Privacy policy

Data we collect

• — Account: email address and password (stored hashed, never in plain text)
• — Profile: first name (if you give one), level, display and language preferences
• — Learning: the words you add, their generated definitions and examples, your review history (answers, response time, hints used), your choices in Discover, and the texts you write in Evening writing, with their corrections
• — Technical: server logs (IP address, browser) kept by our hosting providers, and a pseudonymous account ID in our own usage logs

Why

We use this data to run the service you asked for (performance of a contract), and for security, backups and cost control (legitimate interest). Nothing else.

Storage

Your data is stored with Supabase, in the European Union (Paris). The app’s server code runs on Vercel, also in Paris.

Service providers

• — Supabase: database and sign-in (EU, Paris)
• — Vercel: hosting of the site and server code (EU, Paris)
• — Anthropic (USA): receives Spanish words (the word or short phrase you type, the Discover words you keep and, for Discover, the words already in your list so it doesn’t repeat them) and, for Evening writing, the text you write (150 words at most), with your level and the language of your explanations, to correct it. Never your email, name or account ID. Please don’t write sensitive personal information in these texts.
• — Google Cloud Text-to-Speech: receives the word to produce its audio. Audio files are shared between learners and not linked to your account
• — Resend (EU, Ireland): sends the sign-in and password-reset emails to your address
• — GitHub (USA): keeps an encrypted backup of the database, unreadable without a key GitHub never holds

Paco is run from Tunisia, and some providers are outside the European Union; these transfers rely on the safeguards each provider offers.

How long we keep it

Your data is kept while your account exists. Encrypted backups are kept for 14 days, then erased. Our providers’ logs follow their own retention periods.

Cookies

Four cookies, all needed for the app to work: sign-in (up to 400 days), interface language, theme and your time zone, for the crossword’s day and the Evening writing time (1 year). No advertising or analytics cookies. Your text’s draft stays in your browser, on your device.

Your rights

You can access, correct or get a copy of your data, object to or restrict its use by writing to us (contact@pacovocab.com); we reply within one month. You can also complain to the data protection authority in your country.

Deleting your account

From the Account page, at any time. Your account, profile, words, texts and history are erased immediately. A copy may remain in the encrypted backups for up to 14 days, then disappears. Audio files, which are shared and not linked to your account, are kept.

Contact

Questions? contact@pacovocab.com