Privacy

Plain language version, with the legal one at the bottom.

What we collect

• Email address, when you sign up. Used to send you the magic login link and (rarely) product updates you can unsubscribe from.
• The words you save, text only, including the source sentence and the AI-generated card. Stored so you can review them.
• Berlin conversation transcripts, including what you type or say, the character’s replies, and language corrections. We store these so the conversation can resume and so a restricted administrator can review product quality. Raw microphone audio is not retained.
• Subscription state, managed by Stripe; we store your Stripe customer ID and your plan status.
• Anonymous demo usage, when you try the demo without signing up, we hash your IP address (one-way, salted) and count up to the daily product allowance. We do not store the raw IP.
• Anonymous first-party product events, such as page views, landing button clicks, game arrivals, and reading-tool actions. We hash your IP address one-way and do not set tracking cookies for these counts.

About the microphone

The mic only opens when you press the mic button. Audio is streamed live to our speech-to-text provider (Deepgram or Speechmatics) and discarded after transcription. We do not retain raw audio. We keep recognized text when it forms part of a saved learning card or Berlin conversation transcript.

What we don’t do

• We don’t sell your data.
• We don’t use ad-tech trackers (no Google Analytics, no Facebook pixel) and we don’t share your data with ad networks.
• We don’t profile you for ads.

Product analytics

To understand how WordZam is used and to fix what’s confusing, we use two levels of analytics. First, WordZam records minimal first-party landing and product events without cookies, using a one-way hashed IP, so we can count visits and understand the basic conversion funnel. Second, we use PostHog, hosted in the EU. With your consent (the banner shown on your first visit) it captures usage events, page views, and session replays of how you interact with the interface; text you type into form fields is masked. Once you sign in, these are linked to your account. You can decline on the banner — if you do, PostHog is not used — and we never use this data to profile you for ads.

Service providers we use

• Stripe, payment processing (your card data goes straight to Stripe, we never see it).
• Deepgram or Speechmatics, speech- to-text (live audio stream, discarded post-recognition).
• OpenAI / Groq, generating learning cards, character replies, and language corrections (text in, text out, no raw audio).
• Brevo, sending login emails.
• Hetzner, hosting (EU data center).
• Google Drive, encrypted nightly database backups.
• PostHog (EU), product analytics and session replay, only with your consent.

Deleting your account

Sign in, go to Account, click Delete my account. Your user record, your saved words, your settings, and your subscription record are removed. Stripe records (required for tax / accounting law) are retained per Stripe’s policy.

Contact

Privacy questions: hello@wordzam.com.

Legal

Controller: Dario Penic, address per Impressum. Legal basis under GDPR: contract (for account + payment) and legitimate interest (for service operation). You have the right to access, rectify, erase, restrict, and port your data. Complaints can be addressed to the Berlin data protection authority.

Last updated: 2026-05-17. Substantive changes will be announced by email.