Verbavia Privacy Policy

Last updated 14 September 2026

In short: we do not track you. There are no advertising or analytics cookies, no third-party trackers, and nothing that follows you to other sites. What we know about you is what your own account holds — your progress, and a snapshot of how you were getting on the last time you opened the app.

Verbavia is a language-learning app for the web and Android. This policy explains what we collect, why, who else sees it, and how to get rid of it. We do not sell your data, the only advertisement we show is our own notice for Verbavia Premium, and we do not use your learning content to build advertising profiles.

Who we are

Verbavia is operated by the developer of verbavia.com. For any privacy question or request, email support@verbavia.com.

What we collect

• Your account. An email address and a password. The password is handled by Google Firebase Authentication and stored only as a cryptographic hash — we never see or store it in readable form. If you sign in with Google instead, we receive your email address and basic profile information from Google. If you choose to give a display name when you sign up, we store that too; it is optional and you can leave it blank. We also record the date you confirmed your email address, so we do not have to ask you again.
• Your learning progress. Which lessons and languages you have studied, answers you gave, vocabulary and flashcard scheduling, streaks and completion records, which course you are currently on and which you have archived. This is stored against your account so that your phone and the website show the same progress.
• When you last opened the app, and how you were getting on. Each time you open Verbavia while signed in, we overwrite a small set of fields on your account record: the current server time, and a snapshot of what your progress looked like at that moment — which course you were studying, your streak, lessons completed, level, when you last finished a lesson, the name of your time zone, your chosen lesson length, whether you are on the phone app or the website, and, if you had a lesson paused, which section of it you had reached, plus a one-line summary of it in plain English. We use this to see whether the app is being used and where people get stuck, so we know what to fix next.
  All of it is worked out from information already stored on your own device so that the app can function — we do not add anything to your device to collect it, and we do not give you a tracking identifier. The time zone is the name your browser already reports so it can show you the right date, such as "Pacific/Auckland"; it is not your location, and it is stored only so a streak reminder can be sent before midnight where you are rather than after it. Each field is overwritten on your next visit, so this is a current picture and not a history: not a log of your sessions, not how long you stayed, and not where you were.
• What you did before making an account. Verbavia can be used without an account, and nothing about that play reaches us — there is no account to attach it to. If you later create one, the progress on your device becomes your account's starting point, and at that moment we record how many lessons and what streak you arrived with. It is written once, when you sign up.
• Whether we have written to you, and whether you want us to. If we send you a streak email we record that we sent it, so you are never sent the same one twice, and if you unsubscribe we record that too and never write again. Both are a date and a yes-or-no on your account record, nothing more.
• Premium, if you subscribe. Verbavia Premium is paid for on Stripe's own checkout page, and your card details go to Stripe, never to Verbavia. Stripe tells our server when a subscription starts, renews, changes or ends, and we keep a small record of it against your account: the subscription's status, when a free trial or the current billing period ends, whether it is set to cancel, and the Stripe customer and subscription identifiers that connect it to your account. Only our server can change that record. While you have Premium we also record the days a streak freeze has covered, so that every device you use shows the same streak.
• Lesson content you generate. Verbavia builds lessons and marks answers using Google's Gemini models. The text involved — the topic, the words being taught, and the answers you type — is sent to Google for that purpose.
• Speech, when you choose to use it. Speaking exercises use the speech recognition built into your browser or phone — the Web Speech API on the web, the system recogniser on Android. Audio is captured only while you are actively doing a speaking exercise, and Verbavia never receives, records or stores it; we get back only the text. Be aware that the recogniser is not ours: to turn your speech into text, your browser or phone may send that audio to its own provider (on Chrome and on most Android phones, Google), under that provider's privacy policy rather than this one. The microphone permission is requested at the moment you first use a speaking exercise. Declining it leaves the rest of the app fully usable, and every speaking exercise can be skipped.
• On-device data. Course content, cached audio and your recent activity are stored locally in your browser or app so that lessons work offline. This stays on your device.
• Anonymous visit statistics. We count page views on verbavia.com using Cloudflare Web Analytics, so we can tell how many people visit and which pages get read. It sets no cookies, stores nothing on your device, and cannot follow you to other websites. What we see are totals — visits, pages, referring site and country — never a person.

