Privacy Policy.

English Vocabulary: 8000 Words (“the app”) is made by ALAZ Software (“ALAZ”, “we”, “us”), a software studio. ALAZ is the controller of the personal data processed through the app. You can reach us at hello@alaz.pro; our office addresses are listed on alaz.pro.

This policy explains what the app collects, why, who receives it, how long it is kept and what you can do about it. It covers the iOS and Android app. Our website has its own privacy policy.

Your account. You can use the app as a guest: we then create an anonymous account with a random ID and no personal details. If you choose to save your progress, we also store your email address, the sign-in method you used (email and password, Google or Apple) and your name if you enter it or Apple or Google shares it. Passwords are handled by Firebase Authentication; we never see them.

Your learning profile. The answers you give when you start (name, native language, level, goals, weekly word target, daily minutes), your time zone and when you were last active.

Your progress. The words you have swiped (learned or to review), their review schedule and dates, daily counters (words learned, swipes, points, games played, time of day you studied) and your streak.

Purchases. Whether you have Premium, which plan, and its renewal and expiry dates, through RevenueCat. Payment details stay with Apple or Google; we never receive card numbers.

Usage and diagnostics. In release versions the app sends usage events to Firebase Analytics (for example onboarding answers, screens opened, swipes, games, paywall views, notification permission choices and errors) together with your account ID and a few properties (guest or registered, free or Premium, native language, level, goals, app language). Events never contain your name, email or the words you type; for a search only its length is sent. Crash reports (stack trace, device model, operating system and app version, account ID) go to Firebase Crashlytics. Firebase App Check checks with Apple or Google that requests come from a genuine copy of the app. Collection of the advertising ID is turned off and the app doesn't track you across other companies' apps or websites.

Messages you send us. If you write to us from the app's feedback form, we receive your message, your email and name if you have them, whether you are a guest, the app language and your platform. Emails you send us are kept in our mailbox.

What stays on your device. An offline copy of your progress, your settings and notification preferences, game scores and badges, and the word of the day shown in the home screen widget. Reminders are scheduled on the device as local notifications; no notification server is involved.

The app doesn't access your camera, microphone, photos, contacts or location.

• To run the app: keep your progress, sync it across devices and reinstalls, and restore it when you sign in.
• To provide Premium: check your subscription and unlock its features.
• To remind you to study, when you allow notifications.
• To keep the app working and secure: find and fix crashes, prevent abuse and fraudulent requests.
• To improve the app: understand which features, games and screens help people learn, in aggregate.
• To answer your messages and support requests.

Where the GDPR, the UK GDPR or Türkiye's KVKK applies, we rely on these legal bases:

• Contract — to provide the app, your account, your progress and Premium as described in the terms.
• Legitimate interests — to keep the app secure and stable, prevent fraud and understand usage in order to improve it. You can object at any time (see “Your rights”).
• Consent — for notifications, which you can turn off in the app or in your device settings.
• Legal obligation — to keep purchase records required by tax and accounting law and to answer lawful requests.

• We don't sell or rent your personal data.
• We don't use it for advertising and we don't share it with data brokers.
• We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

We use a few service providers to run the app. They process data on our behalf, under contracts that limit them to that purpose:

• Google Firebase — sign-in (Authentication), database (Cloud Firestore), usage analytics (Analytics), crash reports (Crashlytics), App Check, Remote Config and Cloud Functions (Google LLC / Google Ireland Ltd.)
• RevenueCat — manages subscriptions and tells the app whether you have Premium (RevenueCat, Inc., USA)
• Apple and Google — sign-in with Apple or Google, and payment for subscriptions bought in the App Store or Google Play

Apart from them, we disclose data only when the law requires it (for example a valid court order), to protect our rights or users' safety, or to a successor if ALAZ or the app is sold or merged, in which case this policy keeps applying to your data.

Your account, profile and progress are stored in Google Cloud Firestore in the European Union (multi-region). Firebase Authentication, Analytics and Crashlytics, and RevenueCat, may process data in the United States and other countries where they operate. This may be outside the country where you live. When data leaves the European Economic Area, the United Kingdom, Switzerland or Türkiye, we rely on the safeguards the law provides, such as the European Commission's adequacy decisions (including the EU–US Data Privacy Framework for certified providers) and standard contractual clauses in our providers' data processing terms.

• Account, profile and progress: until you delete your account, or until you reset your progress. Guest accounts that haven't been used for 60 days are deleted automatically, with their progress.
• Analytics data: up to 14 months; crash reports: up to 90 days.
• Purchase records: as long as tax and accounting law requires (Apple, Google and RevenueCat keep their own records under their policies).
• Feedback messages and emails: up to 24 months after we answer them.
• Data on your device: until you delete the app or its data.

Depending on where you live (for example under the GDPR, the UK GDPR, Türkiye's KVKK, Brazil's LGPD or US state privacy laws such as the CCPA), you can ask us to:

• tell you what data we hold about you and give you a copy;
• correct it, or delete it;
• export it in a portable format;
• restrict or object to how we use it, and withdraw any consent you gave.

In the app you can edit your name in Profile, erase your progress with Settings › Reset All Progress, and delete your account with Settings › Delete Account (how). Notifications can be turned off under Profile › Notifications.

For anything else, email hello@alaz.pro from the address on your account, with “English Vocabulary: 8000 Words” in the subject. We may need to confirm it's you. We answer within 30 days and don't charge for it. You can also complain to your local data protection authority (in Türkiye, the KVKK Authority at kvkk.gov.tr; in the UK, the ICO). California residents: we don't sell or share personal information as those terms are defined by the CCPA, and we won't treat you differently for using your rights.

Data travels over encrypted connections (TLS) and is encrypted at rest by our cloud providers. Access is limited by per-user rules, so one user can't read another's data, and only the people at ALAZ who need it for support or operations can reach it. No system is perfectly secure; if a breach affects your data, we'll tell you and the authorities as the law requires.

The app isn't directed at children under 13, and we don't knowingly collect personal data from them. In some countries the age to consent to data processing on your own is higher (up to 16 in parts of the EU); below it, a parent or guardian has to agree. If you believe a child has given us data, write to hello@alaz.pro and we'll delete it.

When we change how the app handles data, we update this page and the date at the top. If a change is significant, we also tell you in the app before it takes effect.

Questions about this policy or your data: hello@alaz.pro. Help with the app: English Vocabulary: 8000 Words support.