send a welcome email. If you request a password reset, we send a one-time code. We may also send product emails about your learning (for example a streak milestone) or about VocaBoost Pro. These are sent via Resend from noreply@vocaboost.app. Email us to opt out of non-essential product mail. Password-reset and security messages cannot be opted out of while you have an account.
4.2 Information collected automatically
Learning progress. Review history and scheduling data for each word, practice scores, streak counts, session timestamps, and weekly counts of graded AI checks (used to apply the free-tier limit of 5 checks per UTC week) and the number of words in your library (used to apply the free-tier cap of 5 words).
Usage analytics. Screens viewed, features used, actions taken (such as adding a word or completing a practice session), session duration, app version, device model, and operating system version. We use Amplitude for this, including Amplitude Session Replay (currently sampled on all sessions), which reconstructs what appeared on screen in the App so we can debug usability problems. Replays may include learning content visible on those screens. They are not used for advertising.
Approximate location. Derived from your IP address at country or region level only, by our host and analytics providers. We do not collect GPS or precise location data. The App does not request location permission.
Diagnostics. Crash reports and performance data via Sentry, used to identify and fix technical problems. These reports can include device information, app version, and the state of the App at the time of a crash.
On-device storage. Access and refresh tokens, an onboarding flag, and a "has account" flag are stored in the device secure store (Keychain on iOS). Amplitude also stores a first-open timestamp and session count in on-device storage.
4.3 Information from third parties
Purchases. When you subscribe, Apple (or Google Play on Android) provides a purchase receipt and subscription status to RevenueCat, which forwards entitlement updates to our servers. We never receive your payment card number, billing address, or other payment credentials — these are handled entirely by the store.
Sign-in providers. Apple and Google confirm that you control the account you used to sign in.
4.4 Website (vocaboost.app)
The marketing site at vocaboost.app is a static page. It does not create an account. We use Amplitude on the Website to measure visits, locale, scroll depth, and which buttons people tap (for example App Store). Amplitude stores a device-scoped identifier in the browser (cookie or local storage) to recognise sessions. This is not used for advertising and is not shared with advertising networks. The Website also loads fonts from Google Fonts.
4.5 Chrome extension
The Extension is a capture tool for the same VocaBoost account. It never scans pages in the background. Only when you click "Add to VocaBoost" (toolbar or right-click menu) do we send: the selected word or phrase, the surrounding sentence, the page URL, the page title, and your auth token. Sign-in uses email/password or Google. Session tokens are stored locally in the extension; uninstalling it removes those tokens but does not delete words already in your library.
5. How we use your information
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Create and maintain your account, keep you signed in | Email, name, authentication identifiers, hashed credentials, hashed refresh tokens | Performance of a contract |
| Provide core learning functionality | Learning content, progress data, language settings | Performance of a contract |
| Generate AI feedback, translations, example sentences, and pronunciation audio | Sentences you write, optional voice audio, target words | Performance of a contract |
| Look up definitions, examples, and dictionary pronunciations | Individual words you add or look up | Performance of a contract |
| Schedule spaced repetition reviews and apply free-tier limits | Progress, review history, library size, weekly AI-check counts | Performance of a contract |
| Process and restore subscriptions | Purchase receipts, account identifier, RevenueCat customer ID | Performance of a contract |
| Send practice reminders and other push notifications | Device notification token | Your consent (you can revoke in device settings) |
| Send password-reset, welcome, and other product emails | Email address, first name when you have given one | Performance of a contract; legitimate interest for optional product mail |
| Answer in-app feedback | Your message, email, app version, platform, language, subscription tier | Performance of a contract |
| Understand usage and improve the App | Usage analytics, session replays, diagnostics | Legitimate interest |
| Detect and prevent abuse or fraud | Usage patterns, account identifiers, security logs | Legitimate interest |
| Comply with legal obligations | As required | Legal obligation |
Where we rely on legitimate interest, we have assessed that our interest in operating and improving the App does not override your rights and freedoms. You may object to this processing at any time by contacting us, including analytics and session replay.
6. Voice recordings
Voice input is an optional feature. The App works fully with text input alone.
- Microphone access is requested only when you first activate voice mode. You may decline, and you may revoke permission at any time in your device settings.
- Recordings are limited to a maximum of 20 seconds.
- Audio is transmitted over an encrypted connection to our API, then to Google's Gemini API for transcription and language assessment.
- We do not keep the audio file after processing. Only the resulting text transcript, score, and feedback are stored with your learning history.
