Short version: without an account your words and settings stay in your browser; only the word to be translated leaves it. Sign in and your vocabulary (including the subtitle sentences it came from), your exercise answers and your usage events sync to our database, and the AI features send the relevant parts to Google's Gemini API. Nothing is sold, and you can have all of it deleted.
1. Who is responsible
The controller, under Art. 4(7) GDPR and under Turkey's Personal Data Protection Law No. 6698 (KVKK), is Murathan Bakti.
- Email: contact@wordmi.com
- Place of establishment: Türkiye
2. What the extension does, and where
The extension runs on netflix.com and www.youtube.com, and nowhere else. It reads the subtitle tracks the platform provides for the title or video you are playing, shows two of them at once, and makes the words in the upper line clickable. On YouTube it requests that video's subtitles from YouTube's own subtitle service, the same way the player does, including YouTube's automatic translation when the video has no subtitles in your language. It does not read your Netflix or Google credentials, your payment details, your viewing history, or any other site you visit. It does not download video or audio, and it does not save subtitle files to your device.
3. Using it without an account
An account is optional. Without one, nothing is stored on our servers. Your chosen languages, your appearance settings, the words you save, the sentences they came from and your review schedule all live in your browser's local storage. Exercise answers and usage events that have not been sent yet wait in the same place.
One exception: showing you what a word means requires sending that word to a translation service; if you have switched on direct translation mode, the subtitle line currently on screen goes too. That happens whether or not you are signed in (see section 6).
The first time you sign in, the words stored in that browser and the pending records (at most 500 usage events and 2,000 exercise answers) are uploaded to the account you signed in to.
4. What we process once you sign in, and on what legal basis
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Email address | To identify the account and send sign-in codes | Performance of a contract (Art. 6(1)(b) GDPR · KVKK Art. 5/2-c) | Until you delete the account |
| Password, stored only as a salted hash | To authenticate you. At sign-in it passes through our server function to be checked; the plaintext is not stored anywhere | Performance of a contract (Art. 6(1)(b) GDPR · KVKK Art. 5/2-c) | Until you delete the account |
| Phone number: required when you sign up with email and password; not asked for when you sign in with Google | Kept to recover your account. Verification codes go to your email, not to this number; no SMS is sent to it and it is never called | Legitimate interests (Art. 6(1)(f) GDPR · KVKK Art. 5/2-f) | Until you delete the account |
| Display name and profile picture | To identify you in the app; your display name also appears on the leaderboard. Both are supplied by Google if you sign in with Google; you can also upload a picture yourself | Performance of a contract (Art. 6(1)(b) GDPR · KVKK Art. 5/2-c) | Until you delete the account |
| Profile details: your native language, the language you are learning, your level, your daily goal, your reason for learning and your interests | To tailor the exercises and the AI answers to you | Performance of a contract (Art. 6(1)(b) GDPR · KVKK Art. 5/2-c) | Until you delete the account |
| Saved words: the word, its translation, the language pair, the subtitle sentence it appeared in, the name and id of the title or video you were watching and the position in it | This is the product: it is what you study from, and the sentence is what makes the word memorable | Performance of a contract (Art. 6(1)(b) GDPR · KVKK Art. 5/2-c) | Until you delete the word or the account |
| Spaced-repetition state: repetitions, interval, ease, next due date, lapses and your full answer history | To decide when to show each word again | Performance of a contract (Art. 6(1)(b) GDPR · KVKK Art. 5/2-c) | Until you delete the word or the account |
| Exercise attempts: the exercise type, the question, the answer you typed or picked, whether it was correct, your response time, how many hints and backspaces you used, whether you left the tab while the question was open; for speaking questions, the text your browser recognised (not an audio recording) | To score your progress, adapt the difficulty and let the AI coach see where you struggle | Performance of a contract (Art. 6(1)(b) GDPR · KVKK Art. 5/2-c) | Until you delete the account |
| Usage events: saving and removing words, the start and end of a study session, reaching your daily goal, level changes, the words you hovered but did not save and how many times (with the name and id of the title), the sentences you asked to have explained, clicks on the scene link and the upgrade button, the extension version | So the AI coach and the reports can get to know you; to see how the product is used and to spot sync errors | Legitimate interests (Art. 6(1)(f) GDPR · KVKK Art. 5/2-f) | Until you delete the account |
| Your conversations with the AI coach | So a conversation can continue where it left off | Performance of a contract (Art. 6(1)(b) GDPR · KVKK Art. 5/2-c) | Until you delete the thread or the account |
