Privacy Policy

Introduction

Welcome to Wordify. Wordify is operated by Sidewind OÜ ("we," "our," or "us"). We are committed to protecting your privacy and being transparent about the limited data we process. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you have over your data when you use the Wordify mobile application (the "App") or visit https://wordify.it (the "Website").

By using Wordify, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the App.

Data Controller

The Data Controller responsible for processing your personal data is:

• Sidewind OÜ
• Registry code 17593317 (Estonian Commercial Register)
• Tallinn, Harju maakond, Estonia
• Email: support@sidewind.dev
• Website: sidewind.dev

If you live in the European Economic Area (EEA), the United Kingdom, or Switzerland, this entity is your point of contact for any privacy-related questions or to exercise your rights under GDPR/UK GDPR.

Wordify was previously published by its founder as an individual developer. As of the Effective Date above, Sidewind OÜ has taken over the App and the Website and is the data controller for all data described in this Privacy Policy. Nothing about what data is processed or how has changed.

Information We Collect

1. Information Stored Locally on Your Device

Wordify is designed to be offline-first. The following information is stored only on your device and is not transmitted to us:

• Words and translations - both pre-installed collections and any custom words you add
• Learning progress - review history, mastery levels, streak counter, activity heatmap data
• App settings - interface language, learning language, notification preferences, daily goal, theme
• Custom images - any images you attach to your own custom words via camera, gallery, or the Pixabay search feature

This data never leaves your device unless you choose to share it (e.g., via the system share sheet to share your activity heatmap as an image), to back it up as described in "Optional Backups" below, or to send a photo for recognition as described in "Adding Words by Photo".

2. Anonymous Analytics Data

When analytics is enabled (default ON, opt-out available in Settings → Share anonymous usage data), we use Firebase Analytics to understand how the App is used. The following categories of data are processed:

• App interactions - screen views, feature usage, session duration
• Subscription events - trial started, subscription purchased (without your name, email, or payment details)
• Device information - device model, operating system version, app version, language setting
• Approximate location - country and city derived from IP address (we do not access GPS)
• Pseudonymous identifier - a Firebase Installation ID that is not linked to your real identity and resets if you reinstall the App

We have configured Firebase to not collect data for advertising purposes - specifically, advertising identifiers (IDFA on iOS, AAID on Android) are NOT used, and we have set Firebase consent flags adStorageConsentStatus, adUserDataConsentStatus, and adPersonalizationSignalsConsentStatus to denied.

You can disable analytics entirely at any time in Settings → Share anonymous usage data.

Crash Reports

When the App crashes or hits an unexpected error, we use Firebase Crashlytics to receive a crash report so we can fix the problem. A crash report contains:

• Technical details of the error - where in the App's code it happened
• Device information - device model, operating system version, app version, and the device's state at the time (for example, free memory and orientation)
• Recent technical steps - short, non-personal notes such as which screen was opened or which subscription plan a purchase was started for
• Pseudonymous identifier - a Crashlytics installation ID that is not linked to your real identity

Crash reports do not contain your words, translations, custom images, or backups. The same setting, Settings → Share anonymous usage data, turns crash reporting off as well.

3. Subscription Data

If you purchase a Wordify Premium subscription (Monthly, Yearly, or Lifetime), the following is processed by RevenueCat (our subscription management provider):

• A pseudonymous user identifier (randomly generated, not linked to your real identity)
• Purchase information (product, price, currency, transaction ID)
• Subscription status and renewal events
• Device type and operating system version
• App Store / Play Store transaction receipts

Payment is processed by Apple (App Store) or Google (Play Store) - we never see your credit card details, name, email, or billing address.

4. Optional Backups (iCloud, Google Drive, Backup File)

You can back up your Wordify data to move it to another device or keep it safe. Backups are always started by you, and they are stored in a place you choose. We never receive or store your backups.

