# Privacy Policy for CoWords
This Privacy Policy explains how CoWords collects, uses, and protects your information when you use the CoWords mobile application (the "App"). By creating an account and using the App, you agree to the practices described here.
> This document is provided as a starting template and is not legal advice. Please have it reviewed by a qualified professional and confirm it matches your actual data practices and the laws that apply to you (e.g., GDPR, UK GDPR, CCPA/CPRA) before publishing it.
---
## 1. Who we are
CoWords is an English vocabulary learning app that teaches words through high-frequency collocations and spaced repetition. The App is operated by [LEGAL ENTITY NAME], located in [COUNTRY / JURISDICTION].
For any privacy questions or requests, contact us at: [CONTACT EMAIL].
## 2. Information we collect
We aim to collect only what is needed to run the App.
a) Account information. To use CoWords you must create an account. Depending on how you sign up, we collect:
- Your email address.
- A password, if you register with email and password. Passwords are handled by our authentication provider and stored only in hashed form; we do not have access to your plaintext password.
- If you sign in with Google, we receive basic account identifiers from Google such as your email address, in accordance with the permissions you grant.
b) Learning data. To provide and synchronize your study experience, we store:
- The words and collocations you add to your study list.
- Your review history and spaced-repetition scheduling state (e.g., when cards are due, ratings you give).
- Study progress and statistics derived from the above.
c) App preferences. Settings such as your daily card limit, pronunciation accent, and language preferences are stored locally on your device and are not transmitted to our servers.
d) Technical information. We may process limited technical data necessary to operate the service (for example, your authentication session token). The App is "local-first": most of your data lives on your device and is synchronized to our servers for backup and multi-device access.
What we do not collect: We do not collect your precise location, contacts, photos, or similar device data. We do not currently use third-party advertising or third-party analytics SDKs. (Update this section if that changes.)
## 3. How we use your information
We use the information we collect to:
- Create and authenticate your account.
- Provide, maintain, and synchronize your study data across sessions and devices.
- Generate learning content (collocations and example sentences) for the words in the App.
- Diagnose problems, maintain security, and improve the App.
- Send you essential service communications, such as email verification or account-related notices.
We do not sell your personal information.
## 4. How your data is stored and where
- On your device: core content and your study data are stored locally (in an on-device database) so the App works quickly and offline.
- On our servers: your account and learning data are stored and synchronized using Supabase, our backend and authentication provider, which hosts data on its infrastructure in [SUPABASE REGION / COUNTRY].
Synchronization is used to back up your data and make it available when you sign in on another device.
## 5. Third-party service providers
We share data only with service providers that help us operate the App, and only as needed for them to perform their services:
- Supabase — authentication, database, and hosting for your account and learning data.
- Google — sign-in (OAuth), if you choose to sign in with Google.
- Anthropic — we use an AI service to generate collocations and example sentences. Only the target word and its learning level/topic are sent for this purpose; we do not send your personal account information or your individual study history to this service.
- Expo / EAS — app build and update delivery, which may process limited technical data needed to deliver app updates.
These providers process data under their own privacy and security terms. We do not authorize them to use your data for their own purposes beyond providing the service to us.
## 6. Disclosure of information
We may disclose your information:
- To the service providers listed above, to operate the App.
- If required by law, regulation, legal process, or enforceable governmental request.
- To protect the rights, property, or safety of our users, the public, or us.
- In connection with a merger, acquisition, or sale of assets, in which case we will notify you of any change in ownership or use of your personal data.
## 7. Data retention
We retain your account and learning data for as long as your account is active. If you delete your account or request deletion, we will delete or anonymize your personal data within a reasonable period, except where we are required to retain it to comply with legal obligations.
## 8. Your rights and choices
Depending on where you live, you may have rights to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Delete your data ("right to be forgotten").
- Object to or restrict certain processing.
- Receive a copy of your data in a portable format.
To exercise any of these rights, contact us at [CONTACT EMAIL]. We will respond within the time required by applicable law.
## 9. Account and data deletion
You can request deletion of your account and associated personal data at any time by emailing [CONTACT EMAIL]. Deletion removes your account and your synchronized learning data from our servers. You can also clear locally stored data on your device through your device's app settings ("Clear data" / uninstall).
## 10. Children's privacy
CoWords is intended for adult learners and is not directed to children under the age of [13/16, per your jurisdiction]. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
## 11. Security
We take reasonable technical and organizational measures to protect your data, including encryption of data in transit and storage of passwords only in hashed form by our authentication provider. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
## 12. International data transfers
Your information may be stored and processed in countries other than the one in which you live, including where our service providers operate. Where required, we rely on appropriate safeguards for such transfers.
## 13. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you within the App. Your continued use of the App after changes take effect constitutes acceptance of the updated policy.
## 14. Contact us
If you have questions or concerns about this Privacy Policy or your data, contact us at:
[LEGAL ENTITY NAME]
Email: [CONTACT EMAIL]
Address: [BUSINESS ADDRESS, optional]
