The short version
We store your account, your learning progress, and the diagnostics that tell us when the app is broken. We do not sell your data, we do not run advertising, and we do not build profiles for anyone else. You can delete everything from inside the app, permanently, without asking us.
Who we are
Wordhabit is operated by Ethiel Adiassa. For anything on this page, including access and deletion requests, write to [email protected].
What we collect
Data you give us
- Email address — to create your account, verify it, sign you in, and send account emails such as verification and password resets.
- Name or username — to address you in the app.
- Learning preferences — the language you are learning, your level, and the themes you picked, which decide which words you are shown.
Data the app produces as you use it
- Learning progress — which words you have seen, how you graded yourself, your mastery levels, your review schedule, your streak and your badges. This is the product: it is what lets the app show you a word again at the right moment.
- Usage events — which screens you open and which actions you take, so we can tell which parts of the app help and which do not.
- Crash and performance diagnostics — the technical detail of an error when the app fails, including device model and operating system version.
- Push notification token — an identifier issued by your device, used only to deliver your daily reminder. It is stored only if you allow notifications.
What we never collect
No contacts, no location, no photos, no microphone, no advertising identifier, no browsing activity outside the app. When the app saves an image to your gallery — sharing a word card — it writes the file to your device and sends us nothing.
Why we are allowed to hold it
Under the GDPR, account data and learning progress are processed to perform our contract with you: without them the app cannot function. Diagnostics and usage analytics rest on our legitimate interest in keeping the app working and improving it. Push notifications rest on your consent, which your device asks for and which you can withdraw at any time in your system settings.
Who processes it
We use a small number of service providers. They process data on our instructions and may not use it for their own purposes.
| Provider | What it handles | Where |
|---|---|---|
| Fly.io | Application hosting and database | Canada |
| Google Firebase | Push notification delivery | United States |
| Sentry | Crash and performance diagnostics | United States |
| PostHog | Product analytics | United States |
| Resend | Account emails | United States |
Transfers outside the European Economic Area rely on the European Commission's Standard Contractual Clauses.
Wordhabit generates its vocabulary using OpenAI. This happens on our side, ahead of time, to build a shared library of words. No user data is ever sent to OpenAI — not your account, not your progress, not the words you struggle with.
How long we keep it
- Account and learning data — for as long as your account exists.
- After deletion — purged within 30 days, including from backups as they rotate.
- Crash diagnostics — 90 days.
- Usage events — 12 months.
Deleting your data
Open Profile → Delete account. Your account is closed straight away and erased 30 days later, which gives you time to change your mind by signing in again. The erasure covers your account, your progress, your badges and your notification token, and we keep no shadow copy.
If you cannot reach the app, email [email protected] from the address on the account and we will do it for you.
Your other rights
If you are in the European Economic Area or the United Kingdom, you may ask for a copy of your data, ask us to correct it, ask us to restrict or stop a particular use, and receive it in a portable format. Write to us and we will answer within one month. You may also complain to your national data protection authority.
Children
Wordhabit is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, write to us and we will remove it.
Security
All traffic between the app and our servers is encrypted in transit. Passwords are stored hashed, never in readable form. Access to the production database is restricted to the operator.
Changes
If we change what we collect or who processes it, we will update this page and change the date at the top. Material changes will be announced in the app before they take effect.