Privacy Policy

Privacy at Vocabloot

This privacy policy applies to the Vocabloot mobile application ("Application", previously published under the name Snavo) developed by Nirmal Jeffrey Bernard Wilson ("Service Provider") as a Freemium service, and to the Vocabloot tester waitlist website (together, the "Service"). This service is provided "AS IS".

How you use the Application

Vocabloot uses anonymous Firebase Authentication. You use the Application anonymously — there is no sign-up, and we do not require or collect your email address, name, or any other personally identifying information. A unique anonymous user identifier (Firebase UID) is generated to associate your subscription and usage with your device.

What data does the Application collect?

• Photos you snap. When you snap an object, the photo is first processed on your device. A cropped image of the object is then transmitted via our backend (Firebase Cloud Functions) to OpenAI for object recognition. We do not store your photos on our servers — they are processed in real time and discarded. Your snap photos and the words you've learned are saved locally on your device (in the Application's gallery); they are not uploaded to Firebase Storage or any other server-side storage.
• Firestore profile record. Platform (iOS/Android), first-seen date, and the app version you most recently used, stored against your anonymous identifier. It contains no name, email address, or profile photo.
• Server-side usage counters. To enforce snap quotas and fair-use limits, our backend keeps per-account counters: your daily snap count, daily analysis-attempt count, any unused rolled-over allowance, the day of your first snap, and a lifetime snap count. These are retained while your account exists. We use your account identifier to enforce fair-use limits, prevent abuse, and control costs.
• Short-lived analysis records. For each analysis request the backend keeps a 24-hour deduplication record containing a cryptographic fingerprint (hash) of the request and the analysis result (the generated word entry) so a retried request is not billed or processed twice. These records never contain your photo and expire automatically after 24 hours.
• Rate-limit counters. Request counters keyed by a one-way hash of your network address (your raw IP address is never stored), kept briefly to protect the service from abuse and deleted automatically.
• Anonymous user identifier (Firebase UID). A unique ID generated per device or account.
• Device information. OS version, device model, app version, locale.
• Crash logs and analytics. Crashes, screen views, and feature usage events via Firebase.
• Purchase history. Subscription state and transaction events via RevenueCat.
• Waitlist email address (website only). If you join the Vocabloot tester waitlist on our website, we store the email address you provide in Cloud Firestore so we can send you a one-time transactional email with your app install link.

How is AI used and which provider processes my data?

Vocabloot uses a third-party AI provider to identify the objects you snap and to generate the corresponding word, translations, and example sentences in your target language:

• OpenAI — after on-device processing, the cropped photo of the object you snapped is sent via our backend (Firebase Cloud Functions) to OpenAI's API (a GPT-4.1-mini class model) for object recognition and to generate learning content such as translations and example sentences. Per OpenAI's API data usage policies, data submitted through the API is not used to train OpenAI's models. We do not store the transmitted photo on our servers — it is discarded once the recognition result is returned to your device.

All photo transmission is encrypted in transit (HTTPS / TLS).

OpenAI acts as a data processor. It is contractually bound (through a Data Processing Agreement, and for EU/UK users, Standard Contractual Clauses) to protect your data to the same standard described in this policy, to use it only to perform the requested processing, and not to train its models on it. We confirm that this provider offers the same or equivalent data protection that we provide.

We ask for your explicit consent before any photo is sent. The first time you open Vocabloot, a dedicated screen explains that your photo is sent to OpenAI for recognition and asks you to agree. You must agree before the Application's AI features are used, and no photo is transmitted before you do. Sending your snapped photo for recognition is what makes Vocabloot's core snap-and-learn feature work — there is no way to identify an object or generate its translation without this transmission. You can withdraw your consent at any time by not using the snap feature and by contacting us to delete any data tied to your user identifier; note that snapping is the Application's core function, so most of the Application's functionality will be unavailable without it.

AI-Generated Content Disclosure (EU AI Act)

Vocabloot uses AI to identify the objects in your photos and to generate the words, example sentences, translations, and definitions shown to you. These are AI-generated outputs, not verified translations from a professional linguist or lexicographer. AI-generated content may occasionally be inaccurate, incomplete, or mislabel what is in your photo. Treat AI-identified objects, translations, and example sentences as a learning aid, not as an authoritative source for professional, academic, or safety-critical language use.

