Short version: we collect the minimum data needed to make the app work. We do not sell your data. You can delete your account at any time.
1. Who we are
Kanji Morning is a personal project operated by Guillaume Morin (the "Controller"). Contact: [email protected]
For the purpose of EU Regulation 2016/679 (GDPR), Guillaume Morin is the data controller for personal data processed through this application.
2. What data we collect
We collect only what is strictly necessary to provide the service:
- Account data — when you sign in with Google: your email address, display name, and Google user ID (UID). This is provided by Google's OAuth service and stored in Firebase Authentication.
- Study data — words you save, quiz scores, SRS (spaced-repetition) card states, your JLPT goal, and streak data. Stored in Firestore under your UID.
- Payment data — if you purchase a Premium licence, payment is processed by Stripe. We do not store your card number. Stripe provides us with a customer ID and subscription status only. Stripe's Privacy Policy applies: stripe.com/privacy.
- Local data — study history is also cached in your browser's
localStorage for offline access. This never leaves your device unless you are signed in.
We do not collect: location, device identifiers, IP addresses (beyond what your browser sends to our VPS for serving the page), or any behavioural analytics.
3. Why we collect it
- Account data — to identify you and sync your study data across devices (legitimate interest / performance of contract).
- Study data — to power the SRS algorithm, streak, and quiz history (performance of contract).
- Payment data — to verify your Premium licence (performance of contract).
We do not use your data for advertising or profiling.
4. Where data is stored
- Firebase Authentication & Firestore: hosted by Google, EU data region (
europe-west1 — or the default US region if not explicitly set — see Firebase docs).
- Web server: VPS hosted in Finland (Hetzner), serving the application files only — no personal data stored on the VPS.
- Payment: Stripe, USA/EU (Stripe is certified under EU–US Data Privacy Framework).
5. How long we keep it
- Account & study data: retained as long as your account exists. Deleted within 30 days of account deletion.
- LocalStorage: stored on your device until you clear it or delete your account.
- Stripe data: governed by Stripe's retention policy (typically 7 years for financial records).
6. Do we share your data?
We do not sell, rent, or share your personal data with third parties, except:
- Google Firebase — as our hosting and database provider.
- Stripe — as our payment processor, if you purchase Premium.
Both are data processors under a DPA (Data Processing Agreement) with GDPR-compliant terms.
7. Your rights (GDPR)
If you are in the European Economic Area, you have the following rights:
- Access — request a copy of your personal data.
- Rectification — ask us to correct inaccurate data.
- Erasure — request deletion of your account and all associated data ("right to be forgotten"). You can do this directly in the app via Settings → Delete Account, or by emailing us.
- Portability — receive your study data in a machine-readable format (JSON export available in Settings).
- Objection — object to processing based on legitimate interest.
- Lodge a complaint — with your national supervisory authority (in France: CNIL).
To exercise any right, email [email protected]. We will respond within 30 days.
8. Cookies & local storage
Kanji Morning does not use advertising cookies. We use:
- Firebase Authentication cookie — a session token stored by Firebase to keep you signed in. Essential for the service.
- localStorage — used to cache your study data locally for offline access. No expiry; cleared when you clear browser data or delete your account.
No third-party tracking pixels or analytics scripts are loaded.
9. Children
This service is not directed at children under 13. We do not knowingly collect data from anyone under 13. If you believe a child has provided us data, please contact us for immediate deletion.
Questions about this policy: [email protected]
We may update this policy. Changes will be reflected by the "Last updated" date above. Continued use of the app after changes constitutes acceptance.