This privacy policy applies to the ScanVocab app for mobile devices (the “Application”), together with any related services operated by Thao Tran (the “Service Provider”), and describes how the Service Provider collects, uses, and discloses information in connection with your use of the Application.
Information Collection and Use
The Application collects information in the following ways when you download and use it.
Account information
When you create an account, the Application uses “Sign in with Google” or “Sign in with Apple” to authenticate you. Through this process, the Service Provider receives and stores your name, email address, profile picture, and a unique user identifier associated with your account. The Service Provider does not collect or store a separate password, since authentication is handled entirely by Google or Apple. The Service Provider may use this contact information to send you important account-related notices and, where permitted by applicable law, marketing communications, which you may opt out of at any time.
User data
The Application stores the vocabulary sets and folders you create, including the structured word data (such as vocabulary/definition pairs) contained within each set, which is used to generate flashcards, study sets, and practice exercises within the Application. See “Artificial Intelligence” below for how this word data may be generated from a photograph you submit.
Other information collected
The Application also collects:
- Your device’s Internet Protocol (IP) address, which may be automatically collected by the Service Provider’s infrastructure and hosting providers (such as Cloudflare and Supabase) as part of standard server operations, such as maintaining security and diagnosing technical issues
- Your device’s operating system, which is collected by Expo as part of its update-delivery service (see “Third Party Access” below)
- Subscription and purchase status (see “In-App Purchases” below)
- An advertising identifier, where permitted (see “Cookies and Tracking Technologies” below)
- Data about your usage of premium features, such as the number of AI photo-scans and AI-graded submissions associated with your account, in order to enforce usage limits and provide premium features
- The number of reward ads you have viewed, in order to grant the associated in-app rewards (see “Cookies and Tracking Technologies” below)
The Application does not request or collect precise device location (GPS) data.
In-app purchases and subscriptions
The Application offers in-app purchases and subscriptions, processed through RevenueCat in conjunction with the Apple App Store or Google Play Store. The Service Provider receives your subscription and purchase status (for example, whether you have an active subscription) through RevenueCat, but does not receive, process, or store your payment card number or other raw payment details. Payment information you provide is handled directly by Apple, Google, and RevenueCat in accordance with their own privacy policies, linked below.
Artificial Intelligence
The Application’s core features rely on artificial intelligence, both processed through Google’s Gemini API:
Vocabulary extraction
The Application allows you to photograph text — such as vocabulary lists, textbook pages, worksheets, or handwritten notes. The photograph is transmitted to Gemini, which processes the image and returns structured vocabulary/text data. Once this data has been returned, the original photograph is deleted and is not retained on the Service Provider’s servers; the returned data is what becomes the word data described in “User Data” above.
Sentence grading
As a premium feature, when you write a sentence using a target vocabulary word, that text is submitted to Gemini, which grades and returns feedback on how well the word was used. The submitted sentence text is not retained by the Service Provider and is discarded after grading, in the same manner as photographs described above.
The Service Provider currently uses the free tier of the Gemini API, and plans to upgrade to a paid, billed tier in the near future. Under Google's terms currently applicable to the free tier, Google may use submitted content — including photographs, extracted text, and graded sentences — to improve its products and services, including for machine-learning and model-training purposes, and human reviewers may access this content for that purpose. This differs from Google's paid-tier terms, under which content is not used to train Google's models. This processing is governed by Google's own applicable terms and privacy policy (linked below), in addition to this Privacy Policy, and the Service Provider does not control how Google itself handles or retains data during this processing. Once the Service Provider upgrades to a paid tier, this Privacy Policy will be updated to reflect Google's paid-tier data-handling terms..
The Application does not use AI to make automated decisions about you that produce legal or similarly significant effects, and does not use AI to profile users for any purpose other than generating the study materials and grading feedback described above.
Third Party Access
The Service Provider works with the following third-party services to operate the Application, each of which may receive certain categories of your information as described below. Their own privacy policies, which govern how they separately handle data, are linked below:
- Google — provides “Sign in with Google” authentication, and provides the Gemini API used to process photographs and graded sentences into structured data and feedback. Privacy policy: policies.google.com/privacy
- Apple — provides “Sign in with Apple” authentication, and processes in-app purchases made through the Apple App Store. Privacy policy: apple.com/legal/privacy
- Google AdMob — displays advertising within the Application and may receive advertising identifiers and usage data for that purpose. Privacy policy: policies.google.com/technologies/ads
- RevenueCat — manages and processes in-app purchases and subscriptions, and receives your purchase/subscription status. Privacy policy: revenuecat.com/privacy
- Expo — provides application development and runtime infrastructure, including update-delivery services that collect your device’s operating system and a randomized device token to manage update delivery, and may receive limited technical/usage data as part of that role. Privacy policy: expo.dev/privacy
- Cloudflare — provides the backend serverless infrastructure used to operate the Application’s servers and APIs. Privacy policy: cloudflare.com/privacypolicy
- Supabase — provides the database in which your account information and user data are stored, and provides the edge functions used to run backend business logic, such as processing requests to the Gemini API. Privacy policy: supabase.com/privacy
Other than as described in this privacy policy, the Service Provider does not sell your personal information to third parties.
