← Back to Milestone

Privacy Policy

Last updated: July 10, 2026

1. Introduction

Milestone ("we," "our," or "us") is a vocabulary learning app for iPhone. It teaches the 1000 most useful words in whichever language you're learning, glossed in the language you already speak. This Privacy Policy explains what data we collect, what we don't, and how the small amount we do use flows between your device and a couple of ordinary services.

The most important thing to understand: your learning stays on your device.The words you've learned, your streak, your ranks, and your settings are all stored locally on your phone. We never see them. The only thing that lives on our servers is the account you sign in with. We don't sell ads, we don't run any analytics or tracking SDK, and Milestone has no camera, microphone, location, or contacts access at all.

2. How Your Data Flows

Understanding the data flow is the clearest way to understand our privacy model:

• Device only (all of your learning):Your progress (which of the 1000 words you've learned and when), your daily streak, your rank, and your settings (the two languages you picked, your daily goal, sound and notification toggles) are stored on your device using local storage (AsyncStorage). This data never leaves your phone and we never receive it. It currently does not sync between devices.
• Device ↔ Firebase (your account): To use Milestone you create an account. Authentication is handled by Google Firebase Authentication. Firebase stores your email address, your display name, the sign-in provider you used, and a profile photo URL if your provider supplies one. This is the only personal data we hold on a server. We do not store your learning progress in the cloud.
• Device ↔ Apple / Google (sign-in): If you sign in with Apple or Google, the provider handles authentication and returns a token to Firebase Auth. We never see your Apple or Google password. If you sign in with email and password, Firebase Authentication stores and verifies those credentials; we never see your password in plain text.
• Device ↔ RevenueCat ↔ Apple (subscriptions): When you upgrade to Milestone Pro, the purchase is processed by Apple. RevenueCat sits between the app and the App Store to tell us whether your Pro entitlement is active. RevenueCat receives your Firebase user ID and the store receipt Apple returns. We never see your Apple ID or payment method.

3. Information We Collect

Account information

• Email address (if you sign up with email or Google; Apple may relay a private email)
• Your display name, if you set one or your sign-in provider supplies it
• A Firebase Authentication user ID (UID), generated when you sign up
• The sign-in provider you used (Apple, Google, or email)
• The profile photo URL your sign-in provider supplies, if any

Learning progress and settings (created by you, kept on your device)

• Which of the 1000 words you have marked learned, and when
• Your daily streak and last active day
• The language you speak and the language you're learning
• Your daily word goal, and your sound and notification toggles

All of this is stored only in local storage on your device. It is not uploaded to us or to any third party, and deleting the app removes it.

Subscription state

• Whether your Milestone Pro entitlement is active (true/false), as reported by RevenueCat and the App Store

What we do NOT collect

• No product analytics or behavioral event tracking. Milestone ships with no analytics SDK.
• No camera or photo access. Milestone has no camera feature.
• No location data of any kind
• No microphone, contacts, calendar, or health data
• No advertising identifier (no IDFA), no ad networks, no retargeting
• No cross-app or cross-site tracking of any kind
• No session recording or screen replay
• No copy of your learning progress on our servers

4. Tracking & Advertising

Milestone does nottrack you across other companies' apps or websites. We do not participate in ad networks, retargeting, or audience-building of any kind. We do not use Apple's IDFA (Identifier for Advertisers). Accordingly, the App does not present an App Tracking Transparency (ATT) prompt, because no cross-app or cross-site tracking occurs.

5. Third-Party Services

The App relies on the following services, each with their own privacy policies:

• Google Firebase (Authentication): stores your account and verifies your sign-in. Data is stored in Google Cloud in the United States.
• Apple: handles Sign in with Apple, App Store distribution, and Milestone Pro in-app purchase billing.
• Google Identity: handles Sign in with Google.
• RevenueCat: reports your Milestone Pro entitlement (active/expired) to the app. RevenueCat receives your Firebase user ID and the store receipt, and processes data in the United States.

Milestone does not use any analytics, advertising, or crash- reporting service.

6. Data Retention & Deletion

Your learning progress and settings live only on your device. Deleting the app removes them, and there is no server-side copy to delete.

Your account (the record held by Firebase Authentication) stays until you delete it. To delete your account and the personal information tied to it, email support@moetalaat.com from the address on the account, or use the in-app account deletion option where available. We delete your Firebase Authentication record (email, display name, provider, and photo URL), which invalidates all sessions. This is irreversible. Because we hold nothing else about you, that removes everything on our side.

7. Legal Basis for Processing (GDPR)

If you are located in the EEA, United Kingdom, or Switzerland, we process your personal data on the following legal bases:

• Contractual necessity (Art. 6(1)(b) GDPR): creating and maintaining your account so you can use the App, and confirming your Pro entitlement.
• Legitimate interest (Art. 6(1)(f) GDPR): basic account security and abuse prevention.

8. International Data Transfers

Firebase and RevenueCat process data in the United States. If you use Milestone from outside the U.S., your account data is transferred to and processed in the U.S. These providers offer Standard Contractual Clauses for cross-border transfers.

9. Your Rights

You have the right to:

• Access the personal information stored in your account (your email, name, and provider are visible in the app)
• Delete your account and the personal information tied to it at any time
• Request a copy of your data by emailing us

EEA/UK residents (GDPR): you also have the right to data portability, the right to restrict or object to processing, and the right to lodge a complaint with your local data protection authority.

California residents (CCPA/CPRA):you have the right to know what personal information we collect, the right to delete it, and the right to opt out of "sale" or "sharing" of personal information. We do not sell or share your personal information.

10. Children's Privacy

Milestone is a learning app suitable for teens and adults, but it is not directed to children under the age of 13 (or 16 in the EEA), and we do not knowingly collect personal information from them. If you believe a child has created an account, contact us and we will delete it.

11. Security

Authentication is handled by Firebase Auth, and your sign-in tokens are kept in your device's secure local storage. All traffic between the app, Firebase, and RevenueCat uses HTTPS. No system is perfectly secure, but Milestone stores almost nothing about you: your learning never leaves the device, and your account record holds only your email, name, and sign-in provider.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced on this page and, if significant, in the app. Continued use of Milestone after changes constitutes acceptance.

13. Contact

Questions, requests, or anything else, write to support@moetalaat.com.

14. Summary

In short: Milestone keeps all of your learning (words, streak, ranks, settings) on your own device, never on our servers. The only thing in the cloud is the account you sign in with, held by Firebase, which stores your email, name, and sign-in provider. RevenueCat tells us whether Pro is active. There is no analytics, no ads, no camera, no location, and no cross-app tracking. Delete the app and your progress is gone. Delete your account and the rest is gone too.