Privacy notice

Last updated: 16 August 2026

In short: Vocatale does not use advertising trackers or audience analytics. Supabase provides accounts and synchronisation. When built-in AI is used, the necessary input is sent to AI service providers for safety checks and generation. Your own API keys remain in your browser and are not synchronised with Vocatale. The browser extension has a dedicated privacy notice describing selected page text and Chrome permissions.

1. Controller

The controller for personal data processed in connection with Vocatale is:

Wen-Tao Wu
Email: contact@vocatale.com

2. Data we process

Depending on how you use Vocatale, we may process:

technical access data such as IP address, time, requested file, browser information and error data;
account data such as email address, internal user ID, sign-in provider and session data;
learning data such as languages, level, settings, vocabulary, learning state, reading progress, stories and series;
for AI features: selected words, prompts, text input, story context, generated answers and technical usage or cost metadata;
for an iOS credit purchase: Apple product and transaction identifiers, credit amount, environment, purchase time, fulfillment status and refund status; Vocatale does not receive full payment-card details;
for the Lite/Pro notification: your email address and registration timestamps;
for your own AI provider: provider, model, endpoint and API-key settings stored locally.

3. Purposes and legal bases

Website and app, account, sign-in and cloud sync: Article 6(1)(b) GDPR.
AI generation, dictionary and translation requested by you: Article 6(1)(b) GDPR.
Purchase fulfillment, refunds and account credit balance: Article 6(1)(b) GDPR; accounting and tax records are also retained where Article 6(1)(c) requires it.
Abuse prevention, moderation, troubleshooting and security: Article 6(1)(f) GDPR; our legitimate interest is a secure and reliable service.
Lite/Pro notification: Article 6(1)(a) GDPR; consent may be withdrawn at any time.

4. Hosting, Supabase and Apple purchases

GitHub Pages

The public website is delivered through GitHub Pages. GitHub processes technically necessary access data, including IP addresses, to deliver and protect the service. Provider: GitHub, Inc. See the GitHub Privacy Statement.

Supabase

Vocatale uses Supabase for authentication, account management, cloud synchronisation, the waitlist, server-side AI functions and the credit ledger. This includes account data, synchronised learning data, credit and purchase records, and AI usage metadata. API keys entered for your own provider are removed before synchronisation. See the Supabase Privacy Policy.

Apple In-App Purchase

The iOS app uses Apple In-App Purchase for credit packs. Apple displays and processes payment and supplies a signed transaction. Vocatale verifies that transaction with Apple before adding credits to the signed-in account. Apple’s terms and privacy notice apply to payment processing. Purchased credits do not expire.

5. Third-party sign-in

Vocatale supports email and, where enabled, Apple, Google, Microsoft, GitHub and WeChat sign-in. A provider receives data only when you select it. The identity and connection data needed for sign-in are exchanged between that provider and Supabase. The selected provider’s privacy notice also applies. Vocatale does not store passwords in application code; Supabase handles authentication and OAuth uses PKCE. Sign in with Apple is offered in the iOS app. Facebook is currently disabled and WeChat is not configured.

6. AI features

Built-in AI (“Managed AI”)

Vocatale sends dictionary lookups directly to DeepSeek on both the Global and China built-in routes. Dictionary lookups do not use the OpenAI safety-check or OpenRouter steps. For other built-in AI features, Vocatale sends the required input to OpenAI for an automated safety check and then either through OpenRouter on the Global route or to the separately configured provider on the China route (currently DeepSeek); output is also checked automatically. The provider used receives the request content and technical connection data.

Full prompts and outputs are not stored in the operational AI request ledger. A successfully generated story may, however, be saved in your Supabase learning library. Metadata such as feature type, route, provider, model, token counts, cost, status and moderation categories is processed for billing, abuse prevention and troubleshooting. See the OpenRouter Privacy Policy, OpenAI Privacy Policy, and DeepSeek Privacy Policy.

