Privacy Policy
Last updated: November 2026
This Privacy Policy explains what the VocabLoom website ("the Website", "we", "us") collects, why, who we share it with, and the choices you have. It covers the Website: creating an account, choosing a plan, paying and managing your account. Your use of the VocabLoom mobile app is covered by the app's own Privacy Policy.
1. Who we are
The Website is operated by the developer of VocabLoom. For any privacy question, or to use any right described below, contact us at: support@vocabloom.xyz
2. What we collect
2.1 Account
- Your email address and display name, and a unique account identifier issued by Firebase Authentication.
- If you sign in with Google or Apple we receive the basic profile that provider returns. We never receive your Google or Apple password.
- Passwords for email accounts are handled entirely by Firebase Authentication. We never see them.
2.2 Subscription and payment
- We store your plan and its status (for example active or canceled), its renewal or end date, and where it was bought.
- When you pay on the Website you are taken to a checkout page run by Polar. Polar collects your payment details, billing details and tax information. We never receive or store your card number.
- So that your payment can be matched to your account, we send Polar your account identifier and email, the plan you chose, and any discount code you enter. Polar sends us back your subscription status: new, renewed, canceled, ended or refunded.
2.3 Technical data
- Our servers and our hosting providers process technical data such as your IP address, browser type and request logs, to deliver the Website, keep it secure and prevent abuse.
2.4 Browser storage and cookies
- Firebase Authentication keeps your sign-in session in your browser's storage so that you stay signed in. It is needed for sign-in to work.
- We do not use advertising or analytics cookies on the Website.
- The checkout page is operated by Polar and may use its own cookies under Polar's own terms.
2.5 Messages you send us
- If you write to us, we keep your message and our reply so that we can help you and follow up.
3. Where your data is stored
| Data | In your browser | On our servers |
|---|---|---|
| Account (email, name, identifier) | No | Yes |
| Sign-in session | Yes, until you sign out | No |
| Plan and subscription status | No | Yes |
| Card and billing details | No | No: held by Polar |
| Support messages | No | Yes |
4. How we use your data
- To create and secure your account.
- To show your plan and unlock it in the app when you sign in with the same account.
- To take payments, apply discount codes, and handle cancellations and refunds, through Polar.
- To prevent abuse and keep the Website secure.
- To answer your questions and give support.
We do not use your data on the Website for advertising or to build advertising profiles, and we do not sell it.
5. Who we share it with
| Provider | What it receives | Why |
|---|---|---|
| Polar (payment partner and merchant of record) | Your email, account identifier, chosen plan, discount code, and the payment and billing details you enter on its page | To take payment, handle sales tax and VAT, send receipts, and process cancellations, refunds and card disputes |
| Google Firebase (Authentication) | Your email, name and sign-in method | Sign-in |
| Google Firebase (Firestore) | Your account identifier and subscription record (plan, status, end date) | Storing the entitlement the app reads to unlock your plan |
| RevenueCat | Your account identifier and your store purchase status (app purchases only) | Handling subscriptions bought in the app |
| Railway (hosting) | Your account identifier, email and subscription status | Running our backend that receives payment notifications |
| Our website hosting provider | Technical request data such as your IP address | Serving the Website |
Polar is the merchant of record: it sells the subscription to you and handles payment, taxes and refunds, under its own terms and privacy policy. If you choose Google or Apple to sign in, they share the basic profile described in section 2.1. These providers process data on our behalf or under their own terms. We may also disclose information where the law requires it, or to protect the rights and safety of our users or ourselves.
6. The VocabLoom app
You sign in to the app with the same account you use here. The app's Privacy Policy describes what the app collects and how it uses it, including your learning data. When you delete your account on the Website, the account and the data we hold for it in the app's service are deleted as described in section 7.
7. Retention and deletion
- We do not delete your data automatically over time. We keep your account and subscription record until you delete your account.
- Delete your account at any time from the Account page (Delete my account). If you have an active subscription, cancel it first. This deletes your account, your learning data stored in our service and your subscription records from our servers, and your sign-in account.
- Polar and we may keep limited records that the law requires, such as invoices and tax records, for as long as it requires.
- We keep support messages for as long as needed to help you and to handle any follow-up.
8. Your rights
Depending on where you live, you may have the right to access, correct, export or delete your data, to object to or restrict some processing, and to withdraw your consent. Write to support@vocabloom.xyz and we will reply within the period the applicable law requires. You may also complain to the data protection authority in your country.
9. Age
The Website is for people aged 13 or over (the lowest age we can accept by law without a parent's consent). We do not knowingly collect data from anyone under 13. If you believe a child has given us information, write to support@vocabloom.xyz and we will delete it. Where the law in your country sets a higher age for consenting to data processing, the Website is for people who have reached it.
10. Security
Data is encrypted in transit between your browser and our servers, and every request to your account is authenticated. Sign-in is handled by Firebase Authentication, and card details are handled only by Polar. No system is perfectly secure, and we cannot guarantee absolute security.
11. International transfers
Our providers may process data in countries other than yours, including the United States and other countries. Where required, we rely on appropriate safeguards for those transfers.
12. Changes to this policy
We update this policy when the Website changes in a way that affects your privacy, and we change the "Last updated" date above. Material changes are announced on the Website.
13. Contact
VocabLoom: support@vocabloom.xyz