Brevlex ("we," "us," or "our") is a website for learning English words through sentences about topics you pick, available at brevlex.com. Some of its content is generated with AI (see AI and data processing). This Privacy Policy explains what data we collect, why we collect it, and how we handle it. We believe in being specific and honest rather than hiding behind vague legal language.
The short version: we collect what we need to make your learning experience work. We do not run ads. We do not sell your data.
What we collect
Account information
- Email address — required for account creation, used for authentication and for the emails described under How we use your data.
- Name — optional. Displayed in your profile if provided.
- Authentication credentials — if you sign up with email and password, your password is securely hashed and never stored in plain text. If you use Google OAuth, we receive your name and email from Google but never your Google password.
Learning data
- Interests — topics you select during onboarding (e.g., technology, cooking, sports). Used to personalize AI-generated sentences.
- Learning goals — why you are building vocabulary (e.g., an exam such as the GMAT, work, or everyday English). Used to tailor word selection and difficulty.
- Study progress — which words you have studied, your correct and incorrect answers, mastery levels, and spaced repetition scheduling data.
- Flashcard data — cards you have created or reviewed, including any custom mnemonics.
- Daily activity — study sessions, words studied per day, streaks, and achievements earned.
Analytics and error monitoring
- Only if you allow usage stats, your browser sends pseudonymous product-usage events to PostHog (no ad pixels, no session replay) so we can see which features people use. Separately, pages report how fast they loaded (Core Web Vitals timings) to our own server, which logs them with your browser type and a shortened IP address, whatever your usage-stats answer; they reach PostHog only if you allow usage stats. Error monitoring via Sentry is not currently active in production; if we re-enable it, we would forward the stack trace and request metadata to Sentry to diagnose crashes. See the sub-processor list for the full set.
Guest sessions
- If you try Brevlex without creating an account, we keep your guest session using a one-way hash of your IP address and browser user agent (we do not store either one in the session). Guest sessions do not collect directly identifying information such as your name or email address. A guest session records the number of study attempts, the words seen, when it started and was last used and, if you then sign up, the account it was carried over to. If you report a problem with a card while studying as a guest, the report is saved with your guest session's ID and kept to improve that card, including after the guest session is deleted. Guest sessions expire after 30 days; a session that was carried over to an account is deleted after it has gone unused for 90 days.
How we use your data
- Personalization — your interests and goals drive the AI-generated sentences and word recommendations you see.
- Spaced repetition — your study history powers the scheduling algorithm that determines when to show you each word again.
- Progress tracking — we display your stats, streaks, and achievements so you can see how you are improving.
- Authentication — your email and credentials are used to sign you in and keep your account secure.
- Emails — account emails (such as email verification, a welcome email, password resets, security alerts, class invites, and notices about account deletion) and, unless you turn them off in Settings, study reminders and a weekly progress summary. Reminder and summary emails carry an unsubscribe link. We do not send advertising for other companies.
- Product improvement — aggregated, pseudonymous usage data helps us understand which features are useful and where users struggle.
AI and data processing
Brevlex uses the Anthropic API (Claude models from Anthropic, PBC) to generate personalized example sentences, mnemonics, word associations, translations and AI Learning Packs, to check Learning Pack words for unsafe content, and to read and check interests you type in your own words. Amazon Web Services (AWS) Bedrock is configured as an alternative AI provider. The study features (sentences, mnemonics, associations, translations and reading your interests) use whichever of the two we have switched on, and send it the same data. Learning Packs and their safety check use Anthropic whenever an Anthropic key is configured, and AWS Bedrock only when it is not.
What we send to the AI provider:
- the word being studied, with its definition and part of speech;
- your selected interests (up to four short topics), a style hint based on your learning goal, and your sentence-style settings;
- for students in a class, the class's grade level;
- text to be translated, and the language to translate it into;
- text you type into a field that uses AI, such as a description of your interests or a Learning Pack request. It is sent as you wrote it, so please leave personal details out of it.
We do not send your email address, name or account ID to the AI provider.
