This Privacy Policy applies to recabulary.app and any associated backend services I operate ("Recabulary"). It does not apply to third-party services that you reach through links or that Recabulary relies on (see "Third-Party Processors" below) — those services have their own policies.
For the purposes of data-protection laws that use the term, the controller of personal data processed in connection with Recabulary is me, the individual operator named in the contact section. I am acting in a personal capacity, not on behalf of any employer or organisation.
Authentication is handled by Auth0. When you log in, Auth0 (and the upstream identity provider you choose, e.g. Google) returns to Recabulary the following profile information about you:
Auth0 itself collects and stores additional information directly under its own privacy policy; please see auth0.com/privacy.
As you use the app, the following data is created and stored against your account in the Recabulary backend:
The hosting and edge providers I use (Microsoft Azure Static Web Apps for the website, Azure cloud functions and Cosmos database for the backend) automatically log standard request information when you use the site. This typically includes IP address, user-agent string, request paths, response status, and timestamps. I use these logs only to operate, secure, and debug the service.
Recabulary stores small pieces of data in your browser's local storage:
recabulary:pending_starter_pack — a short-lived value used to remember which profile pack you selected before sign-in. It is removed once your starter pack is imported.@@auth0spajs@@) holding your authentication tokens. These are required to keep you signed in across page refreshes and are managed by the Auth0 SDK.I do not currently use cookies or local storage for analytics, advertising, or third-party tracking.
| Purpose | Legal basis (where GDPR / similar applies) |
|---|---|
| Letting you sign in and recognising your account on return visits | Performance of your request to use the service / legitimate interest in operating it |
| Storing the words, bookmarks, and starter-pack data so you can recall them later | Performance of your request to use the service |
| Keeping the site available, secure, and free of abuse (server logs) | Legitimate interest in operating a working, reasonably secure service |
| Responding to questions or data-rights requests you send me | Legitimate interest / legal obligation |
I rely on the following third-party services to operate Recabulary. Each receives only the data it needs and is bound by its own privacy terms:
These providers operate in a number of countries. By using Recabulary, you understand that your data may be processed and stored in jurisdictions outside your own, including the United States, the European Economic Area, India, and other regions where the providers operate.
recabulary:pending_starter_pack).Depending on where you live, you may have the right to:
To make any of these requests, email me at the address below. I'll respond within a reasonable time and free of charge for normal requests. I may need to verify your identity before acting (typically by confirming you can access the email address linked to your account).
I take reasonable steps to protect your data — authentication is delegated to Auth0, traffic uses HTTPS, and the backend is reachable only with a valid token. However, no internet service is fully secure, and I cannot guarantee absolute security. If I become aware of a breach affecting your data, I will take reasonable steps to address it and inform affected users where the law or the circumstances require.
Recabulary is not directed at children under 13 (or the local minimum digital-consent age, whichever is higher). If you believe a child has provided personal data through Recabulary, please contact me and I will delete it.
Recabulary itself does not set cookies for advertising, analytics, or tracking. The Auth0 SDK and the upstream identity provider you choose may set cookies as part of the sign-in process; these are necessary for authentication. The hosting providers may set technical cookies for load balancing or security.
I may update this Privacy Policy from time to time. The "Effective date" at the top of this page reflects the most recent version. Material changes will be reflected here; please check this page when you return.
For privacy questions, data-access or deletion requests, or any other concern, email me at:
AMARJIT JHA
Email: [email protected]