This Privacy Policy describes how Maksym Sharov (Empresário em Nome Individual), NIF 310115493 ("Vunzo", "we", "us", or "our") collects, uses, stores, and discloses information when you use the Vunzo mobile app and related services (the "Service"). Vunzo is an app for learning foreign vocabulary using spaced repetition.

By using the Service, you agree to the practices described in this Policy. If you do not agree with it, please do not use the Service.

1. Data we collect

1.1. Account data

When you create an account, we process: your email address; whether it has been verified; (optionally) a display name; and your sign-in method (email and password, Google, or Apple). For email sign-in, your password is stored in hashed form by the Firebase Authentication service — we have no access to it in plain text.

1.2. Your learning content

This is the data you create while learning: words, phrases, verbs, and categories; translations, synonyms, example sentences, grammatical gender; your review progress under the spaced-repetition algorithm (SM-2): ease factor, interval, number of repetitions, next review date; "know / don't know" counters; your learning-day streak; and your settings (languages, theme, reminders, and so on).

1.3. Subscription data

If you subscribe to Vunzo Pro, we store: your Pro status, plan type, expiry date, platform (iOS/Android), environment (Production/Sandbox), and the transaction identifier received from the App Store or Google Play. We do not receive or store your payment card details — payments are handled entirely by Apple and Google.

1.4. Operational data

To operate the Service we process: a daily AI-hint usage counter (to enforce limits); and temporary one-time codes (for email verification, password reset, and account deletion) — these are stored only as a hash and are valid for 15 minutes.

1.5. Device permissions (microphone and speech)

If you use voice input to answer during review, the app requests access to the microphone and speech recognition. Audio is processed by your device's or operating system's speech recognition; we receive only the recognized text and do not store the audio itself. Word pronunciation (speech synthesis) is also performed by your device.

1.6. Data stored locally on the device

Your learning content and settings are stored on the device itself. For users without a subscription, the library is kept mostly locally; full cloud synchronization across devices is available with a Pro subscription.

1.7. Usage analytics (can be turned off)

To see how the app is used and where people get stuck, we use Google Analytics for Firebase. It records events such as: opening a screen, completing onboarding, adding a word, finishing a review session, opening the subscription page, and starting or completing a purchase. Alongside these we record the language pair you are learning, the size and score of a review session, and the amount and currency of a purchase.

What analytics does not receive: the words, translations, and sentences you write — only the fact that a word was added; your email address or account identifier — analytics events are not linked to your Vunzo account; advertising identifiers; and your precise location (Google may infer an approximate country from your IP address).

Analytics is tied to a random installation identifier generated by the SDK, which is reset when you reinstall the app. You can switch analytics off at any time in Settings → Privacy. The setting applies to the device you change it on and is deliberately not synced between your devices.

1.8. What we do NOT collect

We do not use advertising identifiers, cross-site trackers, or crash-reporting tools. We do not collect precise geolocation, your contacts, or your browsing history. We do not sell your data and do not use it for advertising.

2. How we use data

• to provide and operate the Service (store your library, calculate reviews);
• to synchronize data across your devices (for Pro subscribers);
• to authenticate you and protect your account;
• to provide AI translation and grammar hints;
• to process subscriptions and verify purchases on the server;
• to send operational emails (email verification, password reset, security notices, account deletion, welcome email);
• to show local review reminders (scheduled on the device);
• to see how the app is used and improve it (analytics — only while you have not switched it off);
• to prevent abuse and comply with the law.

We process data on the basis of performance of a contract (providing the Service), our legitimate interest (security and abuse prevention), and your consent (where applicable — for example usage analytics, which you can withdraw at any time in Settings).

3. AI features and processing of your text

When you use AI hints (translation, synonyms, example sentences, grammatical gender, verb government), two scenarios are possible:

• On-device. On some devices, hints are produced by a built-in model — in which case your text never leaves the device.
• In the cloud. In other cases (and for Pro subscribers), the request is sent to our server and from there to a third-party AI provider (Google Gemini or, as a fallback, DeepSeek). Only the word or phrase you entered and the language codes are sent to the provider; we do not send your email or your identity.

Responses are stored in a shared, anonymized cache so that other users don't repeat the same request. The cache stores the entered term and the response but does not store your identifier. As a result, an individual word or phrase you entered may remain in the shared cache even after you delete your account — but without any link to you.

Tip: do not enter personal or confidential data into AI hints. AI results may be inaccurate — verify anything important.

4. Who we share data with (service providers)

We do not sell your personal data. We rely on trusted providers that process data on our behalf and are obligated to protect it:

We may also disclose data if required by law, or to protect the rights, property, and safety of ourselves or others.

5. Payments and subscriptions

Vunzo Pro subscriptions are handled by the app stores (Apple App Store and Google Play). We do not see or store your payment card details. From the store we receive a purchase confirmation (a receipt or token), which we verify on our server in order to grant Pro access. Subscription management and refunds are handled through your account in the respective store.

6. Where data is stored

Your data is held in Google Cloud / Firebase infrastructure. Our application servers (cloud functions) run in the europe-west1 region (Belgium, EU), while the database (Firestore), file storage and the account records held by Firebase Authentication are located in the United States. Certain providers (AI providers, email service, payment systems) may process data in other countries — see "International data transfers".

7. How long we keep data

• Account data and learning content — for as long as your account exists; deleted when the account is deleted.
• Temporary codes — 15 minutes.
• Anonymized AI cache — kept indefinitely (low-value or empty results up to 365 days); contains no identifier of yours.
• Subscription data — for as long as needed to provide access and meet store and legal requirements.

8. Security

We apply technical and organizational safeguards: encryption of data in transit (TLS); Firestore access rules under which each user can access only their own data; server-side purchase verification; storage of passwords and codes in hashed form; and storage of API keys exclusively on the server. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your rights

Depending on your jurisdiction (including under the GDPR in the EU), you have the right to: access your data; correct it; delete it ("the right to be forgotten"); restrict and object to processing; port your data; withdraw consent; and lodge a complaint with a data protection supervisory authority (in Portugal, the Comissão Nacional de Proteção de Dados — CNPD).

Many of these actions are available directly in the app (editing content, changing settings, deleting your account). For other requests, contact us at privacy@vunzo.app.

10. Account deletion

You can delete your account in the app (the "Account" section). We will send a confirmation code to your email. After you confirm, we permanently delete your account and all associated data: learning content, settings, subscription status, usage counters, and authentication data. Anonymized entries in the shared AI cache are not deleted, as they are not linked to you. Deletion is irreversible.

11. Children

The Service is not intended for children under 13 (or, in jurisdictions where a higher age of consent for data processing applies, under that age; in most EU countries this is 16). We do not knowingly collect data from such children. If you believe a child has provided us with their data, contact us and we will delete it.

12. International data transfers

Your data may be processed outside your country. In particular, the Google (Firebase) database, file storage and account records are located in the United States, and operational emails, AI providers and payment systems may also process data in the United States and other countries. Google Gemini and DeepSeek are third-party AI providers; DeepSeek may process data outside the EU. For these transfers we rely on appropriate data-transfer mechanisms, in particular the European Commission's standard contractual clauses, which are incorporated into our data processing agreements with these providers.

13. Changes to this Policy

We may update this Policy from time to time. We will notify you of material changes in the app or by email. The date at the top of the document reflects the most recent update.

14. Contact

Maksym Sharov — Empresário em Nome Individual (sole proprietor)
NIF: 310115493
Rua Guerra Junqueiro 48, 2970-853 Cotovia, Sesimbra, Portugal
Email: privacy@vunzo.app
Website: vunzo.app