Privacy Policy

Your privacy is important to us. At SavvyDiction, we follow a few fundamental principles:

• We only collect the personal information we actually need to run the service.
• We store personal information for only as long as we have a reason to keep it.
• We make it simple for you to permanently delete your account and everything associated with it.
• We don't sell your personal information to anyone, and we don't show ads.
• We aim for full transparency on how we gather, use, and share your personal information.

Below is our Privacy Policy, which incorporates and clarifies these principles.

Who We Are and What This Policy Covers

SavvyDiction is a vocabulary-learning web app, installable as a Progressive Web App (PWA), operated by James Watt ("we", "us"). You add words you encounter while reading, we show you their definition and origin, and, if you opt in, we send you a daily push notification using one of your words in an example sentence.

This Privacy Policy applies to information we collect about you when you use the SavvyDiction website and app at savvydiction.com (our "Services"). James Watt, based in London, United Kingdom, is the data controller for that information.

Creative Commons Sharealike License

This Privacy Policy is adapted from Automattic's open-source legal documents, available under a Creative Commons Attribution-ShareAlike 4.0 license. This adapted version is available under the same license: you're welcome to copy, adapt, and repurpose it for your own use. Just make sure to revise it so it reflects your actual practices, and please keep the credit chain intact.

Information We Collect

We only collect information about you if we have a reason to do so — for example, to provide our Services, to communicate with you, or to make our Services better.

Information You Provide to Us

• Account information: an email address and a password are required to create an account. Passwords are stored only in hashed form by our authentication provider (Supabase Auth). We never see or store your plaintext password.
• Your words:the words you save, the collections ("lexicons") they belong to, and related metadata such as when each word was added.

Information We Collect Automatically

• Authentication cookies: we set session cookies so you stay signed in. These are strictly necessary for the Services to function and are not used for advertising or cross-site tracking.
• Push subscription information: if you enable reminders, your browser gives us a push subscription for that device (an endpoint URL plus the cryptographic keys needed to send notifications to it). We store one subscription per device, and only after you explicitly grant notification permission.
• Notification history:a log of which word and example sentence we sent you and when, so we don't send you the same word twice.
• Usage statistics: we run a self-hosted instance of Umami, an open-source, cookieless analytics tool, to understand aggregate usage (page views, referrers, browser types). It sets no cookies, builds no user profiles, does not track you across other sites, and the data never leaves infrastructure we control.
• Performance measurements: our hosting provider, Vercel, collects anonymised page-performance metrics (Speed Insights) to help us keep the site fast. These are not tied to your account.

Information We Do NOT Collect

• No payment information. The Services are free.
• No advertising identifiers and no third-party advertising or tracking cookies.
• No precise location data.

How and Why We Use Information

We use information about you for the purposes below, with the corresponding legal bases under the UK and EU General Data Protection Regulation (GDPR):

• To provide your account and word collections (email, password hash, saved words). This is necessary to perform our contract with you (Article 6(1)(b)).
• To send signup-confirmation and password-reset emails (email address). This is necessary to perform our contract with you (Article 6(1)(b)).
• To send daily word-reminder notifications (push subscription, saved words, notification history). This is based on your consent (Article 6(1)(a)), which you can withdraw at any time.
• To keep you signed in (session cookies). This is necessary to perform our contract with you.
• To understand aggregate usage and keep the site fast (anonymised analytics and performance metrics). This is based on our legitimate interest in maintaining and improving the Services (Article 6(1)(f)).

We do not use your information for automated decision-making with legal effects, profiling, or targeted advertising.

