Vocab Cards keeps very little about you, and two things never happen: nothing is sold, and nothing feeds advertising. There are no ads and no tracking. The dictionaries come with Vocab Cards, so your searches never leave your device, and without an account your words stay on it too. The app counts how it is used, never with your words, your email or your account, and you can switch that off; the website counts nothing. An account, if you make one, keeps your word file with Google’s Firebase so that it follows you from device to device. What it holds is listed below, and the date at the bottom changes whenever this page does.
Without an account
Vocab Cards works in full without an account. The dictionaries for every language are files that come with the website and with the iPhone and iPad app. Searching them, building your file and reviewing it all happen on your device. These are kept on the device and nowhere else:
- Your word file: each word with its meaning, the list it is in, when you added it and where it stands in the review schedule, along with your languages, your review settings and how many cards you reviewed each day.
- A random identifier for this copy of Vocab Cards, which goes nowhere unless you make an account (it is the device identifier described below).
- On the website, your light-or-dark choice, and a copy of the site’s files, dictionaries, typefaces and any recordings you have played, kept by its service worker so that the site works offline.
In the app they live in the app’s own storage, and deleting the app removes them. On the website they live in your browser’s storage for this site, and clearing the site’s data removes them. The app’s usage counts, described below, are sent with or without an account until you switch them off.
An account, if you make one
An account keeps your file in step between the website and the app. It is run by Firebase, Google’s app platform, which stores:
- your email address, and your password in a form that cannot be read back (we never see it);
- the username you choose, which is also kept in a list of taken names so that no one else can take it;
- your word file and settings, your daily review counts, and a log of each review: which word, how you answered, and when;
- with each save, its time and the random identifier of the device that made it, so that each device can tell its own saves from another’s. Vocab Cards makes this identifier itself: it is not read from the device, and it is not the advertising identifier;
- when the account was created and when it last signed in.
If you sign in with Google on the website, Google also gives Firebase your name and the address of your profile picture; Vocab Cards does not use or show them. If you sign in with Apple, on the website or in the app, Apple gives Firebase your email address, or, if you choose Hide My Email, a private relay address that forwards to you; Vocab Cards asks Apple for nothing else, not even your name. Password-reset emails are sent by Firebase on our behalf.
The data is kept for as long as the account exists, and each account can read and change only its own. It exists to serve your account back to you: it is deleted with the account, and it is never sold, shared or used for advertising. Like any online service, Firebase sees the IP address and the browser or app details of each connection, which Google keeps for a limited time to keep the service secure.
Product updates, if you ask for them
Making an account offers occasional emails about what is new in Vocab Cards, in a box that starts unticked, and a switch under Privacy & terms in Account turns them on or off at any time. If you ask for them, your email address goes on a list kept in the same Firebase project, with the date and where you asked. It is used for those emails and nothing else: it is never sold, rented or shared, every email says how to stop, and turning the switch off, or deleting the account, takes you off the list at once. If a mailing service is ever used to send them, it will be named here first.
Usage counts, in the app
The iPhone and iPad app counts how it is used, through Google Analytics for Firebase, to decide what to build next: when it is opened and for how long, which screens are shown, and a handful of actions (making an account or signing in, adding a word and its language, finishing a review and how many cards it had, choosing languages). With them go the device’s model and language, the system and app versions, and the country and city worked out from the connection’s address, never a precise location. The counts carry a random identifier that Google Analytics makes for this installation of the app. They are never joined to your account and never include your words or your email, and the app reads neither the advertising identifier nor the device’s vendor identifier. Google processes the counts on our behalf, deletes the detailed records two months after they are made and keeps only totals. To stop them, switch off Usage counts under Privacy & terms in the app’s Account tab, and nothing more is sent. The website counts nothing.
The website
The website is a set of files served by Cloudflare. A few things follow from being on the open web:
- Cloudflare sees requests. Serving a page means the host receives your IP address and the usual request headers. Nothing is built from them here.
- The typefaces come from Google Fonts. Fetching them sends your IP address and browser details to Google. After the first visit the site uses its own copy where it can.
