Privacy Policy

Who we are

Ukiyoe Japanese (ukiyoe-japanese.com) is operated by Catalyst Inc. (株式会社カタリスト), a company registered in Tokyo, Japan. For the purposes of the EU/UK General Data Protection Regulation (GDPR), Catalyst Inc. is the data controller for the personal data described in this policy.

Contact for anything in this policy, including privacy requests: info@ukiyoe-japanese.com

What we collect, and why

Account: your email address — nothing else. No real name, no birthdate, no location, no photos. Your email is used only to sign you in and to recover your account. We never use it for marketing or sell it. It is stored in AWS Cognito (our sign-in provider, AWS Tokyo region), isolated from the rest of our data. Our application database stores only a random user ID and the nickname (handle) you choose.

Learning progress: your lessons, reviews and streaks are stored locally on your device. Two exceptions leave your device only when you choose it: a weekly XP total if you appear on the leaderboard, and a streak/XP snapshot if you attach your progress to a community post.

Community content: posts, comments and reactions you create are public to other users under your handle and are stored in our database (Neon, a managed Postgres service). Reports you submit are kept for moderation records.

AI conversation: when you use conversation practice, the messages of that conversation are sent to our AI provider (Anthropic Claude, via Vercel AI Gateway) to generate the reply and feedback. We do not store your conversations on our servers, and our providers do not use this data to train their models. To enforce fair daily free limits we keep a usage counter for a few days, keyed to your user ID (signed in) or a salted hash of your IP address (signed out) — never the raw IP.

Pronunciation practice and voice input: if you use the microphone for pronunciation scoring, your audio is processed by Microsoft Azure Speech to produce a score and transcript. If you use voice input in conversation practice, your recording is transcribed by Google's Gemini API. We do not store your recordings on our servers.

Payments: if you subscribe to Pro, your payment is handled by Stripe (our payment processor). Card details go directly to Stripe and never reach our servers; we store only your subscription status and Stripe customer ID.

Analytics and error reports: we use PostHog (hosted in the US) to understand feature usage and to collect error reports. Events are pseudonymous, we do not build advertising profiles, and no analytics cookies are set. A random, pseudonymous analytics identifier is kept in your browser's local storage so we can count you as one visitor instead of many; it contains no personal information.

Hosting and logs: the app is served by Vercel. Like every web host, Vercel processes IP addresses in short-lived request logs for security and operations.

Cookies and local storage

We set only strictly necessary cookies: three sign-in cookies (jl_id, jl_at, jl_rt) that keep you signed in. They are HTTP-only, are set only when you sign in, and are not used for tracking or advertising. Because we use no analytics or advertising cookies, no cookie consent banner is required.

We use your browser's local storage for your learning progress and settings (this data stays on your device), and for the pseudonymous analytics identifier described above.

Legal bases (GDPR)

Where the GDPR applies, we process your data on these bases: performance of a contract (providing your account and the app's features), legitimate interests (security, abuse and cost-limit enforcement, pseudonymous product analytics, moderation), and consent where we ask for it explicitly.

Where your data goes (international transfers)

We are based in Japan, which the European Commission recognizes as providing adequate data protection. Some of our processors are in the United States: Vercel (hosting), PostHog (analytics), Anthropic (AI replies), Google (voice-input transcription), Microsoft Azure (speech scoring) and Stripe (payments). Transfers to them are protected by the EU–US Data Privacy Framework and/or Standard Contractual Clauses in their data-processing agreements.

How long we keep data

Your email and profile: until you delete your account. Posts and comments: until you delete them or your account. Moderation reports: kept as moderation records. AI usage counters: a few days. Server logs: short-lived and rotated automatically.

Our AI providers briefly retain what you send them (conversation messages, voice recordings) for abuse monitoring under their own policies — Anthropic for up to 30 days, Google for up to 55 days — after which it is deleted automatically. This data is not used to train their models.

Your rights

You can access, correct, export or erase your personal data, object to or restrict processing, and withdraw consent at any time. Most of this is self-serve: you can delete your account — including your email and all your posts — from the Account page, immediately and permanently. For anything else, email info@ukiyoe-japanese.com and we will respond within one month. If you are in the EU/UK, you also have the right to lodge a complaint with your local supervisory authority.

Children

You must be 13 or older to create an account. We don't store your age — only your confirmation that you meet this requirement.

Changes to this policy

If we change this policy in a meaningful way, we will announce it in the app before the change takes effect. The date at the top shows the latest revision.