Your own provider (“Bring your own provider”)

If you choose your own provider or compatible endpoint, your browser connects directly to it. The API key and provider settings are stored locally, are not sent to Vocatale and are not synchronised to the Vocatale cloud. The selected provider’s terms and privacy notice apply. Remove the key after use on shared devices.

AI transparency

Stories, examples, memory aids and explanations marked as AI-generated are created automatically and may contain errors. They are not professional or authoritative advice. Vocatale does not make solely automated decisions with legal or similarly significant effects about users.

7. Dictionary, translation and speech

A word lookup is handled by the AI feature described in this notice and is not sent to a third-party dictionary or translation service. Two other actions may still use such services when no AI provider is configured: saving a selected word from the reading toolbar, and importing a word list. The term may then be sent to DictionaryAPI.dev, and for machine translation to MyMemory; for technical reasons these services also receive the IP address. Speech uses voices supplied by the browser or operating system. Online voices may send text to the device or browser provider’s speech service; Vocatale receives no additional audio copy.

8. Browser storage and cookies

Vocatale currently uses no analytics, advertising or profiling cookies. It uses localStorage and sessionStorage for requested functions: login sessions and PKCE, language and level, local vocabulary and progress, stories, onboarding state, interface settings, and locally configured AI providers and keys. This storage is necessary for those functions, so no consent banner is displayed. Clearing browser storage may remove login state, local progress and provider settings.

9. Lite/Pro notification

If you enter your email address and consent, you will receive one message when Lite/Pro or Vocatale credits become available. This consent does not cover a general newsletter. The address is kept until the notification or withdrawal, then deleted unless another legal basis applies. Withdraw at any time by emailing contact@vocatale.com.

10. Retention

Accounts and synchronised learning data: until account deletion or no longer needed for the service.
Local app data: until deleted in the app or browser.
Waitlist: until notification or withdrawal.
Security, error and AI usage metadata: only while required for security, abuse prevention, billing, troubleshooting or legal claims.
Purchase and legally required records: for the applicable accounting, tax, fraud-prevention, refund and limitation periods.

Where immediate deletion is not possible, data is blocked or restricted until the retention reason ends.

Deleting an account removes the account, synchronised learning data, available credit balance, word statistics and any waitlist entry. Managed-AI billing rows and Apple transaction records may be retained for accurate billing, accounting, fraud prevention and refunds, but the Vocatale account reference is removed. AI billing rows contain neither inputs nor generated content.

11. Recipients and international transfers

Recipients may include GitHub, Supabase, Apple for In-App Purchase, your chosen sign-in provider, OpenRouter, OpenAI, the provider selected for the China route, and the dictionary, translation or speech services described above. Some providers process data in the United States, China, or other countries outside the EEA. Depending on the provider and processing, transfers rely on an adequacy decision, safeguards such as standard contractual clauses, or another applicable legal basis. For a self-configured AI endpoint, you choose the direct destination.

12. Your rights

Portability and erasure need no request: signed-in readers find Your data in the account bar, with one button that downloads everything stored under the account as a JSON file and one that deletes the account for good after a confirmation. The downloaded file contains no passwords and no sign-in tokens.

Subject to the legal requirements, you may request access, rectification, erasure, restriction, portability and object to processing. Consent may be withdrawn at any time for the future. Contact contact@vocatale.com. We may request suitable proof that you own the relevant account. You may also complain to a competent data-protection authority.

13. Minors

Vocatale is not specifically directed at children under 16. Anyone under 16 should not create an account or notification registration without a parent or guardian’s consent. Do not enter sensitive personal data about yourself or others into free-text fields.

14. Security and changes

Vocatale uses HTTPS, account-scoped access rules, OAuth PKCE, server-held service keys, input limits, moderation and abuse controls. No internet service can guarantee absolute security. This notice will be updated when functions, providers or legal requirements materially change; the current version remains available at this address.