Privacy
Last updated: 2026-09-20
Your learning data
Which kanji you have started, your review history, your settings and your pinned example words are stored on your device. The app has no account. It never asks for a name, an email address or a phone number. Deleting the app deletes the data on that device. If you have turned on your phone's own backup (iCloud or Google), the data is part of that backup, under your Apple or Google account.
Sync
Sync is part of the subscription. The app encrypts your learning data on the device, with a key derived from your sync code, and uploads only the encrypted copy. Our server stores that copy under a hash of the code, with the time it was last used, and nothing else. We cannot read the data, and without the code we cannot tell whose it is. On an upload the server asks RevenueCat whether the subscription that belongs to the code is active. It writes down neither the answer nor the identifier it asked with. The legal basis is the subscription contract (Art. 6(1)(b) GDPR).
Subscriptions
The subscription is sold and billed by Apple on iOS and by Google on Android. Your payment details go to them and never to us. Both process that data under their own privacy policies.
The app uses RevenueCat to find out whether a subscription is active. On every start it sends RevenueCat a random identifier that was created on your device. If you subscribe, RevenueCat also receives what the store reports about the purchase: which product was bought, when it renews and whether it is still active. Each request also carries the app version, device model, operating system version, preferred languages and store country, and on iOS the identifier for vendor that iOS gives your device for our apps. The app also reports when the subscription screen is opened. RevenueCat sees the IP address a request comes from. It receives no name, no email address and no store account. RevenueCat's own policy is at revenuecat.com/privacy. The legal basis is the subscription contract (Art. 6(1)(b) GDPR) and, before a purchase, our legitimate interest in knowing whether one exists (Art. 6(1)(f) GDPR).
Analytics and advertising
The app contains no analytics and no advertising, and it does not track you across apps or websites. If you have agreed in your device settings to share diagnostics with app developers, Apple or Google send us crash reports. They contain no learning data and do not identify you.
This website
These pages set no cookies, use no analytics and load nothing from other domains. The hosting provider, Cloudflare, processes what every request carries (IP address, time, requested address, browser identification) in order to deliver the page. The legal basis is our legitimate interest in operating the website (Art. 6(1)(f) GDPR).
If you write to us, we use your email address and your message to answer you, and delete both once the matter is closed. The legal basis is our legitimate interest in answering requests (Art. 6(1)(f) GDPR).
Processors and transfers outside the EU
Three companies process data on our behalf, each under a data processing agreement that obliges it to keep the data confidential and to use it only to provide its service.
- Amazon Web Services EMEA SARL, Luxembourg (servers in the EU)
- Cloudflare, Inc., United States
- RevenueCat, Inc., United States
Cloudflare is certified under the EU-US Data Privacy Framework. Transfers to RevenueCat take place under the European Commission's standard contractual clauses.
Storage period
The website and the sync server keep no logs of requests. The encrypted sync copy is kept until you delete it in the app's settings, and is deleted automatically after 24 months without use. Subscription records at RevenueCat are kept for as long as the subscription and the statutory retention periods for accounting records require.
Your rights
Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and objection. If something is wrong, please contact us first. You can also complain to the Austrian data protection authority, the Datenschutzbehörde, or to the authority of the country you live in.
Besides your emails to us, the only data we can look up for you is the subscription record at RevenueCat, and for that we need the Support ID shown in the app's settings. Your learning data is on your device, and the synced copy can only be read with your sync code.
Contact
Kaisho and this website are run by Clemens Gruber. The address is in the imprint. For questions about privacy, write to kaisho@gruber.software.