Privacy Policy
Last updated: 23 September 2026
This policy explains what VerbReef stores about you, why it is stored and what you can do about it. It covers the website at verbreef.com and the application behind it. Using VerbReef also means accepting the Terms of Service.
Who is responsible
VerbReef is run by Vladyslav Halchenko, an individual based in Ukraine, acting as the data controller for the data described below.
What is collected
- Account. Your name, email address and password. The password is never stored as text — only as a bcrypt hash. Your chosen avatar, interface theme and interface language are stored with the account so that they follow you to another device.
- What you create. Your categories, words, translations and notes, together with your training progress: which words you marked as known or to repeat, the repetition schedule, the days you practised and your streak.
- Support requests. If you write through “Help & feedback”, the message and its type are stored and sent to us by email.
- Security records. Counters of failed sign-in, sign-up and password-reset attempts, keyed by email address or IP address. They exist to slow down password guessing and are kept for a short window — between 15 and 60 minutes.
- Visit statistics. Vercel Web Analytics counts page views: which page was opened, where the visit came from, and coarse technical details such as country, browser and device type. It sets no cookies and does not follow you to other sites; to tell repeat views apart within a day it derives a temporary identifier from request data, which is not reused the next day and cannot be traced back to a person.
There is no advertising and no cross-site tracking here. Nothing you write is used to profile you or sold to anyone, and these statistics are never joined with your account.
Cookies
VerbReef uses only cookies it needs to work or to remember your choices. There are no advertising cookies, which is why there is no consent banner.
- Session. Keeps you signed in for up to 30 days. Without it you cannot use the account.
- Theme and language. Remember the appearance and the interface language you picked, for a year. They are also set for visitors who never sign in.
- Short-lived helpers. A one-off notice after an action, a remembered shared-category link opened before signing in (one hour) and the state of the side panel.
Why it is stored
Your account and your words are stored to provide the service you asked for. Security records and rate limits are kept out of a legitimate interest in protecting accounts from password guessing and the service from abuse; visit statistics, out of a legitimate interest in knowing which pages people actually use. Email is sent only in response to something you did — resetting a password or writing to support. There is no marketing mail.
Who else processes it
VerbReef runs on services that process data on our behalf and only on our instructions:
- Vercel — hosting and delivery of the site, and the visit statistics described above;
- Supabase — the database where your account and words are stored;
- Resend — sending password-reset and support email;
- Cloudflare — domain name resolution.
Depending on the provider, data may be processed in the European Union or in the United States.
How long it is kept
Your account and everything in it are kept while the account exists. Deleting the account deletes your categories, words and progress; a support message you sent stays as a record of the request, but it is no longer linked to you. Password-reset links are stored only as a hash, expire after an hour and are erased once used. Security counters expire within the hour.
Your rights
You can see and correct your account data on the account page, export the words of any category as a CSV file, and delete your account — together with everything in it — at any time. You may also ask for a copy of your data, ask for it to be corrected or erased, or object to how it is used. If you are in the EU, the UK or Ukraine, you may complain to your local data protection authority.
Security
Passwords are hashed with bcrypt and never stored or sent as text. The site is served over HTTPS. Changing your password signs out every other device.
Children
VerbReef is not directed to children under 13, and accounts are not knowingly created for them.
Changes
If this policy changes, the date at the top changes with it. Changes that affect how your data is used will be announced in the application before they take effect.
Contact
Questions about this policy or your data: support@verbreef.com.