Privacy Policy
Effective date: 18 September 2026
1. Who is responsible
The controller of personal information handled for TypeVocab (https://typevocab.app) is Kirill Sidorov, a Serbian sole trader operating as Kirill Sidorov PR Racunarsko Programiranje Beograd.
Address: Dunavski kej 48, sprat 1, 11158 Beograd (Stari Grad), Serbia. Email for privacy requests: legal@typevocab.app. Telephone: +381 67 768 6551.
This Policy describes the current service. It covers our processing under Serbian data protection law and, where applicable, the EU GDPR, UK GDPR and other mandatory privacy laws. It does not mean that every country's law applies to every user.
We do not use Google Analytics, Meta Pixel or third-party advertising or marketing trackers on TypeVocab. We do not sell personal information. You can use the free training features without giving us an email address. Training progress stays in your browser rather than being synchronised to a TypeVocab account.
Optional Cloudflare Web Analytics measures visits and website performance only if you enable it. Training works without this analytics. This choice does not switch off the infrastructure processing needed to deliver and secure the website.
2. Information we process and why
| Information | Purpose and legal basis |
|---|---|
| Purchase email; internal user and order identifiers; selected product, price and currency; payment-provider invoice reference, payment status and transaction dates | Arrange your requested purchase, provide and restore paid access, and handle refunds. Necessary to take steps at your request and perform the purchase contract. We obtain payment status and transaction information from the payment provider. |
| Sign-in and checkout session identifiers; hashed sign-in tokens; expiry and use information; requested email language; email delivery status | Authenticate access, connect a paid order to the purchasing browser, and deliver requested sign-in messages. Contract performance and our legitimate interest in secure, reliable access. |
| IP address and ordinary HTTP request information received by our hosting infrastructure; request times, technical errors and security information; a hashed IP-derived value and request counts in anti-abuse records | Deliver the website, diagnose faults and prevent abuse or unauthorised access. Our legitimate interests in operating and protecting the service. A hashed IP value is not treated as anonymous merely because it is hashed. |
| Optional Cloudflare Web Analytics: page visits and referrer information, browser/device characteristics, page-load and performance measurements, and ordinary network information received when transmitting them | Understand visits and improve website performance, on the basis of your separate consent. We do not send exercise answers, learning history, purchase emails or payment details to this analytics service. |
| Information you send in support, refund, privacy or other correspondence; relevant purchase and payment-event records | Respond to you, fulfil the contract, handle complaints and comply with applicable legal obligations. We also have a legitimate interest in establishing or defending legal claims. |
| Email, selected language and request date if you join the mobile-launch notification list; an IP-derived hash used to limit abusive submissions | Send the launch notification you requested, including the early-user offer described with the form, on the basis of your consent. Security checks rely on our legitimate interest in preventing abuse. Joining the list does not create a paid account or subscribe you to unrelated marketing. |
We keep records required by applicable tax, accounting and consumer laws. Where the relevant law qualifies as a legal-obligation basis under the data protection law that applies, we rely on that basis. Otherwise, necessary recordkeeping and legal-claims processing rely on our legitimate interests, subject to your rights and the applicable safeguards.
Providing an email is necessary for the current purchase and access-restoration process; without it we cannot provide those functions. Joining the mobile notification list is optional. Do not send passwords, full card numbers, security codes or sensitive personal information in support messages.
Your payment provider collects the information it needs to take payment, which may include payment credentials, billing information and checks required by law. Our application does not collect or store your full payment-card number or card security code. We receive the transaction information needed to identify and administer your order, including information about a refund or payment dispute.
3. Cookies and browser storage
We use the following storage for the functions described, not for advertising:
| Storage | Function and duration |
|---|---|
__Host-typevocab_session cookie | Recognises an authorised paid-access session. Expires after up to 30 days, or is cleared when you sign out. |
__Host-typevocab_checkout cookie | Connects the browser to its pending or completed purchase so that access can be activated safely. Expires after up to 30 days, or is cleared when you sign out. |
| Local browser storage for learning progress, activity history, lesson state, language, theme and display preferences | Keeps your training and chosen settings on that browser. No fixed expiry; remains until reset, cleared or removed by the browser. Some keys retain the earlier internal name englishkey. |
| Local browser storage for your storage choice and purchase-flow state | Remembers your choice and allows the current purchase flow to continue. Remains until the state is updated, reset or cleared. It does not contain card credentials or itself grant paid access. |
Local browser storage for your optional analytics choice (typevocab:analytics-consent:v1) | Records your choice, its purpose, version and date so we can respect it. Remains until you change it or clear site data. This record does not identify you across websites. |
Your local training history and typed exercise responses are not uploaded to our account database. This does not prevent the server from receiving the ordinary requests needed to load the site, obtain learning content or check paid access.
Analytics is off until you choose “Allow all” or enable it in settings. “Allow only necessary” continues training without analytics. “Do not allow” stops setup without starting training. Cloudflare states that Web Analytics does not use cookies or localStorage for its measurements or track users across its customers' websites; the local choice record above is ours. You can enable or disable optional analytics in the website settings. Disabling it reloads open TypeVocab tabs that were running analytics to stop further collection; the saved choice applies to this browser. A different browser has its own choice.
You can clear or block site data in your browser and use the service's available reset and sign-out controls. Clearing local learning data removes that browser's progress; blocking required storage can prevent training, sign-in or payment completion. Cookies needed for authentication and secure checkout serve the functions you request. Where consent is legally required for other storage, it must be obtained before that storage is used. The site's storage-choice screen is not consent to every kind of personal-data processing in this Policy.
