Privacy Policy for Wordify

Introduction

Welcome to Wordify ("we," "our," or "us"). We are committed to protecting your privacy and being transparent about the limited data we process. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you have over your data when you use the Wordify mobile application (the "App") or visit https://wordify.it (the "Website").

By using Wordify, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the App.

Data Controller

The Data Controller responsible for processing your personal data is:

• Denis Šunkin
• Pune tee 9 - 9, 12015 Tallinn, Estonia
• Email: mystixtechdev@gmail.com

If you live in the European Economic Area (EEA), the United Kingdom, or Switzerland, this entity is your point of contact for any privacy-related questions or to exercise your rights under GDPR/UK GDPR.

Information We Collect

1. Information Stored Locally on Your Device

Wordify is designed to be offline-first. The following information is stored only on your device and is not transmitted to us:

• Words and translations — both pre-installed collections and any custom words you add
• Learning progress — review history, mastery levels, streak counter, activity heatmap data
• App settings — interface language, learning language, notification preferences, background images, theme
• Custom images — any images you attach to your own custom words via camera, gallery, or the Pixabay search feature

This data never leaves your device unless you choose to share it (e.g., via the system share sheet to share your activity heatmap as an image).

2. Anonymous Analytics Data

When analytics is enabled (default ON, opt-out available in Settings → Share anonymous usage data), we use Firebase Analytics to understand how the App is used. The following categories of data are processed:

• App interactions — screen views, feature usage (e.g., training mode started, paywall shown), session duration
• Subscription events — trial started, subscription purchased (without your name, email, or payment details)
• Device information — device model, operating system version, app version, language setting
• Approximate location — country and city derived from IP address (we do not access GPS)
• Pseudonymous identifier — a Firebase Installation ID that is not linked to your real identity and resets if you reinstall the App

We have configured Firebase to not collect data for advertising purposes — specifically, advertising identifiers (IDFA on iOS, AAID on Android) are NOT used, and we have set Firebase consent flags adStorageConsentStatus, adUserDataConsentStatus, and adPersonalizationSignalsConsentStatus to denied.

You can disable analytics entirely at any time in Settings → Share anonymous usage data.

3. Subscription Data

If you purchase a Wordify Premium subscription (Monthly, Yearly, or Lifetime), the following is processed by RevenueCat (our subscription management provider):

• A pseudonymous user identifier (randomly generated, not linked to your real identity)
• Purchase information (product, price, currency, transaction ID)
• Subscription status and renewal events
• Device type and operating system version
• App Store / Play Store transaction receipts

Payment is processed by Apple (App Store) or Google (Play Store) — we never see your credit card details, name, email, or billing address.

4. Information We Do NOT Collect

To be clear, we do not collect or process:

• Your name, email address, phone number, or any account credentials (we have no account system)
• Precise location (GPS coordinates)
• Contacts or address book
• Photos or media outside what you voluntarily set as a background image
• Browsing history outside the App
• Advertising identifiers (IDFA / AAID)
• Microphone, camera (except briefly when you take a custom-word photo, which is then stored locally)
• Health, biometric, or financial information

Legal Basis for Processing (GDPR/UK GDPR)

Where the GDPR or UK GDPR applies (i.e., users in the EEA, UK, or Switzerland), we rely on the following legal bases:

Third-Party Services

We share limited data with the following processors. Each acts under a Data Processing Agreement and we have configured them to minimise data sharing where possible.

Firebase Analytics (Google LLC)

• What is shared: Anonymous app usage events, device info, IP-based approximate location, Firebase Installation ID
• Purpose: Aggregate analytics to understand and improve the App
• Data location: Firebase project located in the European Union (Estonia/Finland region)
• Privacy policy: https://policies.google.com/privacy
• Data Processing Agreement: Google's standard Firebase DPA applies

RevenueCat (RevenueCat, Inc.)

• What is shared: Pseudonymous user identifier, purchase events, subscription status, device info
• Purpose: Subscription management, restoring purchases, preventing fraud
• Privacy policy: https://www.revenuecat.com/privacy

Unsplash (Unsplash Inc.)

