Short version: the app needs an account, and your words, your answers and your progress are stored with it so you can study on any device. The AI features send the relevant parts to Google's Gemini API, the pronunciation check sends a short recording to Microsoft, and purchases go through Apple and RevenueCat. There are no ads and no tracking, nothing is sold, and you can delete your account in the app at any time.
1. Who is responsible
The controller, under Art. 4(7) GDPR and under Turkey's Personal Data Protection Law No. 6698 (KVKK), is Murathan Bakti.
- Email: contact@wordmi.com
- Place of establishment: Türkiye
2. What the app does, and what it asks for
Wordmi AI is a vocabulary app: you collect words, study them in short games, and an AI coach helps you along. To do that it asks your device for only three permissions, each at the moment a feature needs it:
- Microphone and speech recognition: only for the speaking, shadowing and pronunciation exercises, and only while you hold the microphone button.
- Photos: only if you choose a profile picture. The app reads the one picture you pick, and nothing else in your library.
The app does not ask for your location, your contacts, your calendar or your advertising identifier, and it does not send push notifications.
3. What we process, why, and on what legal basis
The app works with an account. Everything in the table below is stored with that account in our database and kept until you delete it, unless a shorter period is given.
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Email address | To identify the account and send sign-in, confirmation and password-reset codes | Performance of a contract (Art. 6(1)(b) GDPR · KVKK Art. 5/2-c) | Until you delete the account |
| Password, stored only as a salted hash | To authenticate you. At sign-in it passes through our server function to be checked; the plaintext is not stored anywhere | Performance of a contract (Art. 6(1)(b) GDPR · KVKK Art. 5/2-c) | Until you delete the account |
| Phone number: required when you sign up with email and password; not asked for when you sign in with Google | Kept to recover your account. Codes go to your email, not to this number; no SMS is sent to it and it is never called | Legitimate interests (Art. 6(1)(f) GDPR · KVKK Art. 5/2-f) | Until you delete the account |
| Display name and profile picture | To identify you in the app; your display name also appears on the leaderboard. If you sign in with Google, your name and picture come from Google; you can also choose a picture yourself | Performance of a contract (Art. 6(1)(b) GDPR · KVKK Art. 5/2-c) | Until you remove the picture or delete the account |
| Profile details: your native language, the language you are learning, your level, your daily goal, your reasons for learning and your interests | To tailor the words, the exercises and the AI answers to you | Performance of a contract (Art. 6(1)(b) GDPR · KVKK Art. 5/2-c) | Until you delete the account |
| Saved words: the word, its meaning, the language pair, the example sentence, and where it came from (Discover, a word pack, the AI coach, typed by you, or the title you were watching when you saved it with the extension) | This is the product: it is what you study from | Performance of a contract (Art. 6(1)(b) GDPR · KVKK Art. 5/2-c) | Until you delete the word or the account |
| Spaced-repetition state: repetitions, interval, ease, next due date, lapses and your answer history | To decide when to show each word again | Performance of a contract (Art. 6(1)(b) GDPR · KVKK Art. 5/2-c) | Until you delete the word or the account |
| Exercise attempts: the game, the question and the sentence shown, your answer, whether it was correct, your response time, hints used and whether you left the app while the question was open; for speaking questions, the text the speech recogniser heard and its score (not an audio recording) | To score your progress, adapt the difficulty and let the AI coach see where you struggle | Performance of a contract (Art. 6(1)(b) GDPR · KVKK Art. 5/2-c) | Until you delete the account |
| Usage events: the start and end of a study session, saving and removing words, reaching your daily goal, level changes, word packs added or removed, opening the daily dialogue, opening the subscription screen and the outcome of a purchase or restore; each event carries the platform and the app version | So the AI coach and the reports can get to know you; to see how the product is used and to spot sync and purchase errors | Legitimate interests (Art. 6(1)(f) GDPR · KVKK Art. 5/2-f) | Until you delete the account |
| Your conversations with the AI coach | So a conversation can continue where it left off, on any device | Performance of a contract (Art. 6(1)(b) GDPR · KVKK Art. 5/2-c) | Until you delete the conversation or the account |
| What the AI produces for you: practice sets and progress reports; your progress through the daily dialogue | So you can reopen past reports and pick up where you left off | Performance of a contract (Art. 6(1)(b) GDPR · KVKK Art. 5/2-c) | Until you delete the account |
| Plan and usage counters: the name of your plan and when it last changed; your leaderboard score and level; your weekly AI allowance and daily counters for pronunciation checks, audio and dialogues | To unlock what you paid for, build the leaderboard and enforce the usage limits of the AI features | Performance of a contract (Art. 6(1)(b) GDPR · KVKK Art. 5/2-c) | Until you delete the account |
| Verification codes and the trusted-device record: a hash of the 6-digit code emailed to you; a hash of the token that remembers this device, a description of the client (user agent) and when it was last used | To protect email-and-password sign-in with a second step on a device we do not recognise | Legitimate interests (Art. 6(1)(f) GDPR · KVKK Art. 5/2-f) | A code is valid for 10 minutes, a device token for 30 days; the records themselves stay until you delete the account |
| Rate-limiting counters: the number of attempts per email address, per account id and per IP address the request came from | To limit password attempts and code sending against brute force | Legitimate interests (Art. 6(1)(f) GDPR · KVKK Art. 5/2-f) | Counting windows run from 15 minutes to 24 hours; counters older than a day are deleted automatically |
There is no advertising, no third-party analytics SDK and no tracking in the app. We do not use your advertising identifier, we do not track you across other companies' apps or websites, and the app therefore never shows Apple's tracking prompt. The usage events above are written only to our own database. We do not sell your data and we do not build an advertising profile of you.
