What we keep, and what we don't.

sabaisabai is operated by Castagna Labs (Romain Castagna). It is a personal project, free to use, not affiliated with any educational institution.

We're the data controller for everything below. If you have a question or want to exercise your rights, contact admin@learnsabaisabai.com.

When you sign up:

• · Your email address (used as the sign-in identifier)
• · Your display name (whatever you typed, or the part of your email before the @)
• · The date the account was created
• · If you signed in with Google: your Google account's public profile (display name + email) is shared with us by Google. We don't request any other Google scopes.

As you use the app:

• · Your XP, level, day-streak and per-item correct/wrong counts
• · Any vocabulary or stories you add yourself
• · Your theme preference (pink / blue)

If you join the newsletter:

• · Your email address and the date you opted in
• · The page or app surface where you joined, so we understand which signup form worked

That's the complete list. We do not collect your location, your device fingerprint, your IP for tracking, or anything you do on other sites. The app has no analytics, ads, A/B testing or cross-site trackers.

Account email + profile sit in Firebase Authentication; your XP/streaks/saved-vocab sit in Cloud Firestore. Both are Google products operated within our Firebase environment, with data hosted on Google's European infrastructure.

Firebase's own privacy practices are documented at firebase.google.com/support/privacy.

The web app is hosted on Heroku (Salesforce); the Android app uses the same account and database services. We do not publish internal project identifiers, credentials or security configuration in this policy.

We do not use advertising or tracking cookies. The persistent storage we set is:

• sabaisabai-theme (cookie + localStorage): your chosen theme color, set only after you click "Allow cookies".
• sabaisabai-cookie-consent (localStorage): remembers your choice on the cookie banner.
• Firebase Authentication sets strictly necessary cookies and IndexedDB entries to keep you signed in. These cannot be disabled — without them, you can't have an account.

You can manage the consent state any time on the cookie-consent page.

Your data is private to your account. The only people who can read it are:

• · You, when you sign in.
• · The app maintainer, only when investigating a bug you specifically reported. We do not browse user data otherwise.
• · The app maintainer receives a new-account notification when someone signs up. It includes the account email, display name, Firebase user ID, provider and signup time.
• · Firebase / Google as the processor running the database infrastructure (under their Data Processing Addendum).
• · OpenAI, but only when you explicitly tap "AI fill" on a vocab entry, and only for the snippet you typed. Details in section 6.

We do not sell, rent, share or trade your data with any third party. If you explicitly join the newsletter, we keep that email only for sabaisabai updates and learner notes. We have no ad network, no third-party marketing partners and no rented lists.

On the vocab page, signed-in users can tap "AI fill" when adding a word to have the rest of the entry suggested. This is the only feature that sends user-typed content to a third-party AI provider.

What gets sent:

• · The partial vocab entry you typed (Thai, English, romanization, optional category and example). Nothing else — no profile, no XP, no other saved vocab.

Where it goes:

• · Your browser sends the snippet to our authenticated backend, which verifies that you are signed in before processing the request.
• · Our backend forwards the snippet over HTTPS to OpenAI using the OpenAI API and returns the completed entry to your browser.
• · You decide whether to save the result. Saving writes to your own Firestore vocab collection; nothing is saved automatically.

OpenAI is the sub-processor for this feature only. Their handling is governed by openai.com/policies and the OpenAI API data-usage terms (see openai.com/enterprise-privacy); API inputs are not used to train OpenAI models by default.

To prevent abuse we store a small daily AI-usage counter for your account, reset each UTC day. There is a per-user daily cap; admins may be exempt for maintenance and testing.

On /vocab → Import, you can drop an .xlsx or .csv file to bulk-add vocabulary. The file is parsed entirely in your browser — it never reaches our server. Only the rows you confirm get written, via Firestore, to your own vocab collection.

You own your account. Email admin@learnsabaisabai.com with the address you signed up with and we'll delete your account, your XP/streaks, your saved vocab and your stories within 7 days. No questions, no recovery — once gone, it's gone.

For the in-app "I want to start fresh but keep my account" case, we'll surface a self-serve reset in a later release.

sabaisabai is open to learners worldwide. Your data is stored on Google Cloud's European infrastructure. By using the app you consent to your data being processed in the EU regardless of where you live.

If we materially change what data we collect or who can see it, we'll update the date at the top of this page and notify signed-in users on next launch. Minor wording / typo fixes won't trigger a notice.

For anything privacy-related — questions, deletion, complaint — write to admin@learnsabaisabai.com.