Who is responsible
Sipword is made and run by Nikita Kočkur, an independent developer in the Czech Republic, who is the controller of your personal data. Write to support@sipword.com about anything on this page — including requests to see, correct or delete your data.
This policy covers the Sipword browser extension (Chrome, Edge, Firefox and other browsers), the Sipword mobile app, the website sipword.com, and the server they all talk to.
What we store, and why
The words you save
When you save a word, Sipword keeps: the word and its language; the sentence around it on the page; the address and title of the page; and whatever you add yourself — a definition, a transcription, a note, tags, a list. It also keeps when each of these was last changed, your learning status for the word, and its review schedule. This is the product: without it there is nothing to review.
Sipword never reads pages on its own. The extension looks at a page only when you select or double-click a word, and it sends nothing anywhere until you press Save. It does not record your browsing history.
Dictionary lookups in the app
When you type a word into the mobile app to add it, the app asks Wiktionary (run by the Wikimedia Foundation) for a short definition, so it can fill one in for you. Only the word itself is sent — nothing about your account — and, as with any website, Wikimedia's servers see your IP address. Wikimedia handles that under its own privacy policy. The browser extension does not do this.
An account, even before you sign up
Your words are stored on your device first. So they also reach your other devices and survive a lost browser, the first save creates an anonymous account on our server: a random identifier and a device key, nothing about you. Your words are then copied to the server under that identifier.
If you create an account, we add your email address and a hash of your password (Argon2id — the password itself is never stored and cannot be read back). Each signed-in device holds its own key; on the server we keep only a SHA-256 hash of it.
Password reset
If you ask for a reset code, we email you a 6-digit code. We store only a hash of it; it expires after 15 minutes. Emails are sent through Amazon Simple Email Service.
Server logs and abuse protection
Like any web server, ours sees your IP address. We use it to limit how often accounts can be created, signed into or sent reset codes, to stop automated abuse. Those counters live only in memory. The web server's access logs, which contain IP addresses, are kept for up to 14 days for security and troubleshooting, then deleted.
The website
sipword.com uses no analytics, no advertising and no tracking cookies. Fonts are served from sipword.com itself, not from Google. If you sign in on the account page, your session key is kept in your browser's local storage so you stay signed in; signing out removes it.
Legal basis
- Providing the service you asked for (GDPR Art. 6(1)(b)) — storing and syncing your words, your account, password reset.
- Legitimate interest (Art. 6(1)(f)) — keeping the service secure: rate limits and short-lived server logs.
Where it is kept, and who else touches it
The server and its database run on Amazon Web Services in the EU (Frankfurt) region. Data is encrypted in transit (HTTPS). Our only provider is Amazon Web Services — server, database, sending email (SES) and hosting sipword.com — under its GDPR data processing addendum. The one other service the app talks to is Wiktionary, for definitions, as described above; it receives the word you type and nothing else from us.
Amazon is a US company. Where any data could be reached from outside the EU, the transfer is covered by the EU–US Data Privacy Framework and the European Commission's standard contractual clauses. We do not sell personal data, and we do not share it with anyone for advertising or for training AI models.
How long we keep it
- Words and your account — for as long as you use Sipword, until you delete them or ask us to delete your account.
- Deleted words — a deletion marker stays for 90 days so your other devices learn about it; then it is removed for good.
- Anonymous accounts — deleted automatically, with all their words, after 90 days without any sync. Create an account if you want to keep them longer.
- Reset codes — 15 minutes.
- Server access logs — up to 14 days.
Your rights
Under the GDPR you can:
- get a copy of your data — the extension exports your whole library as JSON (Settings → Export), and the account page lists the words stored on the server; for everything else we hold about you, write to us;
- correct it — edit any word, or change your password;
- delete it — delete words one by one in the extension or the app, or delete your whole account: write to support@sipword.com from your account email and we will delete your account and everything in it within 30 days;
- object to processing based on legitimate interest, or restrict it;
- take it elsewhere — the export is plain JSON.
Signing out of the extension removes the words cached in that browser; they stay in your account. If you think we handle your data wrongly, you can complain to the Czech data protection authority, Úřad pro ochranu osobních údajů, or to the authority where you live.
Browser extension specifics
The extension asks to run on all pages so the double-click card can appear wherever you read, including inside frames. It reads only the selected word and the sentence around it, and only when you act. Its connection to the server goes to api.sipword.com and nowhere else.
Sipword's use of information received through browser extension APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements: the data is used only to provide Sipword's features, is not transferred to third parties except as described above, is not used for advertising, and is not read by humans unless you ask us to, it is needed for security, or the law requires it.
Mobile app specifics
The app keeps your words in a database on the phone and syncs them with the same server as the extension. Its sign-in key is kept in the phone's secure storage (Keychain on iOS, Keystore on Android). Your learning progress — daily goal, streak — and your settings stay on the phone and are not sent anywhere. The app contains no analytics, advertising or tracking SDKs, its fonts are built in rather than downloaded, and the only permission it asks for is internet access. In the app, Account → Delete account leads to how to delete your account.
Children
Sipword is not intended for children under 15. If you believe a child has given us personal data, write to us and we will delete it.
Changes
When this policy changes, the date at the top changes too. If a change affects data you have already given us, we will tell registered users by email before it takes effect.