Vocab First has no user-account system or advertising SDK. Protected-app selections and learning history stay on device. The app uses privacy-restricted Firebase Analytics, Firebase Crashlytics, RevenueCat, and the app store as described below.
Overview
Vocab First is operated by Lab&Co (“Lab&Co,” “we,” “us,” or “our”). This policy explains what information the app handles, why it is needed, where it goes, and the choices available to you.
Information kept on your device
Vocab First stores the app selections you choose to protect; app display labels or opaque Screen Time selection tokens; your settings; vocabulary progress; words seen; quiz attempts and results; streaks and unlock statistics; unlock timing; permission states; and a cached subscription-entitlement state. This information powers blocking, learning, personalization, progress, and troubleshooting inside the app. Answers used to personalize the onboarding projection are held only while onboarding is in progress and are not saved after the flow.
This information is stored locally using platform storage. On iOS, data used by Vocab First’s Screen Time extensions may also be stored in the app’s private App Group container. Lab&Co does not receive this local learning history or your protected-app list through the app.
Screen Time and notifications
On iOS, Apple’s Family Controls, Managed Settings, and Device Activity frameworks provide private app/category selections and allow Vocab First to schedule and display shields. Apple controls these permissions and may represent selections as opaque tokens. Vocab First uses them only for the focus features you configure.
Notification permission is used for functional Vocab First reminders or handoffs related to the shield and intervention flow. It is not used for advertising. You can revoke Screen Time or notification access at any time in system settings; the related feature will then stop working.
Usage analytics
Vocab First uses Google Analytics for Firebase to understand aggregate app usage, onboarding and subscription-flow completion, and technical failures. The service automatically processes a pseudonymous app-instance identifier assigned to the app installation; app sessions and lifecycle events; app version; device category and model; operating-system version; language; and approximate geographic information derived from a masked IP address. Depending on the platform and store integration, Firebase may also receive automatically generated in-app purchase or subscription events, including product and pricing details.
Vocab First’s custom analytics events contain only allowlisted flow stages and categorical outcomes, such as an onboarding step, permission outcome, coarse selected-app count range, paywall source, subscription action, or finite failure reason. They do not contain your name, email address, account ID, onboarding survey answers, protected-app names or identifiers, Screen Time tokens, words or quiz history, RevenueCat customer IDs, transaction or receipt identifiers, URLs, or free-form error messages. Vocab First does not set an Analytics user ID or custom user properties.
Vocab First configures Firebase not to collect Apple’s Identifier for Vendor (IDFV) and disables ad-personalization signals. Lab&Co uses this analytics information to measure product-flow performance and reliability, not for cross-app advertising or to identify you directly. Google processes the information under the Google Analytics and Firebase terms and privacy documentation.
Crash and stability diagnostics
Vocab First uses Firebase Crashlytics to detect and diagnose fatal crashes and certain memory-related terminations. A Crashlytics report can include pseudonymous Firebase and Crashlytics installation identifiers; crash time; app identifier and version; device model, CPU architecture, available RAM or disk information, operating-system and jailbreak state; exception, signal, stack-trace, process, and thread information; and privacy-restricted Analytics events that occurred before the failure. System- or SDK-generated exception messages may also appear in a report.
On iOS, Apple MetricKit can provide delayed aggregate counts for memory-limit, memory-pressure, and hang cases; Vocab First forwards only the fixed diagnostic category and count to Crashlytics. These operating-system reports are not guaranteed for every termination and may arrive after a delay.
Vocab First does not set a Crashlytics user ID or deliberately attach survey answers, protected-app identities, Screen Time tokens, learning history, purchase identifiers, user-entered text, or arbitrary custom logs to crash reports. Crash and stability information is used to investigate defects, prioritize reliability work, and measure crash-free operation.
Purchases and service providers
Apple processes subscription purchases, billing details, refunds, and the store account used for a transaction under its own terms and privacy policy. Lab&Co does not receive your complete payment-card number.
