Privacy Policy
Last updated 7 November 2026
This policy explains what data the Wortken app collects, why, who it is shared with, and how you can delete it.
Wortken is a vocabulary app for iPhone and Android, published by Ayaz Shahid as an individual developer (“we”). Questions go to hello@wortken.app.
The short version
- Your words and your sentences are stored on your phone.
- Sentences and photos are sent to our server only so they can be checked or read. We don’t store them.
- No ads, and no third-party analytics or tracking. We don’t sell your data.
- You can delete your account and its data from the app at any time.
Data stored only on your phone
Your vocabulary, word history, the sentences you write or say, your progress and your settings are kept in a local database on your phone. Your sign-in session is kept in the phone’s secure storage (Keychain on iPhone, Keystore on Android). Uninstalling the app removes all of it.
Data we collect, and why
Account details
The user ID from Google or Apple, your email address and your name, as the sign-in service provides them. For Sign in with Apple we also keep a token, used only to revoke Apple access when you delete your account. Why: to sign you in.
Learning settings and totals
The language you learn, your translation language, level, rhythm settings and summary totals, backed up about once a day. Why: to restore your setup on a new phone and pick words at your level.
Words you have been given
The list of headwords, not your sentences. Why: so the same word doesn’t come twice.
Daily activity counts
For each day, the number of accepted sentences (spoken and written), words met, words that became known and your known total, plus your time zone. Why: to calculate your streak and weekly numbers, which friends can see.
Public profile (optional)
An @username, a display name, who may find you (everyone, only people with your link, or nobody; the default is “only with my link”) and a private invite code. Why: so friends can find and add you.
Friends, blocks and reports
Who you are friends with, who you have blocked, and any report you make about a profile (reason, plus the username and name it showed). Why: to run the friends feature and keep it safe.
Challenges
The exercises you send to or receive from a friend, the answers and the score. Why: to deliver challenges and show results.
Push notification token
A token for your device, plus the app’s language. Why: to tell you when a friend sends a challenge or a request. Word echoes are scheduled on the phone itself and don’t use this token.
Device ID and request count
A random ID made by the app, plus how many requests it made that day. Why: to prevent abuse and keep usage within limits.
Data that is processed but not stored
- Sentences. When you ask for feedback, your sentence goes to our server and to the AI service listed below so it can be checked. We don’t save it.
- Photos of word cards. If you import words with the camera or from your photos, the images go to our server and to the AI service to read the words, and aren’t stored. The app only sees photos you choose.
- Word lookups. Words you look up are sent to the server. The results are cached so they come back faster, but the cache isn’t linked to you.
- Voice. Speech is turned into text by your phone’s built-in speech recognition (Apple on iPhone, Google on Android), under Apple’s or Google’s own privacy terms. Wortken never receives your audio, only the text.
Permissions
- Microphone and speech recognition: to hear the sentence you say, only while you record.
- Camera and photos: only when you import word cards, or save your progress picture.
- Notifications: for word echoes and friend activity.
Who we share data with
Only service providers that run the app for us:
- Cloudflare hosts our server and database.
- Google (Gemini API) is the AI model that writes word cards, checks sentences and reads word-card photos. Google processes this data under its Gemini API terms, which govern how long it keeps the data and whether it may use it to improve its services.
- Google and Apple verify your identity when you sign in.
- Expo, Apple Push Notification service and Firebase Cloud Messaging deliver push notifications.
Friends can see your public profile and activity numbers (streak, weekly counts, known words). They never see your words or sentences, except the exercises in a challenge you send them. We don’t sell personal data or use it for advertising. We may disclose data if the law requires it.
Keeping and deleting your data
Account data is kept while your account exists. To delete it, open the app and go to Rhythm → Account → Delete account. This permanently removes your account, profile, friends, challenges, activity counts, push tokens and backups from our server, and revokes Sign in with Apple access. You can also ask by email; see Delete your account.
Security
All traffic between the app and our server is encrypted (HTTPS). Sign-in tokens are checked against Google’s and Apple’s public keys, and your session token sits in your phone’s secure storage.
Children
Wortken isn’t aimed at children under 13, and we don’t knowingly collect data from them. If you think a child has given us data, write to us and we will delete it.
Your rights
Depending on where you live (for example under the GDPR in the EU and UK), you may have the right to access, correct, export or delete your personal data, and to object to or restrict its processing. We process account data to provide the service you asked for. To use any of these rights, email hello@wortken.app. You can also complain to your local data protection authority.
Changes
When this policy changes, the date at the top changes too. For significant changes we will also tell you in the app.