Privacy Policy

1. Who we are

WordBonk ("we", "our", "us") operates the website wordbonk.app, the WordBonk mobile apps, and the WordBonk browser extension (together, the "Service"). The data controller is [OPERATOR ENTITY], [REGISTERED ADDRESS, ANTIGUA & BARBUDA]. As we have no establishment in the EU or UK, our EU representative (Art. 27 GDPR) is [EU REPRESENTATIVE + ADDRESS] and our UK representative is [UK REPRESENTATIVE + ADDRESS]. You can reach us about privacy at [privacy@wordbonk.app].

2. Data we collect

• Account & identity: username, email address, password (stored only as a bcrypt hash), chosen role (student/teacher), student code, and — if you enable it — two-factor authentication data.
• Profile: optional bio, avatar image, native/target/interface languages, timezone offset, and theme.
• Content you create: vocabulary cards, definitions and examples, images you upload or capture with "scan to card", books you upload, and word packs.
• Communications: global-chat messages, direct messages, support tickets and their attachments.
• AI interactions: the prompts you send to AI features and the responses generated (a short preview of each is stored — see §6).
• Usage & technical: study/review activity, achievements and streaks, timestamps, approximate timezone, and error diagnostics (browser/user-agent string, the page path, and error traces) used to keep the Service reliable.

3. Why we process it, and our legal basis

• To provide the learning service and your account — performance of a contract (GDPR Art. 6(1)(b)).
• To secure accounts, prevent abuse and debug errors — legitimate interests (Art. 6(1)(f)).
• To send transactional emails (verification, password reset) — contract.
• Where we ask for it (e.g. optional features) — your consent (Art. 6(1)(a)), which you can withdraw at any time.

We do not use your data for advertising or profiling, and we do not sell or "share" it for cross-context behavioural advertising (as those terms are defined under California law).

4. AI features

Word and context explanations, the AI tutor, book chat, voice chat, sentence checking and "scan to card" use automated AI systems. To generate responses, your input — text and, for scans, the image — is sent to our AI providers Google (Gemini) and Groq. AI output is generated automatically and may be inaccurate; see our AI & Content Disclaimer. Please do not enter sensitive personal information into AI features.

5. Who we share data with (sub-processors)

We use the following service providers to operate the Service. A current list is maintained at [/subprocessors].

• Google — Gemini AI, and Google Translate for translation/pronunciation.
• Groq — AI text and vision generation.
• Microsoft — Edge neural text-to-speech (audio pronunciation).
• Resend — sending transactional email (receives your email address).
• RapidAPI / Filmot and YouTube (Google) — vocabulary video clips.
• Webshare — network proxy used for video-clip lookups.
• Dictionary sources — Wiktionary, dictionaryapi.dev, Kaikki and other language-specific dictionary APIs (receive the looked-up word only).
• Open Library — book cover images.
• Hosting — [HOSTING PROVIDER + REGION].

We share only what each provider needs for its function, and never for their own advertising.

6. Retention

We keep account data while your account is active and delete it within [30] days after you delete your account. AI interaction logs, error diagnostics and activity logs are kept for a limited period and then automatically purged. Full details are in our Cookie Policy and Data Retention & Deletion Policy.

7. International transfers

Some providers listed in §5 process data outside your country, including in the [United States]. Where required, such transfers rely on [Standard Contractual Clauses / applicable adequacy decisions]. Contact us for a copy of the safeguards.

8. Your rights

Depending on where you live, you have the right to access, correct, delete, restrict or object to processing, port your data, and withdraw consent. You can:

• Export your data and delete your account yourself in Settings → Privacy (self-service).
• Contact [privacy@wordbonk.app] for any other request.

You may also complain to your data-protection authority (EU/UK/Switzerland) or your state Attorney General (US).

9. Children

WordBonk is intended for users aged 16 and over. We do not knowingly collect personal data from children below that age. If you believe a child has registered, contact [privacy@wordbonk.app] and we will delete the account and associated data.

10. Security

We protect data with encryption in transit (HTTPS/TLS), bcrypt password hashing, optional two-factor authentication, network isolation and access controls. No system is perfectly secure; we cannot guarantee absolute security.

11. Changes

We may update this policy from time to time. Changes are posted here with a new "last updated" date; for material changes we will notify you. Continued use after changes take effect constitutes acceptance.