Last updated: 6 October 2026
This policy explains what personal data Aravoca collects, why, and what you can do about it. It covers the website at aravoca.com, the web app at app.aravoca.com, and the Aravoca apps for iOS and Android (together, the "Service").
The short version: we collect only what we need to run your account and remember your learning progress. We do not sell your personal data, we do not show advertising, and we do not track you across other companies' apps or websites.
Aravoca is operated by App Bamboo Ltd, a company registered in the United Kingdom (company number 17481725, registered office 82a James Carter Road, Mildenhall, United Kingdom, IP28 7DE) ("Aravoca", "we", "us"). We are the data controller for the personal data described in this policy. You can reach us about anything in this policy at contact@appbamboo.com or through the contact page.
Account data. When you create an account we receive your email address and, if you provide one or sign in with Google or Apple, your display name and profile picture. Sign-in is handled by Firebase Authentication (a Google service). If you sign up with a password, it is stored by Firebase in hashed form — we never see or store your password. If you use Sign in with Apple and choose to hide your email, we receive Apple's private relay address instead.
Learning data. We store what is needed to run your course: which words you have studied and how you rated them, review scheduling, your daily goal, daily activity, streak, study time, and how many words you learned each week.
Leaderboard. The weekly leaderboard shows your display name, profile picture and the number of words you learned that week to other signed-in learners. You can hide yourself from the leaderboard at any time in Profile → Privacy.
Guest use. If you try Aravoca without an account, your progress is kept on your device, and we use a randomly generated identifier so that the Service works and so that your progress can be moved into your account if you later sign up.
Usage events. We record a small, fixed set of product events — for example that an account was created, a word was learned, the free limit was reached, or an upgrade screen was viewed — together with the platform (web, iOS or Android) and your account or guest identifier. We use these only to understand how the Service is used and to improve it. We do not use third-party analytics or advertising SDKs.
Purchase data. If you buy a paid plan we store your plan, its status, renewal and expiry dates, the amount and currency, and the transaction identifiers we receive from the payment provider. Payments are processed by Apple (App Store), Google (Google Play) or Stripe (web). We never receive or store your full card number or other payment credentials.
Technical data. When you use the Service, our hosting provider processes your IP address, browser or device type and request details in order to deliver the Service, keep it secure and prevent abuse.
Messages you send us. If you use the contact form or email us, we receive your name, email address and whatever you write.
Data stored on your device. The apps and website store a small amount of data locally (for example your sign-in session, colour theme, voice choice and reading preferences) so that the Service works as you expect. The website does not use advertising or cross-site tracking cookies.
We do not ask for and do not want special-category data (such as health, religious belief or ethnic origin), and the Service does not request access to your contacts, photos, microphone, camera or precise location.
We do not use your data for automated decision-making that has legal or similarly significant effects on you, and we do not send marketing emails unless you have asked to receive them.
We do not sell or rent your personal data. We share it only with the service providers that help us run Aravoca, each of which processes it on our instructions or as an independent provider of its own service:
We may also disclose data where we are required to by law, where it is necessary to establish, exercise or defend legal claims, or as part of a sale or reorganisation of the business — in which case the recipient will remain bound by this policy in respect of your data.
Our providers operate globally, so your data may be processed outside the country you live in, including in the United States. Where data is transferred out of the UK or the European Economic Area, we rely on recognised safeguards such as adequacy decisions, the UK–US Data Bridge / EU–US Data Privacy Framework, or standard contractual clauses put in place by our providers.
You can ask us to delete your account and the personal data associated with it at any time by emailing contact@appbamboo.com or sending a request through the contact page, from or quoting the email address on your account. We will confirm the request and complete the deletion within 30 days, except for records we are legally required to keep (see section 6).
Deleting your account does not cancel a subscription bought through Apple or Google — please cancel that in your App Store or Google Play subscription settings first.
Depending on where you live (including under UK GDPR and EU GDPR), you have the right to:
To exercise any of these rights, contact us through the contact page. We may need to verify your identity before acting, and we will respond within one month. You also have the right to complain to your data protection authority — in the UK, the Information Commissioner's Office (ico.org.uk) — though we would appreciate the chance to put things right first.
California and other US state residents: we do not sell personal information and do not share it for cross-context behavioural advertising. You may exercise rights to know, correct and delete in the same way as above, and we will not discriminate against you for doing so.
Aravoca is a learning tool that can be used by learners of all ages. If you are under 18, please use Aravoca with the permission of a parent or guardian. Where the law requires a parent or guardian to consent to a child's personal data being processed (for example under 13 in the UK and the United States, and up to 16 in some European countries), the account should be created and managed by the parent or guardian. We collect no more data from younger learners than from anyone else, and we never show them advertising. A parent or guardian can ask us to show, correct or delete a child's data at any time through the contact page.
We protect your data with measures appropriate to its sensitivity, including encryption in transit, authenticated access to every account's data, and restricted administrative access. No online service can be guaranteed to be completely secure, so we cannot promise absolute security; if a breach affecting your data occurs, we will notify you and the relevant authorities as the law requires.
The Service may link to websites and services we do not operate. Their privacy practices are their own, and this policy does not cover them.
We may update this policy from time to time. The "last updated" date at the top shows when it last changed. If we make a material change, we will tell you in the app or by email before it takes effect.
Questions, requests or complaints about privacy: App Bamboo Ltd, 82a James Carter Road, Mildenhall, United Kingdom, IP28 7DE — email contact@appbamboo.com or use the contact page.