Privacy Policy

Last updated: 12 September 2026

Vocalabs is a browser extension that turns highlighted text into flashcards. This policy describes what data the extension collects, why, and where it goes. Written in plain English because privacy shouldn't be a mystery.

What we collect

On your device only

• Flashcards you create (the word, definition, example sentence, source URL)
• Review history: which cards you've studied and when
• Preferences: target language, review settings, opt-in/out flags
• API keys you provide for AI features (Anthropic, OpenAI, Gemini, or OpenRouter)

All of this stays on your device unless you explicitly opt into cloud sync.

Sent to our servers (only if you sign in for cloud sync)

• Your email address (for account identification)
• The flashcards described above, encrypted in transit
• A random session token used to keep you signed in

Sent to third parties

• Dictionary lookups (on by default): the word you capture is sent to en.wiktionary.org and dictionaryapi.dev to fetch its definition.
• AI features (opt-in): if you enable AI, the word and its sentence are sent to your chosen AI provider (Anthropic, OpenAI, Google, or OpenRouter). Your API key stays in your browser and is sent directly to that provider. We never see it.
• Anonymous usage counts (opt-out available): a random installation ID (not linked to your email), extension version, browser family (Chrome, Edge, Brave), and locale. Sent once at install and once per day. No card content, URLs, or personal information is ever included. Disable in Settings → Privacy.

What we never collect

• Browsing history
• Page content beyond the sentence you highlight
• Location data
• Third-party analytics (no Google Analytics, no Facebook pixels)
• Advertising IDs

Who has access

• You: everything, always
• Our servers: only what you've synced, and only if you've signed in
• AI providers: only what you send them, when AI is enabled
• No one else

Your rights

• Delete everything on your device: Settings → Reset → Delete everything
• Disable telemetry: Settings → Privacy → uncheck "Send anonymous usage counts"
• Delete your account and server-side data: email hello@vocalabs.app and we'll remove your data within 30 days
• Export your data: Settings → Export → Download cards.csv

Data retention

On-device data: kept until you delete it. Server-side sync data: kept while your account is active; deleted within 30 days of account deletion. Anonymous telemetry: retained for aggregate stats only, no individual timelines.

Children

Vocalabs is not intended for children under 13. We don't knowingly collect data from anyone under 13. If you believe we have, contact us and we'll delete it.

Changes to this policy

We'll post updates here. Continued use of Vocalabs after changes means you accept them. For material changes, we'll notify signed-in users by email.

Contact

Questions or requests: hello@vocalabs.app

Vocalabs is built by an independent maker who cares about doing this right. If any of this looks off or contradictory, tell us and we'll fix it.