Privacy policy

How Vokably handles your data · last updated 2026-09-21

1. Who is responsible

The controller for the purposes of the GDPR is Mohammad Saboor, contact@vokably.com.

2. What we collect, and why

Account data. Your email address and, if you sign in with Google, your name and profile picture. If you register with a password, we store only a bcrypt hash of it — never the password itself. Purpose: to create and secure your account. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.

Learning data. Which words you have studied, which box each sits in, when each is next due, your answers, how long you took, your streak, and your game scores. Purpose: to provide the service — without it there is nothing to schedule. Legal basis: Art. 6(1)(b) GDPR.

Server logs. Our web server records the requesting IP address, timestamp, page requested, referrer and browser user-agent. Purpose: operating and securing the service, and diagnosing faults. Legal basis: legitimate interests, Art. 6(1)(f) GDPR.

We do not collect special category data, we do not profile you for advertising, and we make no automated decisions with legal effect.

3. Cookies and similar technologies

Strictly necessary. Three cookies, used to sign you in and to protect the sign-in form. None are set until you interact with the sign-in page.

• __Secure-authjs.session-token — keeps you signed in. Expires when the session ends.
• __Host-authjs.csrf-token — protects against cross-site request forgery on the sign-in form.
• __Secure-authjs.callback-url — returns you to the page you came from after signing in.

All three are HttpOnly, Secure and SameSite=Lax, meaning they cannot be read by scripts and are not sent on cross-site requests. Because they are strictly necessary for a service you have explicitly requested, they need no consent under §25(2) TDDDG.

Visit statistics — no cookies, no consent needed. We count page views using Umami, which we run ourselves on the same server in Finland as the rest of the site. Nothing is stored on or read from your device, so there is nothing to consent to under §25(2) TDDDG, and no data leaves our server.

It records the page you viewed, the referring site, and the country, browser and device type worked out from your IP address and browser string. Those two are used to derive a visitor number and are then discarded: your IP address is never stored. The visitor number is a one-way hash including a secret that changes daily, so the same browser cannot be recognised from one day to the next, and never across other websites.

Legal basis: our legitimate interest in knowing which parts of the site are used, Art. 6(1)(f) GDPR. You can object under Art. 21 at the address below. We consider the impact minimal precisely because nothing identifying is kept — but if you would rather not be counted at all, say so and we will tell you how to block it.

Google Analytics — optional, and off by default. With your consent we also use Google Analytics 4 to count visits and see which pages are used. It stores _ga and _ga_<id> on your device for up to two years to recognise a returning browser.

Until you choose “Allow analytics”, the Google script is not loaded at all: no cookie is written and no request is made to Google. Declining leaves the site working exactly as it does otherwise — there is no feature, and no part of any page, that depends on agreeing.

Legal basis: your consent, Art. 6(1)(a) GDPR and §25(1) TDDDG. Consent is asked for by category, so you can allow some things and not others, and you can change any of it at any time through Cookie settingsat the foot of any page. Withdrawing deletes that category’s cookies immediately, and does not affect the lawfulness of anything done beforehand.

We have not enabled Google Signals, advertising features or data sharing for advertising purposes, and advertising storage is switched off in the tag itself. We never send your email address, your name or your learning data to Google Analytics.

4. Who else processes your data

• Hetzner Online GmbH — hosting. Our server and database are in Helsinki, Finland, inside the EEA.
• Google Ireland Limited— only if you choose “Continue with Google”. Google then tells us your email address, name and profile picture. If you register with a password instead, no data reaches Google. Signed in with Google, your browser also loads your profile picture from Google’s servers, which discloses your IP address to Google.

• Google Ireland Limited— Google Analytics, and only if you have allowed it. Your IP address, the pages you view and general device information are processed to produce visit statistics. Google may transfer this to servers in the United States; that transfer relies on the European Commission’s adequacy decision of 10 July 2023 for the EU–US Data Privacy Framework, of which Google LLC is a certified participant, together with the standard contractual clauses in Google’s terms. Despite that framework, a US authority may be able to access data held there, and you cannot be guaranteed the same remedies as within the EU. If that is not acceptable to you, decline — nothing is sent.

Our visit statistics are not in this list because nobody else is involved: Umami runs on our own server, and the figures never leave it.

We use OpenAI to generate the German stories in the Fill the Story game. No user data is sent to OpenAI — stories are written in advance from vocabulary prompts and stored in our own database.

We do not sell your data and we share it with nobody for advertising.

5. How long we keep it

Account and learning data are kept for as long as your account exists. Deleting your account erases them immediately. Server logs are kept for a short period for security and diagnostics and are then rotated out.

6. Your rights

Under the GDPR you can request access to your data (Art. 15), correction (Art. 16), erasure (Art. 17), restriction (Art. 18), a portable copy (Art. 20), and object to processing based on legitimate interests (Art. 21). Where we rely on your consent — currently only for analytics — you can withdraw it at any time under Art. 7(3), using Cookie settings at the foot of any page.

You can delete your account yourself at any time under Settings → Delete account. That erases your account and all learning data immediately and permanently. For anything else, email contact@vokably.com. You may also complain to a data protection supervisory authority (Art. 77).

7. Security

The site is served over HTTPS only. Passwords are stored as bcrypt hashes. The database is not reachable from the public internet — it listens only on an internal Docker network.

8. Changes

We will update this page when what we do with data changes, and the date at the top will change with it.