- We do not use your voice to identify you, build a voiceprint, or for any purpose other than transcribing and assessing the sentence you spoke.
Separately, the App can play computer-generated speech of example sentences (Google Gemini text-to-speech). That audio is synthesised from text, not recorded from you. We may cache those clips on our servers and reuse them for the same word and sense so other learners hear the same example. Cached clips are not linked to your account.
7. Artificial intelligence processing
The App uses Google's Gemini API (Google AI Studio / Gemini Developer API) to assess your sentences, generate example sentences and feedback, look up meanings when dictionaries miss, and synthesise pronunciation audio.
- Sentences you write, target words, and optional voice recordings are sent to Google for processing.
- Google acts as our service provider. We do not use this content to train our own models. Google's handling of API content is governed by the Google Gemini API / Google AI terms that apply to our account. Those terms restrict use of customer content for advertising. Whether Google may use API content to improve its models depends on the Gemini API plan in force for our account at the time of the request.
- AI output is generated automatically and may contain errors. It does not constitute professional language instruction. See our Terms of Use.
- No automated decision-making produces legal or similarly significant effects for you. AI scoring affects only your review schedule, feedback, and free-tier limits inside the App.
8. Who we share data with
We share data only with service providers who help us operate the App. Each is used only for the purposes described here. We do not sell personal data and we do not share it for cross-context behavioural advertising.
| Provider | Role | Data shared | Location |
|---|---|---|---|
| Railway (PostgreSQL) | Application hosting and primary database | Account data, learning content, progress, hashed credentials, subscription mirror, push tokens | US |
| Google (Gemini API) | AI assessment, translation, text generation, text-to-speech | Sentences, voice audio, target words, generated example text | US |
| Amplitude | Product analytics and session replay | Usage events, device information, account identifier, on-screen App content in replays | US |
| Sentry | Crash reporting and performance monitoring | Diagnostic logs, device information, account identifier when known | US |
| RevenueCat | Subscription management | Purchase receipts, subscription status, account / app user identifier | US |
| Apple | App Store payments, Sign in with Apple, push delivery (APNs) | Purchase transactions, authentication, device push address | US / global |
| Sign in with Google; Android push (FCM) when applicable | Authentication token; push token | US / global | |
| Expo | Push notification routing; optional over-the-air updates | Expo push token, app version / update metadata | US |
| Resend | Transactional and product email | Email address, name, and the message content (welcome, reset codes, product mail, internal feedback alerts) | US |
| Google Fonts | Typefaces on the Website | IP address of Website visitors | US |
| Free Dictionary API, Wiktionary, Tatoeba, Datamuse | Definitions, example sentences, pronunciations, spelling hints | The individual word being looked up (not your account) | Varies |
| YouGlish / YouTube | In-app pronunciation videos you choose to open | The word you look up; those sites may collect their own data | Varies |
We may also disclose data if required by law, to enforce our Terms of Use, or to protect the rights, safety, or property of our users or ourselves.
If the App is ever transferred to another owner, your data may be transferred as part of that transaction. We will notify you before this happens and before your data becomes subject to a different privacy policy.
9. International data transfers
We are based in Ukraine. The App is hosted in the United States, and several of our service providers process data in the United States and elsewhere. This means personal data of users in the European Economic Area, the United Kingdom, or Switzerland is transferred outside those regions.
Where personal data of individuals in the European Economic Area, the United Kingdom, or Switzerland is transferred outside those regions, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses incorporated into our agreements with service providers, or an adequacy decision where one applies (including, where relevant, the EU–US Data Privacy Framework for certified providers).
You may request further information about these safeguards by contacting us.
10. How long we keep your data
| Data | Retention period |
|---|---|
| Account and learning data | While your account remains active |
| Voice recordings you make | Deleted immediately after processing; not retained |
| Cached text-to-speech example clips (not your voice) | Until replaced or the cache is cleared; not tied to your account |
| Usage analytics and session replays | Up to 24 months, then deleted or fully anonymised |
| Crash and diagnostic reports | Up to 90 days in Sentry, unless needed longer to finish a fix |
| In-app feedback | While your account remains active, then deleted with the account |
| Support and product email | Up to 24 months after the last message |
| Password-reset codes | Until used or expired (minutes), then the hashed record is removed with the account |
| Purchase records | As required for tax, accounting, and store rules |
| Data after account deletion | Deleted from our production database within 30 days |
Backups may persist for a short additional period before being overwritten in the normal backup rotation.