What we do not collect

• No payment details. Premium subscriptions, and gifts through the “Support me” box, are paid on Stripe's own page, and your card details never reach Verbavia.
• No contacts, photos, location, or device identifiers for advertising.
• No third-party advertising or tracking networks. The one advertisement in Verbavia is our own short notice for Verbavia Premium, shown to people who do not have it. It is the same for everyone, nothing about you is used to choose it, and showing it sends nothing anywhere.
• No advertising or analytics cookies, and no cross-site profile of you.

Who else processes your data

• Google Firebase — authentication, database (Cloud Firestore) and website hosting. Your account and progress live here.
• Google Gemini, via Firebase AI Logic — generating lessons and marking answers, as described above.
• Cloudflare — DNS and email routing for verbavia.com, and the anonymous visit statistics described above.
• Resend — delivering the streak emails described below. It receives your email address and the message itself, and nothing about your learning.
• Stripe — payments for Premium and for gifts. Stripe handles your card and billing details under its own privacy policy, and tells our server only whether your subscription is active and when it renews or ends.

These providers operate servers internationally, so your data may be processed outside your own country. We do not share your data with anyone else, and we do not sell it.

Why we are allowed to hold it

We process your account and progress because it is necessary to provide the service you asked for. Where consent is the appropriate basis — the microphone, for example — we ask you first, and you can decline or withdraw it at any time in your device settings.

How long we keep it

Your account and progress are kept while your account exists. Delete your account and everything held against it goes with it — progress, decks, display name and the last-opened timestamp. Backups may persist for a short period afterwards before being overwritten in the ordinary course.

Deleting your account also cancels any Premium subscription straight away, so you are not charged again, and deletes our record of it. Stripe keeps its own record of past payments, as the law requires of it.

Email we send you

There are two kinds, and both are about your own learning — we do not send advertising, we do not send anyone else's offers, and we never pass your address to anybody for marketing.

• Account email. Confirming your address and resetting your password. These are sent by Firebase when you ask for them, and you cannot unsubscribe from them — without them you could be locked out of your own account.
• Streak reminders. A message about an hour before your streak runs out, and occasionally one if you have not studied for a while. Every one of these has an unsubscribe link at the bottom; one click stops all of them, immediately and for good, and it does not need you to sign in. Unsubscribing changes nothing else about your account.

If you would rather not receive the reminders and cannot find the link, email support@verbavia.com and we will switch them off for you.

Your choices

• See or correct your data — most of it is visible in the app. Email us for anything that is not.
• Delete everything — open Settings, scroll to Account and choose Delete my account. It is immediate, it needs no approval from us, and it works the same way on the website and in the Android app. Everything goes: your account, every course with its words, streak and history, and the copy on the device you delete from. There is no recovery period. Step-by-step instructions. If you would rather we did it, email support@verbavia.com from your account address.
• Export your data — ask and we will send it to you in a machine-readable form.
• Withdraw microphone access — revoke it in your device or browser settings; speaking exercises stop working, nothing else does.

Depending on where you live you may have additional rights, including under the GDPR or the New Zealand Privacy Act 2020. Email us and we will honour them.

Children

Verbavia is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child has created an account, email us and we will remove it.

Security

Traffic is encrypted in transit. Access to your progress is restricted by database security rules so that only your signed-in account can read or write your own records. No system is perfect, and we will tell affected users promptly if a breach ever puts their data at risk.

Changes

If this policy changes materially, we will update the date at the top and, where the change matters to you, tell you in the app.