Privacy policy.

Who we are

Wit is operated by Dmitry Leshchenko, an individual entrepreneur registered in Georgia. Questions about this policy reach a person at hello@yourwit.app.

Every company named on this page handles data only for the purpose described here, on our instructions, and provides the same or equal protection of user data as this policy states. Meta is the one partial exception: it also uses the install and purchase events it receives to build its own aggregated models for measuring ads, and decides for itself how it does that. Each company also publishes its own privacy practices, which sit alongside this policy rather than in place of it.

What Wit asks you for

Setting Wit up takes fifteen screens, and six of them can be skipped: your age band, how you identify, whether you want a daily reminder and when, which categories interest you, what you want the words for, and how you rate your own level. The widget screen also lets you pick how often the widget changes word, if you want to.

Four things the flow will not move past. Three of them because Wit cannot start giving you words without them: a display name, how many words a day you are aiming for, and which packs you take. The fourth is the three calibration rounds, which you pass through rather than answer, because marking nothing is itself an answer there.

All of it is stored on your iPhone. Your display name stays there and is the one answer that never leaves the phone: nothing in Wit ever puts it on anything the analytics sends. The bands and picks do reach our analytics, which lists them; the words you marked as known in calibration do not, only the level they worked out. None of your answers goes into the iCloud mirror described below.

What we store, and where

Seven things mirror to your own private iCloud: the words you save, the day-by-day record of which words you have been shown, a note of when you first and last saw each word, two small settings that remember where you had got to, and two marks that say whether Meta has already been told of your free week starting and your first payment. A second device carries on where the first left off, and knows what has already been reported. That is the whole of the mirror. It is your iCloud rather than ours, and we cannot read it.

Everything else stays on the iPhone. Your onboarding answers, your Practice progress, the counters the Progress screen reads – words met, rounds played, the day you installed – your widget and notification preferences, and the translation language you picked. The widget shares a container with the app on your phone: it reads your words from it, and a word you save or move past on the widget waits there until you next open Wit. It carries no analytics code and collects nothing of its own.

The words themselves are in the app when you download it: every definition and every pronunciation clip is bundled, so playing a word out loud makes no request to anyone.

Your daily word reminder and the warning before a free week ends are notifications your iPhone schedules locally, at the hour you picked. The one-time note about the widget, on your second day, is scheduled on the phone too. Nothing is pushed from a server, because there is no server of ours to push it.

iCloud Backup is a different thing, and it is Apple's rather than ours. Nothing in Wit is marked as excluded from backup, so if you have iCloud Backup switched on, the app's files and preferences are swept into your own backup along with the rest of your phone. That backup is yours, and you control it in iPhone Settings.

What we do not do

We do not sell your data. We do not use Apple's advertising identifier and never ask for it. We do not run ads inside Wit itself: nothing you see in the app is an ad. We do not build a profile of you for advertising, and there is no account to sign into.

We do use a limited amount of information to measure our own advertising – whether an ad we ran brought you to Wit, and whether it led to a subscription. That is the only advertising purpose anything here serves: nothing we collect is combined with data from other companies to build a profile of you, and nothing here is sold or handed to a data broker.

Three companies' code runs inside the app: PostHog, for the product analytics below; RevenueCat, which remembers what you bought; and Meta's own SDK, which measures our own advertising and is named below in What leaves your iPhone. All three are described on this page. The widget extension carries none of them.

What leaves your iPhone

This is what leaves, case by case. The three companies' software also fetches things of their own – the price of Pro and what the paywall shows, the analytics software's own configuration – which the sections below describe.

