Privacy Policy

1. Data controller

Nichiyomu e.U.
Hermann-Bahr Gasse 10
8020 Graz
Austria
legal@nichiyomu.com

We are not required to appoint a Data Protection Officer. Privacy questions go to the address above.

2. What data we collect

• Account information - email address, display name, password hash, and your chosen starting JLPT level.
• Reading activity - which texts you read, your Easy/Medium/Hard ratings, your reading-level score and its history, streaks and timestamps, and the words and grammar points you save to your notebook, each with the sentence it came from.
• Content reports - the category and any free-text note you submit when reporting a text.
• Preferences - furigana setting, light/dark theme, audio volume and playback speed.
• Newsletter preference - only if you tick the optional box: whether you are subscribed, and a record of each time you subscribed or unsubscribed, with the date, where you did it and the wording you agreed to. We keep that record because we have to be able to demonstrate that you gave permission.
• Technical data - IP address, browser type and device information, collected when you load the site and when our anti-abuse check runs on the sign-up, sign-in and password-reset forms.
• Usage analytics - pages you visit, the site that referred you, an approximate country, your browser, device type and screen size, and which features you open. Collected without cookies, kept separately from your account, and never joined to your reading history. Your IP address is processed to derive the country and to tell one visit from another, but is not stored.
• Error diagnostics - if something breaks, technical details of the failure. We have configured our error monitoring not to attach personal data to these reports and session recording is switched off.
• Subscription status - your plan tier and whether you have used your free trial. Payment and card details are handled entirely by Polar; we never see or store them.
• Advertising measurement - only if you accept advertising cookies: that you arrived from one of our ads on Google or Meta, and whether you then signed up or started a subscription. This is collected on your device by Google and Meta and goes to them. It never includes what you read, how you rated it, or your reading level.
• Where your sign-up came from - if you reached us through an advert or a campaign link, the campaign labels in that web address (which campaign, advert and search term it was) are stored with your account when you create it. We do not keep the click identifier that Google or Meta adds to such links. This is separate from the advertising cookies above and needs no consent, because we read it from the address you already requested and store nothing on your device to do it. We do not send it to Google or Meta.

3. Why we collect it, and on what legal basis

• Providing and personalising the reading experience, including matching text difficulty to your level - contract performance (Art 6(1)(b) GDPR)
• Managing your subscription and entitlements - contract performance
• Sending account and service emails (confirmation, password reset, changes to these terms) - contract performance
• Protecting the sign-up, sign-in and password-reset forms against bots and abuse - legitimate interest (Art 6(1)(f)) in keeping the Service secure
• Diagnosing errors and improving the Service - legitimate interest in a working product
• Administering, supporting and securing the Service - including reviewing texts that users report and investigating abuse - legitimate interest (Art 6(1)(f)) in a Service that works and is safe to use, or contract performance where we are acting on your own support request. This involves our own access to the data stored about you; see section 5
• Measuring how the Service is used, so we can tell which parts are worth improving - legitimate interest (Art 6(1)(f)) in developing a product people can actually use. This uses cookieless analytics that do not identify you and are not linked to your account; you may object at any time (see section 7), and blocking the analytics script in your browser has the same effect
• Calibrating text difficulty across all readers - legitimate interest; this uses your rating together with your reading level at that moment, and the result is retained in aggregate form only
• Knowing which advert or campaign link a sign-up came from, so we can tell whether our advertising is worth paying for - legitimate interest (Art 6(1)(f)) in not spending money on advertising that does not work. Only the campaign labels described in section 2 are used, they stay with us and are never shared with Google or Meta, and you may object at any time (see section 7)
• Measuring whether the advertising we run on Google and Meta actually brings people to Nichiyomu - consent (Art 6(1)(a)). Nothing is collected for this unless you accept advertising cookies, and you can withdraw at any time from the Cookie Policy page
• Sending you our newsletter, if you asked for it: news about new features and updates, and offers such as discounts on our paid plans - consent (Art 6(1)(a)). We use your email address and, to decide which emails are relevant to you, your current plan and your reading activity as described in section 2: an offer on a paid plan, for example, goes only to people who are not on it yet, and news about advanced texts only to people reading at that level. When an email is meant only for some readers, our email provider receives the list of addresses it goes to and nothing else about you, not even why you are on it, and we delete that list once the email has been sent. The box is never ticked for you, and signing up for Nichiyomu never requires it. You can withdraw at any time from the settings page or from the unsubscribe link in any newsletter; withdrawing does not affect anything we sent before
• Meeting legal obligations such as accounting and tax record-keeping - legal obligation (Art 6(1)(c))

We send marketing email only to people who asked for it. The newsletter box at sign-up is optional and unticked; leaving it alone means you hear from us only about your account. If you do opt in, we keep a record of when you did and what you agreed to, we do not track whether you open our emails or which links you click, and every newsletter carries an unsubscribe link. Apart from which emails you agreed to receive, your plan and your reading activity are the only things about your account we use to decide which newsletters reach you, and that decision is made on our own systems. If you accept advertising cookies, Google and Meta measure whether their ads brought you here - but your reading activity, your ratings and your reading level are never part of that. Those tags see that a visit and a sign-up happened, and nothing about what you read.

