Privacy Policy
Effective . Last updated .
The short version
- Vako works before you make an account. Until you sign in, all we hold is a random identifier your device generated.
- We collect what the app needs to teach you: the language you picked, the clips you watched, the words you saved.
- There are no ads, no advertising identifiers, and no third-party analytics or tracking SDKs in the app. We do not sell data.
- Video plays through YouTube’s own player in privacy-enhanced mode. YouTube sees the playback; we do not send them who you are.
- You can delete your account from inside the app, in Settings. It takes one tap and a confirmation.
The rest of this page is the detail behind those five lines.
Who we are
Vako is a language-learning app for iPhone and Android, operated by the maker of Vako. For anything on this page — a question, a correction, a request to see or delete what we hold — write to hello@abhishekbr.com and you will reach a person, not a queue.
For readers in the UK, EU or any jurisdiction with equivalent law: we are the data controller for everything described here.
What we collect
Your account
The app creates an anonymous account the first time you open it, so you can use it without signing up. That account holds a random identifier generated on your device and nothing else about you — no name, no address, no advertising id.
If you later choose to sign in, we additionally hold:
- your email address;
- a display name and avatar, where Google or Apple provides one, or where you set one yourself;
- for an email-and-password account, a one-way cryptographic hash of your password — never the password itself.
Signing in upgrades the anonymous account you already had rather than replacing it, which is how your saved words survive the transition. If you sign in with Apple and use Hide My Email, we only ever see the relay address Apple gives us.
What you do in the app
- Your learning setup — the language you are learning, your level, the topics you chose, your daily goal and reminder time.
- Your watch history — which clips were shown to you, which you played, and how much of each you watched.
- Your words — the words you saved, and how you graded yourself on them in review, which is what schedules the next review.
- Your saved clips, and any clip you hid or reported, together with the reason you gave.
Product analytics
The app records a fixed, named list of events so we can tell which parts of the product work: opening the app, finishing onboarding, starting and finishing a clip, opening a translation, saving a word, reviewing a word, seeing the paywall, starting or restoring a subscription. Each event carries the account identifier, a session identifier, when it happened, and a small set of properties describing it — a clip id, a language code, a word.
These go to our own server and nowhere else. There is no analytics SDK, no crash-reporting SDK and no advertising SDK in the app; the complete list of events is defined in one file in our codebase, and nothing outside that list is recorded.
Subscriptions
If you subscribe, the purchase happens inside the App Store or Google Play. We never see your card, and we cannot: the stores do not give it to us. We receive, through RevenueCat, whether your subscription is active, which plan it is, when it renews or lapsed, and whether a free trial has been used. That is all we store about payment.
Technical data
Our server processes your IP address to apply rate limits and to keep abuse off the API. We hold app version, platform and language preference so the app can be sent the right content and so we can reproduce a bug. Access and refresh tokens are stored on your device in the operating system’s secure storage — the iOS Keychain or the Android Keystore.
What we do not collect
- No advertising identifier (IDFA / GAID), and no advertising or attribution SDK.
- No third-party analytics. No Google Analytics, no Facebook SDK, no Firebase Analytics, no Segment, no Mixpanel.
- No location, contacts, photos, microphone or camera. The app never asks for these permissions, because it never needs them.
- No push tokens. The daily reminder and the trial-ending reminder are scheduled locally on your device; no push service is involved.
- No sale of personal data, and no sharing of it for cross-context behavioural advertising, under any definition, at any price.
Why we are allowed to hold it
Where the UK GDPR or EU GDPR applies, our legal bases are:
- Performance of a contract — your account, your learning data and your subscription status. Without these there is no product.
- Legitimate interests — product analytics, rate limiting and abuse prevention, in a form that stays proportionate: a fixed event list, no profiling that produces legal effects, and no data broker anywhere in it.
- Consent — notifications, which are off until you turn them on and revocable in the operating system at any time.
Video, and what YouTube sees
Vako does not host, download, copy or re-upload video. Every clip plays through YouTube’s official embedded player, in YouTube’s privacy-enhanced mode (youtube-nocookie.com). When a clip plays, YouTube receives the request and whatever their player collects — that processing is theirs, governed by Google’s Privacy Policy, and by using Vako you also accept the YouTube Terms of Service. We do not pass YouTube your account identifier, your email or anything else identifying you.
Word meanings and Wikipedia
When you open a word and ask to read more about it, the app queries Wikipedia directly from your device. The word being looked up goes to the Wikimedia Foundation as part of that request; your Vako account identifier does not. Their handling is covered by the Wikimedia Privacy Policy.
Who else touches your data
A short list, and it is the whole list. Each of these is a service we use to run Vako, not a party we sell to.
| Who | What for | What they get |
|---|---|---|
| Amazon Web Services | Hosting the API and the database | Everything described above, at rest and in transit |
| Cloudflare | Hosting this website and the review dashboard | Standard web request data. This site sets no cookies and calls no API. |
| RevenueCat | Managing subscriptions across both stores | Your account identifier and your purchase status |
| Apple, Google | Sign-in, payment, app distribution | What their own sign-in and billing require. Their policies apply. |
| YouTube (Google) | Video playback | Playback requests from your device, as above |
| Wikimedia Foundation | Word meanings, when you ask for them | The word looked up |
| Our transcription provider | Turning a clip’s audio into a transcript before publication | Public video URLs only. No learner data is ever sent. |
We will also disclose data where the law genuinely requires it, and we will tell you when we are permitted to. If Vako is ever sold or merged, this policy travels with the data and you will be told before anything changes.
Where your data is held
Our servers are in the United States. If you are reading this from the UK, the EU or elsewhere, using Vako involves transferring your data there. Where that transfer needs a safeguard, we rely on the Standard Contractual Clauses our providers offer.
How long we keep it
We keep your account and learning data for as long as your account exists. When you delete it, this is exactly what happens:
- Immediately, and irreversibly: your email address, your password hash, your linked Google and Apple identities and your device identifier are erased, and every session is revoked. Nothing can sign back into that account, and the address is free for you to use again.
- Retained, de-identified: your watch history, saved words and analytics events remain attached only to a random account identifier that no longer connects to any name, address, device or sign-in. We keep them because they are what the aggregate numbers about the product are built from.
If you would rather that residue were removed too, write to hello@abhishekbr.com and we will erase it. We answer within 30 days.
Your rights
Wherever you live, you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask for it in a portable form, or object to our processing it. In the UK and EU these are rights under the GDPR; in California they are rights under the CCPA, including the right not to be discriminated against for exercising them — and since we sell nothing, there is nothing to opt out of.
The fastest route to deletion is in the app: Settings → Delete account. For anything else, write to hello@abhishekbr.com. If we get it wrong, you may complain to your data protection authority — in the UK, the Information Commissioner’s Office.
Children
Vako is not directed at children. You need to be at least 13 to use it, or older where your country sets a higher age for digital consent — 16 in parts of the EU. We do not knowingly collect data from anyone below that age. If you believe a child has given us data, write to hello@abhishekbr.com and we will delete it.
Clips come from public YouTube and are reviewed by a person before publication, but they are made by third parties and we cannot guarantee every clip suits every age.
Security
Everything travels over TLS; the API refuses plain HTTP. Passwords are hashed with scrypt. Refresh tokens are stored hashed and rotated on every use, and reusing a spent one revokes the whole chain. Tokens on your device live in the operating system’s secure storage. No system is perfect, and we would rather say that than imply otherwise.
Changes
If this policy changes we will update the date at the top, and for anything that materially affects you we will tell you in the app before it takes effect rather than after.