Vocab First uses RevenueCat to display subscription offers, validate purchases, restore purchases, determine entitlement status, and measure Apple Ads subscription performance on iOS. RevenueCat may process an SDK-generated anonymous App User ID; device and operating-system technical information; product, transaction, and receipt information; subscription status; purchase or renewal timestamps; and Apple-provided campaign, ad group, keyword, country or region, and attribution-type information. Vocab First does not provide RevenueCat with your email address, protected-app list, or learning history.
Apple, Google, and RevenueCat process information under their own privacy terms. Where a provider acts on Lab&Co’s behalf, we require it to handle the information only for the contracted service and with protections required by our agreements and applicable law.
Support communications
When you choose Email Lab&Co Support, your mail app creates a draft that you decide whether to send. The template can include app version, operating system, permission states, protection state, cached subscription state, and the number of selected apps. Your email provider and Lab&Co then process the address, message, attachments, and diagnostic details you choose to send so we can respond and troubleshoot.
The generated draft does not include an account or device identifier, purchase identifier, protected-app names, or learning history. Anything you add manually is provided at your choice.
How and why information is used
We process information as needed to provide the app and subscriptions, remember your choices, run interventions, calculate progress, validate access, measure aggregate usage and flow reliability, prevent purchase fraud, answer support requests, maintain security, and comply with legal obligations. Depending on your location and the processing involved, the legal basis may be performance of our agreement with you, your consent, Lab&Co’s legitimate interests in operating, understanding, and protecting the service, or compliance with law.
Vocab First does not sell your personal information and does not use protected-app activity, learning history, or purchase data for cross-app advertising or tracking.
Retention and deletion
Local app data remains until you reset or remove it using available platform controls, clear the app’s data, or uninstall the app, subject to how the operating system handles private containers and backups.
Google retains Analytics information according to the settings and policies that apply to Lab&Co’s Analytics property. Firebase Crashlytics keeps crash stack traces, extracted diagnostic data, and associated installation identifiers for 90 days before beginning removal from live and backup systems. Apple and RevenueCat retain transaction and subscription records according to their policies and any financial, fraud-prevention, or legal requirements. Lab&Co retains support correspondence only as long as reasonably needed to resolve the request, maintain support records, protect the service, and meet legal obligations.
To request access to, objection to, or deletion of information held by Lab&Co or processed for Lab&Co by Google Analytics, Firebase Crashlytics, or RevenueCat, email support@labco.app. Because Firebase records use pseudonymous installation identifiers and Vocab First does not have user accounts, we may be unable to associate a record with you unless enough limited verification information is available. Some transaction records may need to be retained where required by law. Store-account or payment records controlled by Apple must be managed through Apple.
Your choices and privacy rights
You control which apps are selected, whether monitoring is enabled, which optional permissions remain granted, whether a support email is sent, and whether a subscription is purchased or renewed. You may contact us to object to Analytics or Crashlytics processing where that right applies. Uninstalling Vocab First stops future collection from that installation but does not by itself delete previously processed Firebase information or cancel a store subscription.
Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability, or an objection to certain processing; to withdraw consent; and to complain to your local data-protection authority. Contact us to exercise a right. We will not discriminate against you for making a privacy request, though some requests may be limited by law or by our inability to identify a fully anonymous record.
Security and international processing
Vocab First uses private platform storage and encrypted network connections provided by Firebase, the app stores, and RevenueCat. We limit the information sent off-device, but no storage or transmission method can be guaranteed completely secure.
Google, RevenueCat, and store providers may process information outside your country, including in the United States. When required, these transfers rely on contractual, organizational, and legal safeguards provided by the applicable service.
Children
Vocab First is not directed to children under 13. If you are not old enough to consent to data processing or accept these terms where you live, use Vocab First only with permission from a parent or legal guardian. If you believe a child provided personal information to Lab&Co through support, contact us so we can review and delete it where appropriate.
Changes to this policy
We may update this policy when Vocab First, its providers, or legal requirements change. We will update the effective date and provide additional notice in the app when a change is material and notice is required.
Questions or requests
Contact Lab&Co at support@labco.app. Please do not email passwords or full payment-card details.