4. What stays on your device
So the app works offline and opens quickly, it keeps a copy of your words, your review schedule, answers that have not been sent yet, your settings and recently played audio on the device. Your sign-in session is kept in the iOS Keychain. This copy is removed when you delete the app or your account. Signing out ends the session but keeps the copy, so the same account can pick up where it left off; if a different account signs in on the device, the previous account's copy is erased.
Widgets. If you add a Wordmi widget to your home screen or lock screen, the app writes a small set of your words, their meanings and example sentences to storage the widget can read on the same device. Nothing is sent anywhere for this. Keep in mind that a lock-screen widget can be seen by anyone who can see your screen.
5. The AI features
The AI coach chat, the AI Arena practice sets, the progress report, the meaning of a word in its sentence, extra example sentences, the daily dialogue and the one-sentence tip in the pronunciation check are produced by Google's Gemini API. To answer, we send only the part of your data the answer needs: the words in question and their sentences, a summary of your exercise answers and usage events, your profile (display name, languages, level, goal, reasons for learning, interests), and the message you typed. Your email address and phone number are not sent.
Google acts as our processor for this. Under the paid Gemini API terms, the content we send is not used to train Google's models. Your saved words are also turned into numerical vectors (embeddings) by the same API so that related words can be found.
AI answers are generated automatically and can be wrong. They are learning help, not professional advice; see the App Terms of Use.
6. Audio, microphone and speech
Listening
Words and sentences are read aloud by Google Cloud Text-to-Speech. That service receives only the text and its language; your account id is not sent. The audio it produces is kept in a shared cache so the same sentence is not generated twice; the cache record carries no account id. The daily dialogue is written and voiced once per language, level and day and is the same for everyone who opens it that day, so it contains nothing about you. If these services cannot be reached, your device's own voice reads the text.
Speaking and shadowing
These exercises use the speech recognition built into your device (on iPhone, Apple's speech recognition). The app asks for permission first and listens only while you hold the button. Where the recognition model for your language is installed on the device, recognition happens on the device; where it is not, your device sends the audio to Apple's speech service, under Apple's own privacy terms. The audio does not reach our servers. We receive only the recognised text, which is stored with your attempt. For shadowing, your recording is kept on the device so you can play it back next to the model voice.
Pronunciation check
When you tap the pronunciation check button, and only then, the short recording you just made and the sentence you were reading are sent through our server to Microsoft Azure Speech, which scores how you pronounced each sound. Gemini then turns those scores into a one-sentence tip; it receives the scores and the sentence, not the audio. We do not store the recording on our servers. Microsoft processes it as our processor to return the scores. The number of checks per day is limited.
7. Translation and word information
When a word has no meaning yet and our server cannot supply one, the app asks Google Translate directly from your device, and MyMemory (Translated s.r.l.) if that fails. For the widget, the example sentences shown in it are translated the same way. These requests carry only the text and the language pair, not your account. MyMemory may retain submitted text in its public translation memory.
The meaning of a word in its sentence is found by sending the word and its sentence to our server and from there to Gemini. The result is kept in a shared cache so the same content is not generated again for the next person. The cache holds the word, the sentence, the answer and the id of the account that first requested it, which is kept to count the daily usage limit. Other users receive only the meaning; who requested it is not shown to anyone.
When you add a new word, our server may look it up in public, openly licensed sources (Wiktionary data via kaikki.org, and Tatoeba for example sentences). Only the word and its language are sent; nothing identifies you.
8. Purchases
Premium is sold as an in-app subscription through Apple. Apple handles the payment; we never see your card or bank details. To find out what you have bought, the app uses RevenueCat: it receives your Wordmi account id as its user id, the purchase and receipt information Apple provides (product, price, currency, store country, purchase and renewal dates), and basic technical information about the device and app version. When a subscription starts, renews, ends or is refunded, RevenueCat tells our server, and we store only the name of your plan and the time of the change.
9. The leaderboard is public to other users
Your display name, language level, game level and score are visible to other signed-in Wordmi users on the leaderboard. Your email address, your phone number, your saved words and your chat history are never shown there.
A profile picture you upload is not shown on the leaderboard, but it sits in publicly readable storage: anyone who knows its address can open it, and that address contains your account id.