Information collected automatically

In addition to the categories above, the Application may collect anonymized telemetry: type of mobile device, mobile operating system, app version, and information about how you use the Application. This is used to improve the product.

Does the Application collect precise real-time location?

No. Vocabloot does not access GPS or precise device location, and does not request location permissions.

Third parties that may receive your information

The Application and website use third-party services that have their own privacy policies. Below are the providers and links:

• Google Play Services
• Firebase (Authentication, Firestore, Cloud Functions, Analytics, Crashlytics, App Check)
• OpenAI — object recognition and AI-generated learning content
• RevenueCat — subscription management
• Apple App Store — iOS purchase processing
• Google Play — Android purchase processing
• Apple iCloud — optional wordbook backup on iOS, stored in your own iCloud account
• Google Drive — optional wordbook backup on Android, stored in your own Google account
• Loops.so — sends the transactional waitlist install-link email (website only)
• Google reCAPTCHA Enterprise — bot protection on the waitlist form (website only)

The Service Provider may disclose information:

• as required by law (e.g. subpoena or similar legal process);
• when disclosure is necessary in good faith to protect rights, safety, investigate fraud, or respond to a government request;
• with trusted service providers operating on our behalf, who do not have an independent right to use the data and are bound by this privacy policy.

Device permissions Vocabloot requests

• Camera — required to snap photos of objects for on-device processing and AI-based recognition. Only a cropped image of the recognized object is transmitted for processing, and it is not retained on our servers.
• Photo library — optional. Used only when you choose to select an existing photo from your device instead of taking a new one, or to save a snap or word card to your device's photo library.
• Notifications — optional. Used only to send you local reminders about words you have already saved, scheduled on your own device at the time you choose. These reminders are generated on your device; we do not operate a push server and no reminder content is sent to us. Declining notification permission does not affect any other part of the Application.

You can revoke any of these permissions at any time from your device's Settings.

Backing up to your own cloud (optional)

Vocabloot can keep a copy of your wordbook (your saved words, their photos and doodles) in your own cloud account, so a new phone or a reinstall does not lose them. Backup is off until you turn it on in Settings or during setup, and you can turn it off at any time. Nothing is uploaded to Vocabloot's servers; the Service Provider does not operate a backup server.

• iOS — iCloud. Should you choose to turn backup on, Vocabloot saves your wordbook to a private database in your iCloud account (Apple CloudKit). Your data only travels to Apple's servers and follows the security guidelines in Apple's platform security documentation. Your data is never available to the Vocabloot team: it is stored in an iCloud storage area that is only available to devices signed in with your Apple Account. We cannot see the data in your private iCloud database, nor do we want to.
• Android — Google Drive. Should you choose to turn backup on, you pick a Google account and grant Vocabloot access to its application data folder only (the drive.appdata scope). This is a hidden folder that only the Vocabloot app can read or write; it does not appear in the Google Drive interface, and Vocabloot cannot see any of your other Drive files. The backup lives in your Google account, is subject to your Google storage quota, and we cannot read it. Vocabloot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• What the backup contains. The words you have saved, their translations and example sentences, your snap photos and cutouts, and your doodles. It does not contain your anonymous identifier, usage counters or purchase history.
• Restore. When you set up Vocabloot on a new device signed in to the same Apple or Google account, the Application offers to restore that backup. Restoring only adds words to the device; it never deletes anything.
• Your cloud provider's terms apply. If you use a backup service integrated with the Application (iCloud or Google Drive), that provider will receive the information you back up, under its own privacy policy and terms. Deleting the backup, or turning backup off and removing the files from your account, is under your control through that provider.

Sharing your wordbook. You can export your wordbook as a file (a .vlbackup package containing the same content as a backup) and share it with anyone you choose through your device's share sheet, and open a file someone shares with you. The file goes only to the recipients you pick; it never passes through Vocabloot's servers.

