Extension Privacy Policy
Last updated: 30 July 2026
Short version: without an account the extension keeps everything in your browser. Sign in and your vocabulary — including the subtitle sentences it came from — syncs to our database, and the AI features send the relevant parts to Google's Gemini API. Nothing is sold, and you can delete all of it.
1. Who is responsible
The controller — under Art. 4(7) GDPR and under Turkey's Personal Data Protection Law No. 6698 (KVKK) — is Murathan Bakti.
- Email: contact@wordmi.com
- Place of establishment: Türkiye
2. What the extension does, and where
The extension runs on netflix.com and nowhere else. It reads the subtitle tracks Netflix has already loaded for the title you are playing, shows two of them at once, and makes the words in the upper line clickable. It does not read your Netflix credentials, your payment details, your viewing history, or any other site you visit. It does not download video, audio or subtitle files.
3. Using it without an account
An account is optional. Without one, nothing is stored on our servers. Your chosen languages, your appearance settings, the words you save, the sentences they came from and your review schedule all live in your browser's local storage.
One exception: showing you what a word means requires sending that word, and the sentence around it, to a translation service. That happens whether or not you are signed in — see section 6.
4. What we process once you sign in, and on what legal basis
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Email address | To identify the account and send sign-in codes | Performance of a contract — Art. 6(1)(b) GDPR · KVKK Art. 5/2-c | Until you delete the account |
| Password, stored only as a salted hash | To authenticate you. We never see the plaintext | Performance of a contract — Art. 6(1)(b) GDPR · KVKK Art. 5/2-c | Until you delete the account |
| Phone number | Only if you switch on two-factor authentication | Your consent — Art. 6(1)(a) GDPR · KVKK Art. 5/1 | Until you turn 2FA off or delete the account |
| Display name and profile picture | To identify you in the app and on the leaderboard. Supplied by Google if you sign in with Google | Performance of a contract — Art. 6(1)(b) GDPR · KVKK Art. 5/2-c | Until you delete the account |
| Saved words — the word, its translation, the language pair, the subtitle sentence it appeared in, the title you were watching and the position in it | This is the product: it is what you study from, and the sentence is what makes the word memorable | Performance of a contract — Art. 6(1)(b) GDPR · KVKK Art. 5/2-c | Until you delete the word or the account |
| Spaced-repetition state — repetitions, interval, ease, next due date, lapses and your full answer history | To decide when to show each word again | Performance of a contract — Art. 6(1)(b) GDPR · KVKK Art. 5/2-c | Until you delete the word or the account |
| Exercise attempts — the exercise type, the question, your answer and whether it was correct | To score your progress and adapt the difficulty | Performance of a contract — Art. 6(1)(b) GDPR · KVKK Art. 5/2-c | Until you delete the account |
| Your conversations with the AI coach | So a conversation can continue where it left off | Performance of a contract — Art. 6(1)(b) GDPR · KVKK Art. 5/2-c | Until you delete the thread or the account |
| Rate-limiting records tied to the account and the request | To stop sign-in and code-sending being abused | Legitimate interests — Art. 6(1)(f) GDPR · KVKK Art. 5/2-f | Short-lived; cleared automatically |
There is no advertising, no analytics SDK and no tracking in the extension. We do not profile you for marketing and we do not build an advertising identity for you.
5. The AI features
The coach chat, the grammar explanations, the weekly reports and the AI subtitle translation are produced by Google's Gemini API. To answer, we send only the part of your data the answer needs: the words in question, the sentences they came from, a summary of your recent progress, and the message you typed.
Google acts as our processor for this. Under the paid Gemini API terms, the content we send is not used to train Google's models. Your saved words are also turned into numerical vectors (embeddings) by the same API so that related words can be found.
6. Translation
When you hover or click a word, that word and the sentence around it go to Google Translate, and to MyMemory (Translated s.r.l.) if the first request fails. These requests do not carry your account identifier. MyMemory may retain submitted text in its public translation memory, so avoid clicking through anything sensitive.