When you ask for a themed Learning Pack, we first look for a public-domain book that matches it: a search phrase taken from your request (with phrases like "give me words from" removed) is sent from our server to Gutendex (gutendex.com), a public catalogue of Project Gutenberg books, and the matching book is downloaded from Project Gutenberg. No email address, name or account ID is sent to either.
Generated sentences are cached so that the same request does not need to be processed repeatedly. Each provider handles this data under its own terms: Anthropic's privacy policy and AWS's privacy policy.
Cookies
We use cookies to keep you signed in, to remember your language and theme, to carry a class invite or sign-up choice through registration, to identify a guest session, to remember your answer about usage stats, and, on a device where a student signed in to a class, to keep the device's language. When you sign in, a JSON Web Token (JWT) is stored in a secure, HTTP-only cookie; it is required for the application to recognize you across page loads.
We do not use tracking cookies, advertising cookies, or any third-party cookie-based analytics.
The usage-stats cookie, brevlex_analytics_consent, holds only your answer (allow or no thanks). It is shared across brevlex.com and its subdomains so you are asked once, and it expires after a year. A copy of the answer is also kept in this browser's storage, for when cookies are blocked; it expires at the same time. If you say yes, PostHog also keeps a random analytics ID in this browser's local storage (never a cookie); saying no deletes it here and stops the analytics code loading anywhere on brevlex.com. Your browser sends nothing to our analytics provider unless the answer is yes. You can change your answer at any time here:
Sub-processors
We use a limited number of third-party sub-processors, each for a specific purpose. The current list:
- Anthropic — our AI provider, reached through the Anthropic API, for example sentences, mnemonics, word associations, translations and AI Learning Packs. It receives the data listed under AI and data processing above, never your email, name or account ID.
- Amazon Web Services (AWS) — Bedrock — an alternative AI provider. It receives the same data as Anthropic for the features that use it: study features while we have it switched on, and Learning Packs only if no Anthropic key is configured.
- Gutendex — a public catalogue of Project Gutenberg books. When you ask for a themed Learning Pack, it receives a search phrase taken from your request, never your email, name or account ID.
- DigitalOcean — hosting for the application, its Postgres database and Redis, on one server in the United States (San Francisco, SFO2 region). DigitalOcean Block Storage Volumes are AES-256-encrypted at rest, but the Postgres data volume runs on droplet local disk and is not encrypted at rest by default. See /legal/subprocessors for full hosting details and our encryption attestation.
- Google — OAuth sign-in. If you choose Google sign-in, Google provides us with your name and email. Google's use of your data is governed by Google's Privacy Policy.
- Stripe — our payment processor. Paid plans are not on sale right now. Stripe holds the email address and internal account reference of anyone who started a checkout earlier; card details never reach Brevlex.
- Brevo — email delivery for account emails, study reminders and the weekly progress summary. Brevo receives your email address and name, in security-alert emails the IP address the request came from, and, for reminders and summaries, your study figures (such as words studied, accuracy and your streak).
- Free Dictionary API (dictionaryapi.dev) — looks up definitions for a word you or a teacher adds, and for words proposed for a Learning Pack or a class word list. It receives that single word, sent from our server, never your email, name or account ID.
- Wiktionary (Wikimedia Foundation) — the fallback definition lookup when the Free Dictionary API has no entry or cannot be reached. It receives the same single word, sent from our server, never your email, name or account ID.
- Have I Been Pwned (Pwned Passwords) — checks whether a new password appears in known data breaches. It receives the first 5 characters of a SHA-1 hash of the password (k-anonymity), sent from our server, never the password itself, your email, name or account ID.
- PostHog — product analytics. Pseudonymous usage events from your browser (keyed to an account ID, not your name or email) are forwarded to PostHog only if you allow usage stats, to help us understand which features people use. No ad pixels, no session replay.
- Sentry — client- and server-side error monitoring. Not currently active in production: no Sentry DSN is configured, so nothing is transmitted to Sentry. If we re-enable it, stack traces and request metadata would be forwarded to Sentry when the application crashes so we can diagnose and fix the failure.