Deleting your VocaBoost account does not cancel an App Store or Google Play subscription. You must cancel auto-renewal in your store account settings. Apple or Google may keep purchase records independently of us.
11. Your rights
Depending on where you live, you have some or all of the following rights:
- Access — obtain confirmation of whether we process your data, and a copy of it
- Rectification — have inaccurate or incomplete data corrected
- Erasure — have your personal data deleted
- Restriction — limit how we process your data in certain circumstances
- Portability — receive your data in a structured, machine-readable format
- Objection — object to processing based on legitimate interest, including analytics and session replay
- Withdraw consent — withdraw consent for notifications or microphone access at any time, without affecting processing already carried out
- Complain — lodge a complaint with your local supervisory authority
How to exercise your rights
Delete your account in the App (Apple Guideline 5.1.1(v)): open Profile (the account tab) and tap Delete account. This permanently removes your account and associated personal data from our production systems. Cached dictionary / text-to-speech clips that are not tied to your account may remain.
For all other requests: email hello@vocaboost.app. We will respond within 30 days. We may ask you to verify your identity before acting on a request.
We do not charge for these requests unless they are manifestly unfounded or excessive.
If you are in California or another US state with a privacy law
You have the right to know what personal information we collect and how we use it, to request deletion, to request correction, and to not be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined under the CCPA/CPRA (we do not use your data for cross-context behavioural advertising). We do not use or disclose sensitive personal information for purposes that require a right to limit under the CPRA. We do not use audio to identify you. To exercise your rights, contact us at the address above. You may use an authorised agent if you provide written permission and we can verify both identities.
12. Security
We take reasonable measures to protect your data, including:
- Encryption of data in transit using TLS
- Encryption of data at rest in our database
- Access controls limiting who can view user data
- Passwords stored as one-way hashes; refresh tokens stored as hashes
- Authentication handled by established providers (Apple, Google) or our own hashed-password flow
- Rate limiting on authentication and API routes
- Regular review of our infrastructure and dependencies
No method of transmission or storage is completely secure. If a breach affects your personal data and is likely to result in a risk to your rights, we will notify you and the relevant supervisory authority without undue delay, as required by law.
You are responsible for keeping your account credentials secure and for activity that occurs under your account.
13. Children
The App is not directed at children. You must be at least 13 years old (16 in the European Economic Area) to use it, as set out in our Terms of Use.
We do not knowingly collect personal data from children below these ages. If you are a parent or guardian and believe your child has provided us with personal data, contact us at hello@vocaboost.app and we will delete it promptly.
14. Cookies, identifiers, and tracking
The mobile App does not use cookies. Our analytics provider uses a device-scoped identifier to distinguish sessions and understand feature usage. This identifier is not used for advertising and is not shared with advertising networks.
The Website uses Amplitude, which may set a cookie or local-storage identifier in your browser for the same analytics purposes. Google Fonts may receive your IP address when a page loads. We do not use the Website for advertising or cross-site tracking.
We do not engage in tracking as defined by Apple's App Tracking Transparency framework, and therefore do not request tracking permission.
If you open an in-app pronunciation video (YouGlish / YouTube), that third-party player may set its own cookies or identifiers under its own policy. That is not App Tracking by us.
15. Device permissions
The App may ask for the following permissions. All are optional.
- Microphone — only when you start spoken practice. Used to capture the sentence you speak. Declining does not block text-based learning.
- Notifications — only if you enable practice reminders. Used to send Expo / APNs push messages. You can turn these off in the App or in system settings.
The App does not request access to your camera, photo library, contacts, calendar, precise location, motion sensors for tracking, or tracking across other companies' apps.
16. Third-party links
The App may open YouGlish (which embeds YouTube clips) so you can hear how a word is used in real video. Those sites are not operated by us. If you open them, their own privacy policies apply, and they may set cookies or collect data according to those policies. We are not responsible for their content or privacy practices.
17. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in the App, in our practices, or in applicable law.
If we make material changes, we will notify you within the App or by email before the changes take effect. The "Last updated" date at the top of this page indicates when this policy was last revised.
Your continued use of the App after changes take effect constitutes acceptance of the revised policy.
18. Contact
If you have questions, concerns, or requests regarding this Privacy Policy or your personal data:
Sofiia Triasko
Website:
https://vocaboost.app
Email:
hello@vocaboost.app
If you are in the European Economic Area or the United Kingdom and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority. In Ukraine, you may also contact the Ukrainian Parliament Commissioner for Human Rights.