On this page
Data Controller
Wordify is developed and provided by Muhammed Mustafa Geldi (Türkiye), operating under the name Swanky Software (referred to in this policy as “Swanky Software”). The developer name of the application on Google Play is “Swanky”.
With regard to the personal data processed in connection with Wordify, the data controller is Swanky Software. Questions and requests concerning personal data may be sent to [email protected].
Scope
Wordify is an ad-supported application, used with an account, that helps you learn English vocabulary. A premium version that removes advertisements and offers additional features can be obtained through a one-time purchase.
Wordify is available worldwide, and this policy applies in the same way to all users regardless of the country in which they are located. As the data controller is established in Türkiye, all processing activities are subject to the KVKK; processing relating to users in the European Economic Area is additionally subject to the GDPR. Where the laws of your country grant you rights in addition to those set out in this policy, those rights remain unaffected.
Personal Data Processed
The following categories of data are processed in order to provide the service.
Account data
- Email and password: When you create an account with an email address and password, your email address and password are stored. The password is stored using a one-way hashing method; no one, including Swanky Software, can access the password in plain text.
- Username: The username you choose for your account.
- Sign in with Google: When this method is chosen, the email address and account identifier provided by Google and, if available in the Google account, the name and a link to the profile photo are received. The Google account password is not accessed.
- Session and security records: Account identifier, account creation and last sign-in dates, email verification status, sign-in method, and the IP address and time of authentication operations.
- Verification and password reset: The links needed to verify your email address and reset your password are sent to your email address.
Learning data
- Word status: Words you have learned and added to your favourites, and the time you last saw each word.
- Mistakes and tests: Words you answered incorrectly, the number and dates of mistakes, and your test results and statistics.
- Progress and streak: Your level progress, your daily study streak, your longest streak and your last activity time.
- Word requests: The English words you have requested to be added to the word list, their Turkish equivalents and the status of your requests.
Purchase information
- Premium record: The purchase token, order number, product identifier and purchase status provided by Google Play for verifying and restoring the premium purchase.
- Payment details: Card and other payment details are processed solely by Google; they are not transmitted to Swanky Software and are not stored by us.
Advertising data
Google AdMob is used to display advertisements to users who do not have premium. AdMob may process the advertising identifier, the IP address and the approximate location derived from it, device and application information, and information on ad views, clicks and rewarded ads watched. Your learning data are not sent to advertising services.
Information stored on your phone
Your notification preferences and the session information needed for the application to work are stored on your phone. If Android backup is enabled on your phone, this information may be included in your phone’s backup in your Google account.
Support correspondence
When you send us an email, your email address and the content of your message are processed to respond to your request and, where necessary, to verify that the account belongs to you.
Purposes and Legal Bases of Processing
Personal data are collected electronically through the information you enter in the application, the information provided by Google during Sign in with Google and Google Play purchases, and the records generated when the application communicates with the servers, and are processed for the following purposes:
- Provision of the service: Creating and managing the account, recording your learning progress, offering suitable words and tests, and reviewing word requests. Legal basis: conclusion and performance of a contract (Art. 5(2)(c) KVKK; Art. 6(1)(b) GDPR).
- Premium purchase: Verifying the purchase and granting and restoring premium entitlements. Legal basis: performance of a contract (Art. 5(2)(c) KVKK; Art. 6(1)(b) GDPR).
- Displaying advertisements: Displaying advertisements so that the application can be offered free of charge, measuring ad performance, granting additional rights in return for rewarded ads and preventing ad fraud. Legal basis: legitimate interest of the data controller (Art. 5(2)(f) KVKK; Art. 6(1)(f) GDPR). Personalised advertising and access to information on the device are based on your consent where the law requires consent (Art. 6(1)(a) GDPR).
- Security: Preventing unauthorised access and misuse. Legal basis: legitimate interest of the data controller (Art. 5(2)(f) KVKK; Art. 6(1)(f) GDPR) and the legal obligation relating to data security (Art. 12 KVKK).
- Responding to requests: Handling support requests and requests concerning personal data. Legal basis: performance of a contract and legal obligation (Art. 5(2)(c) and (ç) KVKK; Art. 6(1)(b) and (c) GDPR).
Device Permissions and Notifications
Wordify does not request access to your location, contacts, camera, microphone or files.
- Internet and network status: Used for the account, learning data, purchases and advertisements.
- Advertising identifier: Used by Google AdMob to display and measure advertisements.
- Notifications: If you allow them, used to remind you of your daily study streak. You can turn notifications off in the application or in your phone settings.
- Google Play purchases: Used for premium purchases.
Disclosure of Personal Data
Personal data are not sold. Data are disclosed only to the recipients listed below and only for the stated purposes.