When a whole subtitle track is translated, the result is cached on our server so the next person watching the same episode does not have it generated again. That cache holds the subtitle text and a fingerprint of it, and the id of the account that first requested it. It is not a record of what you watched, and it is not shown to anyone as such.
7. The leaderboard is public to other users
If you are signed in, your display name, profile picture and score are visible to other signed-in Wordmi users. Your email address, your phone number, your saved words and your chat history are never shown there.
We do this on the basis of our legitimate interest in making practice motivating — Art. 6(1)(f) GDPR. You have the right to object under Art. 21 GDPR: write to contact@wordmi.com and we will take you off it without otherwise limiting your account.
8. Who we share it with
We do not sell your data, we do not share it with advertisers or data brokers, and we never use it to assess creditworthiness or for lending. We do not use it for any purpose unrelated to teaching you a language. The only third parties involved are the providers that make the product work; they act as processors under Art. 28 GDPR.
| Recipient | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, authentication and the server functions behind the AI features | US-based; data sits on AWS infrastructure in the project's configured region |
| Google LLC — Gemini API | The coach, explanations, reports, subtitle translation and embeddings | US-based; global infrastructure |
| Google LLC — Google Translate | Single-word and sentence translation | US-based; global infrastructure |
| Translated s.r.l. — MyMemory | Fallback translation when the request above fails | Italy (EU) |
| Our email provider | Delivering sign-in and two-factor codes | Per the provider's own infrastructure |
Beyond that we disclose data only where legally compelled — a court order or an explicit statutory requirement.
9. International transfers
Because these providers operate globally, your data may be processed outside Türkiye and outside the EEA, including in the United States. Transfers to our US-based processors rest on the European Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR, incorporated into those providers' data processing terms. For KVKK purposes, transfers abroad rest on your explicit consent under Art. 9 KVKK where no other ground applies.
10. Retention and deletion
Your account and everything tied to it stay until you delete them. Delete your account and your words, review history, exercise attempts, chat threads, profile picture, phone number and email address are removed within 30 days. Backups roll off on their own schedule shortly after.
Cached subtitle translations are not personal data about you and stay in the cache. Data held only in your browser is removed when you uninstall the extension or clear its storage.
11. Your rights
Under the GDPR (Art. 15–22) and the KVKK (Art. 11) you have the right to know what we hold, to get a copy, to correct it, to have it erased, to restrict or object to processing, to portability, and to withdraw any consent at any time without that affecting what was lawful before.
You can export your words as JSON from the study page yourself, at any time, without asking us. For anything else, write to contact@wordmi.com. We answer within 30 days (KVKK: 30 days; GDPR: one month, extendable by two where a request is complex), and we do it free of charge.
12. Complaining to a regulator
If you think we have handled your data badly, tell us first — we would rather fix it. You can also complain to Türkiye's Kişisel Verileri Koruma Kurumu (KVKK) or, if you are in the EEA, to the supervisory authority where you live or work.
13. How we protect it
Traffic runs over HTTPS. Passwords are stored only as salted hashes by our authentication provider. Every table carries row level security, so an account can read only its own rows. Sign-in and code sending are rate limited against brute force, and two-factor authentication is available.
No system is perfectly secure. If a breach is likely to put your rights at risk we will notify the supervisory authority within 72 hours as Art. 33 GDPR requires, and tell you directly where Art. 34 requires it.
14. Children
The extension is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has created an account, write to contact@wordmi.com and we will delete it.
15. Automated decisions
The AI features generate suggestions and explanations, and the review algorithm decides when to show you a word again. Neither produces a legal or similarly significant effect on you, so this is not automated decision-making within the meaning of Art. 22 GDPR.
16. Changes
If this policy changes in a way that affects what we collect or who receives it, we will update the date at the top and tell account holders by email before the change takes effect.
17. Contact
Data protection questions, access requests and deletion requests: contact@wordmi.com.