Privacy Policy
Effective date: 23 March 2026
FlipWords is a vocabulary learning application. This policy explains what personal data is processed, why it is processed, how long it is kept, and which choices users have.
1. Data controller
The operator of FlipWords is responsible for the processing described on this page. Contact and support requests can be sent through the in-app contact form or the support email published inside the app.
2. Data we process
- Account data such as email address, display name, password hash, password salt, and account verification status.
- Learning data such as selected languages, level, custom words, notes, and study progress.
- Operational data such as session records, rate-limit records, application events, and error logs needed to secure and operate the service.
- Feedback and contact messages voluntarily submitted by the user.
3. Why we process data
- To create and secure user accounts.
- To sync learning progress and user-created content across devices.
- To send transactional emails for verification and password reset.
- To prevent abuse, spam, brute-force attacks, and misuse of the service.
- To investigate incidents, support users, and improve reliability.
4. Legal bases
Where applicable, processing is based on contract performance for account functionality, legitimate interests for security and reliability, and user consent or user action for optional contact and feedback messages.
5. Processors and infrastructure
Application data is stored in Cloudflare Pages and Cloudflare D1. Transactional emails are sent through Resend when live email delivery is enabled. These providers process data on behalf of the service operator.
6. Retention
- Account data and learning data are kept until the account is deleted.
- Verification and password reset tokens are short-lived and periodically removed after use or expiry.
- Rate-limit records are retained only for short operational windows.
- Operational logs and feedback records are retained according to the project retention policy and may be pruned after fixed periods when no longer needed.
7. Security
FlipWords uses hashed passwords, secure cookies, rate limiting, production security headers, and operational monitoring controls. No internet-facing system can be guaranteed to be perfectly secure, but reasonable technical and organisational safeguards are used.
8. User rights
Users can access, correct, and delete their account data from inside the application. They may also request help through the contact channel for privacy-related questions.
9. International transfers
Depending on the hosting and email providers configured for the service, data may be processed in countries outside the user’s home jurisdiction. Appropriate provider safeguards should be reviewed before production launch.
10. Changes
This policy may be updated when product, infrastructure, or legal requirements change. Material updates should be published with a revised effective date.