Privacy Policy

1.Who We Are

HiWord.AI ("we", "us", "our") is a vocabulary learning web application that helps users acquire and retain English vocabulary through spaced repetition. The application is accessible at https://karryzhang.github.io/VocabLoop/ and https://vocab-loop.vercel.app.

This Privacy Policy explains how we collect, use, and protect your personal information when you use HiWord.AI. By using the application, you agree to the practices described in this policy.

2.Information We Collect

2.1 Information you provide directly

• Username — chosen by you when creating an account. Must be 5–30 characters.
• Password — entered when registering. We store only a cryptographic hash (PBKDF2-SHA512, 120,000 iterations) and never the plain-text password.

2.2 Information collected via Google Sign-In (optional)

If you choose to sign in with Google, we receive the following from Google:

• A unique Google account identifier (Google "sub" / user ID)
• Your Google account email address — used only to derive an initial username

We do not receive or store your Google password, profile photo, contacts, or any other Google account data.

2.3 Learning data (automatically generated by your use)

• Vocabulary review history, spaced repetition intervals, and difficulty ratings
• Daily streaks, total reviews, and achievements
• Preferred vocabulary deck and study round
• AI-generated reading articles based on words you have studied

2.4 Technical data

We do not collect IP addresses, browser fingerprints, analytics events, or advertising identifiers. Standard server logs may be generated by our hosting providers (Vercel) as part of normal infrastructure operation.

3.How We Use Your Information

We do not use your information for advertising, profiling, or any purpose other than operating and improving HiWord.AI.

4.Legal Basis for Processing

Where applicable under data protection laws (such as the GDPR), we rely on the following legal bases:

• Contractual necessity — processing required to provide the service you have requested (account creation, data sync).
• Legitimate interests — maintaining service security and preventing abuse.
• Consent — where you have expressly chosen to use optional features such as Google Sign-In or AI-generated reading content.

5.Information Sharing and Disclosure

We do not sell, rent, or trade your personal information to any third party.

We may disclose information only in the following limited circumstances:

• Service providers — trusted infrastructure providers (listed in §6) who process data on our behalf under strict data processing terms.
• Legal requirements — if required by law, court order, or to protect the rights and safety of users.
• Business transfers — in the unlikely event of a merger or acquisition, users will be notified in advance.

6.Third-Party Services

7.Data Storage and Security

Local storage — learning progress is stored in your browser's localStorage. This data never leaves your device unless you create an account and enable cloud sync.

Cloud storage — if you register an account, your learning data is backed up to a Turso (SQLite cloud) database. Data is encrypted at rest and in transit (TLS/HTTPS).

Password security — passwords are hashed using PBKDF2-SHA512 with a random salt and 120,000 iterations before storage. We cannot retrieve or reset your password — only you know it.

Session tokens — authentication tokens are HMAC-signed and stored in your browser's localStorage. They are not accessible to other websites.

8.Data Retention

We retain your account data for as long as your account is active. Learning data synced to our servers is kept indefinitely to allow you to resume learning at any time.

You may request deletion of your account and all associated data at any time by contacting us (see §13). Upon a verified deletion request, we will remove your data from our databases within 30 days.

Data stored solely in your browser's localStorage is under your complete control and can be deleted at any time through your browser settings.

9.Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your account and personal data ("right to be forgotten").
• Portability — export your learning data using the built-in Export function in the app.
• Objection / Restriction — object to or request restriction of certain processing activities.
• Withdraw consent — if processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, please contact us using the details in §13.

10.Children's Privacy

HiWord.AI is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately and we will delete such information promptly.

Users between 13 and 18 should obtain parental consent before creating an account.

11.Cookies and Local Storage

HiWord.AI does not use tracking cookies or advertising cookies.

We use browser localStorage for the following functional purposes only:

• srs_{deck}_v1 — spaced repetition learning state per vocabulary deck
• srs_global_v1 — global stats (streaks, achievements, XP)
• shared_dict_v1 — cached word definitions to reduce API calls
• vocabloop_auth — authentication token (if logged in)
• vocabloop_theme — your display theme preference (light/dark)
• reading_history — cached AI-generated reading articles

All localStorage data is stored on your device and is not transmitted to us unless you have an account with cloud sync enabled.

12.Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the app, legal requirements, or our data practices. When we make material changes, we will update the "Last updated" date at the top of this page.

We encourage you to review this policy periodically. Continued use of HiWord.AI after changes are posted constitutes your acceptance of the updated policy.

13.Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us through one of the following channels:

• GitHub Issues: github.com/karryzhang/VocabLoop/issues

We will respond to all legitimate requests within 30 days.