| What the AI produces for you: practice sets and reports | So you can reopen past reports, and to count your daily allowance | Performance of a contract (Art. 6(1)(b) GDPR · KVKK Art. 5/2-c) | Until you delete the account |
| Score and usage counters: your leaderboard score, your game level, the name of your plan, your daily and weekly AI usage counters | To build the leaderboard and enforce the usage limits of the AI features | Performance of a contract (Art. 6(1)(b) GDPR · KVKK Art. 5/2-c) | Until you delete the account |
| Verification codes and the trusted-device record: a hash of the 6-digit code emailed to you; a hash of the token that remembers this browser, your browser's description (user agent) and when it was last used | To protect email-and-password sign-in with a second step, and not to ask for a code again in the same browser for 30 days | Legitimate interests (Art. 6(1)(f) GDPR · KVKK Art. 5/2-f) | A code is valid for 10 minutes, a device token for 30 days; the records themselves stay until you delete the account |
| Rate-limiting counters: the number of attempts per email address, per account id and per IP address the request came from | To limit password attempts and code sending against brute force, and to count the daily chat allowance | Legitimate interests (Art. 6(1)(f) GDPR · KVKK Art. 5/2-f) | Counting windows run from 15 minutes to 24 hours. Counters older than a day are deleted automatically; a counter that hit its limit stays until the same key is used again |
There is no advertising and no third-party analytics or tracking SDK in the extension. The usage events above are written only to our own database. We do not profile you for marketing and we do not build an advertising identity for you.
5. The AI features
The coach chat, the practice sets, the sentence explanations, the meaning of a word in its sentence, the reports and the AI subtitle translation are produced by Google's Gemini API. To answer, we send only the part of your data the answer needs: the words in question and the sentences they came from, a summary of your exercise answers and usage events, your profile (display name, level, goal, reason for learning, interests), and the message you typed. For subtitle translation, the video's subtitle text and its name are sent. Your email address and phone number are not sent.
Google acts as our processor for this. Under the paid Gemini API terms, the content we send is not used to train Google's models. Your saved words are also turned into numerical vectors (embeddings) by the same API so that related words can be found.
Listening and speaking questions
The sentence in listening and speaking questions is read aloud by Google Cloud Text-to-Speech. That service receives only the text of the sentence and its language; your account id is not sent. The audio file it produces is kept in a shared, publicly readable cache so the same sentence is not generated twice; the cache record carries no account id. To enforce the usage limit, a daily character count is kept per account. If the service cannot be reached, your browser's own voice reads the sentence.
A speaking question uses your microphone only when you press the microphone button, and only after your browser's permission prompt. The speech is turned into text by your browser's own speech recognition (the Web Speech API): the audio never reaches the extension or our servers, and we do not store it. In Chrome that recognition is server-based: the audio goes to Google's speech service to be recognised. We receive only the recognised text, which is stored with your attempt.
6. Translation
When you hover or click a word, that word and the language pair go to Google Translate, and to MyMemory (Translated s.r.l.) if the first request fails. The sentence around the word is not sent to these services. When direct translation mode is on and the AI translation is not available (for example because you are not signed in), the subtitle line currently on screen is translated the same way. These requests do not carry your account identifier. MyMemory may retain submitted text in its public translation memory, so avoid clicking through anything sensitive.
If you are signed in, resting on a word for a moment sends that word together with the subtitle sentence it appears in to our server, and from there to Gemini, to find what it means in that sentence. The “Explain sentence” button sends the sentence the same way.
Three AI results (the translation of a whole subtitle track, the meaning of a word in its sentence, and a sentence explanation) are kept in a shared cache on our server so the same content is not generated again for the next person. The cache holds the translated lines and the id of the title for a subtitle translation, the word and the sentence for a word meaning, the sentence for a sentence explanation, and in all three a fingerprint of the content, the AI's answer and the id of the account that first requested it. The account id is kept to count the daily usage limit. The cache returns only the translation or explanation to other users; who requested it is not shown to any user.
7. The leaderboard is public to other users
If you are signed in, your display name, language level, game level and score are visible to other signed-in Wordmi users. You enter the board once you have answered at least 20 questions in the ranked test. Your email address, your phone number, your saved words and your chat history are never shown there.