A backup contains:

• Your saved words, translations, and custom words, for every language pair
• Your learning progress, streak, Streak Freezes, daily goal, activity history, and practice statistics
• Images you attached to your custom words
• Your learning and interface language
• The name of the device that made the backup (for example, "iPhone"), the backup date, and the app version, so you can tell backups apart

A backup does not contain your notification settings, your subscription status, or any analytics or advertising identifier.

You can choose where the backup goes:

• Backup file - the App creates a file and opens your device's share sheet. You decide where the file goes, for example your Files app, an email, or a messaging app.
• iCloud (iPhone and iPad) - the backup is saved in Wordify's private folder in your own iCloud account. It is stored and protected by Apple under Apple's privacy policy. We have no access to your iCloud account. Wordify does not ask for your Apple Account details.
• Google Drive (iPhone, iPad, and Android) - see below.

Google Drive backup and Google user data

If you choose Google Drive to back up your Wordify data, you sign in with Google and allow Wordify access to its own private app folder in your Google Drive (the Google permission called drive.appdata). This folder is hidden from your Drive file list. With this permission Wordify can only create, read, update, and delete the backup files it put there itself. Wordify cannot see, open, or change any other file in your Google Drive.

From your Google account, Wordify uses only:

• The Wordify backup files in the app folder - to save your backup and to restore it when you ask
• Your Google account email address - shown in the App so you can see which account is connected. It stays on your device and is never sent to us.

The App talks to Google directly from your device. We do not run a server that receives your backup or your Google data, and we never transfer it to anyone else. Google user data is not used for advertising, is not sold, and is not used to develop, improve, or train artificial intelligence or machine learning models. Nobody at Sidewind OÜ reads it.

Wordify's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You stay in control:

• Disconnect - tap Disconnect in the App's Backup and restore screen to sign out of Google
• Revoke access - remove Wordify at myaccount.google.com/permissions
• Delete the backup from Google Drive - in Google Drive on the web, open Settings, then Manage apps, find Wordify, and choose Delete hidden app data
• Delete the backup from iCloud - on your iPhone or iPad, open Settings, tap your name, then iCloud, then manage your storage, choose Wordify, and delete its data

5. Adding Words by Photo (AI Recognition)

Add by photo is an optional feature: you take or choose a photo of an object, and the App suggests the word for it in the language you are learning, with a translation and example sentences. Before your first photo is sent, the App asks for your permission. When you use the feature, the App sends the following over an encrypted connection to our server, which runs on Cloudflare Workers:

• The photo you took or chose, reduced to at most 1024 pixels on its longest side
• Your learning language and interface language
• Your pseudonymous RevenueCat identifier (the random ID described under "Subscription Data"), to apply usage limits and to check whether you have Premium

Our server passes the photo and the two languages, without your identifier, to Anthropic's Claude API. Claude checks the photo for unsafe content, names the objects in it, translates them and writes example sentences. The answer comes back to the App and you decide whether to save the word. A photo you keep as the word's picture stays on your device like any other custom image.

• We do not store your photo. Our server holds it only in memory while your request is processed.
• Anthropic does not use it to train its models. Anthropic processes the photo for us under its Data Processing Addendum, deletes API inputs and outputs within 30 days, and keeps them longer (up to 2 years) only if its safety systems flag a request, to detect and prevent abuse.
• Usage counts. To apply the free and daily limits, our server keeps, per pseudonymous identifier and day, how many photos were sent and how many were recognised. No photos, words, or IP addresses are kept with these counts. They are deleted automatically after 12 months.
• Network counts. So that the free photos can't be claimed over and over, our server also counts, per network and day, how many free photos were sent. The network is recorded only as a one-way code made from your IP address with a secret key and the date: the address itself is not kept, and the code can't be turned back into it or linked to other days. These counts are deleted automatically the next day.
• Technical logs. Cloudflare keeps short technical logs of requests to our server (such as the time, the result, and the amount of AI processing used, but not your photo) for up to 7 days, so we can keep the service running.
• Unsafe content. Photos showing nudity or sexual content, graphic violence, drugs, weapons aimed at people, or hate symbols are refused, and nothing in them is named.
• Where it is offered. Our AI provider's terms do not allow its use by people in Russia, Belarus, or the occupied regions of Ukraine, so Add by photo is switched off there, based on the approximate location of your IP address.

