PRIVACY POLICY

Last updated: [date]

1. Who we are

This Privacy Policy describes how Buk Up, operated by [your full name] (živnostník/OSVČ, Czech Republic), collects, uses, and protects your personal data. For any questions or to exercise your rights, contact us from the app.

2. What data we collect

• Account data: email address and password (the latter securely managed by Supabase Auth; we never see or store it in plain text).
• Language preferences: your native language and the language(s) you are learning.
• Content you generate: the words, translations, conjugations, and antonyms you save in your personal dictionary.
• Practice data: completed repetitions, practice times, practice-mode preferences (mute/sound, default mode).
• Technical cookies: see section 6.

We do not collect sensitive data (health, biometric, ethnic origin, beliefs, etc.) or payment data directly — if we activate payments in the future, these will be processed by a third-party provider (Stripe) under its own privacy policy.

3. What we use your data for

• To create and manage your account, and give you access to the service.
• To save your personal dictionary and practice progress.
• To validate your translations through the AI corroborator.
• To improve the service (for example, by identifying common errors or frequent words).
• To communicate with you about important changes to the service, these terms, or this policy.

Shared validation cache: when the AI corroborator validates a word, that validation (the word-translation pair, with no data that identifies you) may be stored in a shared cache so that if another user looks up the same word, it isn't necessary to query the AI model again. This reduces costs and wait times, and does not link the word to your account or identity.

4. Legal basis for processing

We process your data under two legal bases, depending on the case:

• Contract performance: data necessary to provide the service (account, dictionary, practice) is processed because it is essential to deliver what we offer you upon registration.
• Consent: any additional use, such as optional analytics or non-essential communications, is based on your consent, which you may withdraw at any time.

5. Who we share your data with

We do not sell your personal data. We share data only with providers that help us operate the service, under their own data protection agreements:

• Supabase: hosts our database, manages authentication, and stores your account, dictionary, and preferences.
• Anthropic (Claude API): receives the words and translations you submit to the corroborator for validation. This is necessary for the app's core function to work. Anthropic processes this data under its own privacy policy.
• Vercel: hosts the web application and manages its deployment infrastructure.

All of these providers are subject to data protection obligations compatible with the GDPR.

6. Cookies we use

We use technical cookies necessary for the service to function, not for advertising or third-party tracking:

• Session cookie: keeps you logged in.
• idioma_sistema: remembers the language you want the Buk Up interface displayed in.
• ya_se_registro: remembers whether you've already completed registration, to adjust what you see on the landing page.

You can block cookies from your browser settings, though this may affect how the service works.

7. How long we keep your data

We keep your data while your account is active. If you cancel your account, we delete your personal data and dictionary within a reasonable timeframe, unless the law requires us to retain some record (for example, for tax purposes).

8. Your rights (GDPR)

As a user in the European Union (or depending on your location), you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Request deletion of your data ("right to be forgotten").
• Request portability of your data in a structured format.
• Object to the processing of your data in certain cases.
• Withdraw your consent at any time, when processing is based on it.

To exercise any of these rights, contact us from the app. We will respond within a reasonable timeframe and as required by applicable law. You also have the right to file a complaint with your country's data protection authority (in the Czech Republic: the Úřad pro ochranu osobních údajů).

9. Data security

We apply technical measures such as Row Level Security (RLS) in our database, authentication token verification, and good password-handling practices (managed by Supabase Auth) to protect your information. No system is 100% foolproof, but we take security seriously from the service's design onward.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make significant changes, we will notify you by email or through a visible notice in the app before they take effect.