4. Who receives information
- Cloudflare provides site delivery, server functions, security infrastructure and the D1 database used for account, order and notification-list records. It processes the data necessary for those functions. See Cloudflare's Privacy Policy and Data Processing Addendum. With your separate consent, Cloudflare also receives the optional analytics information described above. See Cloudflare Web Analytics.
- Resend delivers transactional emails. It receives the recipient address, the message and link being sent, and delivery information. See Resend's Privacy Policy and Data Processing Addendum.
- lava.top, operated by LAVALANE LTD in Cyprus, processes payments. We send your purchase email, the selected offer and payment currency, and an internal order reference used to match the payment. It returns relevant transaction information. The order reference is not an advertising-tracking identifier. For the provider's own payment, fraud-prevention and legal-obligation processing, consult its Privacy Policy. Its checkout and its own website are separate from TypeVocab; this Policy does not describe their cookies as cookies used on TypeVocab.
- Our professional advisers and competent authorities may receive relevant records where necessary for accounting, a legal obligation or a legal claim. We disclose only information needed for that purpose.
External learning links, such as PlayPhrase or Reverso, take you to another website when you choose to open them. Their operators receive information through that visit under their own privacy notices. We do not embed their advertising trackers in TypeVocab.
5. Countries and international transfers
We administer the service from Serbia. Our providers may process information in the United States, the EEA and other countries where their infrastructure and authorised service providers operate. Cloudflare uses a global network; a database location preference is not a promise that all processing stays in the EU. Resend uses US infrastructure. lava.top's operator is established in Cyprus, and its payment partners may operate elsewhere.
The standard processing terms of Cloudflare and Resend incorporate their data processing addenda. For restricted transfers covered by EU or UK data protection law, those addenda provide for the European Commission’s Standard Contractual Clauses and the UK Addendum, where applicable, together with the safeguards set out in those agreements. These are contractual safeguards, not a promise that data stays in Europe. Transfers subject to Serbian law must also meet that law’s requirements; EU/UK clauses do not automatically establish a lawful basis for every transfer under other countries’ laws.
You may ask us for information about the safeguards that apply to your information and a copy of the relevant terms, with unrelated confidential information removed where necessary.
6. How long information is kept
- Local learning data: until you reset or clear it or your browser removes it.
- Optional analytics: Cloudflare makes reports for the previous six months available to us. Its documentation describes seven days of unsampled beacon data followed by sampling for longer-term storage; report availability is not a guarantee that every provider copy is deleted after six months. We do not create a separate user-level analytics database. Your local choice remains until changed or cleared.
- Access credentials: sign-in links expire after 15 minutes; access and checkout sessions expire after up to 30 days. Expired server records are removed by scheduled cleanup. Anti-abuse request-limit records are removed after they become more than 24 hours old. This short period does not apply to the notification-list entry itself or to separate incident records.
- Account and access records: while needed to provide your paid access, or until an applicable deletion request is fulfilled. If you end your account, we separate any records that must be kept for legal reasons from those needed for active access.
- Orders, refunds and formal complaints: for the period required by the tax, accounting or consumer rules applicable to the particular record, and for an unresolved dispute or applicable legal-claims period where necessary. Serbian consumer complaint records are retained for at least two years where that requirement applies. A legal retention duty does not justify keeping unrelated session or learning data.
- Operational, support and email-delivery records: while needed to deliver or retry the requested message, resolve the issue, investigate an incident or handle a related claim. Provider-side copies and backups are subject to the provider's retention arrangements; we assess our own copies separately.
- Mobile notification list: until the requested launch notification and associated early-user offer have been handled, you withdraw consent, or the launch plan is abandoned, whichever first makes the data unnecessary. Only a minimal record needed to demonstrate or honour a withdrawal may remain where justified.
Where an exact period depends on a legal obligation or an unresolved matter, the criteria above determine the period. Once the relevant purpose and retention duty end, we delete or anonymise the information. Backups expire through their normal retention cycle and are not used to restart marketing or ordinary account activity after deletion.
7. Your rights and choices
Subject to the law that applies and its permitted exceptions, you may request access to your information, correction, deletion, restriction of processing, or a portable copy of information processed automatically on the basis of consent or contract. You may object to processing based on legitimate interests, explaining your circumstances, and may object to direct marketing at any time.
You can withdraw analytics consent in the website settings and consent to mobile-launch messages by emailing legal@typevocab.app. Withdrawal does not affect processing that was lawful before withdrawal or automatically erase measurements already collected; you may also contact us about applicable deletion rights. A privacy notice or acceptance of the Terms is not a blanket consent.
Send privacy requests to legal@typevocab.app. We may ask for proportionate information to confirm that a request concerns your information; do not send identity documents unless specifically needed and requested. Requests are ordinarily free. We respond within the applicable deadline: normally 30 days under Serbian law, or one month under GDPR/UK GDPR, with extensions only where legally permitted and explained to you. We explain any lawful refusal and the available complaint options.
You may complain to the Serbian Commissioner for Information of Public Importance and Personal Data Protection, to the relevant EEA supervisory authority, the UK Information Commissioner's Office, or another competent local authority. You do not have to complain to us first.
We do not use personal information for advertising profiles or solely automated decisions within the meaning of GDPR Article 22 that have legal or similarly significant effects. Ordinary payment-status, authentication and anti-abuse checks operate automatically; contact us if they incorrectly prevent access.
8. Younger users and policy changes
TypeVocab is intended for users aged 16 and over. We do not knowingly seek personal information from children under 16. If you believe a younger child has supplied personal information, contact us so that we can address it. Users aged 16 or 17 retain the privacy protections that apply to children under local law.
We update this Policy when our actual processing changes. We publish the revised date and provide additional notice or seek consent where the law requires it. Contact details for questions are in section 1.