Please do not photograph people or documents with personal information. The feature names objects, never people. Everything else in the App works without this feature and without an internet connection.

6. Information We Do NOT Collect

To be clear, we do not collect or process:

• Your name, email address, phone number, or any account credentials (we have no account system; if you connect Google Drive, your Google email is only shown on your device). The one exception is the optional desk display waitlist on the Website, described below, where you give us your email yourself.
• Precise location (GPS coordinates)
• Contacts or address book
• Photos or media other than images you choose to attach to your own custom words or send for recognition with Add by photo
• Browsing history outside the App
• Advertising identifiers (IDFA / AAID)
• Microphone, camera (except briefly when you take a photo for a custom word or for Add by photo)
• Health, biometric, or financial information

Legal Basis for Processing (GDPR/UK GDPR)

Where the GDPR or UK GDPR applies (i.e., users in the EEA, UK, or Switzerland), we rely on the following legal bases:

Third-Party Services

We share limited data with the following processors. Each acts under a Data Processing Agreement and we have configured them to minimise data sharing where possible.

Firebase Analytics and Firebase Crashlytics (Google LLC)

• What is shared: Anonymous app usage events, device info, IP-based approximate location, Firebase Installation ID, and crash reports as described above
• Purpose: Aggregate analytics to understand and improve the App, and finding and fixing crashes
• Data location: Firebase project located in the European Union (Estonia/Finland region)
• Privacy policy: policies.google.com/privacy
• Data Processing Agreement: Google's standard Firebase DPA applies

RevenueCat (RevenueCat, Inc.)

• What is shared: Pseudonymous user identifier, purchase events, subscription status, device info
• Purpose: Subscription management, restoring purchases, preventing fraud, and, when you use Add by photo, telling our server whether your identifier has Premium
• Privacy policy: revenuecat.com/privacy

Cloudflare (Cloudflare, Inc.)

• What is shared: Add by photo requests (the photo, your learning and interface language, your pseudonymous identifier) and your IP address
• Purpose: Running our server, which passes photos on for recognition and keeps the usage and network counts described above
• Data location: Requests are handled at the Cloudflare location nearest to you; usage counts are stored in Western Europe
• Privacy policy: cloudflare.com/privacypolicy
• Data Processing Agreement: Cloudflare's standard DPA applies

Anthropic (Anthropic, PBC; Anthropic Ireland, Limited for EEA customers)

• What is shared: Photos you send with Add by photo and your learning and interface language, without your identifier
• Purpose: Checking the photo for unsafe content, naming the objects in it, translating them and writing example sentences, using the Claude AI model
• Data use: Not used to train Anthropic's models; API inputs and outputs deleted within 30 days, or kept up to 2 years if flagged by safety systems
• Data location: Processed in the United States or other regions where Anthropic runs its models
• Privacy policy: anthropic.com/legal/privacy
• Data Processing Agreement: Anthropic's Data Processing Addendum, including the EU Standard Contractual Clauses, applies

Pixabay (Pixabay GmbH)

• What is shared: Your search queries (when adding images to custom words), IP address
• Purpose: Returning matching images
• Privacy policy: pixabay.com/service/privacy

Apple iCloud and Google Drive (only if you use backups)

These are your own storage accounts, not services we use to process your data. When you back up, the App saves the backup directly into your iCloud or Google Drive account. Apple and Google store it under their own privacy policies, linked below. We do not receive a copy.

Apple App Store / Google Play Store

When you download or purchase, Apple or Google process the transaction directly. Their privacy practices are governed by:

• Apple: apple.com/legal/privacy
• Google: policies.google.com/privacy

International Data Transfers

Although we have configured Firebase to use a European data location, some of our processors (Google, RevenueCat, Cloudflare, Anthropic) operate globally. When your data is transferred outside the EEA, UK, or Switzerland, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission, OR
• UK Addendum to the SCCs for UK users, OR
• An adequacy decision by the European Commission for the destination country

You may request a copy of the safeguards in place by contacting us at the address above.

