Privacy Policy

Draft for review. This document has not yet been reviewed by a lawyer and will be finalised before launch.

SnapVocab is a vocabulary app for people studying for the GRE and the SAT. This policy explains what the app stores about you and who else sees it. It is written to be read, not to be survived.

The app is built but not yet released, so nothing described below has run for a real learner yet. We will revise this page before launch and again whenever the product changes what it collects.

Who we are

SnapVocab (SnapVocab) makes the SnapVocab mobile app and this website. You can reach us at hello@snapvocabapp.com about anything on this page.

What we collect

When you create an account

You can sign in with an email address and a password, or with Google. There is no other sign-in method, and the app cannot be used without an account because your progress lives on our server.

• Email and password. Your address, and your password stored as a cryptographic hash — we never hold the password itself.
• Google sign-in. If you choose it, Google tells us your name, email address and profile picture URL, and we keep the tokens that hold the connection open. We ask Google for nothing else, and we never get your Google password.
• Your display name, which other learners see if you add them as a friend or meet them in a league.

While you are signed in

Each session record carries your IP address and your device's browser or app user-agent string, which our authentication library stores so a session can be recognized and expired.

What you do in the app

• Your study plan: which exam you are sitting, how far away it is, your target score, your daily goal and the short assessment you take during onboarding.
• Your progress: a spaced-repetition record for every word — how well you knew it, how often you have seen it, when it is next due — plus your finished sessions and the individual answers in them.
• Your game and story progress: levels cleared, stars, Vocab Mountain days marked, stories read.
• Streaks, XP, levels, badges and league standings, and the friend code other learners use to add you.
• Things you write: your own mnemonics, your edits to a word's definition, examples, synonyms or antonyms, and any word list you import or type in yourself.
• Your social activity: friend requests you send and accept, and the duels you play — including your opponent and both scores.
• Your subscription state once paid plans exist: whether Pro is active, when it lapses, and — if you tell us on the way out — the reason you cancelled, in your own words.

What we do not collect

The app ships no analytics SDK, no crash reporting, no advertising or attribution SDK, and no ad network. We do not track you across other apps or websites, we do not build an advertising profile, and we do not sell or share personal information for advertising. We do not ask for your contacts, your location or your photos. We do not send push notifications; the daily reminder is scheduled by your own phone and never reaches our server.

Why we use it

• To run your account — signing you in, keeping you signed in, and knowing which learner a piece of progress belongs to.
• To teach you words — scheduling reviews, building your daily plan, and picking what to show you next.
• To run the social and game features you opt into — friends, duels and weekly leagues only work because other learners can see your display name and score.
• To enforce free and paid limits — daily counters exist so the free tier's caps can be applied.
• To keep the service working and safe — session records exist so a stolen session can be ended.

Who processes it

We keep the list of outside parties as short as we can. Today it is:

• Google — twice, for two unrelated reasons. If you sign in with Google, Google handles that sign-in. Separately, the app's optional AI features send text to Google's Gemini model, described below.
• OpenRouter, which routes the optional AI requests described below to Google's model.
• Supabase, which hosts the Postgres database everything above is stored in. It runs in Supabase's ap-south-1 region — Mumbai, India.
• Vercel, which runs the server the app talks to (Mumbai, alongside the database), and Cloudflare, which serves this website.

If you are outside India, your data is stored there. We chose one region rather than several because a spaced-repetition schedule is one consistent record, and splitting it across regions would make it neither faster nor safer.

The AI features, specifically

Three optional features send text to an AI model: asking a question about a word, asking for extra mnemonic ideas, and generating practice questions. These are paid features, they are never used automatically, and each one only runs when you ask for it.

When you use them, the word you are studying and the text you typed are sent through OpenRouter to Google, and processed by its Gemini model. What we send is the word and your question — never your email address, your name or your progress history. Do not type anything into these features that you would not want to leave the app.

Payments

Paid plans are not live. When they are, subscriptions will be sold and billed by the Apple App Store and Google Play, and we will never see or hold your card details. We will update this page before that happens.

How long we keep it

Your account data stays for as long as your account exists — that is the point of it, since a spaced-repetition schedule is worthless if it is periodically forgotten. Sign-in sessions expire on their own.

We run no inactivity cutoff and no purge job: data is kept until you ask for it to go. When you do, it goes immediately — there is no retention period and no grace period, and the deletion is a single transaction that either removes everything or nothing. What exactly is removed, and the two narrow things that survive, are listed under deleting your account.

Your rights

Depending on where you live, you may have the right to ask for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to complain to your data-protection regulator. You can exercise any of these by emailing hello@snapvocabapp.com from the address on your account. We will not charge you or make the app worse for asking.

There is no self-service export yet. If you ask for a copy of your data we will assemble it by hand and send it to you.

Children and teenagers

SnapVocab is for people preparing for the GRE and the SAT. SAT candidates are commonly between 13 and 17 years old, so we expect teenagers to use the app, and we design for that: no advertising, no tracking, no location, no open messaging between learners, and no public profile beyond a display name and a score.

The app is not intended for children under 13, and we ask that they do not create an account. If you believe a child under 13 has an account, email hello@snapvocabapp.com and we will delete it.

If you are under 18, please get a parent's or guardian's agreement before creating an account.

Deleting your account

You can delete your account from inside the app at any time: the You tab, then Settings, then Delete account. It takes effect the moment you confirm. If you cannot reach the app, email hello@snapvocabapp.com from the address on your account. The account deletion page has both routes in full, and lists exactly what is removed and what is kept.

Security

Passwords are stored hashed. Your session token is kept in your device's secure storage — the iOS Keychain or the Android Keystore — not in ordinary app files. Traffic between the app and our server is encrypted in transit. No system is perfect, and we will not pretend otherwise.

Changes to this policy

When we change this page we will update the date at the top. If a change materially affects what we collect or who receives it, we will tell account holders by email before it takes effect.

Contact

Questions, requests and complaints: hello@snapvocabapp.com.