VisEn Privacy Policy

1. Who is responsible for your information

The controller and operator is Andrii Hulak, Ukraine. For privacy, support, access, correction, or deletion requests, email contact@visual-english.app. Please identify the app as VisEn or Visual English.

2. Information we process

Account and sign-in information

Firebase Authentication assigns a user identifier to a guest account when online features need one. If you choose Google sign-in, or Sign in with Apple on iOS, the sign-in provider and Firebase process your provider identifier, authentication credentials or tokens, email address, and profile information such as your name when supplied. Apple may provide a private relay email address. We do not receive your Google or Apple account password.

Learning information and preferences

The app stores learning progress, practice results, review timing, favorites, selected topics, learning goals, language and display preferences, and study plans on your device. When you use cloud backup, a progress snapshot is sent to Firebase and associated with your account. It includes the progress, preferences, content references, and learning history needed to restore your learning.

Separate from optional cloud backup, the app sends learning milestone totals and product-usage events when online services are available. These can describe onboarding choices, topics and words practiced, exercise outcomes, screens and features used, learning and response durations, reminder settings, download outcomes, and subscription interactions. Turning off automatic backups does not turn off analytics.

Reports and support

If you submit a content report, we receive the selected reason, any note you enter, the relevant word, translation or scene identifiers, content version, app version, platform, language, and submission time. Reports are associated with the account used to deliver them. Report payloads do not automatically include your typed exercise answers or local file paths. Please avoid including sensitive personal information in a report.

The feedback action opens your email application with app-version and platform information. Nothing is emailed until you send it. If you contact us, we receive your email address, message, and any attachments or other details you choose to provide.

Purchases

Apple or Google processes payments. RevenueCat helps validate purchases and manage subscriptions and access. We and these providers process product and transaction identifiers, purchase and renewal times, subscription status, currency and price information, and refund or cancellation events. RevenueCat is linked to your Firebase user identifier. Signed analytics identifiers and purchase-attribution information can also connect subscription events with use of VisEn. We do not receive your full payment-card number or bank-account credentials.

Push notification registrations

After you grant notification permission, the app uses Firebase Cloud Messaging to obtain a registration token for this app installation. We store that token, a random installation identifier, the platform, and the latest registration time in Cloud Firestore under your Firebase account, including a guest account, so we can deliver push notifications to that installation. The app updates the registration when its token changes. Push registration is separate from optional learning backups.

Device, connection, and diagnostic information

Our infrastructure and SDK providers process information such as IP address, device and operating-system details, app version, language, time zone, installation and session identifiers, request metadata, crashes, error traces, and performance information. Google Analytics can derive an approximate location from an IP address. We do not request GPS location.

Firebase App Check uses Apple App Attest or DeviceCheck on iOS and Google Play Integrity on Android to help verify genuine app requests. Firebase installation and messaging infrastructure may also process installation identifiers and registration tokens. This is separate from the local learning reminders described below.

3. How we use information

• Provide lessons, pronunciation playback, review scheduling, preferences, downloaded content, and optional backup and recovery.
• Authenticate accounts, validate purchases, restore eligible purchases, and provide subscribed features.
• Schedule local learning reminders and deliver push notifications after notification permission is granted.
• Understand learning activity and product use, improve content and usability, and measure subscription performance.
• Investigate reports and crashes, answer support requests, secure the service, and prevent abuse.
• Meet legal obligations, resolve disputes, and protect lawful rights.

4. Analytics and advertising

We use Amplitude and Google Analytics for Firebase for product analytics. Events use random installation identifiers and, for signed-in accounts, an account pseudonym. These identifiers can link activity across sessions and, after sign-in, across devices. Pseudonymous information is not the same as anonymous information.

Our product-event fields exclude names, email addresses, raw Firebase user IDs, raw RevenueCat customer IDs, typed exercise answers, report notes, and arbitrary full URLs. Account-to-analytics mappings and purchase information are handled separately by our backend and billing providers.

Analytics starts automatically when the relevant online services initialize. The current app does not provide a separate in-app switch to opt out of product analytics. You can contact us about your privacy rights, including an objection or deletion request, using the address above.

We do not display third-party advertising or sell personal information. We do not use VisEn data for cross-app targeted advertising or share it with data brokers. Our analytics configuration disables advertising-ID collection and advertising personalization signals; Amplitude also disables IP-address and location enrichment in its event payloads. Those settings do not prevent network providers from processing connection information or Google Analytics from deriving approximate geography.