Data Retention

We retain data only as long as necessary for the purpose it was collected:

You may request earlier deletion at any time, see "How to Delete Your Data" below.

Your Rights

Depending on where you live, you have some or all of the following rights:

For EEA, UK, and Swiss residents (GDPR / UK GDPR)

• Right of access - request a copy of personal data we process about you
• Right to rectification - correct inaccurate data
• Right to erasure ("right to be forgotten") - request deletion of your data
• Right to restrict processing - limit how we use your data
• Right to object - object to processing based on legitimate interest (including analytics)
• Right to data portability - receive your data in a structured, machine-readable format
• Right to withdraw consent - at any time, without affecting the lawfulness of processing before withdrawal
• Right to lodge a complaint - with your local supervisory authority. For Estonia: Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee). For Poland: Urząd Ochrony Danych Osobowych (uodo.gov.pl). For other EU countries: see edpb.europa.eu

For California residents (CCPA/CPRA)

• Right to know what personal information is collected and shared
• Right to delete your personal information
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of personal information (we do not sell or share data for cross-context behavioural advertising)
• Right to non-discrimination for exercising your rights

To exercise any right, contact us at support@sidewind.dev. We will respond within 30 days (or as required by your local law). We may need to verify your identity before fulfilling certain requests; for an app without accounts, this typically means we will ask you to demonstrate ownership of the device or subscription you are asking about.

Children's Privacy

Wordify is not directed at children under 13. In certain jurisdictions (including parts of the European Economic Area), parental consent is required for users under 16. We do not knowingly collect personal data from children below the applicable age in their country of residence.

Teenagers use Wordify to learn languages, and we design it with that in mind. We comply with the child protection and data privacy laws that apply to the App, including the GDPR and UK GDPR (with their rules on the age of digital consent) and the US Children's Online Privacy Protection Act (COPPA). For the AI feature Add by photo, the App says before the first photo that an AI service will process it and asks for permission, refuses unsafe images, and limits how often it can be used.

If you are a parent or guardian and believe your child has used the App in a way that may have transmitted personal data to us, please contact us at support@sidewind.dev and we will delete any such data promptly.

Data Security

We implement reasonable technical and organisational measures to protect your data:

• All network communication uses HTTPS/TLS encryption
• Local app data is stored on your device using your device's standard application storage and does not leave your device unless you choose to share it or back it up
• Google Drive access is limited to Wordify's own app folder, and backups travel directly between your device and your storage account over encrypted connections
• Photos sent with Add by photo are not stored on our server, and the AI provider's key never leaves our server
• Access to Firebase, RevenueCat, and other processor dashboards is protected by strong authentication
• We never store payment card details on our servers (Apple and Google handle these)

No method of electronic storage or transmission is 100% secure, but we work to use commercially acceptable means.

Cookies and Tracking on the Website

The Website (wordify.it) is a marketing site that uses minimal cookies. Third-party tags are loaded only after you accept via the cookie banner:

• Essential cookies - required for the site to function and to remember your cookie choice (no consent needed)
• Google Analytics - measures how the site is used (pages viewed, store-button clicks) so we can improve it
• Google Ads (conversion measurement) - measures the performance of our advertising, such as whether a visit followed from one of our ads. We do not use it to sell your data or for cross-site behavioural advertising.

You can decline at any time via the banner - the site works exactly the same. Both Google services are governed by Google's privacy policy. The mobile App does not use cookies and does not load Google Ads.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will:

1. Update the "Last Updated" and "Effective Date" at the top
2. Post the new version at wordify.it/policy
3. For material changes (new categories of data collected, new processors, changed legal basis), we will notify users via an in-app message before the changes take effect

We encourage you to review this Privacy Policy periodically.

Contact Us

For any privacy-related question, request, or concern:

• Email: support@sidewind.dev
• Website: wordify.it
• Registered office: Sidewind OÜ, Tallinn, Harju maakond, Estonia

We aim to respond within 5 business days.

Summary