The canonical, versioned list lives at /legal/subprocessors. We do not use any third-party advertising networks, social media trackers, or ad-targeting analytics platforms.
For schools and districts
When Brevlex processes student personal information on behalf of a school or district, we act as a service provider / school official under FERPA. Brevlex is not for children under 13 (see Children's privacy). The terms that govern that relationship — including our data-handling commitments, sub-processor approvals, breach-notification timelines, and deletion obligations — are in our Data Processing Addendum.
- Data Processing Addendum (DPA) — the contract we sign with school and district customers.
- Sub-processor list — the canonical list of third parties that may process customer data on our behalf.
Data retention
- Account data — kept while your account is active. When you delete your account, it is scheduled for deletion: for 30 days you can sign back in to restore it, and after that your personal data is permanently erased from our database. Copies in our scheduled database backups are deleted as those backups expire, within 90 days.
- Study progress — retained with your account. Deleted when your account is deleted.
- Guest sessions — expire after 30 days and are then deleted; a session carried over to a new account is deleted after it has gone unused for 90 days. Card reports made as a guest are kept.
- Analytics events — pseudonymous product-usage events may be retained by our analytics sub-processor after account deletion, subject to its retention schedule.
- Security-event audit log — records sign-ins, password resets, 2FA changes, admin actions, and educators' access to their own students' records, each with a shortened IP address and your browser type. Kept for 90 days, then deleted.
- Signed-in sessions — for each device you sign in on, we store the browser type and a one-way hash of the IP address; learner accounts can see and sign out of them in Settings. Deleted after the session has gone unused for 16 days.
Data security
The specific controls we have in place today:
- In transit — all traffic is served over TLS 1.2 or higher.
- Passwords — hashed with bcrypt. Plain-text passwords are never stored and never logged.
- TOTP secrets — application-encrypted with AES-256-GCM before they are written to the database. Two-factor authentication (TOTP) is available for any account.
- At rest — the Postgres data volume runs on droplet local disk and is not encrypted at rest by default. Beyond bcrypt hashing of passwords and AES-256-GCM encryption of TOTP secrets, we do not currently apply additional application-layer encryption to other user fields. See /legal/subprocessors for our full encryption attestation.
- Session tokens — stored in secure, HTTP-only cookies to prevent cross-site scripting access.
- Database access — restricted to the application; not publicly exposed.
No system is perfectly secure. If you discover a security vulnerability, please report it to support@brevlex.com.
Your rights
You have the right to:
- Access your data — view the personal information we hold about you through your account settings.
- Correct your data — update your name, interests and learning goals in Settings; to change your email address, contact us.
- Delete your data — delete your account in Settings. You have 30 days to change your mind by signing back in; after that the deletion is permanent. Educator accounts are deleted by our support team: email support@brevlex.com, because deleting one also removes its classes and student data.
- Export your data — download a copy of your data (JSON, or your flashcards as CSV) from Settings → Download your data. Educators can request a copy from support@brevlex.com.
- Withdraw consent to usage stats — switch them off at any time with the usage-stats control under Cookies. New usage stats stop straight away, for every part of brevlex.com in this browser; anything captured in the few seconds before may still finish sending. Stats already sent are not deleted by the switch; to have them deleted, contact us.
To exercise any of these rights, visit your account settings or contact us at support@brevlex.com.
Children's privacy
Brevlex is not for children under 13. You must be 18 or older to create your own account. Students aged 13–17 may use Brevlex only through a class set up by their teacher; they join with a class code and are not asked for an email address. Educators who create classes attest that every enrolled student is 13+; grade 3-6 classes are blocked at creation and legacy under-13 classes have been retired (read-only). We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal data, please contact us at support@brevlex.com and we will promptly delete it.
Changes to this policy
We may update this Privacy Policy from time to time. When we make significant changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of Brevlex after changes constitutes acceptance of the updated policy.
Contact
If you have questions about this Privacy Policy or how we handle your data, contact us at: