Viva Privacy Policy
Last updated: July 16, 2026
Viva (also shown as “无痛英语” in earlier extension versions) helps people notice, save, and review English words and phrases. This policy covers the Viva Chrome/Edge extension and companion app.
Information We Process
| Data | How it is used |
|---|---|
| Webpage text | The extension reads webpage text locally in your browser to identify and mark English words and phrases. Full webpage content, form contents, keystrokes, and browsing history are not uploaded. |
| Vocabulary data | When you actively save an expression, Viva stores its type, up to 300 characters of context, page title and URL, dictionary and phonetic information, status, and review schedule. Signed-in data is synchronized across your devices. |
| Account data | Viva uses Google OAuth through Supabase. Google and Supabase process the sign-in request; Viva receives your Google email, provider/account identifiers, basic profile metadata made available by Google, a Viva account identifier, and an authentication session. Viva does not ask for or receive your Google password. The extension can also be used in local guest mode. |
| Device and settings data | A random installation identifier, preferences, sync cursor, queued offline changes, and migration receipts are stored locally for synchronization and recovery. |
| Optional AI explanation data | Only after explicit opt-in and an active contextual-translation request, Viva sends a random request ID, the saved expression, type, up to 300 characters of locally redacted context, a prompt version, and a salted pseudonymous provider user ID to DeepSeek. It does not send the page URL, title, local dictionary text, Google identity, or authentication session to the model provider. |
| Service metadata | Hosting providers may process standard request metadata such as IP address, request time, response status, and security logs. Viva does not use advertising or third-party analytics SDKs. |
How We Use Information
We use the information above only to provide core product functionality:
- highlight unknown English words and phrases on webpages;
- show definitions and learning priority hints;
- save words or phrases that you choose to mark;
- schedule and record review sessions in the companion app;
- sync account vocabulary and review progress across devices;
- load vocabulary levels and phrase dictionaries.
Local Processing and Page Access
Viva requests webpage access for its single purpose: marking English vocabulary in the page you are reading. Tokenization, dictionary lookup, frequency scoring, editable-field protection, and page marking happen locally. Vocabulary content is uploaded only after you actively save a word or phrase.
Accounts, Local-First Storage, and Sync
Guest cards remain in the browser’s IndexedDB until you clear them, uninstall the extension, or merge them into a verified account. Signed-in clients keep owner-scoped local copies in IndexedDB or SQLite and sync queued offline actions to Supabase over HTTPS. Signing out does not merge one person’s data into another account.
Optional AI Explanations
AI explanations are off until you affirmatively enable them. Only an explicit “Query” action, or the first hover over an already-saved card without an AI explanation, can start a request. Email addresses, phone/card-like numbers, and long numeric identifiers are redacted in the browser and checked again by the server. The full webpage, page URL, title, local dictionary, Google identity, and Supabase token are not sent to DeepSeek. Provider credentials remain only on the server.
Requests require a valid Viva account session and are limited to 5 attempts per minute, 50 successful requests per day, 500 per month, and 50,000 model tokens per day per account, plus a service-wide safety limit. A minimal idempotency receipt may be retained for up to 24 hours; operational quota counters are retained to enforce limits. Disabling consent stops new model requests. If AI is unavailable, saving and reviewing continue with the local dictionary fallback. DeepSeek processes model requests under its own service and privacy terms.
Third-Party Services
Google provides the OAuth sign-in identity. Supabase provides the authentication session, database synchronization, and server functions. DeepSeek processes only the optional, consented and bounded explanation payload described above. Apple, Google, and Microsoft may process store distribution data under their own policies.
Data Sharing
We do not sell, rent, or trade your personal information, vocabulary data, webpage content, or browsing history. We do not use your data for advertising.
Webpage Content
The extension requires access to webpages so it can mark vocabulary inside the page you are reading. This analysis happens locally in your browser. It saves only the specific words or phrases and bounded context that you choose to mark. Full webpages and browsing history are not uploaded.
Data Storage and Deletion
Guest data stays on the device until claimed, cleared, or uninstalled. Synced cards, review history, tombstones, and change records remain while the account exists so offline devices cannot resurrect deleted data. You can export a versioned JSON backup or Anki-compatible TSV file.
The Viva app provides account deletion in Settings. After confirmation, it deletes the authentication account and associated Viva cloud data; the initiating device clears its local account cache only after server success. Other devices clear that account when they reconnect. Offline device-only copies can be removed by clearing storage or uninstalling.
Security
Viva uses HTTPS, per-user row-level database security, and authenticated server functions. In the extension, the revocable Supabase session is restricted to trusted extension contexts; model requests are sent only by the background context through the authenticated server function. Provider and service-role secrets are not shipped in the extension or app. No internet service can guarantee perfect security, but Viva minimizes the content it uploads.
Children
Viva is a general learning tool for adults and is not directed to children under 13.
Changes
We may update this Privacy Policy from time to time. Updates will be reflected by changing the "Last updated" date above.
Contact
If you have questions or deletion requests, contact us at liuysh20@gmail.com.