Privacy policy

The controller of your personal data is the operator named in the Imprint. Write to the email address given there with any question or request about your data.

Your data is handled under the EU General Data Protection Regulation (GDPR) and the Swedish Data Protection Act (2018:218).

To create an account you give your name and email address and choose a password. The password is stored only as a hash. You may add a profile picture. Name and email address are required: without them no account can be created. Everything else you enter is optional.

This data is used to sign you in, to email you the links for choosing or resetting a password and for confirming a new address, and to show the people you share a document with who you are. The legal basis is the agreement to provide the service to you (GDPR Art. 6(1)(b)).

Each sign-in is stored with the IP address and the browser it came from, and sign-in attempts are counted per IP address, to keep accounts safe (Art. 6(1)(f): a secure service).

Accounts are by invitation. If someone invites you or shares a document with you, they enter your email address, and it is stored so that you can sign up; this is where the operator gets your address from before you have an account (Art. 6(1)(f): letting people invite each other). Ask the operator to remove it if you do not want it stored.

You only receive emails the service needs: links for your password and for confirming an address. There are no newsletters or advertising.

Verbvine stores what you put into it: documents and lessons, comments, answers to exercises, saved vocabulary, flashcard progress and uploaded images. The legal basis is again the agreement to provide the service (Art. 6(1)(b)).

A document is visible to everyone it is shared with. They see your name and picture, your comments, where you are in the document and the answers you type while practising. Do not put sensitive personal information into lessons or answers.

When you generate exercises, have an answer checked, look up a word, save vocabulary or use AI editing, the text involved (for example the lesson passage, your answer or the selected word) is sent to Anthropic, which returns the result. This happens only when you use such a feature.

The request and the AI’s answer are also recorded, with your account’s internal ID, to check quality, find errors and control costs (Art. 6(1)(f)).

Under the Swedish Electronic Communications Act (2022:482) the following are stored in your browser without asking, because the service you asked for needs them:

• better-auth.session_token (cookie, up to 90 days): keeps you signed in. On the live site its name starts with __Secure-.
• NEXT_LOCALE (cookie, one year): the language you chose with the EN / RU switch.
• theme (browser storage, until you clear it): light or dark theme.
• openPanels (browser storage, until you clear it): which side panels you left open.
• lp-signed-in (browser storage, until you sign out): whether to show the app or the sign-in form while the page loads.
• ww-analytics-consent (browser storage, until you clear it): your choice about analytics.

Only if you allow analytics, PostHog also stores:

• ph_…_posthog (cookie and browser storage, one year): a random ID for your browser and, once you are signed in, your account, so that visits can be told apart.
• further ph_… entries (browser storage and session storage): PostHog’s settings and the current visit.

Until you agree, none of the PostHog entries are set and nothing is sent from your browser to PostHog. If you withdraw your consent, they are deleted and one entry (__ph_opt_in_out_…) remains to remember the refusal. There are no advertising or social media cookies.

If you agree, PostHog records how the app is used in your browser:

• pages opened, clicks and other actions such as generating exercises or finishing a flashcard session
• heatmaps of where people click and scroll
• errors and loading times
• technical details such as browser, device, screen size and an approximate location (country and city) derived from your IP address. PostHog does not store the IP address itself.

The screen itself is not recorded: there are no session replays.

Once you are signed in, this is linked to your account (ID, name and email). The purpose is to find bugs and decide what to improve. The legal basis is your consent (Art. 6(1)(a)); you can withdraw it at any time at the bottom of this page, which also deletes the analytics data stored in your browser.

Whatever you choose, the server keeps technical logs of requests and errors, to keep the service running and secure (Art. 6(1)(f)).

The operator does not sell your data or use it for advertising. These providers process it on the operator’s behalf, each under a data processing agreement:

• Vercel Inc., USA: hosting of the website and storage of uploaded images. Receives all requests, including your IP address. The application runs in Frankfurt, Germany; uploaded images are stored in the United States (Washington, D.C.).
• Neon (Databricks, Inc.), USA: the database with accounts, documents, comments, vocabulary and flashcard progress. It is stored in Frankfurt, Germany.
• Resend, Inc., USA: sends the emails with password and confirmation links. Receives your email address and the content of those emails. Emails are sent from Ireland.
• Liveblocks, Inc., USA: live collaboration. Receives the content of a lesson while it is open, and the names of the people in it. Processed on Cloudflare’s network and stored in the United States.
• Anthropic (Anthropic Ireland, Limited, and Anthropic, PBC, USA): the AI features. Receives the text you use them with.
• PostHog, Inc., USA: analytics in the browser (only with your consent), error reports, server logs and records of AI requests. The data is stored in PostHog’s EU cloud in Frankfurt, Germany.

People you share a document with see its content and your name and picture, as described above.

Most of these providers are based in the United States or can access data from there. Such transfers rely on the safeguards the GDPR provides: the EU–U.S. Data Privacy Framework where the provider is certified, and otherwise the European Commission’s standard contractual clauses.

Your account and content are kept until you delete them or ask for your account to be removed. Documents you shared stay available to the people on them unless you delete them first. Sign-in sessions end after 90 days, emailed links after one hour. Analytics data and logs are deleted when the provider’s retention period ends, or earlier on request.

To have your account and data deleted, write to the operator.

You can ask the operator to:

• tell you which data about you is stored and give you a copy
• correct data that is wrong
• delete your data or restrict its use
• hand over the data you provided in a common format

You can object to processing that rests on legitimate interests and withdraw a consent at any time. Requests are free and answered within one month.

If you think your data is handled unlawfully, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, imy.se) or to the data protection authority where you live.

No decisions with legal or similarly significant effects are made about you by automated means, and no profiles are built. The AI only checks exercises and generates learning material.

Verbvine is not meant for children under 13. Anyone younger needs a guardian’s agreement to use it.

This policy is updated when the service changes. The date at the top shows the latest version; important changes are announced in the app or by email.