We do this on the basis of our legitimate interest in making practice motivating (Art. 6(1)(f) GDPR). You have the right to object under Art. 21 GDPR: write to contact@wordmi.com and we will take you off it without otherwise limiting your account.
10. Who we share it with
We do not sell your data, we do not share it with advertisers or data brokers, and we do not use it for any purpose unrelated to teaching you a language. The only third parties involved are the providers that make the product work; those that process your personal data act as our processors under Art. 28 GDPR.
| Recipient | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, authentication, file storage (profile picture, audio) and the server functions behind the AI features | US-based; data sits on AWS infrastructure in the project's configured region |
| Google LLC (Gemini API) | The coach, practice sets, reports, word meanings, example sentences, the daily dialogue, pronunciation tips and embeddings | US-based; global infrastructure |
| Google LLC (Cloud Text-to-Speech) | Reading words and sentences aloud (only the text and its language) | US-based; global infrastructure |
| Google LLC (Google Translate) | Fallback translation, requested from your device (only the text and the language pair) | US-based; global infrastructure |
| Google LLC (Sign in with Google) | Only if you choose this route: Google authenticates you; your name, email address and profile picture come from Google | US-based; global infrastructure |
| Microsoft Corporation (Azure Speech) | Scoring the recording you send with the pronunciation check | US-based; Azure infrastructure in the region we configured |
| RevenueCat, Inc. | Recording and checking App Store purchases and telling our server about them | US-based |
| Apple Inc. | App Store payments and subscriptions; speech recognition when it is not done on the device | US-based; global infrastructure |
| Translated s.r.l. (MyMemory) | Fallback translation when the request to Google Translate fails | Italy (EU) |
| Our email provider | Delivering sign-in, confirmation and password-reset codes | Per the provider's own infrastructure |
| Public dictionary sources (kaikki.org, Tatoeba) | Looking up meanings and example sentences for a new word. Only the word is sent, so no personal data reaches them | Various |
Apple and Google also process data under their own terms when you use their services directly (the App Store, your Apple ID, Sign in with Google). Beyond that we disclose data only where legally compelled (a court order or an explicit statutory requirement).
11. International transfers
Because these providers operate globally, your data may be processed outside Türkiye and outside the EEA, including in the United States. Transfers to our US-based processors rest on the European Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR, incorporated into those providers' data processing terms. For KVKK purposes, transfers abroad rest on your explicit consent under Art. 9 KVKK where no other ground applies.
12. Deleting your account
You can delete your account in the app at any time: Profile → Delete account. This deletes the account immediately and permanently, together with the data tied to it on our servers: your words, review history, exercise attempts, usage events, conversations, reports, profile details, profile picture, phone number and email address. Backup copies roll off on their own schedule within 30 days. The copy on the device is erased at the same time. You can also ask for deletion by writing to contact@wordmi.com.
Some records stay because they are not yours alone or because the law requires them: shared AI caches that also serve other users, and the purchase records that Apple and RevenueCat keep under their own retention rules and tax obligations.
13. Your rights
Under the GDPR (Art. 15–22) and the KVKK (Art. 11) you have the right to know what we hold, to get a copy, to correct it, to have it erased, to restrict or object to processing, to portability, and to withdraw any consent at any time without that affecting what was lawful before. Turkish law adds the right to learn which third parties your data was transferred to, at home or abroad, and to claim compensation for damage caused by unlawful processing.
You can correct your profile and delete words, conversations or the whole account in the app yourself. For anything else, including a copy of your data, write to contact@wordmi.com. We answer within 30 days (KVKK: 30 days; GDPR: one month, extendable by two where a request is complex), and we do it free of charge. We may ask for information that confirms the request comes from the account holder.
14. Complaining to a regulator
If you think we have handled your data badly, tell us first; we would rather fix it. You can also complain to Türkiye's Kişisel Verileri Koruma Kurumu (KVKK) or, if you are in the EEA, to the supervisory authority where you live or work.
15. How we protect it
Traffic runs over HTTPS. Passwords are stored only as salted hashes by our authentication provider, and the sign-in session on your phone is kept in the iOS Keychain. Every table carries row level security, so an account can read only its own rows. Sign-in and code sending are rate limited against brute force, and signing in with email and password on a device we do not recognise requires a code sent to your email. Provider keys stay on our servers and are never shipped in the app.
No system is perfectly secure. If a breach is likely to put your rights at risk we will notify the supervisory authority within 72 hours as Art. 33 GDPR and Art. 12/5 KVKK require, and tell you directly where Art. 34 GDPR requires it.
16. Children
The app is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has created an account, write to contact@wordmi.com and we will delete it.
17. Automated decisions
The AI features generate exercises, suggestions and explanations, and the review algorithm decides when to show you a word again. Neither produces a legal or similarly significant effect on you, so this is not automated decision-making within the meaning of Art. 22 GDPR.
18. Changes
If this policy changes in a way that affects what we collect or who receives it, we will update the date at the top and tell account holders in the app or by email before the change takes effect.
19. Contact
Data protection questions, access requests and deletion requests: contact@wordmi.com.