Privacy Policy

WordLocker (“the App”) is developed by Octo8 (“we”, “us”, or “our”). This Privacy Policy explains how the App handles your information.

The Short Version

WordLocker is a local-first app: it works fully without creating an account, and all your data stays on your device. Only if you optionally sign in does your learning data sync to the cloud for cross-device backup. No ads, no third-party tracking, no selling personal data.

1. Information We Collect

Anonymous mode (no sign-up): No personal information is collected. All your learning data (word progress, streak, XP, badges) is stored only on your device using SwiftData.

If you create an account (optional):

If you use Sign in with Apple: Apple’s anonymous identifier (user ID), optional display name
If you sign up with email: your email address
Onboarding metadata: native language, motivation (career, travel, exam, etc.), daily English exposure level, age range (used for personalization, not as identifying information)

2. Screen Time Data

For app blocking, we use Apple’s FamilyControls framework:

When you select apps to block, Apple represents that selection as an opaque token (a meaningless identifier)
By Apple’s privacy design, we do not know which apps you selected — only your device knows
These tokens are stored only in your device’s App Group, never sent to our servers
App blocking is fully optional — you can skip it during onboarding (“Skip for now”) and use the app without ever using it

3. Learning Data

The following data is generated during your challenges:

Which words you’ve seen, your correct/wrong counts, mastery scores
Challenge session records (start/end times, results)
Streak, XP, earned badges, your CEFR level

In anonymous mode: This data stays only on your device. It is lost if you change devices or delete the app.

In account mode: This data is stored on Supabase (European data center) with Row Level Security — only you can access it. Data is protected with encrypted transmission (TLS) and encrypted storage (AES-256).

4. Subscription Information

We use RevenueCat to manage premium subscriptions:

Apple App Store purchases are processed normally by Apple — we never access your card details
RevenueCat tracks your subscription status (active/cancelled/trial)
If you purchase anonymously, RevenueCat uses an anonymous identifier
If you create an account later, your anonymous purchase is linked to your account

5. Notifications

Using Apple’s UserNotifications framework:

Daily challenge reminder — single notification at the time you’ve chosen
Spaced repetition reminder (premium) — up to 5 notifications/week for words due for review

Notification content is generated locally on your device. Nothing is sent through Apple Push Notification Service (no remote push).

6. Third-Party Services

WordLocker uses only the following services:

Apple frameworks: SwiftUI, AVFoundation (TTS), FamilyControls, ManagedSettings, DeviceActivity, UserNotifications, SwiftData
RevenueCat: Subscription management only. Has no access to your learning data.
Supabase: Optional account registration and data sync only (auth + PostgreSQL database). Hosted in Europe.

We do not use ad SDKs, analytics SDKs, or user-tracking SDKs.

We do not share, sell, or rent your data to third parties. Only what is required by law or what is operationally necessary for our service providers (RevenueCat, Supabase).

8. Children’s Privacy

WordLocker is not directed at children under 13. We do not knowingly collect personal data from children under 13. The age range question during onboarding includes 13–17, but parental consent is assumed for users under 13.

9. Data Retention and Deletion

In anonymous mode: If you delete the app, all data is lost (no backup).

In account mode:

Data is retained as long as your account is active
You can request account deletion at [email protected] — all your data is permanently deleted from Supabase within 30 days
You can cancel your subscription anytime in App Store settings; after cancellation, your data falls to the free tier with read access but is not deleted

Access: Request a copy of your data
Correction: Correct inaccurate data
Deletion: Delete your account and all data
Portability: Export your data in a structured format
Objection: Object to processing

For requests: [email protected]

11. Changes to This Policy

If we update this Privacy Policy, we will post the revised version at this URL with an updated “Last Updated” date. For material changes, we will also notify you in-app.

12. Contact

If you have questions or concerns about this Privacy Policy:

Email: [email protected]