Widgets. The home-screen and lock-screen widgets read a copy of your wordbook stored on your device. Nothing leaves your device for a widget to work.

Your rights under GDPR (EU/UK users)

If you are located in the European Economic Area or the United Kingdom, you have the following rights regarding your personal data:

• Right of access — request a copy of your data.
• Right to rectification — request correction of inaccurate data.
• Right to erasure ("right to be forgotten") — request deletion of your data.
• Right to data portability — request your data in a machine-readable format.
• Right to object — object to processing of your data.
• Right to restrict processing — request that we limit how we use your data.
• Right to withdraw consent at any time.

To exercise these rights, contact nirmal.jeffrey@vaazhstudios.com. The lawful basis for our processing is the performance of a contract (the snap-and-learn service you have requested) and, for the waitlist, your consent when submitting the form.

International data transfers

Our backend operates on Google Cloud and our AI provider (OpenAI) is based in the United States. Personal data of EU/UK users is transferred to the United States under Standard Contractual Clauses (SCCs) approved by the European Commission, as part of our agreements with these processors.

Your rights under CCPA / CPRA (California users)

If you are a California resident, you have the right to know what personal information we collect, the right to request deletion of your personal information, and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information for cross-context behavioral advertising. Contact nirmal.jeffrey@vaazhstudios.com to exercise these rights.

Opt-out rights

You can stop all collection of information by uninstalling the Application using the standard uninstall process on your device or via the app marketplace; this also removes the snap photos and learned words stored locally on your device. Vocabloot does not require you to create an account, so there is no login to delete; your device is identified only by an anonymous identifier. To have that identifier's server-side records erased — your profile record, your usage counters, your short-lived analysis records, and a deletion request for your subscription record to RevenueCat — or to request deletion of any other data tied to your user identifier, or of your waitlist email address, contact nirmal.jeffrey@vaazhstudios.com.

Data retention

The Service Provider retains account and profile data only as long as you use the Application and for a reasonable time thereafter. Photos are not retained on our servers — they are processed in real time and discarded once the recognition result is returned; your snap photos and learned words remain on your device until you delete them or uninstall the Application. Server-side usage counters are retained while your anonymous identifier is in use and are deleted on request. Analysis deduplication records expire automatically after 24 hours; hashed rate-limit counters expire automatically within days. Waitlist email addresses are retained until you install the Application or request deletion. Automatically collected analytics are retained for up to 14 months, the maximum user-level retention Google Analytics offers, and may then be aggregated. To request deletion of your data, contact nirmal.jeffrey@vaazhstudios.com.

Backups you turn on are stored in your own iCloud or Google account and remain there until you delete them or turn backup off and remove the files; the Service Provider holds no copy and cannot delete them for you. Exported .vlbackup files remain wherever you shared them.

Children's privacy

The Service Provider does not knowingly solicit data from or market to children under the age of 16. The Application is not directed at anyone under 16. The Service Provider does not knowingly collect personally identifiable information from children under 16. If we discover that a child under 16 has provided personal information, we will immediately delete it from our servers. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact nirmal.jeffrey@vaazhstudios.com so that we can take appropriate action.

How is your information kept secure?

The Service Provider provides physical, electronic, and procedural safeguards to protect information we process and maintain. We limit access to authorized parties who need that information to operate, develop, or improve the Application. Photo transmission is encrypted in transit (HTTPS/TLS). API keys for third-party providers are stored in Google Cloud Secret Manager, are managed server-side, and are never embedded in the Application or present on your device. Firebase App Check (App Attest on iOS, Play Integrity on Android) is used to validate that requests come from the genuine Vocabloot app. Although we endeavor to provide reasonable security, no system can prevent all potential security breaches.

Changes to this Privacy Policy

This Privacy Policy may be updated from time to time. The Service Provider will notify you of any changes by updating this page with the new Privacy Policy. You are advised to consult this Privacy Policy regularly. Continued use of the Application is deemed approval of all changes.

Consent

By using the Application, you consent to the Service Provider processing your information as set forth in this Privacy Policy.

Contact

If you have any questions about privacy while using the Application, please contact nirmal.jeffrey@vaazhstudios.com.