Privacy policy

Last updated: 14 October 2026

Vocano is a vocabulary learning service: the Account Holder uses the panel in a web browser (app.vocano.app) and the child uses the Vocano mobile app. We provide the service to the Account Holder: they create the account, create the child's profile and decide what data about the child to enter. This document describes what data we process, why, on what legal basis, for how long and who we pass it to.

The Account Holder is the adult who runs the Vocano account: a parent, a legal guardian or another person teaching the child (for example a teacher) with the consent of the child's parent or legal guardian. The child (learner) is the person learning in the app.

Vocano is a service for families and private individuals. We do not provide it to schools or other institutions; if a school wants to use Vocano in class, write to us before entering any learners' data.

1. Controller

The controller is Koobe Sp. z o.o., ul. Kornela Makuszyńskiego 4, 31-752 Kraków, Poland, KRS 0000432277, NIP (tax id) 6783145863, REGON 122652550. For all matters concerning personal data write to [email protected]. We have not appointed a data protection officer.

2. What data we process

Account Holder data:

• the e-mail address we send the login link to;
• account and login session data: the account creation date and securely stored session identifiers;
• acceptances of the terms and the privacy policy: the document versions, the date and the statement that you are the Account Holder;
• content added in the panel: lessons, words and phrases, test dates, daily goals and challenges;
• technical data: IP address and request information, and the family's daily voice-recording usage counters.

Child data (entered by the Account Holder; the child does not create an account):

• a first name or nickname and the chosen avatar;
• learning history: answers in exercises (whether right, when, which exercise), how well each word is known, learning sessions and the phone's time zone, and the resulting rewards (streak, gems, level);
• the paired device: device name, time of the last sync and the identifier needed to link the phone to the Account Holder's account.

We do not collect the child's surname, date of birth, e-mail address, phone number, photos or location. The camera in the app is used only to scan the QR code from the Account Holder's panel; the image is neither stored nor sent.

Providing an e-mail address is necessary to create an account and log in: without it we cannot provide the service. The Account Holder provides all other data voluntarily, to the extent they want to use the service's features.

3. Purposes and legal bases

• Providing the service to the Account Holder: the Account Holder account, lessons, sync, rewards and the voice. Basis for the Account Holder's data: Art. 6(1)(b) GDPR, performance of the contract with the Account Holder.
• The child's learning: the child's profile, learning history, rewards and paired device. The Account Holder, not the child, is party to the contract, so the basis is Art. 6(1)(f) GDPR: our and the Account Holder's legitimate interest in letting the child learn in the app and the Account Holder follow their progress. This interest does not override the child's rights, because we collect only the data needed for learning (no surname, contact details, photos or location), show no ads, do no marketing profiling, and the Account Holder can correct or delete the child's profile at any time. We do not rely on consent for the child's data, and we do not offer the service directly to children.
• Proof of accepting the terms and the policy: a record of the document versions and the date, to show on what terms you use the service. Basis: Art. 6(1)(b) and (f) GDPR.
• Security and protection against abuse: limits, including limits on voice recordings and on login link requests, a check at login that a person rather than a program is asking, and technical logs. Basis: Art. 6(1)(f) GDPR, our legitimate interest in protecting the service and its costs.
• Handling enquiries and complaints sent to our e-mail address. Basis: Art. 6(1)(f) GDPR.

4. Profiling and automated decisions

The app automatically matches exercises and review dates to the child's progress (for example, a difficult word comes back more often). This has no legal effect and does not similarly significantly affect the child or the Account Holder, so we do not make decisions based solely on automated processing within the meaning of Art. 22 GDPR. We do not profile for marketing.

5. Shared dictionary and voice recordings

• Words and phrases entered in lessons go to Vocano's shared dictionary. Other Account Holders may see the text of a word and its translations as a suggestion while entering their own lessons; they do not see who added it or in which lesson. Entries are not reviewed before they are shared.
• Voice recordings are created automatically the first time a word is played and are shared by all users. We send the speech service (Google) only the text of the word, with nothing about who entered it or for whom; as a rule the text of a word contains no personal data. On our side the recording is linked to the word and, when an Account Holder orders their own recording, also to their lesson.
• That is why you should not enter personal data in lessons (names, surnames, addresses and the like). If it happens, or you notice such data in suggestions, write to [email protected]: we will remove the entry and its recording from the dictionary.