• Analytics goes to PostHog, on its European servers. What it contains is the next section.
• What you bought goes to RevenueCat, so the app knows whether Pro is active. Apple takes the payment itself.
• A random identifier Meta's own software generates on your phone goes to Meta, alongside the fact that Wit was installed and opened, how long each visit to the app lasted, and some basic details about the phone: which version of Wit it is, the model of iPhone and its version of iOS, your phone's language and time zone, its screen size and how many processor cores it has. It is not Apple's advertising identifier and is not tied to your identity – more on it in Analytics, below.
• Your free week starting, and your first payment, go to Meta from the app, with that same identifier: which plan, and for the payment its price and currency as the App Store reports them. Neither is linked to who you are. They tell us whether one of our own ads led to a subscription rather than only an install. Nothing after that is reported: not a renewal, not a later payment, not a refund.
• Once per install, the app asks Apple whether an Apple Search Ads ad brought you. If one did, it keeps the campaign, ad group and keyword alongside your analytics identifier. If none did, it records only that answer, and nothing about an ad.
• Saved words, the record of what you have seen, when you first and last saw each word, the two settings that keep your place, and the two marks that say what Meta has already been told go to your own private iCloud, as above.
• A share card goes wherever you send it, the moment you choose a destination.
• Saving a card writes it to your photo library, which stays on the phone but leaves Wit.
• The first time you use a translation language, iOS downloads that language from Apple.
• Crash reports and usage counts go to Apple, and only if you have left Apple's diagnostics sharing on.
• Crashes of Meta's own software go to Meta, automatically – more under Diagnostics.
• A link opened from the app's settings hands you to a browser and opens this website. That is an ordinary visit to a web page: it reaches this site's host the way any other visit does, and nothing Wit adds travels with the tap. What the visit itself involves is under The website, below. Rate Wit is the exception: it opens the App Store's page for writing a review, which is Apple's.

Analytics

Wit uses product analytics, and today that is PostHog. The instance it reports to is pinned to PostHog's European Union host, never the American one its software defaults to.

What is sent is a list of things you did, not what you typed:

• Setting up – which of the fifteen screens you reached, which you answered, which you skipped, and whether you finished.
• Opening the app – installing it, updating it, opening it and sending it to the background, which the analytics software records itself.
• The widget – whether one is installed and in which sizes; taps on it, with the word when you tap one; each word you move past with its arrow, counted when you next open Wit; and Today's invitation to add one, which comes at most twice: each time it is shown, whether it was the first or the second, and whether you tapped Add widget, tapped Not now or moved past it.
• Notifications – that one was opened, and which kind: the daily word, the one-time note about the widget, or the warning before a free week ends.
• Reading – the card you settle on, with its word, its pack, that word's difficulty, its place in the day's deck, and which part of the app you were in.
• What you do with a word – saving it, un-saving it, revealing a translation, into which language and whether your phone's first language is English, and opening the share sheet. Bringing a word back from Already known records only whether it came from setup's level check or was one you marked later – never which word.
• Practice and the goal – a round started and finished, which kind of round it was and where you started it, its score, how many words it moved, whether you used Show the word in Hear it, and the day you met your goal. Each check on a learned word is recorded as right or wrong, with which of its three checks it was – never the word.
• The level check, taken again – starting it from You › Level, finishing it or closing it and at which of its three rounds, and your level before and after. Never the words you marked.
• The end of a deck – reaching it, dealing the words again, adding packs, and changing your packs or your interests.
• Pro – opening Progress, being shown the card that says Practice is done for today, tapping a control that opens the paywall and which control it was, a purchase that failed and its error code, a purchase you canceled at Apple's payment sheet and which plan it was for, a restore, the trial-end reminder being set, and the screen that offers that reminder, shown and how you closed it. RevenueCat also reports the subscription itself: a first purchase and the one-time lifetime purchase, a free week started and a free week that became a paid year or was canceled before it did, a renewal, a renewal switched off and a renewal switched back on, a change of plan, an expiry and a billing problem – and four facts about the paywall itself: that it was shown, that it was closed, that a purchase on it was canceled, and that a control on it was used.
• Asking for a review – Wit asks at most twice, and records each ask being shown, what brought it up – meeting your goal, learning a word, a perfect round or a finished share – and whether it was the first or the second, then whether you tapped Rate Wit, tapped Not now or moved past it. Rate Wit hands you to Apple; Wit never learns whether you left a rating, or what it was.