Providing your email address and password is necessary to create an account - without them we cannot provide the Service. Everything else is optional or generated as you use the app.

4. Automated processing and your reading level

Nichiyomu estimates your Japanese reading ability from how you rate each text, and uses that estimate to choose what to show you next. This is profiling in the sense of Art 4(4) GDPR: we evaluate an aspect of your performance in order to predict which texts suit you.

It affects which practice texts you are shown and, only if you subscribed to the newsletter, which newsletters you receive (see section 3). There is no automated decision-making that produces legal effects or similarly significantly affects you within the meaning of Art 22 GDPR. You can reset your level at any time from the settings page, and you can object to this processing by contacting us - though it is the core function of the Service, so objecting in practice means the Service can no longer match texts to you. Its use for the newsletter is different: it ends as soon as you unsubscribe, and the Service carries on exactly as before.

5. Where your data is stored, and who processes it

Your account and reading data are stored in the European Union - in Supabase's Frankfurt (eu-central-1) region - and our server-side code runs in Vercel's Frankfurt region. Some of the providers below operate from outside the EU. Where that is the case, the transfer is covered by the European Commission's Standard Contractual Clauses together with supplementary technical and organisational safeguards, or by an adequacy decision where one applies.

We have data processing agreements in place, as required by Art 28 GDPR, with the providers above that act only on our instructions. We do not sell your personal data.

Google and Meta are different, and it matters. If you accept advertising cookies, they do not act purely on our instructions: they also use what they observe for their own purposes, including recognising you on other websites and personalising the advertising you are shown there. That is precisely why this category asks for your consent instead of relying on a contract, and why declining it costs you nothing here.

Joint controllership with Meta. For the step in which the Meta pixel collects data on your device and transmits it to Meta, we and Meta Platforms Ireland Limited are joint controllers within the meaning of Art 26 GDPR. In essence: we decide to place the pixel and for what purpose; Meta determines how it processes that data afterwards; and Meta is responsible for informing you about that later processing and for answering your data-protection rights in respect of it, under its own privacy policy. You may exercise your rights against either of us - write to the address in section 1 and we will pass on whatever we are required to.

Access by us. The providers above are not the only people who can reach your data - we can too. A strictly limited number of authorised people (at present, the operator of Nichiyomu) hold administrative credentials to the database, and can therefore see everything stored in it: your account details, your reading history and ratings, your notebook, your reading level, your preferences, your subscription tier, and any content report you submit, including its free-text note.

We use that access only where there is a reason to: operating, maintaining and repairing the Service; answering your support or data-protection requests; reviewing texts that you or other users have reported; and investigating abuse, fraud or security incidents. The legal basis is our legitimate interest in running a secure and working Service (Art 6(1)(f) GDPR), or contract performance where we are acting on a request you made. We do not read your data out of curiosity, we do not use it to build any profile of you beyond the reading level described in section 4, and we do not pass it to anyone outside the providers listed above unless the law requires us to.

Two things stay outside that access. Your password is stored only as a cryptographic hash - we cannot read it or recover it, and resetting it is the only way back into an account you are locked out of. Your payment and card details never reach our systems at all; they are held by Polar, as set out in the table above.

If we ever extend this access beyond the people described here - to an employee, a contractor or a moderator - they will be bound by a written confidentiality obligation before they receive it, and this section will be updated to say so.