6. Recipients

We entrust data to providers who process it on our behalf (processors), under data processing agreements:

• Hetzner Online GmbH (Germany): servers, database and storage of recordings; data stays in the European Union. Privacy policy.
• Cloudflare, Inc. (USA): content delivery, protection against attacks, hosting of the panel and this website, and the check at login link requests that a person is asking (Cloudflare Turnstile); processes, among others, IP addresses and browser signals. Privacy policy.
• Resend (Plus Five Five, Inc., USA): sending e-mails with the login link; processes the e-mail address. Privacy policy.
• Google Cloud Text-to-Speech (Google LLC, USA): creating voice recordings; receives only the text of a word, which as a rule contains no personal data. Google Cloud privacy notice.

Apple (App Store, TestFlight) distributes the app and processes data related to downloading it as an independent controller, under its own privacy policy.

7. Transfers outside the EEA

Cloudflare, Resend and Google may process data (IP addresses, e-mail address, the text of words) in the United States. Such transfers rely on standard contractual clauses approved by the European Commission and included in the data processing agreements and, for providers certified under the EU-US Data Privacy Framework, also on the Commission's adequacy decision. Google receives only the text of words, which as a rule contains no personal data unless personal data was entered in a lesson (section 5). You can obtain information about the safeguards and a copy of the clauses by writing to [email protected].

8. What we do not do

• We do not show ads and do not use advertising identifiers.
• We do not use analytics or tracking tools, neither in the app nor on the websites.
• We do not sell data or share it for marketing.
• We do not contact the child; all communication is with the Account Holder.

9. Cookies and device storage

The panel uses one essential cookie that keeps the Account Holder logged in, and browser storage for the chosen language. The login page runs Cloudflare Turnstile, which checks browser signals to tell a person from a program; it is not used for tracking or ads. This website uses no cookies. The app stores lessons, progress, voice recordings and a secure key linking it to the Account Holder's account on the phone, so that it also works offline; this data disappears when the app is uninstalled or the phone is disconnected.

10. How long we keep data

• Account, lesson and learning data and document acceptances: until the child's profile or the account is deleted.
• Login links: valid for 15 minutes; login sessions: up to 30 days after their last use.
• Server logs with IP addresses: 7 days.
• Database backups: 20 days; after that, deleted data is gone from the backups too.
• Correspondence: until the matter is closed and, for complaints, until the deadlines for handling them have passed.

11. Deleting data

• A child's profile you delete yourself in the panel (at the end of the learner's details). This immediately deletes their learning data, rewards and paired devices from our database; they are gone from backups within 20 days at the latest.
• The whole account you delete yourself in the panel (the account menu, "Delete account", confirmed with your e-mail address). This immediately deletes the account, children's profiles, lessons, learning data, rewards, paired devices, login links and sessions from our database; they are gone from backups within 20 days at the latest. We confirm by e-mail. You can also ask us to delete the account at [email protected] from the address linked to the account: we delete it within 14 days of the request.
• Words added to the shared dictionary and their recordings stay in the dictionary if they contain no personal data. Entries with personal data we remove on request (section 5).

12. Your rights

You have the right to access your data, rectify it, erase it, restrict its processing and port it, and to object to processing based on our legitimate interest. You exercise the same rights on behalf of the child as their Account Holder. Write to [email protected]; we reply as a rule within one month, and in complex cases this may be extended, in which case we will let you know.

You can also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa), or with the authority in your country.

13. Security

Connections are encrypted, there are no passwords (you log in with a one-time link), and the database keeps only hashes of links, sessions and device keys. An Account Holder can see and change only their own data and the data of their children.

14. For the learner

If you learn with Vocano: we only know your name in the app (or your nickname), the avatar you chose and how your vocabulary practice is going. The adult who runs your learning in Vocano can see this, to help you learn. We show you no ads, collect no photos and do not check where you are. You use the camera only once, to scan the code you get from that adult. If you have a question, ask them.

15. Changes

If we change how data is processed, we will update this document and the date at the top. We will tell Account Holders about significant changes before they take effect: by e-mail to the account's address and with a notice in the panel at the next login, so the information reaches them even if an e-mail is not delivered. The panel then asks you to read and accept the new version; if you do not accept it, you can delete the account.