Every one of those also carries what the analytics software attaches by itself, without our code asking for it and with nothing of ours stripping it: which version and build of Wit you are on and whether it came from the App Store or from TestFlight, the model of iPhone you have and the version of iOS it is running, the size of its screen, your phone's language, its time zone, whether you are on wifi or cellular.

Alongside those, seventeen facts about your setup are kept current:

• Whether you are on free or Pro, and the last Pro control you tapped.
• How many words a day you are aiming for.
• Which packs you take, and which categories interest you.
• The level the three calibration rounds worked out for you, which taking the level check again replaces whenever you mark at least one word. What you marked as known is what produced it; which words those were never leaves the phone.
• The level you rated yourself at, which is the separate answer the setup screen asks for, and is kept separately.
• Your age band and how you identify, if you gave them.
• What you want the words for.
• The hour you picked for the daily word, and whether notifications are switched on.
• Which widget sizes are installed, and your translation language.
• Which voice you picked, and how often the widget changes word.
• The day you installed Wit.

Every one is a band, a pick from a fixed list, a yes or no, an hour of the day or a date. Never a name, never a birthdate, never anything you wrote.

All of it is recorded against an identifier Wit makes up on your first run: a random string kept in your iPhone's keychain. The analytics software makes up a second random one of its own for the installed app, which is what it counts as a device.

Wit's identifier is not your Apple Account, not an advertising identifier, not an email and not an account, and nothing is ever attached to it that could name you. It is what PostHog counts you as, and it is also given to RevenueCat so a purchase can be matched to the app's own figures. Wit never shows it to you.

Meta's software, built into the app to measure our own advertising, makes up a third random identifier of its own, in the app's own storage rather than the keychain – it does not survive deleting and reinstalling Wit, unlike the identifier above. It is sent to Meta together with the fact that Wit was installed and opened, how long each visit lasted, and the basic phone details listed under What leaves your iPhone, and with your free week starting and your first payment, listed there too, so an ad can be measured by whether it led to a subscription, not just an install. It is not the Apple advertising identifier: Wit never asks for permission to track you, and never collects that identifier. Once per install the app also asks Apple whether an Apple Search Ads ad brought you; if one did, it keeps the campaign, ad group and keyword identifiers alongside your analytics identifier – those describe the ad, not you.

Wit's identifier counts an installed app rather than a person, and the keychain is what makes that hold. Deleting Wit and installing it again resumes the same record rather than starting a new one. It also travels with you when a phone is migrated to a new one through an encrypted transfer or backup, so the new phone carries on the old phone's record. It never reaches iCloud Keychain, so a second phone you set up separately is a second record – and a phone set up from scratch, with Wit installed fresh, is a new one.

Your IP address reaches PostHog with each request and is stored there, and PostHog works out an approximate location from it on its own servers: your country, your region, and the city it places that address in. That, and the time zone the analytics software attaches by itself, is as close as anything here gets to where you are – and both are inferences rather than readings taken from you: Wit asks for no location permission and reads no location sensor.

Several things the analytics software can do are switched off in Wit: it does not record your screen, does not capture taps or gestures on its own, does not log which screens you visit, shows no surveys, does not watch for repeated frustrated tapping, and does not capture crashes. It does use one feature flag, to compare two versions of setup: some new readers see one version and some the other. Every reader's analytics also carries which version they were assigned, including readers who never see setup. The one thing we cannot switch off is that the software fetches its own configuration from PostHog; the version Wit uses offers no way to decline it.

Wit does not use Apple's advertising identifier and never asks for it. You will not see the system's tracking permission prompt: measuring which of our own ads led to an install or a subscription is not the same as tracking you, and nothing in Wit tracks you across other companies' apps and sites, sells your data or hands it to a data broker.

