Privacy Policy

JapanLingo is operated by CSJotLab Developer Team (“we”, “us”). We are the data controller for the personal data described in this policy, and we are governed by the laws of [JURISDICTION].

Questions? Email us at csjotlab@gmail.com.

When you create an account, the following data is stored on our backend (hosted by Supabase):

• Account data — your email address and password. Passwords are handled by Supabase Auth; we never see or store your plain password. Email confirmation is required. If you choose the optional Sign in with Google, we receive your name, email address, and profile photo from Google — we never receive your Google account password.
• Profile data — your display name, an optional avatar photo you upload (stored in private, owner-scoped cloud storage), your chosen JLPT level, learning goal, daily-minutes goal, and study preferences (romaji, furigana, audio auto-play).
• Learning data — lesson progress, quiz attempts and graded answers, XP, streaks, achievements, bookmarks, items you mark as difficult, spaced-repetition schedules, and daily study-time estimates.
• Support data— if you use “Report a problem”, we receive your message and your account ID so we can respond.
• Purchase data — some content is free and full access is paid. Payments are processed entirely by the Apple App Store or Google Play; we never receive your card or bank details. We only receive confirmation of your purchase or subscription status so we can unlock premium features on your account.

• No precise location.
• No contacts.
• No advertising identifiers.
• No data for advertising of any kind.
• The app contains no ads and no third-party analytics or tracking SDKs.

Some settings never leave your phone and are never sent to us:

• Your theme choice (light / dark / system).
• Your daily review-reminder schedule. Reminders are local notifications scheduled on your device — there is no push server. Notification permission is opt-in, and you can revoke it in your device settings at any time.
• Kanji writing-practice drawings, which are checked on-device and never uploaded.
• Audio pronunciation, which uses your device’s built-in text-to-speech.

We use the data above only to:

• Create and secure your account, and confirm your email.
• Save your learning progress, streaks, and spaced-repetition schedules and sync them across your devices.
• Show your profile and personalize your study experience.
• Unlock the premium content you have purchased.
• Respond to problem reports you send us.

We do not sell your personal data, and we do not share it with anyone for advertising or marketing.

We use a small number of service providers who process data on our behalf:

• Supabase — provides our database, authentication, and file storage, and hosts all account data described above.
• Google Sign-In — an optional way to sign in. Used only if you choose it.
• Google Fonts — the app currently fetches fonts at runtime. When it does, standard network request data (such as your IP address) is sent to Google in order to deliver the font files.
• Apple App Store / Google Play — process all payments for premium access under their own privacy policies. We never see your payment card details.

These providers may only use your data to provide their service to us — never for their own advertising.

If you are in the European Economic Area or the UK, we rely on these legal bases:

• Contract (Art. 6(1)(b)) — account, profile, and learning data are needed to provide the service you signed up for.
• Legitimate interests (Art. 6(1)(f)) — keeping the service secure and responding to problem reports.
• Consent (Art. 6(1)(a)) — optional features such as Google Sign-In and notification permission. You can withdraw consent at any time.

Depending on where you live, you have the right to:

• Access a copy of your personal data.
• Correct inaccurate data (you can edit your profile in-app).
• Delete your data (see the next section).
• Receive your data in a portable format.
• Object to or restrict certain processing.
• Complain to your local data-protection authority (EEA/UK) if you believe we have handled your data unlawfully.

California residents (CCPA/CPRA): you have the right to know, delete, and correct your personal information, and the right not to be discriminated against for exercising those rights. We do not sell or “share” personal information as defined by the CCPA, so there is nothing to opt out of.

To exercise any right, use the in-app tools or email csjotlab@gmail.com. We respond within the timelines required by law.

You can permanently delete your account directly in the app:

• Go to Profile → Delete account.
• Deletion removes your account, profile, avatar, and all learning data from our servers.

You may also request deletion, or a copy of your data, by emailing csjotlab@gmail.com.

We keep your data only while your account exists. When you delete your account, your data is removed from our servers. Data that stays on your device (theme, reminders, practice drawings) is removed when you uninstall the app or clear its data.

We take reasonable technical and organizational measures, including:

• Encrypted connections (HTTPS/TLS) between the app and our backend.
• Password handling by Supabase Auth — passwords are never stored in plain text and never visible to us.
• Owner-scoped storage rules so only you can access your avatar and private data.
• Access to production data limited to what is strictly necessary.

No system is 100% secure, but we work to protect your data and will notify you and the relevant authorities of a data breach where the law requires it.

Our service providers (Supabase and Google) may store or process data on servers outside your country, including outside the EEA. Where that happens, transfers are protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

JapanLingo is not directed at children under 13 (or under 16 in the EEA), and we do not knowingly collect personal data from them. If you believe a child has created an account, contact us at csjotlab@gmail.com and we will delete the account and its data.

If we change this policy, we will post the new version at this page and update the effective date. For significant changes, we will also notify you in the app or by email before the change takes effect.

CSJotLab Developer Team
Email: csjotlab@gmail.com