Privacy Policy

Last updated: [PLACEHOLDER — e.g. May 24, 2026]

Verbadiem ("we," "us," "our") respects your privacy. This Privacy Policy describes what information we collect when you use verbadiem.com and our related products and services (the "Service"), how we use it, who we share it with, and the choices you have.

1. Summary

In one paragraph: We collect the minimum information needed to run a daily-word language-learning service — your email address, the languages you study, your notification preferences, your subscription status, and a record of which words you've seen and rated. We do not sell your data. We do not run third-party advertising or analytics tracking. We send transactional email through Resend, process payments through Stripe, host data through Supabase, generate vocabulary content through Anthropic Claude, and synthesize audio through ElevenLabs. You can ask us at any time to access, export, or delete your data.

2. Information We Collect

2.1 Information you provide

Email address — required to create an account and receive your daily-word email.
Notification preferences — what time of day you want your email, your time zone, which language(s) you study, whether notifications are enabled.
Subscription information — your plan (Free or Pro), billing cycle, and any cancellation status. Payment card details are collected directly by Stripe and never touch our servers; we receive only a tokenized customer ID and subscription status from Stripe.

2.2 Information generated through use

Word progress — which daily words you've been shown, which you've rated, the ratings you gave, and review history (used to power the spaced-repetition queue).
Account activity — sign-in events, account creation and update timestamps.
Vote history — if you vote on items in our community roadmap, your votes are linked to your account.

2.3 Technical information

Cookies — see section 5 below.
Server logs — when you load a page or make a request, our hosting provider (Railway) records standard web-server log entries (IP address, request URL, response status, user-agent, timestamp). These are retained for a short period for security and debugging purposes and are not used to build advertising profiles.

2.4 Information we do not collect

No advertising identifiers
No third-party analytics cookies (no Google Analytics, no Meta Pixel, no Hotjar, no PostHog, etc.)
No tracking pixels on the website itself
No microphone, camera, location, or contact-list access
No payment card numbers (those go directly to Stripe)

3. How We Use Your Information

We use the information we collect to:

create and manage your account;
deliver the daily-word email to your inbox at the time you've set;
generate and serve your spaced-repetition review queue;
process payments and manage Subscriptions;
communicate with you about Service updates, support requests, and (rarely) product announcements;
detect, prevent, and investigate abuse, security incidents, and violations of our Terms of Use;
comply with legal obligations.

We process this data based on (a) the contract between you and us (the Terms), (b) our legitimate interests in operating and improving the Service, and (c) where applicable, your consent.

4. How We Share Your Information

We do not sell your personal information. We share it only with the third-party service providers ("subprocessors") that operate parts of the Service on our behalf, and only as needed for them to provide that service.

Current subprocessors

| Provider | Purpose | Country | Privacy policy | |---|---|---|---| | Supabase | Database, authentication, audio file hosting | USA | supabase.com/privacy | | Stripe | Payment processing, subscription management | USA | stripe.com/privacy | | Resend | Transactional email delivery | USA | resend.com/legal/privacy-policy | | ElevenLabs | Text-to-speech audio generation | USA | elevenlabs.io/privacy | | Anthropic | AI vocabulary content generation | USA | anthropic.com/legal/privacy | | Railway | Application hosting + server logs | USA | railway.app/legal/privacy | | Google Search Console | Search-traffic analytics for our own monitoring | USA | policies.google.com/privacy |

Anthropic and ElevenLabs receive content for generation/synthesis only — they do not receive your personal information. Audio files are uploaded to Supabase Storage under generic word IDs, not linked to individual users.

We may also disclose information when required by law (subpoena, court order, legal process) or to protect our rights, property, or safety, or that of our users or others.

If Verbadiem is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction; we will notify you by email before any such transfer takes effect.

5. Cookies

We use a small number of first-party cookies to operate the Service:

| Cookie | Purpose | Lifetime | |---|---|---| | sb_at, sb_rt | Authentication (Supabase access + refresh tokens) | Session + ~30 days | | admin_session | Administrative dashboard authentication | ~30 days | | view_lang | Remembers your last-viewed language on the home page | 1 year |

We do not use third-party advertising or analytics cookies on the Service.

When you complete a payment, Stripe Checkout (hosted on checkout.stripe.com) sets its own cookies for fraud detection and session management. Those cookies are governed by Stripe's own privacy policy.

For full details, see our Cookie Policy.

6. Email Tracking

Our daily-word emails are delivered through Resend. Depending on our Resend configuration, transactional emails may include an open-tracking pixel and click-tracking redirects, used to monitor email deliverability. We do not use this data for advertising or profile-building. You can disable open tracking by configuring your email client to block remote images, and you can opt out of all non-essential emails at any time via the unsubscribe link in every email or in your account settings.

7. Data Retention

We keep your information for as long as your account is active and for a short additional period after account closure for backup, fraud-prevention, and legal-compliance purposes (typically 30–90 days). Backups are retained for up to 30 days. Subscription and billing records may be retained longer where required by tax or accounting law (typically 7 years in the United States).

You can request immediate deletion of your account and associated personal data at any time by emailing support@verbadiem.com.

8. Your Rights

Depending on where you live, you may have the following rights regarding your personal information:

Access — request a copy of the personal information we hold about you.
Correction — ask us to fix inaccurate or incomplete information.
Deletion — ask us to delete your account and personal data.
Portability — receive a copy of your data in a structured, machine-readable format.
Restriction / objection — limit or object to certain processing.
Withdraw consent — where processing is based on consent, withdraw it at any time.
Complain to a regulator — lodge a complaint with your local data-protection authority.

To exercise any of these rights, email support@verbadiem.com. We will respond within 30 days (or sooner where required by law).

8.1 California residents (CCPA / CPRA)

You have the right to know what personal information we collect, the right to delete it, the right to correct inaccurate information, and the right to opt out of any sale or sharing of your personal information. Verbadiem does not sell or share personal information as those terms are defined under California law, so there is nothing to opt out of in that regard.

8.2 European, UK, and Swiss residents (GDPR / UK GDPR / nFADP)

The legal bases for our processing of your personal data are listed in section 3. You have the rights listed above, plus the right to object to any processing based on our legitimate interests. Verbadiem is the data controller for the personal data described in this Policy.

If you would like a Data Processing Agreement (DPA) for your own GDPR compliance, contact support@verbadiem.com.

9. International Transfers

Verbadiem is operated from the United States, and the subprocessors listed in section 4 are primarily based in the United States. If you access the Service from outside the US, your information will be transferred to, stored, and processed in the United States. Where required (for example, transfers from the EU/UK), we rely on appropriate safeguards such as the Standard Contractual Clauses approved by the European Commission, plus the safeguards our subprocessors maintain.

10. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected information from a child under 13, contact support@verbadiem.com and we will delete it promptly.

For users aged 13 to the age of majority in their jurisdiction, use of the Service requires parental or guardian consent (see Terms of Use).

11. Security

We use industry-standard measures to protect your information, including encryption of data in transit (HTTPS), encrypted authentication tokens, hashed passwords (managed by Supabase Auth), row-level security on our database, and regular security updates to our dependencies. No system is 100% secure; if you believe your account has been compromised, please notify us immediately at support@verbadiem.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email and/or by an in-app notice at least fourteen (14) days before they take effect, where practical. The "Last updated" date at the top of this page indicates when the most recent changes were made.

13. Contact

Questions about this Privacy Policy, or requests to exercise your rights, can be sent to:

Verbadiem [PLACEHOLDER — Street Address] [PLACEHOLDER — City, State ZIP] [PLACEHOLDER — Country] Email: support@verbadiem.com