Privacy policy
You can use every part of Vocabs without an account. This page lists exactly what is stored, where, and how to remove it.
Stored in your browser (never sent unless you have an account)
vocabs_progress: your study progress for each word (when you last studied it, when it's next due, your sort-pass mark). If you are logged in, this is also synced to your account.vocabs_acct: a flag meaning "this browser has logged in", so the site knows to check your account. It contains no email or identifier.vocabs_tool: only if you tick "Always open the full tool on this device"; it skips the step-by-step questions on the home page.
Clear your browser's site data to remove them.
If you create an account
- Email address, used only as your login name. We don't send email (no newsletters, and password reset by email is not available yet).
- Password hash: your password is never stored. We store a salted PBKDF2-SHA256 hash (100,000 iterations) that can't be turned back into the password.
- Study progress: one record of per-word review data, as described above.
- Session cookie
vx_s: a random login token, HttpOnly and Secure, valid for 30 days or until you log out. We store only a hash of it. It is the only cookie this site sets. - Failed-login counter: to block password guessing, we count failed logins per account email (stored as a one-way hash) and lock logins for 15 minutes after 10 failures. We do not store IP addresses for this.
Accounts are for people aged 13 or older. Data is stored with our hosting provider, Cloudflare (Cloudflare D1 database).
Delete anytime
On the account page, "Delete my account" removes your email, password hash, progress and sessions immediately. Logging out deletes the session from our database.
Analytics and ads
We record anonymous, aggregate usage events (page views, which study mode or home-page situation was used, steps of the study flow) with no cookies, IP addresses or identifiers, and these are never joined to accounts: the analytics script doesn't know whether or who you are logged in as. Do Not Track and Global Privacy Control are honoured. We also use Cloudflare Web Analytics (cookieless). We don't show ads yet; if we add them, there will be no ad personalisation tied to accounts, and this page will be updated first.
The wider Rocky Panda privacy policy covers our other tools. Questions: hello@rockypanda.com.