Privacy policy
GraspIt holds the words you save and very little else. This page says exactly what is stored, where it is stored, who else touches it, and how to get it back or get rid of it.
1. Who we are
GraspIt is made by BaseLoop Ltd, a company registered in England and Wales, company number 17228518, registered office 82a James Carter Road, Mildenhall, IP28 7DE, United Kingdom.
BaseLoop Ltd is the data controller for the personal data described here. For anything on this page, write to [email protected].
2. What we collect
Your account
You sign in with Google. Authentication is handled by Firebase Authentication (Google), and we never see your Google password. From sign-in we store your Firebase user ID, your email address, and your display name, along with whether you have finished onboarding and the dates your account was created and last updated.
The words you save
Every card you keep is stored against your account: the term, the sense you chose and its definition, the example sentences and near-words that came with it, its pronunciation, any tag you added, and the dates it was created and changed. Alongside each card we store its review state — how many times you have seen it, its current interval and ease factor, and the date it is next due. That state is what makes review work.
The words you look up
When you look a word up, the word itself is sent to Google's Gemini API, which writes the entry you see. Your identity is not sent with it, and neither is the sentence, page or app you selected the word from — only the word. The entry that comes back is cached on our server under a hash of the word so the next person to look it up does not need a fresh generation. That cache is shared across everyone and is not linked to any account.
Diagnostics
The app includes Firebase Crashlytics and Firebase Analytics. Crashlytics sends us a report when the app crashes — the stack trace, the device model and OS version, and an installation identifier. Analytics records which screens are opened and how the app is used, so we can see what is worth building. Neither is used for advertising.
Server logs
Our server records one line per API request: the HTTP method, the path, and the response status. It does not log IP addresses and does not log the contents of requests.
3. What we don't collect
GraspIt asks for two Android permissions: internet access, and the ability to appear in the text selection menu. It cannot read your screen. It receives a piece of text only when you select it and choose GraspIt yourself, and nothing about where you were reading travels with it.
We do not collect your location, contacts, photos, calendar, microphone or camera. There are no advertising SDKs in the app, we do not build advertising profiles, and we do not sell or rent personal data to anyone.
4. Why we're allowed to hold it
Under UK GDPR we rely on these lawful bases:
- Performance of a contract — your account, your saved cards and their review state. Without these there is no product to provide.
- Legitimate interests — crash reports and usage analytics, to keep the app working and decide what to improve; server logs and the definition cache, to run the service securely and at reasonable cost. We have weighed these against your interests and consider them proportionate, and you can object at any time.
- Consent — push notifications, and anything else we ask you to opt into. You can withdraw consent whenever you like, in Android settings or in the app.
6. Where it is kept
Our server and database run in Germany, in Hetzner's Nuremberg region. Google's services process data in the United States and elsewhere, which means some of your data leaves the UK. Those transfers rely on the UK government's adequacy regulations where they apply, and otherwise on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
7. How long we keep it
Your account and your cards are kept for as long as your account exists. Delete the account and they go with it — cards and tags are removed from the database along with the account record.
Crash reports and analytics are kept for as long as Google's default retention allows. Server logs are short-lived and hold no personal data. The shared definition cache holds words and their entries, not people, and is kept indefinitely.
8. Your rights
Under UK GDPR you can ask us to:
- give you a copy of the personal data we hold about you;
- correct it, if it is wrong;
- delete it;
- restrict or stop a particular use of it;
- hand it over in a portable format, or send it to someone else;
- stop relying on legitimate interests, where you object.
Write to [email protected] and we will answer within one month. You never have to pay to exercise these rights.
If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
9. Deleting your account
To delete your account and everything in it, write to [email protected] from the email address on the account. We will confirm and delete within 30 days.
Deleting removes your account record, every card you have saved and its review state, and your tags. The shared definition cache is unaffected, because it holds words rather than anything about you.
10. Children
GraspIt is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has given us data, write to us and we will delete it.
11. Changes to this policy
When this policy changes we update the date at the top of the page. If a change materially affects what we do with your data, we will tell you in the app or by email before it takes effect.
12. Contact
BaseLoop Ltd
82a James Carter Road
Mildenhall
IP28 7DE
United Kingdom
[email protected]