Our legal basis for this is legitimate interests: understanding how Wit is used so it can be fixed and improved, and measuring whether our own advertising works. There is no switch in the app to turn analytics off. Deleting Wit stops it, and writing to hello@yourwit.app gets the record deleted – see Deleting your data.

Paying for Pro

Wit uses the App Store to take payment, and a subscriptions provider to remember what you bought. Today those are Apple and RevenueCat.

Apple takes the payment, and we never see your card or your billing details. RevenueCat records an anonymous identifier of its own and whether a subscription is active. It is not tied to your name, your email or your Apple Account.

Other things travel with every request its software makes, and this is not a closed list: the identifier your iPhone gives this one app for this one device; the same random identifier the analytics uses, so a purchase can be matched to the app's own figures; the country your App Store account is in; the languages your phone prefers; the model of iPhone you have and the version of iOS it is running; which version and build of Wit is asking; and a note RevenueCat's own software writes about whether you have been asked the system's tracking question, which you have not, because Wit never asks it. Once per install, RevenueCat's software also collects the attribution token Apple's own framework issues, and RevenueCat asks Apple with it whether an Apple Search Ads ad brought you; if one did, it learns which campaign, ad group and keyword, so we can see which of our ads lead to a subscription. Its software also fetches back what Pro costs and what the paywall should show, which is a request of its own rather than anything of yours leaving.

RevenueCat passes nothing on to Meta. The app itself tells Meta when your free week starts and when you first pay – which plan, and the payment's price and currency – so we can measure whether one of our own ads led to it. A renewal or any later payment is never reported.

Translation

Translation runs on your iPhone, through Apple's own translation framework. The definition is not sent to us and it is not sent to a translation service. The first time you use a language, iOS downloads that language to your phone; after that it works offline. Analytics records that a translation was shown, into which language, and whether your phone's first language is English, never the word's definition and never the result.

Diagnostics

Wit has no crash reporter of its own. The analytics software ships one and it is switched off. Meta's software, described under Analytics, reports its own crashes to Meta automatically, with no switch to turn that off; those reports concern Meta's software and carry nothing you entered. Beyond that, crash reports and usage figures reach us only through Apple's diagnostics, in the form Apple provides them, and only if you have left sharing switched on. Nothing Wit does adds anything to Apple's reports: not a word you saw, not an identifier of ours. You can turn the sharing off in iPhone Settings, under Privacy and Security.

Sharing and Photos

Tapping share hands a finished image to whatever you pick: Messages, Instagram, AirDrop, Files. Wit does not choose the destination and does not send it anywhere itself. Analytics records that you opened the share sheet, and for which word – never where it went. Whether you went through with it shows only if finishing it brings up Wit's request for a review, described under Analytics.

Saving that card writes one image to your photo library. Wit asks only for permission to add to Photos. It never reads your library, and the permission that would let it do so is deliberately absent from the app.

The card tilts as you move the phone, which reads the motion sensors. That reading never leaves the phone and is not stored.

The website

This site is hosted by Vercel, which keeps the standard server and security logs any host keeps, and uses them to serve and protect the site. When it serves a page, Vercel also works out an approximate location from your IP address, which the site returns to your own browser with the page; it goes no further unless the analytics below is running.

The site's own analytics, when it is switched on, is PostHog again and on the same European host, and it is cookieless: it sets no cookie and keeps nothing on your device. While it is running, it sends four things. A page view carries the address of the page, including any campaign tags in it, the page you arrived from, your browser and operating system, your time zone and your browser's language, the size of your screen and of the window, whether you are on a phone, a tablet or a desktop, and what kind of device it is, such as an iPhone or an Android phone, though never its exact model. A page view also carries your approximate location: the country, the region and the city Vercel places your IP address in. Leaving a page records how long you stayed on it and how far down you scrolled. Clicking Get Wit, Download Wit, or the App Store badge on the home page or at the end of an article records that click and which one it was, by where it sits on the page. The contact form records only whether your message was sent or failed, never what you typed.