The Service Provider may also disclose User Provided and Automatically Collected Information:
- as required by law, such as to comply with a subpoena or similar legal process;
- when the Service Provider believes in good faith that disclosure is necessary to protect its rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
- with trusted service providers who work on the Service Provider’s behalf, do not have an independent use of the information disclosed to them, and have agreed to adhere to the rules set forth in this privacy policy.
International Data Transfers
If you access the Application from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where the Service Provider or its third-party service providers (listed above) operate, which may have data protection laws different from those of your home country.
Your Rights
You may request access to, correction of, or deletion of your personal data held by the Service Provider. You can delete your account at any time directly within the Application, which will delete your account information and user data, since most of your data is tied directly to your account. For any other requests, including access or correction requests, or if you experience any issues deleting your account, contact the Service Provider at support.scanvocab@gmail.com.
You can also stop further collection of information from your mobile device by uninstalling the Application. Uninstalling will stop the Application from collecting data from your device, but it does not automatically delete information that has already been transmitted to the Service Provider or to third parties, including your account information and user data stored in the Service Provider’s database.
You can limit ad personalization at any time by adjusting your device’s tracking/privacy settings — for example, by declining or later revoking App Tracking Transparency permission on iOS, or the applicable setting on Android. This will reduce ad personalization but will not stop ads from being shown, and will not delete data already collected.
Your California privacy rights (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information is collected, the right to delete personal information, the right to correct inaccurate personal information, the right to opt out of the sale or sharing of personal information, and the right to non-discrimination for exercising these rights. Under the CCPA/CPRA, the use of advertising identifiers by AdMob for personalized advertising may be considered a “sale” or “sharing” of personal information; see above for how to opt out. To exercise your CCPA/CPRA rights, contact the Service Provider at support.scanvocab@gmail.com.
Data Retention Policy
The Service Provider retains personal data based on its necessity for the stated purposes:
- Account information (name, email, profile picture, user ID): retained for as long as your account remains active, and deleted promptly upon account deletion, unless a longer period is required by law.
- User data (your sets and folders, including the structured word data within them, which is used to dynamically generate flashcards, study sets, and practice exercises): retained for as long as your account remains active, and deleted promptly upon account deletion, unless a longer period is required by law.
- Photographs and submitted sentences: not retained by the Service Provider. Photographs are deleted immediately after processing by Google’s Gemini API, and sentences submitted for AI grading are deleted immediately after grading. Google’s own handling of this data during processing is governed by Google’s applicable terms, as described in “Artificial Intelligence” above.
- Automatically collected data (device identifiers, advertising identifiers, IP address, usage data): retained according to the standard practices of the Service Provider’s infrastructure and service providers listed above, unless a longer period is required for legal compliance.
- Data required for legal compliance: retained as long as required by applicable law.
You may request deletion of your personal data, subject to any legal obligation to retain it, by deleting your account within the Application or contacting the Service Provider at support.scanvocab@gmail.com. Please note that some data, such as your account information, may be required for the Application to function and cannot be deleted without deleting your account entirely.
Children
The Application is intended for use by high school students. It is not directed to children under the age of 13, and the Service Provider does not knowingly collect personal information from children under 13. Because the Application does not verify user age, the Service Provider cannot guarantee that children under 13 do not access or use it.
If you are a parent or guardian and believe that your child under the age of 13 has provided personal information through the Application, please contact the Service Provider at support.scanvocab@gmail.com, and the Service Provider will take reasonable steps to locate and delete that information.
Security
The Service Provider is concerned about safeguarding the confidentiality of your information, and provides physical, electronic, and procedural safeguards to protect the information it processes and maintains. However, no method of transmission over the internet or method of electronic storage is completely secure, and the Service Provider cannot guarantee absolute security.
Data Breach Notification
If a data breach occurs that affects your personal data, the Service Provider will notify you in accordance with applicable legal requirements, including, where required, providing information about the nature of the breach and the steps being taken to address it.
Changes
The Service Provider may update this privacy policy from time to time. The Service Provider will notify you of material changes by posting the updated privacy policy with an effective date. Where required by law, the Service Provider will seek your consent to material changes before they take effect.
Previous versions of this privacy policy will be maintained and made available upon request by contacting the Service Provider at support.scanvocab@gmail.com.
This privacy policy is effective as of 2026-09-09.
Your Consent
Where processing is based on consent, you provide that consent by affirmatively opting in to the relevant feature or action. You may withdraw consent at any time without affecting processing carried out before withdrawal. Processing based on other lawful bases is carried out as described above.
Contact Us
If you have any questions regarding privacy while using the Application, or have questions about these practices, please contact the Service Provider via email at support.scanvocab@gmail.com.