Service providers and other recipients
- Supabase: The account and authentication service and the database in which learning data are stored. For details, see the Supabase Privacy Policy.
- Resend: Sending email verification and password reset links to your email address. For this purpose, your email address and the one-time link are transmitted to Resend. For details, see the Resend Privacy Policy.
- Google: Sign in with Google, distribution, updates and premium purchases via Google Play, and the display of advertisements via Google AdMob. Information relating to advertisements may be shared with Google and its advertising partners. For details, see the Google Privacy Policy and How Google uses information from apps that use its services.
- Hostinger: Emails sent to [email protected] and the content of this correspondence are hosted on the infrastructure of the email service provider Hostinger. For details, see the Hostinger Privacy Policy.
- Competent authorities: Data are disclosed to public authorities and courts empowered by law only where there is a legal obligation to do so and only to the extent required by that obligation.
Countries where data are processed
Regardless of the country in which the user is located, personal data are processed on the infrastructure of Supabase, Resend, Google and Hostinger in various countries, including the United States. Your data may therefore be processed outside your country.
With regard to transfers from Türkiye, these transfers are based on the appropriate safeguards provided for in Article 9 of the KVKK; with regard to transfers from the European Economic Area, they are based on the safeguards provided for in Chapter V of the GDPR, in particular standard contractual clauses and, where applicable, the EU-U.S. Data Privacy Framework.
Data Security
In accordance with Article 12 of the KVKK and Article 32 of the GDPR, Swanky Software takes appropriate technical and organisational measures to ensure the security of personal data.
- Encrypted communication: All communication between the application and the servers is encrypted with TLS.
- Access control: Each user can access only their own data. Data access takes place through rules and functions that authenticate the user and whose authorisation is checked on the server side.
Data breaches
No system can guarantee absolute security. If personal data are unlawfully obtained by others, the competent data protection authorities and the affected users will be notified within the time limits and in the manner prescribed by law.
Retention Periods
- Account and learning data: Retained for as long as the account remains open and deleted when the account is deleted. Deletion methods are described on the Account and Data Deletion page.
- Purchase records: Retained for as long as the account remains open in order to provide the premium entitlement. Google Play purchase and payment records are retained by Google in accordance with its own policies.
- Advertising data: Retained by Google in accordance with the retention rules of the relevant service.
- Technical and security records: Retained for as long as required for security and error detection purposes and deleted at the end of that period.
- Correspondence: Correspondence relating to support requests and data protection requests is retained for as long as necessary to resolve the request and to provide evidence in possible disputes.
Your Rights
Regardless of the country in which you are located, you have the following rights regarding your personal data (Art. 11 KVKK; Arts. 15–22 GDPR):
- Information: To learn whether your personal data are processed and, if so, to request information about it, and to learn the purpose of the processing and whether the data are used in accordance with that purpose.
- Recipients: To know the third parties to whom your personal data are transferred, whether domestically or abroad.
- Rectification: To request the rectification of incomplete or inaccurate personal data.
- Erasure: To request the erasure or destruction of personal data under the conditions provided for by law.
- Restriction: To request, in certain cases, that the processing of your personal data be restricted.
- Data portability: To request the personal data you have provided in a structured, commonly used format.
- Notification: To request that rectification, erasure or destruction be notified to the third parties to whom the data have been transferred.
- Objection: To object to processing based on legitimate interest and to a result to your detriment arising from analysis carried out exclusively by automated systems.
- Withdrawal of consent: To withdraw at any time the consent you have given for processing based on consent, without affecting the lawfulness of processing carried out before the withdrawal.
- Compensation: To claim compensation for damage suffered as a result of the unlawful processing of your personal data.
Advertising settings
You can reset your advertising identifier or limit ad personalisation in the advertising settings of your phone and your Google account. No advertisements are shown in the premium version.
How to Submit a Request
You may send requests concerning your rights to [email protected] from the email address registered to your Wordify account. Additional information may be requested if your identity cannot be verified.
Requests are handled as quickly as their nature allows and free of charge within thirty days at the latest.
If you are not satisfied with the outcome of your request, you may lodge a complaint with the competent data protection authority. Users in Türkiye may apply to the Turkish Personal Data Protection Board within thirty days of learning of the response and in any event within sixty days of the date of the request; see the KVKK right to apply page for details. Users in the European Economic Area may apply to the data protection authority of the country in which they reside or work, and users in other countries may apply to the competent authority in their country.
Age Limit
Wordify is not intended for persons under 18 years of age. Accounts found to belong to a person under 18 may be closed and the associated data may be deleted.
Changes to This Policy
This policy may be updated in line with changes to the application, the services used or the applicable law. The current version is published on this page, and the date of the last update is shown at the top of the page. Updates that materially change the purposes of processing or data transfers will also be announced in the application or by email.