Privacy policy

Who is responsible for the data

Your data is processed by Vorbaro. For any question about your data, use the contact form or write to support@vorbaro.com.

What data we collect

• Account: your email address and password. The password is stored only as a hash; we do not know the password itself.
• Learning: your answers, review schedule, settings, selected categories, word edits and reports of dictionary errors.
• Sign-in and devices: the time of sign-ins and failed attempts, IP address, browser and device type, the device's public key, the time of your last activity.
• Trial lesson: only the answers in it, with no email or password.
• Messages: the email address and text you send through the contact form or by email.
• Technical logs: the time, address and result of requests to the server.

We do not ask for your name, phone number, documents or payment details, and we do not receive data about you from other sources.

Why and on what legal basis

• To run the app: sign-in, saving progress, the review schedule, email confirmation and password reset emails. Legal basis: our contract with you, that is, your use of the app (Art. 6(1)(b) GDPR).
• To protect accounts and the dictionary: the sign-in log, attempt limits, tying sign-in to a device, protection against automated copying. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
• To improve the app: cookie-free visit statistics and your error reports. Legal basis: legitimate interest.
• To answer your messages. Legal basis: your request and legitimate interest.

There is no advertising. Data is not sold and is not used for profiling or automated decisions.

Visit statistics

Visits are counted by Umami, a statistics service that runs on our own server. It sees the page opened, the referrer, browser, device type and country, but it sets no cookies and does not store IP addresses. This data cannot identify an individual person.

How long we keep data

• Account, progress and sign-in log: as long as the account exists. When the account is deleted, everything is erased at once.
• An account with an unconfirmed email and the trial lesson: 7 days, then deleted.
• Sign-in session: 30 days, after which you need to sign in again.
• Failed sign-in attempts with an email that has no account: kept to protect against password guessing.
• Messages: in the support mailbox for as long as needed to reply and keep the conversation history. We delete them on request.
• Technical logs: overwritten as they fill up.

Who receives data

We do not sell data or share it for advertising. Only the services the app cannot work without have access to it:

• the hosting provider whose server runs Vorbaro and its database;
• Resend (USA), an email delivery service: it receives the recipient's address and the text of email confirmation, password reset and contact form emails.

Data may also be disclosed where the law requires it.

How data is protected

The connection to the site is encrypted (HTTPS). Passwords are stored only as hashes. Each sign-in is tied to a key that is stored only in your device's browser: a stolen cookie does not work without it. Only the people who maintain the app have access to the server and database.

Your rights

Under the GDPR you can:

• get a copy of your data: "Profile" → "Export progress", or on request;
• get your data in a machine-readable form (the JSON export file) and take it elsewhere;
• correct your data or ask us to correct it;
• delete your account and all data: "Profile" → "Delete account" (how to delete);
• object to processing based on legitimate interest, or restrict it.

Send requests through the contact form. We reply within one month, as the GDPR requires. So that no one gets someone else's data, the reply is sent only to the account email.

If you believe we are violating your rights, contact us.

Cookies

We use only essential cookies that sign-in needs. Details are on the Cookies page.

Changes to this policy

If the policy changes, we will update this page and the date at the top. We will email you about significant changes.