Privacy

We store the minimum needed to run the app: your email (sign-in), the name you give your samurai, the cards and decks you use, your study history, and your streak. We do not sell or share this data.

Signing in

When you sign in with Google, Apple or GitHub, we receive your email and, where the provider offers it, your name and profile photo. Nothing else from that account is read. When you sign in with an email magic link, we send a one-time link via Resend. The same account works on the web and in the mobile app.

What you bring into the dojo

Texts you import into the Reader (pasted text or a book file), transcripts you add to the media library, and the cards you write are stored under your account and are private to you. We never publish or share them, and we never train anything on them. Deleting the item, or your account, deletes them.

Learning mistakes and Sensei

To understand recurring learning difficulties and improve Sensei, we store mistakes from supported practice, course, grammar, listening, speaking and writing exercises on the web and in the mobile app. This applies to Free and Pro accounts. A record can include the expected answer, your submitted answer, the exercise and language, its outcome and a derived mistake category. Expected and submitted answer fields are limited to 512 characters each. We do not add fully correct answers to this separate mistake record.

The answer text and detailed answer analysis are cleared once they are older than 90 days by our daily retention job. Mistake categories and study statistics remain as part of your study history while your account exists. These records are included in your data export and deleted when you delete your account; mistake text is also removed when an inactive account is anonymized. This separate retention rule does not delete writing submissions or other content you choose to save in the app.

For Pro accounts, Sensei uses recent learning mistakes and study activity to identify recurring difficulties, suggest a personal study plan and provide feedback. This can run in scheduled background jobs, including for activity recorded by older versions of the app. We send Anthropic a bounded selection of recent expected and submitted answers, exercise and language information, mistake categories and study statistics. Planning can also use your learning goal, interests, level and the names of available learning activities. We do not include your account name, email address or account id in these model inputs. Text you enter can itself contain personal information, so please avoid sensitive details. Sensei’s results are associated with your account and are not shared with other learners. Free accounts’ captured mistakes are not sent for these Pro Sensei model calls. To ask about this processing or object to it, contact privacy@kotobadojo.com.

The 90-day rule above describes answer text and detailed analysis in our database, not the AI provider’s retention period. Anthropic processes API inputs and outputs under its commercial terms and applicable retention, safety and legal requirements; see Anthropic’s commercial data-retention information. We do not use these records to train our own AI model. Operational records that limit Sensei model calls are included in your account export and removed by scheduled cleanup after 90 days.

Generated content and AI providers

Card audio and card illustrations are generated and stored by our service providers. Only the word being spoken or illustrated is sent — never your name, email or account id — and each result is reused by every learner of that word, so it never identifies you.

Some features send text to an AI or translation provider: tap-to-translate in the Reader, in Takeshi’s Tale and in the media library sends the word or sentence you tap; adding a card sends the word and its translation so an example sentence can be suggested; the conversational practice exercises send the text you type in that exercise so it can be answered or corrected. We do not add your account name, email or account id to those inputs, but text you enter may itself contain personal information. Shared content such as card audio, illustrations and cached example sentences can be reused across learners. Personal exercise responses and Sensei analysis, plans and feedback are different: they relate to your learning activity. Sensei can be prepared in background jobs rather than only when you open an AI exercise.

Notifications

The mobile app can send push notifications (a study reminder, a streak at risk) and we may send occasional product emails. Both are delivered through OneSignal. To do that we share an anonymous device token, your email, your app language and a handful of study facts (whether cards are due, your streak, whether you have Pro) so a reminder can be relevant. You can turn push off in your device settings or in the app under Self → Notifications; every email carries an unsubscribe link, and unsubscribing is honoured immediately and stays in force unless you opt back in yourself.

Payments

If you subscribe to Pro on the web, payments are processed by Stripe. In the mobile app, purchases go through the Apple App Store or Google Play under their own terms. In all cases your subscription status is brokered by RevenueCat. Your card details are handled by the payment provider and are never stored on our servers — we keep only your subscription state and an internal billing id.

The feedback board

Everything you post on the feedback board (feedback.kotobadojo.com) is public, shown with your samurai name. Please don’t put anything there you wouldn’t want seen. Reports of a problem sent from inside the app go only to us.

How you found us

When an account is created we record, once, the campaign link it came from (the UTM parameters and landing page, if any). This lets us see which channels bring learners who stay. It is stored on our server with your account and nowhere on your device, and it is removed with the account.

Picking up onboarding where you left off

If you leave onboarding part-way, we save the step you reached and your answers so far so you can pick up where you left off on any device; we delete this as soon as onboarding is complete, and we count in aggregate where people stop so we can improve onboarding (legitimate interest — you can object in the mobile app under Profile → Data by turning off Usage insights). It is never shared with any third party.

Crash reports and analytics — with your consent

With your consent, we use Sentry to capture crashes and a brief replay of the error (no passwords, no email, no auth headers — see the consent banner for what each category covers). We use PostHog for anonymous funnel analytics — keyed by an internal user id, not your email or name. You can change either choice at any time from Self → Cookie preferences.

Session replay in the mobile app — with your consent

From version 1.9.0, if you choose to share Usage insights, the mobile app on iOS and Android can record session replays and send them to PostHog, linked to your internal user id. A replay is made of periodic screenshots of the screens you use and the positions of your taps. We use replays to understand how the app is used and to improve it. No recording starts until you have agreed.

The app is set to mask text, text fields and images in these screenshots and, on iOS, protected system screens such as the photo and contact pickers. It is set not to add device logs or network activity to replays. Masking is automatic, so we cannot promise that it hides everything on every screen.

You can withdraw at any time in the mobile app under Profile → Data by turning off Usage insights. This stops new recording. It does not guarantee that a recording already captured on your device is deleted, and that recording may still be sent to PostHog. To ask about replay data, contact privacy@kotobadojo.com.

Who processes your data

We rely on a small number of service providers, each receiving only the minimum needed for its function, under our agreements and applicable safeguards: Google Cloud (hosting, database, file storage, text-to-speech, translation), Cloudflare (card illustrations and their storage), Anthropic (AI text, Sensei mistake analysis, personal study planning and feedback), Resend (sign-in and account email), Stripe, Apple, Google Play and RevenueCat (payments and subscriptions), OneSignal (push and email notifications), Upstash (rate limiting), and — only with your consent — Sentry and PostHog.

Some of these providers operate outside the European Economic Area, mainly in the United States. Where your data leaves the EEA, it is transferred under the European Commission’s Standard Contractual Clauses or another approved safeguard.

Your rights, deletion and retention

You can delete your account at any time from Self on the web or in the mobile app. Deletion is immediate and cascades to every record we keep about you, including your notification subscription. You can also export your data as JSON from the same screen. You have the right to access, correct, export, and delete your data, and to object to processing.

We keep your data for as long as your account is active. If you stop using Kotoba Dōjō entirely — no training sessions for 24 months — we anonymize the account rather than letting it sit indefinitely: your email, name, avatar name and any billing identifiers are permanently removed and your sign-in is severed, while anonymous study statistics and any decks you contributed are kept and can no longer be traced back to you. You never have to wait for this — you can delete your account outright at any time from Self.

The data controller is Artsiom Chtrykov, the operator of Kotoba Dōjō, based in Poland (European Union). To exercise any of these rights, or to ask a privacy question, email privacy@kotobadojo.com. If you believe we have mishandled your data, you also have the right to lodge a complaint with your local EU data-protection authority.

Last updated: 31 October 2026 · Questions: privacy@kotobadojo.com