Each of those carries the same details as a page view, and reaches PostHog with your IP address. To tell one visit from another without a cookie, PostHog's servers compute a code from your IP address, your browser's user-agent string and the site's address, mixed with a random value that changes every day and is deleted once that day's events are processed. Page views on the same day share that code, so the site can see the route through one visit: where you came in and where you left. The next day you are a new visitor; the code cannot follow you from one day to the next, from this site to another, or from one device to another. Your IP address is used to make that code and is then removed rather than stored with the event, and PostHog works out no location from it: the location an event carries is the one Vercel worked out, which the page passes on to PostHog with no extra request. Like the app's, that location is an inference rather than a reading taken from you: the site asks for no location permission. Your IP address and that location are still personal data under the GDPR, so they are named here plainly. The analytics software may also fetch its own configuration from PostHog. If your browser sends Do Not Track or Global Privacy Control, the site loads no analytics at all and no analytics request leaves your browser.

The contact form is handled by Web3Forms. It takes your email address, your message, and your name if you choose to give one, which is optional. Sending it reaches Web3Forms directly from your browser, so your IP address goes with it, as it does with any request a browser makes. We use all of it to reply to you and for nothing else.

Mail to hello@yourwit.app is forwarded by Cloudflare Email Routing.

How long we keep things

Analytics events are kept by PostHog for as long as the plan we are on retains them, which today is a year. Ask us to remove yours sooner and we will.

The purchase record at RevenueCat – the anonymous identifier and whether a subscription is active – is kept for as long as Wit is running, because it is what tells the app you have paid.

What Meta receives is kept by Meta under its own terms, which we do not set.

Server and security logs are kept by our website's host under its own retention schedule, and are used to run and secure the site. Anything the website's own analytics records is kept under the same PostHog account's retention setting. Its page views link to one another within a single day only: the code that joins them depends on a value that is deleted once that day's events are processed, so they never accumulate into a history of one visitor across days.

What you send through the contact form, and the mail it becomes, is kept for as long as we may need it to answer you and to follow up. Ask us to delete your correspondence and we will.

What sits on your iPhone has no retention period, because we do not hold it. It stays until you remove it, and Deleting your data, below, says how.

To object to anything described here, or to ask for it to be deleted, write to hello@yourwit.app. For this website you can also switch on Do Not Track or Global Privacy Control in your browser, which stops the analytics snippet loading before it asks for anything.

Deleting your data

Delete my data, in the app's settings, clears Wit in one action: the words you saved, the record of what you have been shown, your Practice progress, the counters Progress reads, where you had got to, your widget and notification preferences, your translation language and your onboarding answers. It empties the saved-words copy in your iCloud and removes the other iCloud entries except the two Meta marks, named below. It cancels every pending daily notification and the one-time note about the widget, and rebuilds the widget's feed. What is left is an app that has never been set up.

Thirteen things survive it, and they are named here rather than hidden. Your subscription, which lives with your Apple Account and comes back from the receipt. The warning before a free week ends, because deleting your data does not stop the eighth day arriving. The random analytics identifier, which carries nothing you entered. Meta's random identifier, which lives in the app's own storage and goes only when the app itself is deleted. The note that the Apple Search Ads check has finished, which holds no detail of any ad and exists so the check is not run twice. The note that Wit has already offered to remind you before a free week ends, so the offer is not made twice. Two stamps the app keeps so it can go on counting installs rather than launches: the day this install first ran, and the fact that setting up had been started here once before. Three notes about what Meta has been told: that your free week starting has been reported and that your first payment has, each on the phone and in your iCloud, and the day this reporting first ran on the phone, so a purchase from before it is never reported. The day you last met your goal, so the analytics hears about it only once that day. And everything already sent to PostHog, RevenueCat and Meta, which has already left the phone.