Sharing Information

We do not sell or rent your personal information. We share information only with the service providers below, who process it on our behalf and only as needed to run the Services:

• Supabase hosts our database and authentication. Your email, password hash, saved words, push subscriptions, and notification history live here, in the AWS eu-central-1 region (Frankfurt, Germany), inside the European Union. Row-level security is enforced at the database level, so each account can only access its own data.
• Vercel hosts the application and runs the daily reminder job. Vercel processes the request data required to serve the site and collects the anonymised performance metrics described above.
• Resend delivers our transactional emails (signup confirmation, password reset) from noreply@savvydiction.com. Resend receives your email address and the email content, nothing more.
• Browser push services (Google FCM, Apple Push, or Mozilla autopush, chosen automatically by your browser) deliver push notifications to your device. Notification payloads are encrypted end-to-end under the Web Push standard, so these intermediaries cannot read their contents.
• Dictionary and language-model providers (Merriam-Webster, the Free Dictionary API, Groq, and Anthropic as a fallback) receive only the looked-up word and its definition, never your identity, email, or any account data. Lookups and sentence generation happen at most once per word across the whole service, and the results are cached in a shared dictionary, so most word saves involve no external call at all.

We may also disclose information in response to a valid legal request (such as a court order) if we are legally required to do so, or to protect the rights, property, or safety of SavvyDiction, our users, or the public.

We have data processing agreements in place with the providers that handle personal data on our behalf (Supabase, Vercel, and Resend), committing them to process it only on our instructions and with appropriate safeguards.

Transferring Information Internationally

Your account data and saved words are stored in the European Union (Frankfurt, Germany). However, some of our providers are US companies, and serving the site or delivering email and notifications can involve processing outside the UK and the European Economic Area. Where personal data is transferred internationally, we rely on the safeguards in our providers' data processing agreements, such as the European Commission's Standard Contractual Clauses and the UK Addendum, or an adequacy decision such as the EU-US Data Privacy Framework where the provider is certified.

How Long We Keep Information

• Account information and saved words: for as long as your account exists.
• Push subscriptions: until you disable reminders on that device, the subscription expires, or your account is deleted.
• Notification history:for as long as your account exists (it's what prevents duplicate reminders).
• When you delete your account, all of the above is deleted immediately and permanently. Deletion cascades through the database, removing your lexicons, saved words, push subscriptions, and notification history in one operation. The shared dictionary of word definitions and example sentences contains no personal data and is unaffected.
• Anonymised analytics contain no personal information and are retained in aggregate.

Security

While no online service is 100% secure, we work hard to protect information about you against unauthorized access, use, alteration, or destruction, and we take reasonable measures to do so:

• All traffic is encrypted in transit (HTTPS).
• Passwords are hashed by Supabase Auth. We never store plaintext passwords.
• Database row-level security ensures each user can only read and write their own data.
• Push notification payloads are encrypted end-to-end (Web Push with VAPID).

Choices

• Limit the information you provide: the only required personal information is an email address and password.
• Notifications: enabling reminders is entirely optional. You can revoke notification permission in your browser or device settings at any time.
• Cookies: our only cookies are essential authentication cookies. Blocking them will prevent you from staying signed in.
• Close your account: you can permanently delete your account at any time from the account menu in the app (Account → Delete account). This cannot be undone.

Your Rights

If you are located in the European Economic Area, Switzerland, or the United Kingdom, you have rights under data protection law to request access to your personal data, request correction or erasure, object to or restrict our processing, receive a portable copy of your data, and withdraw consent at any time where processing is based on consent (such as push notifications). You also have the right to lodge a complaint with your local supervisory authority. In the UK, that is the Information Commissioner's Office (ICO, ico.org.uk).

Wherever you are located, you can exercise the most important of these rights directly in the app: your saved words are always visible to you, and account deletion removes everything we hold about you. For anything else, contact us at the address below and we will respond within the timeframes required by applicable law.

How to Reach Us

If you have questions about this Privacy Policy or a request concerning your personal data, contact us at savvydiction@mailbox.org.

Children

SavvyDiction is not directed at children. We do not knowingly collect personal information from anyone under 13 (or under 16 in Europe). If you believe a child has created an account, contact us and we will delete it.

Privacy Policy Changes

Although most changes are likely to be minor, we may change this Privacy Policy from time to time. If we make changes, we will update the "Last updated" date above, and for material changes we will provide a more prominent notice on the website. Your continued use of the Services after a change takes effect will be subject to the updated policy.