Privacy Policy – Lexify

Last updated: May 2026

1. Overview

Lexify is a Chrome Extension that helps users learn and retain English vocabulary using spaced repetition (FSRS algorithm). This policy explains what data we collect, why we collect it, how it is stored and processed, and who it is shared with.

2. Data We Collect

Data	How collected	Purpose	Where stored
Email address	Entered by the user during sign-up, or provided by Google during Google Sign-In	Account identification and authentication	Firebase Authentication (Google servers)
Vocabulary cards (word, definition, Vietnamese translation, example sentence, phonetic, part of speech)	Created manually by the user via the Add Card form, or pre-filled from a dictionary/translation API after the user initiates a lookup	Core app functionality — storing and reviewing vocabulary	Firebase Firestore (Google servers)
Review history (review timestamps, FSRS scheduling data, ratings)	Generated automatically when the user completes a review session	Spaced repetition scheduling — determining when each card is due next	Firebase Firestore (Google servers)
App settings (dark mode, reminder time, deck names)	Set by the user in the Settings screen	Personalizing the app experience	`chrome.storage.local` on the user's device; deck names also stored in Firebase Firestore
Selected text from webpages	When the user highlights a word on any webpage and clicks the "＋ Lexify" tooltip or uses the right-click "Add to Lexify" context menu	Pre-filling the Add Card form with the selected word — convenience only	Held in memory temporarily; never transmitted to our servers
Gemini API key (optional)	Entered voluntarily by the user in Settings to enable AI sentence checking	Sent directly from the user's browser to Google's Generative Language API to check example sentences; never transmitted to or stored by us	`chrome.storage.sync` — synced across the user's Chrome-signed-in devices by Google

We do not collect: browsing history, page content, passwords, payment information, precise location, or any data beyond what is described above.

3. How We Use Your Data

Authentication — your email is used solely to identify your account and authorize access to your vocabulary data.
Sync — vocabulary cards and review history are synced to Firestore so your data is available across sessions and devices.
Spaced repetition scheduling — review history is used locally by the FSRS algorithm to calculate the next due date for each card. This computation happens on-device.
Dictionary lookups — when you add a card and click "Generate," the word you typed is sent to Merriam-Webster API and Google Translate API to fetch its definition and Vietnamese translation. No account information is included in these requests.
Notifications — if you enable the daily reminder, your chosen reminder time is stored locally and used to schedule a Chrome alarm. The notification fires on-device; no data is sent to external servers for this purpose.

We do not sell, rent, or share your personal data with any third party for advertising or marketing purposes.

4. Data Storage and Retention

Firebase (Google) — account and vocabulary data is stored on Google's servers in the Firebase platform. Data is retained for as long as your account exists.
Local device storage — settings and auth tokens are stored in chrome.storage.local on your device. This data is cleared when you uninstall the extension or sign out.
Deletion — to permanently delete your account and all associated data, contact us at the email below. We will process the request within 30 days.

5. Data Sharing

Your data is shared only with the following third-party services, strictly to provide the Lexify functionality:

Firebase Authentication & Firestore (Google) — stores your account credentials and vocabulary data. Subject to Firebase Privacy Policy.
Merriam-Webster Learner's Dictionary API — receives the word you look up to return its English definition, phonetic, and example sentence. No personal data (account info, email, etc.) is included in these requests.
Google Translate API — receives the word you look up to return its Vietnamese translation. No personal data is included.
Google Generative Language API (Gemini) — optional. Only called if you have entered your own Gemini API key in Settings. Receives the target word and the example sentence you typed for grammar/spelling feedback. No account information is sent. Subject to Google Generative AI Terms.

No data is shared with any other party.

6. Permissions Justification

storage — saves user settings, authentication tokens, and due card count locally on the device.
alarms — schedules the daily review reminder notification.
contextMenus — adds the "Add to Lexify" right-click option when text is selected on a webpage.
identity — enables Google Sign-In via chrome.identity.launchWebAuthFlow.
notifications — shows the daily reminder when review cards are due.
sidePanel — displays the app as a side panel while the user browses.
Host permissions (dictionaryapi.com, dictionaryapi.dev, translate.googleapis.com, firestore.googleapis.com, securetoken.googleapis.com, generativelanguage.googleapis.com, media.merriam-webster.com) — fetch word definitions, Vietnamese translations, audio pronunciations, and sync data with Firebase.

7. Content Script

Lexify injects a small content script into all webpages (http://*/*, https://*/*). This script listens for text selections and displays a small "＋ Lexify" tooltip near the selected text. It does not read, record, or transmit page content, browsing history, or any other information from the pages you visit. Clicking the tooltip sends only the selected word to the extension's side panel.

8. Children's Privacy

Lexify is not directed at children under 13. We do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this policy as the extension evolves. The "Last updated" date at the top of this page will reflect any changes.

10. Contact

Questions, data deletion requests, or concerns: nguyendinhminhhieu0409@gmail.com