5. Providers and other disclosures

Information is processed by providers that support the functions you use:

• Google Firebase and Google Cloud: authentication, Firestore databases, cloud storage, backend functions, hosting, Remote Config, app integrity, installation services, Firebase Cloud Messaging push notifications, and Crashlytics diagnostics. See Firebase privacy information.
• Google Analytics for Firebase and Amplitude: usage and subscription analytics. See Google’s Privacy Policy and Amplitude’s Privacy Notice.
• RevenueCat: purchase validation, subscription management, and billing analytics. See RevenueCat’s Privacy Policy.
• Apple and Google: sign-in, app-store purchases, integrity services, and platform features. Their own privacy terms also govern information they handle independently. Google sign-in may process additional Google-account and service information, including contact details, approximate location, identifiers, and service-usage information under Google’s policy; VisEn itself requests basic sign-in information.
• Email providers: support messages are handled through our Gmail support mailbox and the email provider you choose.

We may disclose information where required by law or reasonably necessary to address fraud or security incidents, enforce our terms, or protect rights and safety. If ownership of VisEn changes, relevant information may transfer with the service, subject to applicable law and notice obligations. The app does not offer public profiles, a public feed, or learner-to-learner messaging.

6. Device permissions and notifications

Learning reminders are scheduled on your device after you choose to enable them and grant any required notification permission. You can change their schedule in the app. Firebase Cloud Messaging handles push notifications separately from these local reminders; push registration starts only after notification permission is granted.

You can disable notifications in your device settings. On the next successful synchronization, the app invalidates its push token and removes its registration when the same account is still signed in. Changing accounts also invalidates the previous token. These changes require the app to run and successfully contact the relevant services.

The current app does not ask to record your microphone or camera, read your contacts or calendar, or access your precise location. Pronunciation audio is played from app content; it is not a recording of your voice. A platform or SDK may use system security or storage capabilities without exposing biometric templates or your personal files to us.

7. Website and local storage

These legal pages contain no advertising, analytics scripts, tracking pixels, or application cookies. Firebase Hosting still processes ordinary connection information, including IP addresses and request metadata, to serve and protect the pages.

The main VisEn website (the home and contact pages, not these legal pages) uses Google Analytics. If your browser appears to be in Europe, including the EEA, the UK, and Switzerland, nothing is sent to Google until you choose “Accept” on the cookies notice. We judge this from your browser’s time zone, and we ask first when we cannot tell. Elsewhere, analytics runs by default and you can choose “Decline” at any time. When it runs, Google Analytics sets cookies and records which pages you open and which links and buttons you tap, together with approximate location, browser and device details, and an identifier that recognizes your browser. It does not record what you type into the website’s example exercise. We do not use it for advertising and have disabled advertising features and Google signals. Choosing “Decline,” or sending a Global Privacy Control signal, keeps analytics off. You can change your choice at any time with “Analytics settings” in the website footer; declining stops new collection and removes the analytics cookies from your browser. See Google’s Privacy Policy.

The mobile app uses local databases, preferences, secure storage, downloaded content, and SDK storage. Device-level backup or transfer services provided by Apple or Google may retain copies according to your system settings. Those copies are separate from VisEn’s optional cloud progress backup.

8. Retention

We retain account and learning records while needed to provide the service, unless you request deletion or applicable law requires another period. The cloud backup service maintains up to two completed progress snapshots per account; replacing a snapshot retires the older copy. Turning off automatic backup or signing out does not delete existing cloud copies.

Token refresh replaces this installation’s current push registration. If the app can no longer access the previous account after an account change, its old registration can remain until the record or account is deleted; the app invalidates the previous token. Successful cloud-account deletion also removes that account’s push registrations.

The app’s product-analytics delivery queue expires events after seven days and is limited to 10,000 events. Our backend schedules purchase-attribution records for removal after 30 days and billing-event records after 90 days. These limits apply to those queues and records, not to all provider-held data. Identity mappings and original subscription-owner records can remain until account deletion. Minimal deletion records and retired-identifier records are retained to track requests and prevent delayed events from recreating deleted data.

Our cloud storage currently retains recoverable copies of deleted objects for seven days. The default cloud-log bucket retains records for 30 days, and the required audit-log bucket for 400 days. These settings apply to their respective systems, not to all personal information.

