Privacy policy

1. Data controller

The controller of the personal data collected through VocaBag is:

SECBEC — SASU, SIRET 92486099200016
60 rue François Ier, 75008 Paris, France
Contact: Contact form

VocaBag has not formally appointed a Data Protection Officer (DPO). For any question about the protection of your data, you can contact us through the contact form.

2. Data collected and purposes

VocaBag only collects the data strictly necessary for the service to work. No location data, no phone number and no sensitive data within the meaning of Article 9 of the GDPR are collected.

Data	Purpose	Legal basis	Retention
Email address	Account creation, identity verification, sending transactional emails (sign-up confirmation, password reset, streak reminder)	Performance of the contract	Life of the account + 30 days after deletion
Username	Identification in the app, display on the leaderboard	Performance of the contract	Life of the account
Password (bcrypt hash)	Secure authentication (accounts created without Google)	Performance of the contract	Life of the account
Google identifier (google_id, optional)	Authentication through Google Sign-In, only if the user chooses to log in with their Google account	Performance of the contract	Life of the account
Learning progress (XP, level, words seen, SRS statuses, streak, badges, missions)	Learning service, leaderboard calculation, personalization of the experience	Performance of the contract	Life of the account
Quiz session history	Personal statistics, progress tracking	Performance of the contract	Life of the account
Date of last activity	Daily streak calculation	Legitimate interest	Life of the account
Daily goal and language preferences (including interface language)	Personalization of the app	Performance of the contract	Life of the account
Push notification token (optional)	Sending notifications to the user's device (mobile app only, if permission is granted)	Consent	Until consent is withdrawn or the account is deleted
Contact form messages	Handling requests and reports	Legitimate interest	As long as needed to handle the request
Subscription data (plan, status, end date)	Management of the Premium plan, access to paid features	Performance of the contract	Life of the account + 30 days after deletion
Stripe identifiers (stripe_customer_id, stripe_subscription_id)	Link between the VocaBag account and the Stripe billing account	Performance of the contract	10 years (legal accounting obligation)

3. Cookies and trackers

VocaBag uses no advertising cookies, no advertising trackers (Facebook Pixel, etc.) and no commercial profiling. One cookieless audience measurement tool is used (see 4.6).

Trackers strictly necessary for the service:

• PHPSESSID — HTTP session cookie, required for authentication. Duration: browser session. Attributes: HttpOnly, SameSite=Lax.
• vb_remember — persistent login cookie, created only if the user ticks "Remember me". The token is stored hashed (SHA-256) in the database. Duration: 30 days. Revoked on logout and on password change. Attributes: HttpOnly, Secure, SameSite=Lax.
• Pending answers — unsaved answers are kept in this tab’s sessionStorage to allow retries. They are removed after server confirmation or when the tab closes.
• Service Worker cache — the app uses a Service Worker (PWA) that caches static files (CSS, JS) for partial offline access. This cache contains no personal data.

Audience measurement:

• PostHog — sets no cookies and writes nothing to your browser storage.

4. Third-party services

4.1 Hosting — Hostinger

The site and its data are hosted on a VPS server operated by Hostinger International Ltd, 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. Hostinger is a processor within the meaning of the GDPR. Data is stored in data centers located in the European Union. More information: Hostinger privacy policy.

4.2 Sending emails — Gmail API (Google)

VocaBag uses the Gmail API from Google LLC to send transactional emails (email address verification, password reset, reminders related to the user's activity). This integration relies on the OAuth 2.0 protocol applied to a sending account owned by the app; it never allows VocaBag to access the data of users' Gmail accounts.

Transactional emails pass through Google's servers. This transmission is governed by Google's privacy policy and the contractual terms applicable to API partners.

4.3 Social login — Google Sign-In

VocaBag offers login through Google Sign-In (a Google LLC service), available on the login and sign-up pages. It is strictly optional: sign-up with email and password remains available, and no Google data is collected for users who do not use it.

When a user chooses to log in with Google, VocaBag accesses the following data, sent by Google after explicit consent:

• Email address associated with the Google account;
• First name and/or display name (used to generate an initial username);
• Unique Google identifier ("google_id"), stored in the database in order to link the Google account to the corresponding VocaBag account.

VocaBag does not receive or access your Google password, your emails, your contacts, or any other data in your Google account beyond basic profile information. Google Sign-In is governed by Google's privacy policy and its terms of service.

4.4 Audio — gTTS (Google Text-to-Speech)

The audio files for vocabulary words are generated in advance with the gTTS (Google Text-to-Speech) library and stored statically on VocaBag's server as MP3 files. No audio request is sent to Google in real time while using the app. Real-time speech synthesis for some languages uses the browser's Web Speech API, processed locally on the user's device.

