PRIVACY POLICY

1. Who we are

This Privacy Policy describes how Buk Up collects, uses, and protects your personal data. For any questions or to exercise your rights, contact us by writing to contact@bukup.app.

2. What data we collect

  • Account data: email address and password (the latter securely managed by Supabase Auth; we never see or store it in plain text).
  • Language preferences: your native language and the language(s) you are learning.
  • Content you generate: the words, translations, conjugations, and antonyms you save in your personal dictionary.
  • Practice data: completed repetitions, practice times, practice-mode preferences (mute/sound, default mode).
  • Technical error reports: when the app fails, a report with technical information about the failure is sent (error type, place in the code where it happened, page address without parameters, app version, environment, and basic details about your browser and operating system). It is designed not to include your email, your password, your cookies, or the content of your dictionary, and we apply automatic filters that hide email addresses, keys, and tokens; no filter is perfect, which is why we keep what is sent to a minimum.
  • Technical cookies: see section 6.

We do not collect sensitive data (health, biometric, ethnic origin, beliefs, etc.) or payment data directly — if we activate payments in the future, these will be processed by a third-party provider (Stripe) under its own privacy policy.

3. What we use your data for

  • To create and manage your account, and give you access to the service.
  • To save your personal dictionary and practice progress.
  • To validate your translations through the AI corroborator.
  • To improve the service (for example, by identifying common errors or frequent words).
  • To communicate with you about important changes to the service, these terms, or this policy.
  • To detect and fix technical failures of the service through error reports.

Shared validation cache: when the AI corroborator validates a word, that validation (the word-translation pair, with no data that identifies you) may be stored in a shared cache so that if another user looks up the same word, it isn't necessary to query the AI model again. This reduces costs and wait times, and does not link the word to your account or identity.

4. Legal basis for processing

We process your data under three legal bases, depending on the case:

  • Contract performance: data necessary to provide the service (account, dictionary, practice) is processed because it is essential to deliver what we offer you upon registration.
  • Consent: any additional use, such as optional analytics or non-essential communications, is based on your consent, which you may withdraw at any time.
  • Legitimate interest: monitoring technical errors to keep the service secure and working properly is based on our legitimate interest, which we balance against your rights by sending only minimal technical information. You may object to this processing by contacting us.

5. Who we share your data with

We do not sell your personal data. We share data only with providers that help us operate the service, under their own data protection agreements:

  • Supabase: hosts our database, manages authentication, and stores your account, dictionary, and preferences.
  • Anthropic (Claude API): receives the words and translations you submit to the corroborator for validation. This is necessary for the app's core function to work. Anthropic processes this data under its own privacy policy.
  • Vercel: hosts the web application and manages its deployment infrastructure.
  • Sentry: receives the app's technical error reports (see section 2) so we can detect and fix failures. Reports are sent through a channel run by Buk Up itself (your browser does not communicate with Sentry directly) and are stored on servers in the European Union.

All of these providers are subject to data protection obligations compatible with the GDPR.

6. Cookies we use

We use technical cookies necessary for the service to function, not for advertising or third-party tracking:

  • Session cookie: keeps you logged in.
  • idioma_sistema: remembers the language you want the Buk Up interface displayed in.

You can block cookies from your browser settings, though this may affect how the service works.

7. How long we keep your data

We keep your data while your account is active. If you cancel your account, we delete your personal data and dictionary within a reasonable timeframe, unless the law requires us to retain some record (for example, for tax purposes). Technical error reports (Sentry) are kept only for a limited period and then deleted automatically.

8. Your rights (GDPR)

As a user in the European Union (or depending on your location), you have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate or incomplete data.
  • Request deletion of your data ("right to be forgotten").
  • Request portability of your data in a structured format.
  • Object to the processing of your data in certain cases.
  • Withdraw your consent at any time, when processing is based on it.

To exercise any of these rights, contact us from the app. We will respond within a reasonable timeframe and as required by applicable law. You also have the right to file a complaint with your country's data protection authority (in the Czech Republic: the Úřad pro ochranu osobních údajů).

9. Data security

We apply technical measures such as Row Level Security (RLS) in our database, authentication token verification, and good password-handling practices (managed by Supabase Auth) to protect your information. No system is 100% foolproof, but we take security seriously from the service's design onward.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make significant changes, we will notify you by email or through a visible notice in the app before they take effect.