Privacy Policy

How account, learning, moderation, analytics, billing, device, and support data are collected, used, protected, and removed.

Updated October 10, 2026

Controller and contact

The sole establishment operating WordForests in the United Arab Emirates determines how personal data is used for the service and is its data controller. This policy covers the web app, native apps where available, support, billing and safety operations. Contact the operator at support@wordforests.com or through the public contact page.

Account data

The service collects and uses account identifiers, email address, authentication provider details, email-verification state, session records, profile details, preferences, locale settings, and signup legal-acceptance records. This information is used to create and secure accounts, keep preferences in sync, show the right product state, and document the Terms agreement and Privacy Policy acknowledgement given when creating an account. Policy updates do not require existing users to accept again to keep using the service.

Learning, content, and safety data

We use enrollments, answers, review history, progress, preferences, course material and dictionary contributions to provide learning and content features. Public profiles, achievements, leaderboard information and published content can be visible to others according to the relevant visibility controls; an unlisted link can be shared by its recipients. Classroom analytics sharing is subject to the feature's separate consent controls. Reports, blocks, moderation decisions and audit records support safety. Generating audio sends the selected learning text and voice/language options to Microsoft Azure Speech or ElevenLabs. Avoid including personal or sensitive information in text submitted for speech generation.

Billing data

Billing data can include subscription and entitlement status, provider customer and transaction identifiers, checkout sessions, invoices, payment events and refund records. Withdrawal notices also contain your name, receipt email, contract details, statement and handling history. Stripe processes web payments; where native subscriptions are available, Apple or Google processes purchases and RevenueCat helps reconcile access. Payment providers hold payment details under their own privacy terms. New paid purchases are currently disabled; records for earlier purchases or withdrawal requests may still be processed.

Device, usage, and diagnostics

Diagnostics include browser or app platform, version, request metadata, errors, performance information, usage statistics and security logs. Sentry is used for error and performance monitoring. When enabled on the web, Sentry Session Replay records page structure and interactions such as navigation, clicks and scrolling in sampled sessions and sessions with errors to reproduce problems. Replay is configured to mask text and inputs and block media, and diagnostic payloads are filtered to limit account and study data. These measures reduce collection but do not guarantee anonymity. Replay is diagnostic recording, not advertising tracking.

How data is used

Data is used to provide the app, personalize review and course workflows, secure accounts, prevent fraud and abuse, process payments, resolve subscriptions, deliver email, provide support, moderate content, enforce the Terms, investigate reports, improve reliability, run aggregate analytics, comply with law, and respond to privacy, safety, billing, or store-review requests.

Purposes and legal bases

Where EU or UK data-protection law applies, contract necessity supports the account, learning, content, requested audio, subscription and support functions you request. Legal obligations support required accounting, tax and lawful disclosures. Our legitimate interests support proportionate security, fraud prevention, moderation, service reliability and diagnostic monitoring, including replay where enabled, where permitted by law and balanced against your rights. Optional Classroom analytics sharing relies on the consent requested by that feature. A signup acknowledgement is not consent to all processing. Account identifiers and authentication details are needed to provide an account; optional profile or content fields are your choice. We do not make solely automated decisions with legal or similarly significant effects about you.

Processors and providers

Providers include Vercel for hosting, file storage and web analytics; Supabase for the database; Resend for transactional email; Sentry for diagnostics and replay; Microsoft Azure Speech and ElevenLabs for audio generation; Cloudflare Turnstile for signup abuse protection; and your chosen OAuth provider for sign-in. Stripe and, where native billing is available, Apple, Google and RevenueCat handle payment or entitlement functions. We share data needed for the relevant purpose. Some providers act as processors under data-processing terms; payment, store and OAuth providers may also act as independent controllers under their own policies. Authorised support or moderation staff may access relevant records, and data may be disclosed when legally required or necessary to establish or defend legal claims.

International processing and transfers

The operator is based in the UAE, and hosting, database, email, payment, audio and diagnostic providers may process data in the EEA, the United States and other countries where they or their subprocessors operate. Processing can include access from another country, even when a database is hosted in Europe. The UAE is not covered by an EU adequacy decision. Transfers must satisfy the law applicable to the particular transfer; available safeguards include recognised adequacy arrangements and contractual protections such as the European Commission's Standard Contractual Clauses and UK transfer addendum where applicable. Provider data-processing terms describe their transfer arrangements. Contact us for information about the arrangements applicable to your data and how to obtain the relevant safeguards.

Cookies and analytics

Authentication, security, session, preference and locale cookies or local storage support signing in and your chosen settings. Vercel Web Analytics provides cookieless usage statistics when enabled. When enabled, Sentry Session Replay also uses browser session storage for diagnostic recordings, as described above; cookieless analytics does not mean the whole service is free of tracking or storage. We do not use advertising cookies, cross-context behavioural advertising or sell personal information for advertising.

Retention, deletion, and controls

Account and learning records are kept while your account is active to provide progress and history; inactivity alone does not delete an account. Account deletion removes the account, authentication records, signup acknowledgements and linked personal learning data. Shared dictionary contributions or material legitimately retained by others may remain, with account references removed where supported. Withdrawal statements, contact details and handling records can survive account deletion to handle refunds, complaints and legal claims. Payment, tax and accounting records are kept for applicable statutory periods; support and safety records depend on the issue's resolution, abuse risks and applicable claim periods. Diagnostic records and backups follow the relevant provider's configured retention and rotation; deleting an account does not immediately erase every diagnostic record, support email or backup. Contact us for the applicable periods or a specific deletion request, including records held by providers.

Privacy rights

Applicable rights may include access, correction, deletion, portability, restriction and objection. You may object to processing based on legitimate interests, including diagnostics, and withdraw consent for processing that relies on consent without affecting earlier lawful processing. Use the separate Classroom consent controls where available or contact support. Settings provide account deletion and data export. We explain any lawful reason for refusing or limiting a request. You may complain to the data-protection authority competent for your location, including your EU supervisory authority or the UK Information Commissioner's Office; you do not have to contact us first.

Security

The service uses technical and organizational safeguards intended to protect account, billing, learning, and safety data, including authentication, authorization, audited admin operations, production env validation, and limited access to operational records. No internet service can promise perfect security. Users should protect their login credentials and contact support promptly if they believe an account has been compromised.

Children and age baseline

The service is intended for a general audience aged 13 and older and is not directed to children under 13 or to a Kids Category/Families audience. If a parent or guardian believes a child under 13 has provided personal information, they should contact support so the account can be reviewed and removed where appropriate.

Policy changes

We update this policy when our processing or legal obligations change and provide notice of material changes by email or another appropriate channel before new processing begins where required. Signup records preserve the policy version acknowledged when the account was created. Existing users do not need to acknowledge updates again, and updates alone do not block access. Acknowledging this policy does not give blanket consent to new purposes; where separate consent is legally required, a policy update does not replace it.

Privacy requests and contact

Contact support@wordforests.com for privacy questions or rights requests, including requests about providers, transfers, safeguards or retention. Use your account email if possible; we may request proportionate identity verification, but an account is not required to contact us. We respond without undue delay and within the applicable legal deadline. For EU/UK GDPR requests this is normally one month; if a lawful extension is necessary, we explain the reason within that month. Requests are normally free of charge.

support@wordforests.com