A profile picture you upload is not shown on the leaderboard, but it sits in publicly readable storage: anyone who knows its address can open it, and that address contains your account id.
We do this on the basis of our legitimate interest in making practice motivating (Art. 6(1)(f) GDPR). You have the right to object under Art. 21 GDPR: write to contact@wordmi.com and we will take you off it without otherwise limiting your account.
8. Who we share it with
We do not sell your data, we do not share it with advertisers or data brokers, and we never use it to assess creditworthiness or for lending. We do not use it for any purpose unrelated to teaching you a language. The only third parties involved are the providers that make the product work; they act as processors under Art. 28 GDPR.
| Recipient | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, authentication, file storage (profile picture, text-to-speech audio) and the server functions behind the AI features | US-based; data sits on AWS infrastructure in the project's configured region |
| Google LLC (Gemini API) | The coach, practice sets, explanations, word meanings, reports, subtitle translation and embeddings | US-based; global infrastructure |
| Google LLC (Cloud Text-to-Speech) | Reading aloud the sentence in listening and speaking questions (only the sentence text and its language) | US-based; global infrastructure |
| Google LLC (Google Translate) | Single-word translation; in direct translation mode, the subtitle line on screen | US-based; global infrastructure |
| Translated s.r.l. (MyMemory) | Fallback translation when the request above fails | Italy (EU) |
| Google LLC (Sign in with Google) | Only if you choose this route: Google authenticates you; your name, email address and profile picture come from Google | US-based; global infrastructure |
| Our email provider | Delivering sign-in and two-factor codes | Per the provider's own infrastructure |
Beyond that we disclose data only where legally compelled (a court order or an explicit statutory requirement).
9. International transfers
Because these providers operate globally, your data may be processed outside Türkiye and outside the EEA, including in the United States. Transfers to our US-based processors rest on the European Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR, incorporated into those providers' data processing terms. For KVKK purposes, transfers abroad rest on your explicit consent under Art. 9 KVKK where no other ground applies.
10. Retention and deletion
Your account and everything tied to it stay until you delete them. The extension has no button that deletes the account by itself; to delete it, write to contact@wordmi.com. Once your account is deleted, your words, review history, exercise attempts, usage events, chat threads, profile details, profile picture, phone number and email address are removed within 30 days. Backups roll off on their own schedule shortly after.
The translations, meanings and explanations in the shared cache also serve other users, so they stay in the cache. Data held only in your browser is removed when you uninstall the extension or clear its storage.
11. Your rights
Under the GDPR (Art. 15–22) and the KVKK (Art. 11) you have the right to know what we hold, to get a copy, to correct it, to have it erased, to restrict or object to processing, to portability, and to withdraw any consent at any time without that affecting what was lawful before.
You can export your words as JSON from the study page yourself, at any time, without asking us. For anything else, write to contact@wordmi.com. We answer within 30 days (KVKK: 30 days; GDPR: one month, extendable by two where a request is complex), and we do it free of charge.
12. Complaining to a regulator
If you think we have handled your data badly, tell us first; we would rather fix it. You can also complain to Türkiye's Kişisel Verileri Koruma Kurumu (KVKK) or, if you are in the EEA, to the supervisory authority where you live or work.
13. How we protect it
Traffic runs over HTTPS. Passwords are stored only as salted hashes by our authentication provider. Every table carries row level security, so an account can read only its own rows. Sign-in and code sending are rate limited against brute force. When you sign in with email and password from a browser we do not recognise, a second step is required: a code sent to your email.
No system is perfectly secure. If a breach is likely to put your rights at risk we will notify the supervisory authority within 72 hours as Art. 33 GDPR requires, and tell you directly where Art. 34 requires it.
14. Children
The extension is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has created an account, write to contact@wordmi.com and we will delete it.
15. Automated decisions
The AI features generate suggestions and explanations, and the review algorithm decides when to show you a word again. Neither produces a legal or similarly significant effect on you, so this is not automated decision-making within the meaning of Art. 22 GDPR.
16. Changes
If this policy changes in a way that affects what we collect or who receives it, we will update the date at the top and tell account holders by email before the change takes effect.
17. Contact
Data protection questions, access requests and deletion requests: contact@wordmi.com.