Privacy Policy
Last updated: 2026-08-22
Your forest belongs to you. So do the words that grew it, the names you gave your animals, and every tree you placed. This policy explains what Vocabulary Forest stores, why we store it, who else touches it, and how you stay in control of it, without burying any of it in legalese.
What this policy covers
Vocabulary Forest is a vocabulary app built around a forest that grows as you study. For your forest to survive a new phone, we have to store some information about you. This policy is about exactly that information.
It covers three places: the Vocabulary Forest app on iOS and Android, the website at https://vocabularyforest.com, and any support conversations relating to either.
The data controller is [şirket unvanı — eklenecek]. Postal address: [posta adresi — eklenecek]. Effective date: 2026-08-22.
If any part of this page is unclear, write to info@vocabularyforest.com and we will explain it in plain words.
What we collect
We collect only what the app needs to work, to keep your forest safe, and to fix things when they break. The table below is the complete picture.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account details | Email address, account ID, sign-up date, and a display name if you set one | From you, when you register |
| Learning progress | Words you study, correct and incorrect answers, review scheduling, study streaks, and results from word battles in adventure mode | Automatically, as you use the app |
| Forest state | Rain points, land health percentage, the animals, plants and sculptures in your forest, the names you gave them, and where you placed them | Automatically, as you use the app |
| Game economy | Gold and diamond balances, completed quests, daily wheel spins, and items obtained from the market | Automatically, as you use the app |
| Device and technical data | Device model, operating system version, app version, language and region settings, crash and error logs | Automatically, from your device |
| Purchase records | Which item was bought, the transaction date, and the transaction ID issued by the store | Through Apple App Store or Google Play |
| Support correspondence | The emails you send us and any screenshots you attach | From you, when you write to us |
We never see your card number or payment details. Payment happens entirely on Apple's or Google's side; all we learn is that a purchase went through.
Why we collect it
Every category has a concrete job. When a piece of data no longer has a job, we stop keeping it.
- Creating your account, keeping you signed in, and showing the right forest to the right person
- Saving your learning progress, scheduling reviews, and turning the rain points you earn into rain on your land
- Keeping your forest identical across your phone, tablet, and any new device
- Running quests, the daily wheel, gold and diamond balances, and market purchases correctly
- Verifying in-app purchases and handling refund and store enquiries
- Finding and fixing crashes and bugs, and keeping the app fast and stable
- Answering your support requests and following up on issues you report
- Preventing account abuse, fraudulent purchase attempts, and security incidents
- Keeping the records the law requires us to keep
We do not sell your data, rent it, or share it with anyone for advertising purposes.
Legal basis: KVKK and GDPR
We process personal data only when we have a valid legal basis for it. Turkey's Personal Data Protection Law No. 6698 (KVKK) applies in Türkiye, and the GDPR applies in the European Economic Area and the United Kingdom. The table below sets the two side by side for each purpose.
| Purpose | KVKK basis (Art. 5) | GDPR basis (Art. 6) |
|---|---|---|
| Creating your account and syncing your forest across devices | Directly related to the conclusion or performance of a contract — Art. 5/2-c | Performance of a contract — Art. 6(1)(b) |
| Verifying and recording in-app purchases | Expressly provided for by law and compliance with a legal obligation — Art. 5/2-a and 5/2-ç | Legal obligation — Art. 6(1)(c) |
| Investigating crashes, fixing bugs, keeping the service secure | Legitimate interest, provided your fundamental rights are not harmed — Art. 5/2-f | Legitimate interests — Art. 6(1)(f) |
| Responding to your support requests | Performance of a contract and legitimate interest — Art. 5/2-c and 5/2-f | Performance of a contract and legitimate interests — Art. 6(1)(b) and 6(1)(f) |
| Sending optional announcements, news, or promotional messages | Explicit consent — Art. 5/1 | Consent — Art. 6(1)(a) |
Where we rely on consent, you can withdraw it at any time. Withdrawing does not make the processing we carried out before that point unlawful.
How long we keep it
We keep each piece of data for as long as the reason we collected it still holds. Once that reason is gone, we delete the data or strip it of anything that could tie it back to you.
| Data | Retention period |
|---|---|
| Account details, learning progress, forest state, game economy | For as long as your account is open; deleted within 30 days of a deletion request |
| Backups | Removed from the backup rotation within 90 days of deletion |
| Purchase and invoice records | For the period required by applicable tax and commercial law; these records are kept detached from your account |
| Crash and technical logs | Up to 12 months, held in de-identified form wherever possible |
| Support correspondence | Up to 2 years after your request is closed |
| Dormant accounts | If there is no activity for 24 months, we notify you first and then close the account |
Third-party services
A handful of outside services keep the app running. The list below is all of them; we send data to no one else.
| Service | Provider | What it is used for | Data shared |
|---|---|---|---|
| Firebase Authentication | Account creation and sign-in sessions | Email address, account ID | |
| Cloud Firestore | Syncing your forest, learning progress, and game economy across devices | Account ID, learning progress, forest state, gold and diamond balances | |
| Firebase crash and error reporting | Diagnosing crashes and shipping stability fixes | Device model, operating system and app version, error trace | |
| App Store and StoreKit | Apple | Purchases, subscriptions, and refunds on iOS | Transaction ID and purchase validation data |
| Google Play Billing | Purchases and refunds on Android | Transaction ID and purchase validation data | |
| Email infrastructure | The provider hosting our support and privacy addresses | Support and data request correspondence | Your email address and whatever you write to us |
We use no advertising network, no SDK that collects advertising identifiers, no behavioural profiling tool, and no third-party marketing analytics. If that ever changes, we will update this policy, announce it in the app, and ask for your consent where consent is required.
