Privacy Policy

Last updated: 5 November 2026

This policy explains what VerbReef stores about you, why it is stored and what you can do about it. It covers the website at verbreef.com and the application behind it. Using VerbReef also means accepting the Terms of Service.

Who is responsible

VerbReef is run by Vladyslav Halchenko, an individual based in Ukraine, acting as the data controller for the data described below.

What is collected

• Account. Your name, email address and password. The password is never stored as text — only as a bcrypt hash. Your chosen avatar, interface theme and interface language are stored with the account so that they follow you to another device.
• Sign-in with Google. If you choose it, Google tells us your name, your email address and a permanent identifier of your Google account. We use them to create your account or find the existing one and nothing else: VerbReef does not get your Google password, your profile photo or access to anything else in your Google account.
• What you create. Your categories, words, translations and notes, together with your training progress: which words you marked as known or to repeat, the repetition schedule, the days you practised and your streak.
• Reminders. If you turn on reminders on a device, we store the address your browser’s push service gave that device and the keys needed to encrypt messages for it, together with the hour you chose, your time zone and the interface language. The reminder travels through that push service encrypted, so only your device can read it. Turning reminders off or signing out on the device stops them, and the address is deleted once the push service reports it gone.
• Support requests. If you write through “Help & feedback”, the message and its type are stored and sent to us by email.
• Security records. Counters of failed sign-in, sign-up and password-reset attempts, keyed by email address or IP address. They exist to slow down password guessing and are kept for a short window — between 15 and 60 minutes.
• Error reports. When the site breaks, we receive the technical error text and the page it happened on, by email. Your account and IP address are not part of the report.
• Visit statistics. Vercel Web Analytics counts page views: which page was opened, where the visit came from, and coarse technical details such as country, browser and device type. It sets no cookies and does not follow you to other sites; to tell repeat views apart within a day it derives a temporary identifier from request data, which is not reused the next day and cannot be traced back to a person.

There is no advertising and no cross-site tracking here. Nothing you write is used to profile you or sold to anyone, and these statistics are never joined with your account.

Cookies

VerbReef uses only cookies it needs to work or to remember your choices. There are no advertising cookies, which is why there is no consent banner.

• Session. Keeps you signed in for up to 30 days. Without it you cannot use the account.
• Theme and language. Remember the appearance and the interface language you picked, for a year. They are also set for visitors who never sign in.
• Sound and quick add. Whether training sounds are on and the category you last added a word to stay in your browser’s local storage and are never sent to us.
• Short-lived helpers. A one-off notice after an action, a remembered shared-category link or word set opened before signing in (one hour) and the state of the side panel.

Why it is stored

Your account and your words are stored to provide the service you asked for. Security records and rate limits are kept out of a legitimate interest in protecting accounts from password guessing and the service from abuse; visit statistics, out of a legitimate interest in knowing which pages people actually use. Email is sent only in response to something you did — resetting a password or writing to support. There is no marketing mail.

Who else processes it

VerbReef runs on services that process data on our behalf and only on our instructions:

• Vercel — hosting and delivery of the site, and the visit statistics described above;
• Supabase — the database where your account and words are stored;
• Resend — sending password-reset, support and error-report email;
• Google — sign-in, if you choose to use it;
• the push service of your browser (Google, Apple, Mozilla or Microsoft) — delivering reminders, if you turn them on;
• Cloudflare — domain name resolution.

Depending on the provider, data may be processed in the European Union or in the United States.

How long it is kept

Your account and everything in it are kept while the account exists. Deleting the account deletes your categories, words and progress; a support message you sent stays as a record of the request, but it is no longer linked to you. Password-reset and email-verification links are stored only as a hash, expire on their own — after an hour and a day respectively — and are erased once used. Security counters expire within the hour.

Your rights

You can see and correct your account data on the account page, download all of it as a file, export the words of any category as a CSV file, reset your training progress, and delete your account — together with everything in it — at any time. You may also ask for a copy of your data, ask for it to be corrected or erased, or object to how it is used. If you are in the EU, the UK or Ukraine, you may complain to your local data protection authority.

Security

Passwords are hashed with bcrypt and never stored or sent as text. The site is served over HTTPS. Changing your password signs out every other device.

Children

VerbReef is not directed to children under 13, and accounts are not knowingly created for them.

Changes

If this policy changes, the date at the top changes with it. Changes that affect how your data is used will be announced in the application before they take effect.

Contact

Questions about this policy or your data: support@verbreef.com.