Wordado is an app for learning the words of a language: English, and German (beta). This page says what personal data Wordado collects, why, who handles it for us, how long we keep it, and what you can do about it. We collect as little as the app needs, we do not sell data, and there is no advertising or tracking.
Who is responsible
The controller of your personal data is Yordan Mihaylov, 5 Abanos Str, 1616 Sofia, Bulgaria. For anything about your data, write to privacy@wordado.com.
What we collect
You can study without an account. With an account, we keep:
- Your email address, to sign you in with a one-time code and to tell you about changes to the service.
- When you last signed in, so that accounts nobody uses can be deleted after 24 months.
- Whether you want news by email, if you tick the box when you sign in or turn it on in the settings: your choice, when you made it and the wording you agreed to.
- The language you use the app in, so that we write to you in it. The app sends it by itself when you sign in and when you change the language; we keep only the latest, for as long as your account exists.
- Your learning history: each answer (the word, the exercise, whether you knew it, how long you took, the time and your time zone), your progress, the days you studied, and your settings, such as your daily goal and, for each course you take, its level, theme and native language.
- Your sign-in sessions: one for each device you sign in on, with when it started and when it expires. We keep neither its IP address nor its browser.
- Your passkeys, if you add any, to sign you in without a code: for each, its public key and ID, a counter your device raises at each sign-in, whether it can be and is synced to your other devices, the ways your browser says it can reach it (such as “internal”), and when you added it. We keep no name for a passkey, and not which device or password manager holds it.
- Reminders, only if you turn them on: the address your browser gives us for sending them, the time you chose, your time zone and your interface language.
- Problems you report about a word, with your note.
- Feedback you send about the app: your message, the kind of feedback, a contact email if you give one, and what helps us answer: the version of the app and of the word lists, your browser, your interface language and the screen you were on. It is not linked to your account: we note only whether you were signed in. We may use an AI service to translate and sort feedback; see Who handles your data for us.
To keep sign-in safe, we also keep a record of each sign-in code we email (the address and the time) and short counters which limit how often codes can be requested and passkeys tried. When you add a passkey or sign in with one, we also keep the one-time challenge your device signs, with your account if you are signed in, for at most 5 minutes. The counters are keyed by a hash of the IP address, so the address itself is not stored.
What stays on your device
Wordado works offline, so your browser keeps a copy of your study data, the word lists, the audio you have played and your interface language. When you create an account, we ask for your year of birth to check your age, but that check happens on your device, and we do not keep the year. Without an account, your study data stays on your device. It reaches us only if you later create an account and choose to keep it.
If you add a passkey, its private part is kept by your device or your password manager (such as Apple’s, Google’s or Microsoft’s), and never reaches us. When you unlock it with your fingerprint, face or PIN, that check happens on your device: nothing about your face or finger reaches us either. The app also remembers on the device whether you have answered its offer to add a passkey.
Cookies
We use two cookies, both essential for the service, so we do not ask for consent. One keeps you signed in, and is set only when you are signed in. The other is set for at most 5 minutes when a passkey is used: when you add one, and when the sign-in screen opens on a device that can sign in with a passkey. It links your device’s answer to the challenge we sent. We use no analytics, advertising or tracking cookies, and no third-party tracking scripts.
This website
This website, wordado.com, sets no cookies and stores nothing on your device. Its fonts are served from wordado.com itself. Cloudflare, which hosts it, keeps the technical records any web server needs, such as your IP address and the page you asked for, for a short time to deliver the site and protect it from abuse. We count visits with Cloudflare Web Analytics: a small script loaded from Cloudflare, which uses no cookies and does not identify you. It is the only thing this website loads from another company.
The app at app.wordado.com is described in the rest of this policy.
Why we use your data
- To provide Wordado (your account, sign-in, saving and syncing your progress, and the choice of words to study): this is necessary to perform our agreement with you.
- To keep the service secure (sessions, limits on sign-in codes, blocking abuse): this is our legitimate interest in running a safe service.
- To send reminders: your consent, which you give by turning them on and can withdraw by turning them off.
- To tell you about changes to the service (changed terms, planned interruptions), by email to the address you sign in with: this is part of our agreement with you.
- To send you news about Wordado by email: your consent, which you give by ticking the box when you sign in or in the settings, and can withdraw in the settings or from any such email.
- To fix and improve Wordado (the problems you report about a word, and the feedback you send): this is our legitimate interest in correcting mistakes and making the app better. If you give a contact email, we use it only to answer you.
- To know how Wordado is used: we count accounts and how many of them study, have reminders on or have agreed to news, from the data above and only as totals, never per person. This is our legitimate interest in running the service and planning the work on it.
Who handles your data for us
- Cloudflare runs the app and its files. Every request passes through its global network, which processes your IP address.
- Neon hosts our database, in Frankfurt, Germany.
- Resend sends our emails: the sign-in codes, notices about the service and, if you agreed, news. It stores the messages and their delivery logs in the United States. The sign-in emails contain only the code.
- Your browser’s push service (from Google, Mozilla, Apple or Microsoft, depending on your browser) delivers reminders. The message we send it is empty; your device asks us what to show.
- Google, the provider of the AI model, may help us read feedback: it translates and sorts the messages. It receives the text of your message, but not your contact email, and nothing that links the message to an account. It does not train its models on the text, and keeps it only as long as needed to detect abuse.
When data leaves the European Economic Area, it is protected as follows: Cloudflare and Resend are certified under the EU–US Data Privacy Framework, the European Commission’s adequacy arrangement for the United States. The AI service will be switched on only once its transfer is covered by that framework or by the Commission’s Standard Contractual Clauses.
How long we keep it
- Your account and learning history: until you delete your account, or 24 months after your last sign-in if you have not signed in again by then.
- The date of your last sign-in and your choice about news by email: as long as your account exists.
- A sign-in session: 60 days after you last use it.
- A sign-in code: until you use it, and at most 5 minutes.
- A passkey: until you remove it in the app, or until your account is deleted.
- A passkey’s challenge, and the cookie that goes with it: until it is used, and at most 5 minutes.
- The record of emailed sign-in codes, and the counters: one day.
- Problems you reported: we keep the report to fix the word, but remove your identity from it when you delete your account.
- Feedback you sent: it is not linked to your account. We keep the message to act on it, but remove the contact email from it when you delete the account with that address.
Your rights
You can, at any time:
- Download your data as a file: Settings › Account › Download your data (JSON).
- Delete your account: Settings › Account › Delete your account. This removes your account and all your learning history from our servers and from that device.
- Remove a passkey: Settings › Account › Passkeys › Remove. It stops signing you in at once. It stays in your device’s password manager until you remove it there.
- Ask us for access to your data, to correct it, to restrict how we use it, or object to our use of it, by writing to privacy@wordado.com.
- Complain to a data protection authority, such as the one where you live. In Bulgaria, this is the Commission for Personal Data Protection. In Germany, it is the authority of the federal state where you live (the BfDI lists them); in Spain, the AEPD.
Children
To create an account, you must be old enough to consent to online services where you live: 14 in Bulgaria, and between 13 and 16 in other countries. If you are younger, you can still use Wordado without an account, and nothing about you reaches us.
Changes to this policy
When we change this policy, we update the date at the top of this page. If a change affects how we use data we already hold, we will tell you in the app or by email before it takes effect.