• What is shared: Your search queries (when you use background image search), IP address
• Purpose: Returning matching images
• Privacy policy: https://unsplash.com/privacy

Pixabay (Pixabay GmbH)

• What is shared: Your search queries (when adding images to custom words), IP address
• Purpose: Returning matching images
• Privacy policy: https://pixabay.com/service/privacy/

Apple App Store / Google Play Store

When you download or purchase, Apple or Google process the transaction directly. Their privacy practices are governed by:

• Apple: https://www.apple.com/legal/privacy/
• Google: https://policies.google.com/privacy

International Data Transfers

Although we have configured Firebase to use a European data location, some of our processors (Google, RevenueCat) operate globally. When your data is transferred outside the EEA, UK, or Switzerland, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission, OR
• UK Addendum to the SCCs for UK users, OR
• An adequacy decision by the European Commission for the destination country

You may request a copy of the safeguards in place by contacting us at the address above.

Data Retention

We retain data only as long as necessary for the purpose it was collected:

You may request earlier deletion at any time by contacting us (see "Your Rights" below).

Your Rights

Depending on where you live, you have some or all of the following rights:

For EEA, UK, and Swiss residents (GDPR / UK GDPR)

• Right of access — request a copy of personal data we process about you
• Right to rectification — correct inaccurate data
• Right to erasure ("right to be forgotten") — request deletion of your data
• Right to restrict processing — limit how we use your data
• Right to object — object to processing based on legitimate interest (including analytics)
• Right to data portability — receive your data in a structured, machine-readable format
• Right to withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal
• Right to lodge a complaint — with your local supervisory authority. For Estonia: Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, https://www.aki.ee). For Poland: Urząd Ochrony Danych Osobowych (https://www.uodo.gov.pl). For other EU countries: see https://edpb.europa.eu/about-edpb/about-edpb/members_en

For California residents (CCPA/CPRA)

• Right to know what personal information is collected and shared
• Right to delete your personal information
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of personal information (we do not sell or share data for cross-context behavioural advertising)
• Right to non-discrimination for exercising your rights

To exercise any right, contact us at mystixtechdev@gmail.com. We will respond within 30 days (or as required by your local law). We may need to verify your identity before fulfilling certain requests; for an app without accounts, this typically means we will ask you to demonstrate ownership of the device or subscription you are asking about.

Children's Privacy

Wordify is not directed at children under 13. In certain jurisdictions (including parts of the European Economic Area), parental consent is required for users under 16. We do not knowingly collect personal data from children below the applicable age in their country of residence.

If you are a parent or guardian and believe your child has used the App in a way that may have transmitted personal data to us, please contact us at mystixtechdev@gmail.com and we will delete any such data promptly.

Data Security

We implement reasonable technical and organisational measures to protect your data:

• All network communication uses HTTPS/TLS encryption
• Local app data is stored on your device using your device's standard application storage and does not leave your device unless you choose to share it
• Access to Firebase, RevenueCat, and other processor dashboards is protected by strong authentication
• We never store payment card details on our servers (Apple and Google handle these)

No method of electronic storage or transmission is 100% secure, but we work to use commercially acceptable means.

Cookies and Tracking on the Website

The Website (https://wordify.it) is a marketing site that uses minimal cookies:

• Essential cookies — required for the site to function (no consent needed)
• Analytics cookies — only after you accept via the cookie banner (if present)

The mobile App does not use cookies.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will:

1. Update the "Last Updated" and "Effective Date" at the top
2. Post the new version at https://wordify.it/privacy
3. For material changes (new categories of data collected, new processors, changed legal basis), we will notify users via an in-app message before the changes take effect

We encourage you to review this Privacy Policy periodically.

Contact Us

For any privacy-related question, request, or concern:

• Email: mystixtechdev@gmail.com
• Website: https://wordify.it
• Postal address: Denis Šunkin, Pune tee 9 - 9, 12015 Tallinn, Estonia

We aim to respond within 5 business days.

Summary

Wordify respects your privacy:

• ✅ Most of your data stays on your device — never sent to us
• ✅ The App works fully offline
• ✅ No accounts, no email collection, no precise location tracking
• ✅ No advertising identifiers used
• ✅ Anonymous analytics only — opt out anytime in Settings
• ✅ You can request deletion of any data we process