Privacy

Controller

Frank Habermann
Selma-Lagerlöf-Str. 6
21493 Schwarzenbek
Email: lordlamer@lordlamer.de

Data processed

This website does not set tracking cookies. Server logs (IP address, timestamp, user agent) are processed for technical delivery.

VocabNinja stores vocabulary, learning progress, and settings locally on your device by default. No user account is required. VocabNinja does not operate an app server for your vocabulary. The features described below may transmit technical usage data or content you select to third-party providers or export destinations.

Usage analytics with TelemetryDeck

The app uses TelemetryDeck to understand app usage, identify technical problems, and improve VocabNinja. At startup and during use, the SDK sends technical information such as app and operating system versions, device type, session information, and a hashed installation identifier. We also record app areas opened and attempts, outcomes, and cancellations for features such as vocabulary management, import/export, photo capture, OCR, AI analysis, settings, reminders, and speech. For lessons we record their start, successful completion or departure, and learning mode. Counts and durations are transmitted only as ranges. Technical errors are reported as fixed categories; AI features may include the provider category and exports may include the file format.

We do not send names, vocabulary text, typed answers, search terms, photos, OCR text, file names or paths, AI credentials, custom endpoints, or model names to TelemetryDeck. Raw error messages and stack traces are not transmitted either. VocabNinja does not supply a custom analytics user identifier. The HTTPS connection technically exposes an IP address; TelemetryDeck states that it does not store IP addresses. See TelemetryDeck's privacy FAQ for details of processing and storage. This website does not use a TelemetryDeck script.

The legal basis is our legitimate interest in improving the app and fixing errors (Art. 6(1)(f) GDPR). Since no content and no user identifier is transmitted, to the best of our knowledge the data cannot be traced back to you personally.

Error diagnostics with Sentry

The app uses Sentry to detect and fix crashes and technical errors. Reports may include error types, stack traces with code locations, app and operating system versions, technical device information, installation or session identifiers, and recently used app areas and feature categories. The HTTPS connection involves technically necessary connection data, including the IP address.

We do not set a personal user identity or enable screenshots or session recordings. Vocabulary, answers, photos, OCR text, and AI credentials are not attached as content. Before sending Dart error reports, the app removes free-text error messages, request data, and additional content details. Native crash reports are processed by the platform SDK instead and may contain native exception messages, thread stacks, and technical file paths; the Dart filter does not apply to these reports. Processing and retention depend on our Sentry project's configuration and Sentry's privacy information.

The provider is Functional Software, Inc. (Sentry), San Francisco, USA. Error reports are stored in Sentry's EU data region (Germany). Access from the USA cannot be completely ruled out; Sentry is certified under the EU-US Data Privacy Framework and has agreed standard contractual clauses with us. The legal basis is our legitimate interest in a stable, error-free app (Art. 6(1)(f) GDPR).

Optional AI photo import

For the optional photo import, you can configure your own API access to OpenAI, Claude (Anthropic), or Microsoft Azure. The app communicates directly with the selected provider over HTTPS. VocabNinja does not operate an intermediary server and does not receive your API key or the content sent to the provider.

The API key, selected model, and optional Azure endpoint are stored separately for each provider in the operating system's protected credential storage. The key is sent directly to the selected provider for authentication when access is saved or tested, available models are retrieved, and an analysis is requested. Technically necessary connection data, particularly the IP address, is also generated. No photos or OCR text are sent when the model list is retrieved. On Android, stored credentials are excluded from cloud backups and device transfers; portable VocabNinja backups do not contain AI credentials.

Direct photo analysis

After you explicitly confirm, each selected page is resized locally and re-encoded as a new PNG without embedded metadata. The image, source and target languages, selected model, and the instructions required for extraction are sent to the selected provider. The provider returns structured vocabulary suggestions to the app. Only suggestions you confirm are stored in the local vocabulary catalogue.

On-device text recognition (OCR)

Alternatively, VocabNinja can first recognize text on your device: using Google ML Kit for Latin-script text on Android and Apple Vision on iOS. No photo is sent to your selected AI provider during this step. You can review, edit, or remove the recognized text. Only after another explicit confirmation are the visible text, source and target languages, selected model, and required instructions sent to the AI provider; the photo is not included. There is no automatic switch from on-device text recognition to photo upload.

Google states that ML Kit processes input images and OCR results on the device and does not send that content to Google servers. However, the Android library may transmit technical diagnostics and usage data to Google, including device and app information, an installation identifier, performance data, API configurations, and error codes. Google states that this data is transferred over HTTPS and is not shared with third parties. See the ML Kit privacy information and data collection disclosure for details.

Recipients, costs, and provider processing

Depending on the provider, account, and Azure region you select, data may also be processed outside the EU or EEA, particularly in the United States. The provider's current contract, privacy terms, and account settings govern the purpose, retention period, possible use of content, transfer safeguards, and deletion options. Review those terms before use and avoid including personal or sensitive data in photos or OCR text.

Your selected provider may charge for analysis requests under its pricing plan. Costs depend in particular on the provider, account, model, and amount of image or text data. Before every analysis, the app displays the provider, model, destination host, and data volume.

The transfer for AI import takes place only to provide the feature you actively request, on the basis of Art. 6(1)(b) GDPR. You can delete each provider's credentials separately in the settings. Other configured providers remain available. Local deletion prevents future requests using those credentials, but it does not delete data previously transmitted to the provider or submit a provider-side deletion request.

App font

To display the Nunito typeface, the app may retrieve font files from Google servers if they are not already cached on the device. This sends the IP address and technically necessary connection data to Google, but no vocabulary, photos, or OCR text. Google's Privacy Policy applies.

Backups, import, and export

Backups and export files are created or selected only at your request. If you transfer data through the system file picker or native share sheet to a storage location, app, or cloud service, the terms of your selected destination govern further processing. VocabNinja does not operate a server for this purpose.

Contact

If you contact us, we process your details to handle your request.

Your rights

You have the right of access, rectification, erasure, restriction of processing, and data portability.

Where we process data based on legitimate interests (Art. 6(1)(f) GDPR), such as usage analytics and error diagnostics, you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). To do so, please reach out via our contact page.

You also have the right to lodge a complaint with a data protection supervisory authority.

Last updated: October 4, 2026