- No cookies, no analytics. Vocab Cards’s pages set no cookies and count nothing. Once you sign in, your browser also keeps Firebase’s record that you are signed in.
- A human check, only after repeated failures. After three wrong passwords in a row, the sign-in box shows Google’s reCAPTCHA (“I’m not a robot”), which collects information about your browser and device to tell people from programs, under Google’s privacy policy and terms. Signing in with Google likewise happens on Google’s own pages, under its own policy.
Recordings and voices
When you play a word, Vocab Cards looks for a native speaker’s recording on Wikimedia Commons, the media library behind Wikipedia and Wiktionary, and plays it from there. Wikimedia’s servers see your IP address and the word asked for, under the Wikimedia Foundation’s privacy policy. When there is no recording, a voice on your device reads the word. In the app that is one of Apple’s voices, which run on the device. On the website your browser chooses the voice, and some browsers’ online voices send the text to their makers.
Where the data goes
Nothing is passed to anyone beyond the services named on this page. Google runs Firebase, Google Analytics for Firebase and reCAPTCHA, and Cloudflare runs the hosting; both process data for us under their data-processing terms and may handle it in the United States and elsewhere, with the safeguards UK and EU law require for such transfers. Apple runs Sign in with Apple, and Google Fonts and Wikimedia Commons answer your browser or the app directly, each under its own policy.
Deleting your account
You can delete your account in the app or on the website; it takes your password and a moment. In the app, open the Account tab, press Delete account…, type your password, or confirm with Apple if that is how you signed in, and press Delete my account. On the website, open Account, press Delete my account…, confirm with your password (or with Apple or Google, if that is how you signed in) and press Delete my account. The account, its username, its word file, settings and review history are removed at once, nothing of them is kept, the username is released, and you leave the product-updates list. If you signed in with Apple, Vocab Cards’ authorisation with Apple is revoked at the same time, so it leaves the Sign in with Apple list in your Apple Account settings. The app’s usage counts were never tied to the account, and Google deletes their detailed records after two months.
If you cannot sign in, write to fkarim@basilicalabs.ai from the address on the account, and it is deleted by hand within 30 days, with a reply when it is done. The account deletion page has the steps and what goes. The copy of your file on each device is not part of the account: the device you delete from goes back to the starter file, and another device keeps its copy until you delete the app there or clear the site’s data.
Your rights
Under the UK GDPR, and the EU GDPR where it applies, you may ask what we hold about you, have it corrected, have it deleted, take a copy of it away, and object to how it is used. The app’s Account tab and the website’s Account page show what your account holds and delete it at once. For a copy of everything as a file, or anything else, write to the address below and you will have an answer within a month.
We hold account data to provide the account you asked for. Product updates go only to those who ask, and you can withdraw that at any time with the switch. The app’s usage counts, the hosting and the human check run in our legitimate interest in a working, improving and secure service, and the counts can be switched off. Nothing about you is decided by automated means. If you live in California, the same rights are yours, and Vocab Cards does not sell or share personal information. The data controller is Fadil Karim, at the address below. If you think something is wrong and we have not put it right, you may complain to the Information Commissioner’s Office at ico.org.uk, or to the data-protection authority where you live.
Children
Vocab Cards is a study tool for a general audience and is not directed at children. Accounts are for people aged 13 and over; anyone can use Vocab Cards without one, with everything kept on the device. If you believe a child under 13 has made an account, write to us and it will be deleted.
Changes
If this policy changes, the date below changes with it, and a change that matters is described here. The page first appeared on 21 October 2026 and gained product updates and the app’s usage counts later that day. On 24 October 2026 the app and the website were renamed from Vocab Folio to Vocab Cards; nothing about what is kept, or by whom, changed with the name. Sign in with Apple arrived the same day.
Contact
Questions, corrections and requests go to fkarim@basilicalabs.ai, and a person reads them. Vocab Cards is made by Fadil Karim. The terms of use are a separate page.
Last updated 24 October 2026 · Vocab Cards · made by Fadil Karim