This Privacy Policy describes how Maksym Sharov (Empresário em Nome Individual), NIF 310115493 ("Vunzo", "we", "us", or "our") collects, uses, stores, and discloses information when you use the Vunzo mobile app and related services (the "Service"). Vunzo is an app for learning foreign vocabulary using spaced repetition.

By using the Service, you agree to the practices described in this Policy. If you do not agree with it, please do not use the Service.

1. Data we collect

1.1. Account data

When you create an account, we process: your email address; whether it has been verified; (optionally) a display name; and your sign-in method (email and password, Google, or Apple). For email sign-in, your password is stored in hashed form by the Firebase Authentication service — we have no access to it in plain text.

1.2. Your learning content

This is the data you create while learning: words, phrases, verbs, and categories; translations, synonyms, example sentences, grammatical gender; your review progress under the spaced-repetition algorithm (SM-2): ease factor, interval, number of repetitions, next review date; "know / don't know" counters; your learning-day streak; and your settings (languages, theme, reminders, and so on).

1.3. Subscription data

If you subscribe to Vunzo Pro, we store: your Pro status, plan type, expiry date, platform (iOS/Android), environment (Production/Sandbox), and the transaction identifier received from the App Store or Google Play. We do not receive or store your payment card details — payments are handled entirely by Apple and Google.

1.4. Operational data

To operate the Service we process: a daily AI-hint usage counter (to enforce limits); and temporary one-time codes (for email verification, password reset, and account deletion) — these are stored only as a hash and are valid for 15 minutes.

1.5. Device permissions (microphone and speech)

If you use voice input to answer during review, the app requests access to the microphone and speech recognition. Audio is processed by your device's or operating system's speech recognition; we receive only the recognized text and do not store the audio itself. Word pronunciation (speech synthesis) is also performed by your device.

1.6. Data stored locally on the device

Your learning content and settings are stored on the device itself. For users without a subscription, the library is kept mostly locally; full cloud synchronization across devices is available with a Pro subscription.

1.7. What we do NOT collect

We do not use third-party analytics, advertising identifiers, trackers, or crash-reporting tools. We do not collect precise geolocation, your contacts, or your browsing history.

2. How we use data

• to provide and operate the Service (store your library, calculate reviews);
• to synchronize data across your devices (for Pro subscribers);
• to authenticate you and protect your account;
• to provide AI translation and grammar hints;
• to process subscriptions and verify purchases on the server;
• to send operational emails (email verification, password reset, security notices, account deletion, welcome email);
• to show local review reminders (scheduled on the device);
• to prevent abuse and comply with the law.

We process data on the basis of performance of a contract (providing the Service), our legitimate interest (security and abuse prevention), and your consent (where applicable).

3. AI features and processing of your text

When you use AI hints (translation, synonyms, example sentences, grammatical gender, verb government), two scenarios are possible:

• On-device. On some devices, hints are produced by a built-in model — in which case your text never leaves the device.
• In the cloud. In other cases (and for Pro subscribers), the request is sent to our server and from there to a third-party AI provider (Google Gemini or, as a fallback, DeepSeek). Only the word or phrase you entered and the language codes are sent to the provider; we do not send your email or your identity.

Responses are stored in a shared, anonymized cache so that other users don't repeat the same request. The cache stores the entered term and the response but does not store your identifier. As a result, an individual word or phrase you entered may remain in the shared cache even after you delete your account — but without any link to you.

Tip: do not enter personal or confidential data into AI hints. AI results may be inaccurate — verify anything important.

4. Who we share data with (service providers)

We do not sell your personal data. We rely on trusted providers that process data on our behalf and are obligated to protect it:

We may also disclose data if required by law, or to protect the rights, property, and safety of ourselves or others.

5. Payments and subscriptions

Vunzo Pro subscriptions are handled by the app stores (Apple App Store and Google Play). We do not see or store your payment card details. From the store we receive a purchase confirmation (a receipt or token), which we verify on our server in order to grant Pro access. Subscription management and refunds are handled through your account in the respective store.

6. Where data is stored

Core data is stored in Google Cloud / Firebase infrastructure in the europe-west1 region (Belgium, EU). Certain providers (AI providers, email service, payment systems) may process data in other countries — see "International data transfers".

7. How long we keep data

• Account data and learning content — for as long as your account exists; deleted when the account is deleted.
• Temporary codes — 15 minutes.
• Anonymized AI cache — kept indefinitely (low-value or empty results up to 365 days); contains no identifier of yours.
• Subscription data — for as long as needed to provide access and meet store and legal requirements.

8. Security

We apply technical and organizational safeguards: encryption of data in transit (TLS); Firestore access rules under which each user can access only their own data; server-side purchase verification; storage of passwords and codes in hashed form; and storage of API keys exclusively on the server. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your rights

Depending on your jurisdiction (including under the GDPR in the EU), you have the right to: access your data; correct it; delete it ("the right to be forgotten"); restrict and object to processing; port your data; withdraw consent; and lodge a complaint with a data protection supervisory authority (in Portugal, the Comissão Nacional de Proteção de Dados — CNPD).

Many of these actions are available directly in the app (editing content, changing settings, deleting your account). For other requests, contact us at privacy@vunzo.app.

10. Account deletion

You can delete your account in the app (the "Account" section). We will send a confirmation code to your email. After you confirm, we permanently delete your account and all associated data: learning content, settings, subscription status, usage counters, and authentication data. Anonymized entries in the shared AI cache are not deleted, as they are not linked to you. Deletion is irreversible.

11. Children

The Service is not intended for children under 13 (or, in jurisdictions where a higher age of consent for data processing applies, under that age; in most EU countries this is 16). We do not knowingly collect data from such children. If you believe a child has provided us with their data, contact us and we will delete it.

12. International data transfers

Your data may be processed outside your country. In particular: core data is in the EU; operational emails, AI providers, and payment systems may process data in the United States and other countries. Google Gemini and DeepSeek are third-party AI providers; DeepSeek may process data outside the EU. Where required, we rely on appropriate data-transfer mechanisms (for example, standard contractual clauses).

13. Changes to this Policy

We may update this Policy from time to time. We will notify you of material changes in the app or by email. The date at the top of the document reflects the most recent update.

14. Contact

Maksym Sharov — Empresário em Nome Individual (sole proprietor)
NIF: 310115493
Rua Guerra Junqueiro 48, 2970-853 Cotovia, Sesimbra, Portugal
Email: privacy@vunzo.app
Website: vunzo.app