4.5 Payment — Stripe

Premium subscription payments are processed by Stripe Inc., 510 Townsend Street, San Francisco, CA 94103, United States. VocaBag never stores your card details — they are entered and processed directly on Stripe's servers, which are PCI DSS Level 1 certified (the strictest security standard in the industry).

VocaBag only keeps a Stripe customer identifier (stripe_customer_id) and a subscription identifier (stripe_subscription_id) to manage the status of your subscription. No financial data is stored by VocaBag.

More information: Stripe privacy policy.

4.6 Audience measurement — PostHog

VocaBag uses PostHog (PostHog Inc.), with data hosted in the European Union (Frankfurt, Germany), to understand how the site is used and improve the service: pages viewed, where visits come from (for example the blog, social networks or the newsletter), device and browser type, and key steps of the journey (sign-up, end of a quiz, Premium subscription, badges and levels earned).

PostHog runs here without cookies: visits within the same day are grouped using an anonymous technical fingerprint recalculated every day, which does not allow you to be tracked from one day to the next. VocaBag does not send PostHog your name, your email address or your account identifier (only whether you are logged in and your subscription type). No session recording takes place. Legal basis: legitimate interest (audience measurement and service improvement).

More information: PostHog privacy policy.

5. International data transfers

Personal data is hosted in the European Union (Hostinger, Cyprus). Several integrations involve transferring data to servers that may be located outside the EU (Google LLC, Stripe Inc.):

• Gmail API: the recipient user's email address is sent when transactional emails are sent;
• Google Sign-In: when the user chooses to log in with Google, their email address and Google identifier are exchanged as part of the OAuth 2.0 protocol;
• Stripe: during a payment or the management of a Premium subscription, the data required for billing (email, amount, currency) is sent to Stripe Inc.'s servers, located in the United States;

PostHog audience measurement data (4.6) remains hosted in the European Union.

These transfers are governed by the appropriate legal mechanisms (standard contractual clauses — SCCs — and/or the EU–US Data Privacy Framework, an adequacy decision in force since July 2023).

6. Data security

VocaBag implements the following technical and organizational measures:

• Encryption of all communications via HTTPS/TLS;
• Passwords stored only in hashed form (bcrypt, high cost factor);
• Email verification and reset tokens generated in a cryptographically secure way (SHA-256), single-use and with a limited validity period (1 hour);
• Protection against CSRF attacks on all forms (CSRF tokens);
• Protection against SQL injection through prepared statements (PDO);
• Authentication cookies with HttpOnly, Secure and SameSite=Lax attributes.

Despite these measures, no computer system can offer absolute security. In the event of a data breach likely to result in a high risk to your rights and freedoms, you will be informed as soon as possible in accordance with Article 34 of the GDPR.

7. Retention periods

Personal data is kept for the whole life of the user account. If the account is deleted, the data is erased within 30 days, except for data that may be required to meet legal obligations. Any technical logs are kept for a maximum of 12 months.

8. Your rights

Under the GDPR, you have the following rights over your personal data:

• Right of access (Art. 15) — get confirmation that data about you is processed, and receive a copy of it;
• Right to rectification (Art. 16) — have inaccurate or incomplete data corrected;
• Right to erasure (Art. 17) — request the deletion of your data — or, more simply, delete your account yourself from your settings;
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format;
• Right to object (Art. 21) — object to processing based on legitimate interest;
• Right to restriction of processing (Art. 18) — request a temporary restriction of the processing of your data;
• Right to withdraw your consent — at any time, for processing based on consent (e.g. push notifications).

To exercise any of these rights, contact us through the contact form. We undertake to reply within a maximum of 30 days of receiving your request. Proof of identity may be requested.

9. Deleting your account

You can delete your account at any time directly from your settings (Account section). This immediately and irreversibly erases all your personal data: email address, username, progress, quiz history, leaderboard, badges and preferences.

10. Complaint to the CNIL

If you believe your rights are not being respected, you can lodge a complaint with the competent supervisory authority:

Commission Nationale de l'Informatique et des Libertés (CNIL)
3 Place de Fontenoy — TSA 80715 — 75334 Paris Cedex 07, France
www.cnil.fr

11. Changes to this policy

This privacy policy may be updated at any time to reflect legal, regulatory or technical changes. If a substantial change affects your rights, you will be informed by email. The date of the last update is shown below. Continued use of the service after notification constitutes acceptance of the new terms.

Last updated: October 2026