Privacy Policy

Vocab Decoded (“we”, “our”, or “us”) respects your privacy. This Privacy Policy explains what information we collect from you when you use the Vocab Decoded mobile application and website, how we use that information, who we share it with, and the choices and rights you have. By using Vocab Decoded you agree to the practices described here. If you do not agree, please do not use the app.

1. Information We Collect

• Name — provided by you at sign-up or synced from your Google account.
• Email address — collected when you create an account with us, log in via Google, or use email-based OTP sign-in. We use it to log you in, recover your account, manage your Premium subscription, and (only if you opt in) send occasional service updates and a daily vocabulary digest. Your email is never sold, rented, or shared with advertisers.
• Phone number — only when you choose mobile OTP sign-in. We share it with MSG91 (see §3) so a one-time password can be delivered to you by SMS. We never place marketing calls or send promotional SMS.
• Usage data — words you view, quizzes you attempt, streaks, time spent in the app, feature interactions, device model, OS version, app version and anonymised crash logs. This is used only to improve the app.

1a. Where We Send Your Email Address

Your email address is transmitted only to these destinations, always over HTTPS:

• Our own secure MongoDB database — for authentication and profile storage.
• Resend — for transactional emails (password reset, optional vocabulary digest) if you have opted in.
• Google / MSG91 — when you sign in with those providers, they send your email back to us so we can match or create your account.

We do not transmit your email to analytics providers, ad networks, or any other third party.

2. How We Use Your Information

• To provide the service — showing vocabulary, saving your bookmarks, tracking streaks, syncing progress across devices, and authenticating you when you sign in.
• To improve the app — analysing anonymised usage patterns so we can fix bugs, prioritise features, and make the learning experience better.
• To communicate with you — responding to support requests and sending critical service announcements (e.g. important security updates).
• We do not sell your personal data. We do not use your data for advertising or third-party marketing.

3. Third-Party Services We Use

• Razorpay — processes payments when you purchase a Premium subscription. Card / UPI / net-banking details are entered directly on Razorpay's secure checkout. We only receive a payment confirmation, order ID and the amount charged; we never see or store your card number, UPI PIN or bank credentials. Razorpay's policy: razorpay.com/privacy.
• MSG91 — delivers one-time-password SMS to verify your mobile number when you choose OTP sign-in. Only your phone number and a temporary reference ID are shared with MSG91 for this purpose. Their policy: msg91.com/policy/privacy.
• Google — if you sign in with Google we receive your name, email and profile picture as returned by Google's OAuth service. Google's policy: policies.google.com/privacy.
• Resend — sends transactional email such as password-reset links and (if you opt in) our vocabulary digest. Their policy: resend.com/legal/privacy-policy.

4. Data Storage & Security

• Your data is stored on secure MongoDB servers with encryption in transit (HTTPS/TLS) and access-controlled at rest.
• Passwords are stored as one-way bcrypt hashes — we cannot see or recover them.
• Uploaded images and PDFs are stored on Tigris Object Storage under signed URLs with restricted access.
• No system is 100% secure, but we follow industry standards to protect your information and notify affected users promptly in the event of a breach.

5. Data Retention

• We keep your account data for as long as your account is active. If you request deletion (see §6), we permanently remove your personal data within 30 days, except where we're legally required to retain records (e.g. tax invoices).
• Anonymised analytics may be retained indefinitely because they cannot be linked back to any individual user.

6. Your Rights

• Access & Correction — view or edit your name and email inside the app's Profile screen at any time.
• Account & Data Deletion — email us at either address in §8 with the subject line “Delete My Account”. We'll permanently remove your profile, learning progress, and any uploaded content within 30 days and confirm by email. You may also revoke Google or MSG91 access from those providers' own dashboards.
• Withdraw Consent — you may stop using the app at any time. Uninstalling the app stops all data collection; contact us if you also want your existing data erased.
• Data Portability — email us and we'll send a JSON export of your profile and learning history within 30 days.

7. Children's Privacy

• Vocab Decoded is designed for competitive-exam aspirants aged 13 and older. We do not knowingly collect data from children under 13. If you believe we have, please contact us and we will delete the information promptly.

8. Contact Us

Questions, deletion requests, or concerns? Reach us at:

We respond to all privacy-related enquiries within 7 business days.

9. Changes to This Policy

• We may update this Privacy Policy from time to time. Material changes will be highlighted inside the app or emailed to you before they take effect. The “Effective date” at the top always shows the current version.