Word Anatomy

Privacy Policy

Word Anatomy is a dictionary app. This page explains what happens to your data, in plain English.

Policy date: 31 October 2026

This Privacy Policy applies to the Word Anatomy mobile application, its related services, the backend services used to operate the app, and this website, wordanatomy.duhaapps.com (collectively, the "Service").

Word Anatomy is operated by Adnan Zawad Toky. "Word Anatomy," "we," "us," and "our" refer to the operator of the Service. This policy is publicly accessible and is the same policy linked from the App Store and Google Play listings.

What is sent

When you look something up, the app sends our server:

  • the text you look up (a word, phrase or sentence);
  • your primary language;
  • a random install ID. Our server creates it when the app first registers and gives it to the app. It is not linked to your name, email, phone number or any account; and
  • when the app registers (the first time, and again before its install ID expires), app-integrity data from your device (Google Play Integrity on Android, Apple App Attest on iOS). It shows that the request comes from a genuine copy of the app. Our server sends the Play Integrity token to Google to have it checked. App Attest data is checked on our server, without contacting Apple.

Nothing is sent to our server, to the AI provider or to Firebase (see Analytics and crashes) before you agree to the AI notice, which comes right after the welcome screen.

Turning AI lookups off: you can withdraw your agreement at any time in Settings › Privacy › AI lookups. While they are off, the app sends no lookups to our server or to the AI provider, and analytics and crash reports stop; a Report you choose to send still reaches us. Your saved words stay on your device. Turning them back on shows the AI notice again. Deleting the app also stops everything.

IP address: when the app registers (the challenge and register steps), your IP address is used briefly as a rate-limit key to prevent abuse. Our own code does not store or log it. Cloudflare (our host) keeps request logs for our server, which can include your IP address, for up to 7 days. Cloudflare and the platform integrity services (Google Play Integrity, Apple App Attest) also process IP addresses as part of normal network traffic.

Who processes it

  • Our server, hosted on Cloudflare. It receives your lookup, checks it, and keeps a cache of generated entries.
  • Anthropic (Claude API), to write the dictionary entry, under its commercial terms. Anthropic says that by default it does not use inputs or outputs from its commercial products to train models, and that it automatically deletes API inputs and outputs from its backend within 30 days. Anthropic may keep content longer if it is flagged for violating its usage policy. Anthropic receives the text you look up and your primary language. It does not receive your install ID. If we change provider, we will update this policy.
  • Wikimedia, to show an article summary. When what you look up is at most four words in the Latin alphabet (for example "serendipity" or "break the ice"), we may request the Wikipedia article with that name while your entry is being written, so a very short sentence in that form can reach Wikimedia too. Longer text, other punctuation and other scripts are not sent in that way. Once the entry is written, our server may also request the Wikipedia article for the English name of the term the entry chose (for example "Schadenfreude" for a German lookup), whatever language you looked up in. Requests come from our server, never from your device, and no install ID or other identifier is sent. Summaries come from Wikipedia and are shown under CC BY-SA 4.0.

Pronunciation: the Listen button uses your device's own text-to-speech engine. Depending on your device settings, that engine (from Apple, Google or another provider you chose) may send the word to its maker to produce the voice; we do not receive or control it.

Analytics and crashes

The app uses Google Firebase Analytics and Crashlytics to count usage and fix crashes. They start only after you agree to the AI notice and stop when you turn AI lookups off. We turn off ad personalization, and because the app never asks for permission to track you, it has no access to your device's advertising identifier. What you look up is never included in analytics events or crash reports.

These services collect, from your device: an app-instance ID created by Firebase, your device model, operating system, app version and device language, screen views and app events (for example "lookup performed" or "word saved", without the word), and, after a crash, the crash report with the code location. Google derives an approximate location (country and region) from your IP address; it does not receive your precise location.

How long we keep data

  • Daily usage counters (your install ID, the date, and how many lookups you made that day): deleted after 30 days.
  • Reports you send with the Report action (a copy of the reported entry, which includes the text that was looked up, the reason, your optional note, and your install ID): deleted after 365 days.
  • Cached entries (the generated entry for a lookup, stored without your install ID): each one includes the text that was looked up (a word or phrase, or a sentence of up to 2,000 characters). Kept for up to 90 days for words and phrases, up to 30 days for sentences, and up to 7 days when no entry was found. A cached entry may be removed sooner if it is reported.
  • Wikipedia summaries fetched for an entry: cached for up to 14 days, stored under a scrambled (hashed) form of the article name, without your install ID.
  • Install record: holds only the random ID created by our server, the platform, the date it was created, on iPhone your device's attestation public key, and a trust level. Nothing in it identifies you. It is not deleted automatically.
  • Firebase Analytics and Crashlytics data: kept according to Google Firebase's own retention settings.