Analytics providers, crash-reporting systems, support email, stores, and RevenueCat have separate retention processes. Account deletion does not instantly erase every provider record or backup. Product-analytics history can remain until a deletion request is processed rather than expiring with the app’s delivery queue. We do not promise a single fixed retention period for all systems. We assess support and legally required records according to their purpose, outstanding requests, security needs, and applicable obligations.

9. Delete your account or request data deletion

In the app: open Settings, open the progress-backup controls, and choose Delete account. This path is available for a linked backup account and requires a recent Google or Apple sign-in. The app explains the action before you confirm it.

A successful cloud-account deletion removes the active Firebase account, its private learning and report records, push notification registrations, and its progress-backup objects. It clears the local product-analytics queue and requests separate analytics-provider deletion through our backend. Provider processing can take additional time. Some minimal security and deletion records, legally required records, cloud logs, and provider backups may remain.

Your learning stays on the device after cloud-account deletion. To remove remaining local learning data, remove the app and its data using your device’s settings. On iOS, offloading an app preserves its documents and data; use Delete App to remove the local app data. Device backups and keychain or provider-managed identifiers can require separate management.

Without the app, or for a guest account: email contact@visual-english.app with the subject “VisEn account and data deletion.” State whether you want to delete your account and associated data or request deletion of a particular category. Include your sign-in email or, if available, the analytics Support ID shown in Settings so we can locate the records. Never send a password, sign-in token, or payment-card number. We may need proportionate verification and will explain if more information is necessary to identify a guest account.

Purchase records held by RevenueCat, Apple, and Google are not automatically erased by the in-app action. Contact us to request review of provider-held data; stores may retain transaction records for their own legal and operational purposes. Account deletion and uninstalling the app do not cancel a subscription. Cancel it through the store where you subscribed. Deleting VisEn also does not itself revoke your Apple or Google sign-in authorization; you can manage that separately in the provider’s account settings.

10. Your rights and choices

Depending on the law that applies, you may have rights to access, correct, delete, or receive a copy of personal information, restrict or object to processing, withdraw consent where processing relies on it, and complain to a privacy regulator. Where applicable, you may appeal a decision about a privacy request by replying to our response. Contact us using the address in section 1. We will respond within the periods required by applicable law and explain any lawful exception.

You can choose whether to sign in, enable automatic cloud backups, make purchases, submit reports, or send support email. Notification permission and provider authorizations can be managed in system or provider settings. These choices do not disable all technical processing needed for online services.

11. Legal bases

Where applicable law requires a legal basis, we rely on performance of our agreement with you for requested learning, account, backup, and purchase functions; legitimate interests where permitted for service security, diagnostics, support, and product improvement; and legal obligations for required records and lawful requests. Where processing requires consent, consent must be separate and valid under the applicable law. This policy and use of the app do not by themselves constitute consent to optional processing.

You may object to processing based on legitimate interests. Where we rely on consent, you may withdraw it without affecting processing that was lawful before withdrawal. We do not use learning or subscription analytics to make decisions producing legal or similarly significant effects about you.

12. Regional privacy rights

EEA, UK, and Swiss residents may contact their competent supervisory authority. Ukrainian residents may exercise rights under applicable Ukrainian personal-data law and contact the competent authority. Where US state privacy laws apply, residents may have rights to know, access, correct, delete, obtain portable copies, and appeal. We do not sell personal information or share it for cross-context behavioral advertising, and we do not discriminate against you for exercising applicable rights.

13. International processing and security

The operator is based in Ukraine. Our Firebase databases, content and backup storage, and backend functions use US locations, and providers may process information in other countries where they operate. Data-protection laws may differ from those in your country. Applicable provider data-processing terms and legally required transfer safeguards govern relevant transfers; contact us for information about the safeguards relevant to your request.

We use encrypted network connections, account-based access rules, private storage paths, and app-integrity checks. Cloud backups are not represented as end-to-end encrypted against the operator or cloud provider. No system can guarantee absolute security.

14. Adults only

VisEn is intended only for people aged 18 or older. People under 18 must not use the service or provide personal information. If you believe a person under 18 has provided information to us, contact us so we can investigate and take appropriate action, including deletion where required.

15. Changes to this policy

We may update this policy as the service changes. We will update the date above and provide additional notice or obtain consent where the law requires it. The current policy remains available at this page.