Resumé (dansk)
Dette er et kort resumé af privatlivspolitikken. Du kan læse hele teksten på engelsk nedenfor.
- Vi indsamler din e-mail for at kunne sende dig et logind-link og for at identificere din konto.
- Dit ordforråd, noter og studiehistorik gemmes for at vise dig dit ordforråd.
- Når du scanner et trykt ord, behandles billedet på din enhed. Billedet, kamerastrømmen og genkendelsesresultatet sendes ikke til VocabFlash eller en billedanalyseudbyder og gemmes ikke.
- Vi sælger ikke dine personoplysninger.
- Du kan til enhver tid få en eksport af dine data eller slette din konto.
Privacy Policy
Last updated: 31 July 2026
Who we are
Binary Business, CVR 38836234, Denmark, is the controller of your personal data.
Questions, or to exercise any right below: [email protected].
What we collect, and why
When you sign in. Your email address. We use it to send you a sign-in link and to identify your account. Signing in is how your deck follows you between devices, so the legal basis is performance of our contract with you.
We do not ask for a password, because we do not use them. Sign-in is a link sent to your address.
When you use the product. The words in your deck, any notes and examples you add, and which cards you have seen and when. This is the product: without it there is nothing to show you. Legal basis is again our contract with you.
When you scan a printed word. If you grant camera access or choose a photo, your browser processes the image on your device using VocabFlash's bundled text-recognition software. The image, camera stream and full recognition result are not sent to VocabFlash or an image-analysis provider, and are not saved in browser storage. They are discarded from memory after the scan or when you close the scanner. Camera access ends when the scanner closes, fails, or the page goes into the background.
You decide which recognized word to add. Only that selected, normalized vocabulary term enters the same add-word process as a term you type. It is then stored in your deck and may be used for the dictionary lookup described next.
If you confirm a word while offline, the confirmed word and any sentence context you accepted are held in your browser's local storage until they can be added, or until you cancel them. The image, camera stream and full recognition result are never part of that stored entry: they are discarded from memory after the scan as described above. The stored entry is removed after it syncs to your deck or you cancel it, and it is cleared when you sign out.
When you share a word to VocabFlash. On supported Android devices, an installed VocabFlash can appear in the system share sheet. When you share highlighted text, the shared text is held briefly in your browser's local storage and opens an editable confirmation: nothing is added until you confirm, edit, or cancel. The temporary text is removed when you confirm, cancel, or after a short time, and it is never sent to a definition or pronunciation provider. On platforms without share support, the ordinary add and scan paths remain available.
When you look up a word we do not already have. Existing dictionary content is served without involving an external definition or pronunciation service. For a new word or additional dictionary material, VocabFlash may send the vocabulary term and existing dictionary material for that term to China-based definition and pronunciation service providers. The request is made by VocabFlash and does not include your email address, account identifier or IP address.
When you narrate a word. Narration sends the stored definitions and examples shown on the card (and fixed connector phrases) to the pronunciation provider to synthesize one continuous audio stream. These are the same shared dictionary strings every reader sees; they carry no identifier. Your private sentence context and notes are never narrated or transmitted.
When you choose a definition language. If you set "Definitions in" to a language other than the word's own, VocabFlash may ask the definition provider to write the definition and example in that language. The request carries the same vocabulary term and stored dictionary material as an ordinary lookup — never your private sentence context or notes — and the shared dictionary entry itself is never changed for other readers. When the chosen language differs from the word's own, the stored definition and example are rendered in that language on read and cached so a later view of that word costs you nothing extra; the cache is derived dictionary content keyed to the word, not your account.
When you pick a definition language. Your choice of "Definitions in" language is stored with your account, exported and deleted with it, and never sent to a definition or pronunciation provider. VocabFlash Plus and the free tier generate in every supported content language; a request outside your entitlement is refused before reaching a provider.
VocabFlash accepts vocabulary terms rather than free text. Do not enter private personal information as vocabulary content.
When you subscribe. Stripe handles the payment. We never see or store your card details. We store the identifier Stripe gives us, your plan (the VocabFlash Plus tier), its status, and when the current period ends, so we know what you are entitled to. Legal basis is our contract with you; retaining the invoice record afterwards is a legal obligation.
Technical and security data. We keep limited operational logs, including your IP address, the page requested, the time and your browser type. We use these logs to detect attacks and diagnose faults. Legal basis is our legitimate interest in keeping the service available and secure.
What we do not do
- We do not sell your data. To anyone. Ever.
- We do not run advertising, and there are no advertising or tracking cookies.
- We do not use a third-party analytics service that profiles you across sites.
- We do not upload or retain camera images, page photos or unselected recognized text.
- We do not send images to the definition or pronunciation providers.
Service providers
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Hetzner Online GmbH | Provides hosting | Account email, deck content, notes, study activity, subscription status and technical logs | Germany |
| Cloudflare | Stores encrypted backups | Encrypted copies of VocabFlash data | EU/US |
| Stripe | Processes subscriptions | Your name, email address, billing address and payment details, held by Stripe and not us | EU/US |
| Resend | Sends sign-in emails | Your email address and sign-in link | US |
| China-based definition and pronunciation service providers | Generate dictionary content and pronunciation audio | Vocabulary terms and related dictionary material, without a VocabFlash user identifier or user IP address | China |
About the China-based services. The European Commission has not issued an adequacy decision for China. Requests use VocabFlash's service account, so a provider may know that a request came from VocabFlash, but the request data does not identify which VocabFlash user requested it. These services receive no account data. A vocabulary term can nevertheless be a person's name, which is why VocabFlash should not be used to enter private personal information.
How long we keep it
| Your account and deck | until you delete it |
| Server logs | 30 days |
| Off-site backups | up to two weeks after deletion, until backups containing it age out |
| Payment and invoice records | as Danish bookkeeping law requires, currently 5 years from the end of the financial year |
Deleting your account removes your account and everything in your deck immediately. It cannot remove you from backups already taken; those expire on the schedule above and are encrypted at rest in the meantime.
Your rights
Under the GDPR you may ask us to give you a copy of your data, correct it, delete it, restrict or object to what we do with it, or hand it to another provider.
You can do the first and third yourself, from your account menu in the product: export downloads everything we hold about you as a file, and delete removes your account and your deck. No email required, and no waiting for us.
For anything else, write to [email protected]. We will answer within one month.
If you think we have got this wrong, you may complain to your data protection authority. In Denmark that is Datatilsynet (datatilsynet.dk).
Where your data is
The service's primary hosting is in Germany. Cloudflare, Stripe and Resend may process data in the United States under their applicable Data Privacy Framework certifications and/or standard contractual clauses. Definition and pronunciation services may process the limited dictionary material described above in China.
Changes
If we change this policy we will update the date at the top, and tell you by email if the change is one that affects you materially.