Privacy Policy

Effective date: April 5, 2026 · Last updated: June 9, 2026

LAFwords, operated by inMDsoft ("we," "us," or "our"), provides the LAFwords vocabulary learning application at app.lafwords.com and the website at lafwords.com (together, the "Service"). This Privacy Policy explains what personal data we collect, why we collect it, how we process it, and your rights regarding that data.

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address
• Display name (if provided)
• Authentication credentials (managed by Firebase Authentication; we do not store your password directly)
• If you sign in with a third-party provider (e.g., Google), we receive your name, email, and profile picture from that provider

1.2 Learning Data

As you use LAFwords, we collect and store data related to your learning activity:

• Words you add to your vocabulary collection
• Your review history, scores, and spaced-repetition scheduling data
• Word states (e.g., studying, mastered, abandoned) and progression timestamps
• Preferences and settings (e.g., daily word limits, mastery thresholds, language selections)

1.3 AI-Generated Content

When you add words, our Service uses AI to generate contextual example sentences, pronunciation audio, and illustrations for your vocabulary cards. The text you submit (individual words and their context) is sent to third-party AI providers to generate this content. See Section 3 for details on these providers.

1.4 Payment Information

Payments for premium subscriptions are processed by Lemon Squeezy, which acts as our Merchant of Record. Lemon Squeezy collects and processes your payment information (credit card number, billing address, etc.) directly. We do not receive or store your full payment details. We receive only:

• Subscription status (active, cancelled, expired)
• Plan type (monthly or annual)
• Transaction identifiers
• Country of purchase (for regional pricing)

1.5 Usage & Analytics Data

We use Firebase Analytics to collect anonymized usage data, including:

• Pages visited and features used
• Session duration and frequency
• Device type, browser, and operating system
• General geographic region (country/city level, derived from IP address)
• Crash reports and performance metrics

This data is aggregated and does not personally identify you.

1.6 Website Data

When you visit lafwords.com, we may collect:

• IP address (used for regional pricing detection and abuse prevention)
• Information you voluntarily submit through the feedback form on our website (the message content and, if you choose to provide it, your email address so we can reply)
• Cloudflare Turnstile tokens (for bot and abuse prevention on the feedback form; see Cloudflare's Privacy Policy)

2. How We Use Your Information

We use the information we collect to:

• Provide the Service: Create and manage your account, generate AI-powered vocabulary cards, schedule your reviews using the FSRS spaced-repetition algorithm, and sync your learning progress across devices.
• Process payments: Manage your subscription status and enforce trial and subscription limits (payment processing itself is handled by Lemon Squeezy).
• Offer regional pricing: Detect your approximate location via IP geolocation to apply Purchasing Power Parity discounts, making the Service accessible globally.
• Improve the Service: Analyze aggregated usage patterns to identify bugs, improve features, and inform product decisions.
• Communicate with you: Send transactional emails (account confirmation, password resets, subscription receipts) and, if you opt in, product updates.
• Prevent abuse: Enforce rate limits on AI generation, detect fraudulent accounts, and protect the integrity of the Service.

We do not sell your personal data. We do not use your learning data to train AI models. We do not display advertising.

3. Third-Party Services

We use the following third-party services to operate LAFwords. Each processes certain data on our behalf:

Note on AI data processing: We use the OpenAI API under their business terms, which means your data submitted through our Service is not used by OpenAI to train their models. We send only the minimum information necessary (the word and its language context) to generate content for your vocabulary cards.

4. Data Retention

We retain your personal data for as long as your account is active and as needed to provide the Service. Specifically:

• Account and learning data: Retained while your account exists. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law.
• AI-generated content: Vocabulary card content (sentences, audio, images) associated with your account is deleted when you delete your account. Pre-generated content that is shared across users (not tied to any individual account) is retained indefinitely.
• Analytics data: Aggregated, non-identifiable analytics data may be retained indefinitely for product improvement.
• Payment records: Lemon Squeezy retains transaction records in accordance with their own retention policies and applicable tax/financial regulations.

5. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data (you can delete your account at any time from within the app).
• Data portability: Request an export of your data in a machine-readable format.
• Objection / Restriction: Object to or request restriction of certain processing activities.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us via the feedback form within the application. We will respond within 30 days.

For users in the European Economic Area (EEA)

Our legal bases for processing your data under the GDPR are:

• Contract performance: Processing necessary to provide the Service you signed up for (account management, learning features, subscription handling).
• Legitimate interest: Analytics, fraud prevention, and service improvement, balanced against your privacy interests.
• Consent: Optional marketing communications (you can unsubscribe at any time).

If you believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with your local data protection authority.

For users in California (CCPA)

California residents have the right to know what personal information is collected, request deletion, and opt out of the sale of personal information. We do not sell personal information. To make a request, contact us via the feedback form within the application.

6. International Data Transfers

LAFwords is operated from the United States. If you are located outside the US, your data may be transferred to and processed in the US or other countries where our service providers operate. By using the Service, you consent to this transfer. We rely on our providers' safeguards (such as Google's and OpenAI's Standard Contractual Clauses) to ensure adequate data protection for international transfers.

7. Data Security

We take reasonable technical and organizational measures to protect your personal data, including:

• Encrypted data transmission (HTTPS/TLS) for all communications
• Firebase Security Rules to enforce access controls on stored data
• Webhook signature verification for payment events
• Rate limiting on AI generation endpoints

However, no method of electronic storage or transmission is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

8. Cookies & Local Storage

LAFwords uses a minimal set of cookies and browser storage:

• Authentication tokens: Managed by Firebase Authentication to keep you signed in.
• Analytics cookies: Set by Firebase Analytics (Google) to track anonymized usage. You can disable these in your browser settings.
• Cloudflare Turnstile cookies: Cloudflare Turnstile may set short-lived cookies on the website for challenge state and bot detection when you interact with the feedback form. Turnstile is designed to be privacy-respecting and does not use these cookies to track you across other sites.

We do not use advertising cookies or third-party tracking cookies.

9. Children's Privacy

LAFwords is designed for vocabulary learners and is not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16, we will delete it promptly. If you believe a child has provided us with personal data, please contact us via the feedback form within the application.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on this page and updating the "Last updated" date above. For significant changes, we may also notify you by email. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us via the feedback form within the application or through our website at lafwords.com.