6. How long we keep it

• Account and reading data - for as long as your account exists.
• If you delete your account - your account, profile, activity, notebook and reports are erased immediately. We send one confirmation email to the address the account used and keep no copy of it beyond our email provider's own delivery logs. Encrypted backups held by our hosting providers roll off within 30 days, after which no copy remains.
• Reading interactions used for difficulty calibration - on deletion the link to your account is removed and never restored. What stays is the rating, which text it was for, the reading level you had at that moment, and when it happened. No name, email, account identifier or device identifier remains, and we hold no key that could join those rows back to a person. We stop short of calling them fully anonymous, because a long enough run of ratings is distinctive in principle - so we say plainly that we keep them unlinked rather than claim they could never be traced. Keeping them is what lets text difficulty stay accurate for everyone else.
• Error diagnostics - retained by Sentry for up to 90 days.
• Usage analytics - retained for up to 2 years, so that one year can be compared against the next. It carries no identifier, so once collected it can no longer be traced back to you.
• Advertising measurement - the cookies listed in the Cookie Policy expire on your device within the lifetimes stated there. What Google and Meta build from them afterwards is held by those companies under their own retention policies, which we do not control.
• Where your sign-up came from - kept with your account for as long as the account exists, and erased with it.
• Newsletter subscription and consent record - kept while you are subscribed, and the record of when you subscribed or unsubscribed for as long as your account exists, because we have to be able to show that we had your permission. Both are erased when you delete your account, and your address is removed from the mailing list at the same time.
• Billing and invoicing records - held by Polar as Merchant of Record for the retention period its own tax obligations require; in Austria, accounting records are generally kept for seven years. When you delete your account we ask Polar to delete your customer record and anonymise the personal data in it, but the invoices themselves stay, because Polar has to keep them.

7. Your rights

Under the GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict or object to processing
• Receive your data in a portable, machine-readable format
• Withdraw consent where processing is based on it, without affecting prior processing
• Lodge a complaint with a supervisory authority

Deleting your data is self-service: go to the settings page and choose "Delete account". This is immediate and permanent.

Unsubscribing from the newsletter is self-service and takes one click: use the switch on the settings page, or the unsubscribe link at the bottom of any newsletter. Either works on its own and neither asks you to confirm.

Getting a copy of your data - email legal@nichiyomu.com from your account address and we will send you a machine-readable export of your account, preferences, reading history and notebook within 30 days, free of charge. We currently fulfil these requests manually.

For any other right, write to the same address. We respond within one month, extendable by two further months for complex requests, in which case we will tell you.

Supervisory authority. Our lead authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, Austria - dsb.gv.at. You may also complain to the authority where you live or work.

8. Children

Nichiyomu is not intended for children under 16. When you create an account you must confirm that you are 16 or older. We do not knowingly collect data from children under 16, and we do not verify age beyond that confirmation.

If you are a parent or guardian and believe a child under 16 has created an account, write to legal@nichiyomu.com and we will delete the account and its data promptly.

9. Users in the United Kingdom

If you are in the UK, we process your data on the same basis set out above, under the UK GDPR and the Data Protection Act 2018. Transfers out of the UK rely on the UK International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses. You may complain to the Information Commissioner's Office - ico.org.uk.

10. Users in the United States (California and other states)

This section is written for visitors in US states with comprehensive privacy laws, including California (CCPA/CPRA), Colorado, Connecticut, Virginia and others. We are a small Austrian business and fall well below the thresholds that make most of those laws apply, so in all likelihood they do not bind us. We set out our practices here anyway, because you should be able to see how we handle these things wherever you live, and we give you the rights below to the extent the law requires it of us.

Categories we collect. Identifiers (email address, display name, IP address); internet and device activity (browser and device information, error diagnostics); commercial information (subscription tier and status); inferences drawn from your reading activity (your estimated reading level); and, if you accept advertising cookies, the advertising identifiers described in our Cookie Policy. We collect these for the purposes described in section 3 and keep them as described in section 6. We do not collect sensitive personal information, and we do not use or disclose personal information for purposes other than those disclosed here.

We do not sell your personal information. We do share it for cross-context behavioural advertising - as those terms are defined under the CCPA - but only where you have accepted advertising cookies. That sharing consists of the advertising identifiers described in our Cookie Policy, disclosed to Google and Meta. We do not sell or share the personal information of anyone under 16.

Do Not Sell or Share My Personal Information. Advertising cookies are off until you switch them on, so declining the banner already means nothing is shared. If you accepted and want to stop, open the Cookie Policy page and choose "Change your cookie choices" - that withdrawal has the same effect as a Do Not Sell or Share request, and takes effect immediately.

Your rights. You may request to know what personal information we hold, to have it corrected, to have it deleted, and to obtain a portable copy. You may exercise these rights yourself - deletion from the settings page, a copy by emailing us - or through an authorised agent. We will not discriminate against you for exercising any of these rights: your price and service stay exactly the same. To make a request, email legal@nichiyomu.com. We may need to verify that the request comes from your account address.

11. Changes to this policy

We may update this policy from time to time. The version number and date at the top of this page change with every update. We will notify you of material changes by email or an in-app notice before they take effect.