1. Responsible party
Service operator and data controller: Individual entrepreneur Мартинов Дмитро Олександрович (Dmytro Martynov), 104 Druzhby Street, Znamianka, Kirovohrad region, Ukraine. Tax identification number (РНОКПП): 3378800473. Contact: wellcabulary@gmail.com. Payment sellers and stores may act as separate controllers for payments, taxes and fraud prevention.
2. Data and purposes
In the reviewed code, Firebase Authentication handles email/password and Google sign-in, display name and user identifier. Firestore stores native and learning languages, dictionaries, words and expressions, translations, examples, transcriptions, timestamps of addition and use in cards/texts, request counters and reset dates, and subscription status fields. Feedback is stored with user identifier and creation time. Purposes include sign-in, personalised learning, fulfilling requests, support and usage control.
Paid-access verification may involve order identifiers, subscription status and transaction details. Data returned by Paddle / Google / Apple and developer access to payment details must be verified. Do not send card details to support.
3. Legal bases
Intended bases include contract performance for requested account and learning features, legal obligations for required records, a properly assessed legitimate interest in security, and separate consent for optional analytics or marketing where needed. Every actual operation must be mapped to a valid basis and reviewed under Ukrainian law before this policy is used.
Accepting terms is not blanket consent to all processing. Incompatible new uses require an appropriate legal basis and notice.
4. Firebase, OpenAI and international transfers
Code-confirmed Google / Firebase services are Authentication, Firestore, Cloud Functions, Storage for generated audio, and Firebase Hosting for the web app. OpenAI API receives selected words/expressions and language parameters for translation and speech synthesis. The code does not add your email or name to these AI requests. Audio is synthetic; no microphone recording was found in the reviewed code.
Submitted words and expressions are processed to fulfil learning requests; identifiers, technical request information, counters and errors are processed for security and usage control. Do not enter secrets or sensitive personal information. The landing site loads a font through Google Fonts, creating a request to Google with technical connection data. No separate advertising analytics were found in reviewed code; this is not a production traffic audit.
International processing may include the US: Firebase documents US-based Authentication processing, and the speech code requires US-EAST1 for audio storage. Firebase Cloud Functions and Firestore use europe-central2 (Warsaw, Poland); audio storage uses US-EAST1 (South Carolina, US). Other vendor services may process data in other countries. Under OpenAI API defaults, inputs and outputs are not used to train or improve models unless the API account owner separately opts in to data sharing for that purpose. This concerns training, not the absence of processing or retention. We still need to confirm that such sharing is disabled for the Wellcabulary account and verify vendor agreements, retention and international transfer safeguards. This draft does not promise zero retention or EU-only processing.
5. Deletion, retention and security
To delete your account, open Settings → Delete Account or email wellcabulary@gmail.com. Pressing Delete Account starts deletion immediately, with no waiting or account recovery period. For account security, you may need to sign in again; deletion then proceeds after verification. The account is deleted once the operation completes successfully. We undertake to delete the associated personal data except records that the law requires us to retain. This does not guarantee instant erasure by independent payment sellers and external providers with their own lawful obligations and processing rules. Such exceptions are restricted to the relevant lawful purpose and mandatory retention period.
We undertake to retain personal data only as long as necessary to provide services and fulfil legal obligations, and to apply appropriate technical and organisational safeguards. Absolute security cannot be guaranteed. The final version still needs retention periods for support correspondence, inactive accounts and mandatory records, and verification of deletion across all relevant systems.
6. Requests and rights
Email wellcabulary@gmail.com to request access, correction, account or data deletion, consent withdrawal or other rights under applicable law. Identity checks should be proportionate; do not send unnecessary identity documents. Withdrawal does not invalidate prior lawful consent-based processing.
Where GDPR applies, portability, objection, restriction and complaints to a competent authority are also available; the general response period is one month, subject to lawful exceptions. In Ukraine, you may contact the Ukrainian Parliament Commissioner for Human Rights or a court. Data deletion and store billing cancellation are separate processes; support can help with both.
7. Children and other disclosures
Wellcabulary is intended only for users aged 18 or older. We do not knowingly permit minors to register. If you know of an account belonging to a minor, contact wellcabulary@gmail.com so we can investigate, terminate access and delete their personal data subject to lawful exceptions. Any marketing or automated decisions with legal or similarly significant effects must also be verified and disclosed if used.