Privacy Policy

The short version

• You give an email address and a password. Everything else is a record of your own practice.
• Nothing is sold, shared with data brokers, or used for advertising.
• Visits to the public site are counted, without cookies and without anything that identifies you. Your practice inside the trainer is not measured, and nothing is stored on your device until you sign in.
• When a round contains mistakes, those items and what you typed are sent to Anthropic to write the explanation — without your name, email or account id.
• You can have all of it deleted. Ask, and it is done.

Who is responsible

The controller for the purposes of the GDPR is:
Evgeni Hasin, Germany
contact@idearig.com

No data protection officer has been appointed, and none is required here: this is not a public authority, there is no large-scale systematic monitoring, and no special-category data is processed. Write to the address above about anything on this page.

What is collected, and on what basis

Your account

Your email address, a password (stored only as a cryptographic hash, never in readable form), a display name if you set one, and the dates the account was created and last used. Basis: Art. 6(1)(b) — performance of a contract. There is no way to give you an account without it.

Your practice record

The words you were shown, the answers you typed, whether each was counted correct, the per-word difficulty weights that decide what comes back, and how your practice sessions were grouped. Basis: Art. 6(1)(b) — performance of a contract. Storing this is the service: a trainer that forgets which words you keep missing is not a trainer.

Your typed answers are the only free text here. They are not read for any purpose other than checking them and improving the trainer’s accuracy.

Your settings

Level, theme and direction preferences. Basis: Art. 6(1)(b).

Usage counters

Counts of rounds and model calls per day, to keep running costs predictable and enforce the daily limit. Counters only — no record of what you practised. Basis: Art. 6(1)(f) — legitimate interest in controlling the cost of a free service.

Visits to the public site

Pages on idearig.com are counted so we know whether anyone is finding this. It is measured by Vercel, who already host the site, using their cookieless analytics: no cookie, nothing written to your device, and no identifier that ties a visit to you. What is recorded is the page, the time, and the referring site. Basis: Art. 6(1)(f) — legitimate interest in knowing whether the service is used.

Nothing else is measured. The trainer is not — whether you reach it at app.idearig.com or app.vcblry.com, which are two addresses for the same service and the same account. What you practise is not part of this. Neither is vcblry.com: the practice round on that page runs entirely inside your browser and sends nothing anywhere at all — not your answers, and not even a page view.

Keeping the public sign-up forms from being abused

When you join the waiting list, or sign up once that is open, your IP address is briefly recorded alongside the email you submitted, purely to notice and slow down automated abuse of that one form. Basis: Art. 6(1)(f) — legitimate interest in keeping a public, unauthenticated form usable for everyone else. Kept for at most 24 hours, then discarded automatically — it is not linked to your account and is not something we can look up by email.

The waiting list

If you ask to be told when places open up: your email address and anything you write in the optional message field. Basis: Art. 6(1)(a) — consent, which you can withdraw at any time.

When a waiting-list entry is approved, an internal process inside our database platform passes the address to the component that sends the invitation. It goes nowhere else.

Consent records

When you accept these documents or opt in to something, a record is kept of what you agreed to, which version of the document was in force, and when. Basis: Art. 6(1)(c) and Art. 17(3)(e) — being able to demonstrate consent is itself a legal requirement. See what deletion does, because these records are the one thing that outlives an account.

Server logs

Our hosting and database providers record technical request data — IP address, browser user agent, the page requested, timing and error information — as part of running the servers. Basis: Art. 6(1)(f) — legitimate interest in operating and securing the service. These logs are held by the providers, not built into the app, and are kept for the short periods given below.

What is sent to Anthropic, exactly

When a practice round contains mistakes, VCBLRY asks Anthropic’s Claude to write the explanation of what went wrong. This is worth being precise about, because it is the only place your input leaves our own infrastructure:

• What is sent: only the items you got wrong in that round, and the answer you typed for them.
• What is not sent: your account id, your email, your name, your settings, your history, and the vocabulary list itself. The request carries no identifier that ties it to you.
• When nothing is sent at all: a round you get completely right results in no request to Anthropic whatsoever.
• What Anthropic does with it: under their commercial API terms, input and output are not used to train their models and are retained for 30 days.