International data transfers
Firebase and Cloud Firestore are operated by Google, and your data may be stored in data centres outside Türkiye, primarily in the United States. Purchase validation likewise happens on Apple's and Google's own infrastructure.
We make these transfers under Article 9 of the KVKK and the international transfer provisions of Chapter V of the GDPR. Contracts with our providers, including standard contractual clauses, commit them to protecting transferred data at an adequate level.
If you want more detail on which service moves which data where, write to info@vocabularyforest.com and we will walk you through it.
Your rights under the KVKK (Art. 11)
If you are in Türkiye, Article 11 of Law No. 6698 gives you the following rights:
- To learn whether your personal data is being processed
- To request information about that processing if it has taken place
- To learn the purpose of processing and whether the data is used in line with that purpose
- To know the third parties inside or outside Türkiye to whom the data has been transferred
- To request correction of incomplete or inaccurate data
- To request erasure or destruction of your data under the conditions set out in the law
- To request that corrections and erasures be notified to the third parties the data was transferred to
- To object to a result reached to your detriment through processing carried out exclusively by automated systems
- To claim compensation if you suffer damage because your data was processed unlawfully
If you are unhappy with our response, you can always lodge a complaint with the Turkish Personal Data Protection Authority.
Your rights under the GDPR
If you are in the European Economic Area or the United Kingdom, the GDPR gives you the rights below. These sit alongside the KVKK rights rather than replacing them.
- Right of access: you can request a copy of the data we hold about you (Art. 15)
- Right to rectification: you can have inaccurate or incomplete information corrected (Art. 16)
- Right to erasure: you can ask us to delete your data (Art. 17)
- Right to restriction: in certain cases you can ask us to keep your data but stop using it (Art. 18)
- Right to data portability: you can receive your progress and forest data in a machine-readable file and take it elsewhere (Art. 20)
- Right to object: you can object to processing we base on legitimate interests (Art. 21)
- Right to withdraw consent: you can withdraw consent for any processing that relies on it (Art. 7(3))
- Right to complain: you can contact the data protection authority in your country (Art. 77)
We do not carry out solely automated decision-making or profiling that produces legal effects for you.
How to exercise your rights
Send your request to info@vocabularyforest.com. Writing from the email address registered to your account is the fastest route, because it lets us verify your identity in one step.
We respond within 3 days. If a request is complex or involves a large amount of data we may need longer, in which case we will write and tell you why.
Responding costs you nothing. We reserve the right to charge a reasonable fee or decline only where a request is manifestly unfounded or excessively repetitive.
- To request a copy of your data: write with the subject line data access request
- To delete your account and data: follow the steps at https://vocabularyforest.com/pages/delete-account.html
- To correct something that is wrong: tell us what the information is and what it should be
Children's privacy
An app that teaches vocabulary naturally appeals to children, so we would rather be explicit about age.
Vocabulary Forest is a general-audience app and is not designed specifically for young children. To create an account on your own you must be at least 13. In the European Economic Area, the age of digital consent ranges from 13 to 16 depending on the country; if you are below the threshold where you live, a parent or guardian must give consent for the account.
In the United States, we do not knowingly collect personal information from children under 13 as defined by COPPA. If we discover that a child under 13 has given us data without verifiable parental consent, we close the account and delete the data.
If you believe your child has given us data without your permission, write to info@vocabularyforest.com and we will treat it as a priority.
We show no behavioural advertising to children; there is no third-party ad network in the app at all. Because the app does contain in-app purchases, we recommend keeping your device's parental controls and purchase confirmation settings switched on.
What the website does
The site at https://vocabularyforest.com is a promotional site. You cannot create an account there and no forest data lives on it.
The site stores exactly one thing in your browser: your language preference, saved in localStorage. That is what makes the page open in the right language next time. It never leaves your device, is never sent to us, and disappears when you clear your browser data.
There are no analytics cookies, no marketing cookies, no tracking pixels, and no third-party advertising scripts. Because the only thing we store is strictly necessary, we do not show a cookie consent banner either; the law requires consent for non-essential tracking, and we do not run any.
If we ever add measurement, we will look at cookieless and anonymous options first. If we add anything that requires consent, the relevant script will not load until you give it, and this policy will be updated.
The store badges on the site link to [App Store bağlantısı — eklenecek] and [Google Play bağlantısı — eklenecek], which are Apple's and Google's own pages. Once you follow those links, the respective store's privacy policy takes over.
How we protect your data
- All traffic between the app and our servers runs over an encrypted TLS connection, and the website is served over HTTPS only
- Data is also encrypted at rest with our cloud provider
- Firestore security rules are configured so each user can reach only their own forest and their own progress
- Access to production data is limited to the few people who need it
- Payment details never enter our systems; the entire payment flow stays with Apple and Google
- Backups are taken regularly and expire automatically once their retention window ends
No system is perfectly secure. If a breach affects the security of your data, we will notify the competent authority and the affected users within the timeframes the law requires.
Changes to this policy
As the app changes, so does this text. Every version carries its last-updated date; this one is dated 2026-08-22.
If something significant changes, such as a new category of data or a new third-party service, we will tell you in the app or by email before it takes effect.
Continuing to use the app after a change means you accept the updated policy. If you would rather not, you can delete your account; the steps are at https://vocabularyforest.com/pages/delete-account.html.
Contact
You can reach us directly about anything privacy-related.
- Privacy and data requests: info@vocabularyforest.com
- General support: info@vocabularyforest.com
- Postal address: [posta adresi — eklenecek]
- Web: https://vocabularyforest.com
We reply within 3 days. If you have not heard back in that time, send your email again; every so often a message ends up in a spam folder.