1. Data Controller

The controller of your personal data is the owner of the VocabuLit application – Krzysztof Krysztofczyk (contact: [email protected]).

2. What data we collect

• Account data – email, nickname, preferred language.
• Learning materials – books, words, sentences, translations, and your answers during study sessions.
• Technical data – server logs; page-load timings of the study screen (time, account and book identifiers, page address, durations); sign-in events with the IP address and browser identification (user agent), and for failed attempts the login that was entered. Anonymous visit statistics are collected with Cloudflare Web Analytics (see sections 5 and 6).
• Firefox extension data – the optional VocabuLit New Tab extension may read account data and learning materials listed above through your existing vocabulit.com session. The extension does not add new categories of account data.

3. Purposes and legal basis for processing

• Performance of an online services contract (Art. 6(1)(b) GDPR).
• Statistics and service improvement – our legitimate interest (Art. 6(1)(f) GDPR).
• Sending email notifications (password reset, updates) – legitimate interest.
• Accounting or tax obligations (if payments are introduced) – legal obligation.
• Securing accounts and the Service (sign-in records) – our legitimate interest (Art. 6(1)(f) GDPR).

4. Data retention period

We retain your account data until you delete your account. An account with no sign-in for 6 months may be deleted. Data in backups is erased within 30 days after deletion.

Technical data (page-load timings and sign-in events) is deleted automatically after 90 days.

5. Data sharing

• Hosting: Microsoft Azure (application and database).
• Cloudflare – the network and security provider all traffic to vocabulit.com passes through; it processes your IP address and technical request data. Cloudflare also provides Cloudflare Web Analytics, our visit statistics (see section 6).
• Email delivery: Brevo – your email address and the content of the messages we send (account confirmation, password reset).
• AI/translation provider (OpenAI) – only the content of words and sentences submitted for translation; never your email.
• Google – only if you choose to sign in with Google: we receive from Google and store your email address, your name (used as your nickname), your Google account identifier, your language setting and the address of your profile picture.
• Sentry – error monitoring; technical details of errors, configured not to attach personal data such as IP addresses or cookies.
• YouTube (youtube-nocookie.com) – embedded videos, loaded only after you allow “Embedded video” in Cookie settings.
• Public authorities – only when required by law.

6. Cookies and analytics

The Service's own cookies are used for:

1. keeping you signed in (session cookie) and protecting forms (CSRF cookie),
2. remembering your chosen interface language,
3. allowing the optional VocabuLit Firefox extension to authenticate book-list requests using your existing vocabulit.com session cookie.

Your cookie choices are stored in your browser's local storage. Cloudflare may set strictly necessary security cookies. Embedded YouTube videos are loaded only after you allow them in “Cookie settings”; YouTube may then set its own cookies. For anonymous visit statistics we use Cloudflare Web Analytics. It does not use cookies; a script in the page sends Cloudflare the page address, the referring page, the browser and device type and page-loading performance. We use the results only in aggregate, to see which pages are used and how fast they load. You can change your choices at any time through the “Cookie settings” link at the bottom of every page, and manage cookies in your browser settings.

7. Your rights

• access to your data,
• rectification,
• erasure (“right to be forgotten”),
• restriction of processing,
• objection to processing based on legitimate interest,
• complaint to the Data Protection Authority.

8. Security

We use TLS encryption, regular backups, and restrict data access to authorized personnel only.

9. Changes to this document

Updates to this policy are published on this page; significant changes are communicated by email. This update (October 15, 2026) brings the policy in line with the tools actually in use: it removes Google Analytics and Hotjar, which are not used, names the providers we work with, and adds the 90-day retention of technical data. It also states that accounts with no sign-in for 6 months may be deleted.

10. VocabuLit Firefox extension

VocabuLit offers an optional Firefox extension called “VocabuLit New Tab”. The extension replaces Firefox's new-tab page with vocabulary from one of your VocabuLit books.

What the extension accesses.

• When you ask it to list your books, the extension reads your VocabuLit book list using the login session already present in your Firefox browser for vocabulit.com.
• When you choose a book for the extension, VocabuLit may create or reuse a wallpaper link for that book so the extension can load the selected vocabulary wallpaper.
• For the selected book, the extension loads the wallpaper data: book title, up to three words, translations, and example sentences.

What the extension stores locally.

• the selected wallpaper link,
• the most recently loaded words as a local cache,
• display preferences such as sentence visibility and refresh interval.

This local data is stored inside Firefox extension storage on your device. Removing the extension removes its locally stored extension data.

What the extension does not do.

• It does not store your VocabuLit password.
• It does not store your VocabuLit session cookie.
• It does not send extension data to third parties.
• It does not include analytics, tracking, or telemetry of its own.
• It does not work on or read websites other than vocabulit.com.

In Firefox's data-collection declaration, the extension declares the “Website content” data type because it reads VocabuLit book-list and wallpaper content associated with your account through your existing vocabulit.com session.

11. Contact

To exercise your rights or ask questions, contact us at [email protected].