Basis: Art. 6(1)(b) — the explanation is part of the service you signed up for.

Who else processes your data

These are the only companies involved. Each acts as a processor under a data processing agreement, on our instructions.

Supabase

Accounts, login, and the database holding everything above. Our production database runs in Frankfurt, Germany (eu-central-1).

Vercel

Hosting and delivery of the site itself, the request logs described above, and the cookieless page-view counting on the public site.

Anthropic

Writes the explanations for missed items, on the strictly limited input described in the previous section.

Resend

Delivers the transactional email the service sends — invitations, password resets — as the relay used by Supabase. It therefore receives your email address and the contents of those messages.

No advertising provider is on this list, and nothing here is used for advertising or sold to anyone. The only measurement is the page counting described above, done by Vercel — not a separate analytics company.

Transfers outside the EU

Our database sits in the EU. Vercel, Anthropic and Resend are US companies, and data reaching them is transferred to the United States. Those transfers are covered by the European Commission’s Standard Contractual Clauses; Resend is additionally certified under the EU–US Data Privacy Framework.

One point worth stating because it is easy to get wrong: although Resend can dispatch mail from a European region, that is a sending location, not data residency — message content and delivery logs are stored in the US.

US law gives public authorities access powers that have no exact European equivalent, and the Standard Contractual Clauses cannot fully exclude them. That is the honest position for any service built on US infrastructure.

How long it is kept

• Your account and everything tied to it — for as long as the account exists. Delete it and it goes.
• Abuse-prevention records for the public sign-up forms — at most 24 hours, then discarded automatically.
• Waiting-list entries — deleted once your invitation has been taken up and an account exists, or after 24 months if no invitation was ever issued, or sooner if you ask.
• Consent records — up to 3 years after the consent they record has lapsed, matching the ordinary German limitation period, so that agreement can still be demonstrated if it is ever disputed.
• Server logs — request logs at Vercel are kept 1 hour; platform logs at Supabase are kept 1 day. These are set by the providers’ plans, and cannot be selectively edited.
• Data at Anthropic — 30 days, per their API terms.

What deleting your account does

Ask at contact@idearig.com and your account is removed, along with your profile, settings, word weights, rounds, typed answers and usage counters.

One thing is deliberately kept: the record that you agreed. Consent records survive deletion — re-keyed to your email address — for the period given above, because a record of agreement that vanishes the moment it might be needed is not a record at all. This is permitted by Art. 17(3)(e). It contains what you agreed to, which document version, and when — nothing about your practice.

If you were also on the waiting list, that entry is stored separately from your account and is removed as part of the same request.

Your rights

You can, at any time:

• Get a copy of your data, and know what is held (Art. 15).
• Correct anything wrong (Art. 16).
• Have it deleted (Art. 17), subject to the consent records described above.
• Restrict processing (Art. 18), or object to processing based on legitimate interests (Art. 21).
• Take your data elsewhere in a machine-readable form (Art. 20).
• Withdraw consent you have given — for the waiting list, for example — without affecting what was lawful before you withdrew it (Art. 7(3)).

One address handles all of it: contact@idearig.com. You will get a response within a month.

You also have the right to complain to a data protection supervisory authority (Art. 77) — either the authority for the German state where the controller is established, or the one where you live.

Automated decisions

Your answers are checked automatically, and that decides what you practise next. There is no automated decision-making producing legal or similarly significant effects within the meaning of Art. 22, and no profiling beyond difficulty weights for vocabulary.

Children

VCBLRY is not intended for anyone under 16, and accounts are not knowingly created for them — see the terms of use.

Security

Traffic is encrypted in transit. Passwords are stored only as hashes. Database access is restricted per user at the database itself, so one account cannot read another’s data, and the answer keys for a round are never sent to the browser. No system is perfectly secure, but those are the measures in place.

Changes to this policy

The date at the top of this page is the version in force. Substantive changes — a new provider, a new category of data, a new purpose, or a change to your rights — will be notified to registered users by email before they take effect. Storage on your device is covered separately in the cookie policy.