Privacy notice
Last updated: October 29, 2026
Core 1000 Words collects as little as it can. There are no ads or advertising trackers.
Analytics
We use Vercel Web Analytics to count page visits. It doesn’t set cookies or follow you across other sites. For each visit it records the page address, the referring site, an approximate location (country, region, and city), and your browser, operating system, and device type. Before anything is sent, we remove everything after the “?” in the address except campaign tags like utm_source. Visitors are counted with an anonymous hash that Vercel discards after 24 hours. Password-reset and admin pages aren’t counted. Your study answers are never sent to analytics.
If you study without an account
Your progress is saved only in this browser’s local storage. It never leaves your device unless you export it or create an account. Clearing your browser data deletes it, so export a copy from the dashboard if you want a backup.
If you create an account
| What | Why |
|---|---|
| Username and email address | Signing in, and sending password-reset emails. We don’t send marketing email. |
| Password | Stored only as a salted scrypt hash, never in readable form. |
| Session records (including IP address and browser type) | Keeping you signed in, and security. Removed when the session ends or expires (30 days). |
| Your answers and settings | Calculating your review schedule and syncing it across devices. |
| Rate-limit counters | Blocking password guessing and abuse. Short-lived. |
The only cookie is the sign-in session cookie, which is required for accounts to work. We don’t use advertising or analytics cookies.
Correction reports
If you send a report, we store what you wrote, the word, an optional email address if you give one, and a one-way hash of your IP address that’s used only to limit spam.
Service providers
- Vercel hosts the website.
- Neon hosts the database (PostgreSQL).
- Resend delivers password-reset emails, once email is turned on.
We don’t sell or share your information for advertising.
Your choices
- Export: download all of your progress as JSON from Settings (accounts) or the Dashboard (guests).
- Delete: deleting your account in Settings permanently removes your account, sessions, answers, and settings from the live database right away. Copies in the database provider’s short-term recovery backups expire on their own schedule.
- Sign out on shared computers: signing out removes your account’s cached progress from that browser.
Children
Accounts are intended for people aged 13 and over. Younger learners can use the site without an account.
Changes
If this notice changes in a meaningful way, we’ll update the date above and describe the change on this page.