What we do not do

  • There are no accounts and no sign-in.
  • There are no ads.
  • We do not sell your data.

Tracking

We do not track you across other companies' apps or websites, we do not build advertising profiles, and we do not work with ad networks or data brokers. That is why the app never shows Apple's "Allow app to track" prompt. If this ever changed, we would update this policy and ask for your permission first. Because we do no such tracking, browser "Do Not Track" signals do not change anything.

On your device

Your saved words and your lookup history stay on your device. We do not upload them. Deleting the app removes them.

Apart from the services listed above, we disclose data only if we believe in good faith that the law or a valid legal request requires it, or that it is needed to protect the safety of a person, to investigate fraud, abuse or a security incident, or to enforce our Terms of Use. If Word Anatomy were ever transferred to someone else (for example sold), the data described here could move with it, and this policy would continue to apply to it.

International transfers

Our server runs on Cloudflare's global network, so a lookup may be handled in a data centre near you or elsewhere. Anthropic and Google (Firebase) process data mainly in the United States. Where the law requires it, these transfers rely on the providers' standard safeguards, such as the European Commission's Standard Contractual Clauses in their data processing terms.

Security

Everything the app sends travels over encrypted HTTPS connections. Our server only accepts requests from genuine copies of the app (checked with Google Play Integrity or Apple App Attest), limits how fast requests can be made, and keeps no personal details. Access to the server and its data is limited to us. No system is perfectly secure, so we cannot promise absolute security; if you notice a problem, please tell us at privacy@duhaapps.com.

Your rights

Depending on where you live, you may have the right to ask what data we hold about you, to have it corrected or deleted, to restrict or object to how we use it, to receive a copy of it, and to withdraw consent. Because we hold no names, emails or accounts, we usually cannot find data that belongs to a particular person (see Deleting your data), but we will always answer a request and do what we can. Write to privacy@duhaapps.com; we answer within the time the law requires, and within 30 days at the latest.

Europe, the UK and Switzerland (GDPR). We send what you look up to Anthropic because you asked for the lookup and agreed to the AI notice (consent, and providing the service you asked for). We use analytics and crash reports (only while AI lookups are on), app-integrity checks and rate limits for our legitimate interests in keeping the app working, secure and free of abuse. You can withdraw your consent at any time by turning off AI lookups in Settings › Privacy. We keep reports and some records to meet legal obligations. You can also complain to your local data protection authority.

California (CCPA/CPRA). You have the right to know what personal information we collect and why, to ask us to delete or correct it, and not to be treated differently for using these rights. We do not sell personal information and do not share it for cross-context behavioural advertising.

Children

Word Anatomy is not directed at children under 13, and we do not knowingly collect data from them.

Deleting your data

There are no accounts and we hold no personal details, so we cannot link the data on our server to you. That means we cannot look up or delete data for a particular person. Instead:

  • Uninstalling the app discards everything stored on your device, and the app never uses that install ID again. On iOS a copy of the ID can stay in the device keychain after you uninstall; if you reinstall, the app deletes it the first time it starts and registers a new ID. The install record on our server is not deleted (see above).
  • Usage counters expire after 30 days and reports after 365 days.
  • Saved words never leave your device.
  • Turning off AI lookups in Settings › Privacy stops lookups, analytics and crash reports from then on.

If you have questions, email us (see Contact).

This website

This website (wordanatomy.duhaapps.com) uses no cookies, no analytics and no third-party scripts, and loads its fonts from its own server. It is hosted on Cloudflare, which processes your IP address to deliver the pages and keeps request logs for a short time. If you email us, we keep your email address and message for as long as we need to answer you and keep a record of the conversation.

Third-party privacy policies

Each provider we share data with is bound by its terms or contract to protect it at least as well as this policy and the app store rules require, and may use it only to provide its service to us. They handle data under their own policies:

Changes

If we change this policy, we will update the date above. If a change is important (for example a new kind of data or a new provider), we will also say so in the app or on this website before it takes effect.

Contact

Word Anatomy is operated by Adnan Zawad Toky (Duha Apps), the data controller. For privacy questions and requests, email privacy@duhaapps.com; for anything else, support@duhaapps.com. See also our Terms of Use.