It is thorough, and it is not a guarantee. A file removal can fail quietly, and a copy arriving from another device can lag behind. The action does what it describes; it does not promise that nothing anywhere survives it.

Deleting the app instead removes only the copy on that iPhone. Nothing in Wit clears the iCloud mirror when the app is deleted – Delete my data is the only thing that does (all of it but the two Meta marks, which nothing removes), so run it first if that is what you want. The random analytics identifier is kept in your iPhone's keychain, which outlives the app, so reinstalling Wit resumes the same analytics record rather than starting a new one.

To have that record deleted, write to hello@yourwit.app and ask. Wit never shows you the identifier, so we will ask you for whatever we need to find your record, and then remove it – PostHog's and, where you have bought Pro, RevenueCat's. What Meta holds is keyed to its own random identifier, which we have no way to look up, so Meta's own privacy tools are the route to it.

There is no account to delete, because there is no account. Apple requires in-app deletion from apps that let you create one, so that rule does not reach Wit at all. Wit offers deletion anyway.

Support correspondence is deleted on request. Write to hello@yourwit.app.

Your rights

If you are in the European Union or the United Kingdom, the GDPR gives you the right to see the personal data we hold about you, to correct it, to have it deleted, to restrict what is done with it, and to object to processing.

Our legal bases are short, because the processing is. Legitimate interests covers operating, securing and improving Wit – the product analytics above, the approximate location PostHog derives from your IP address, this website's own analytics and the approximate location Vercel works out from your IP address, which tell us how people find the site, from where, and whether they go on to download Wit, and our website's server logs – and measuring our own advertising: what Meta is sent, and the Apple Search Ads check. Performing the purchase you made covers the record of whether your subscription is active. Taking steps at your request covers support correspondence.

In practice there is little of yours for us to hold: an analytics record keyed to a random identifier your phone made up, whether you are paying, and whatever you have written to us. No name, no email address and no account, unless you send us one.

If you are a California resident, the CCPA and CPRA give you the right to know what is collected and to ask for it to be deleted, and the right not to be treated differently for asking. We do not sell your personal information, and we do not share it in the sense California law gives that word. We act on both browser signals anyway: with Global Privacy Control or Do Not Track set, this site loads no analytics at all.

To exercise any of this, write to hello@yourwit.app.

Children, security and where data is handled

Wit is not directed to children under 13, or the higher minimum age your country sets, and we do not knowingly collect personal information from them. If you think a child has sent us something through the contact form, write to hello@yourwit.app and we will delete it.

We use established providers and reasonable technical measures. The real protection is how little there is to protect: what leaves the phone is a list of bands and picks, and whether an ad brought you, against a random identifier, with no name, no email address and no account anywhere in it.

The app's analytics is processed in the European Union, and so is this website's whenever it is switched on, though the approximate location it carries is first worked out by Vercel, where it serves the page. RevenueCat, Meta, our website's host Vercel, the contact form's handler Web3Forms and Cloudflare, which forwards mail sent to hello@yourwit.app, may handle data in the United States or elsewhere, and where they do they act under this policy and under their own published terms. What the website itself collects is in The website, above.

Changes, and writing to us

When a company is added to this page it is added before it starts handling anything, not after, and the date at the top moves with it. Several statements here describe today rather than forever: that Wit uses no advertising identifier and shows no tracking prompt, what is switched off in the analytics software, that there is no switch for analytics in the app, and which companies are named above. Each gets revisited on the day it changes.

Measuring our own advertising is one of those changes, and it is live from Wit's first release rather than added later: this page already names Meta and describes what it is sent, above. It did not bring Apple's tracking permission prompt with it, and it is not going to – measuring our own ads is not the kind of tracking that prompt is for, and Wit's App Store privacy answers say so.

Use the contact form, or write to hello@yourwit.app. One person reads it, and answers from a real address, usually within two days.