Privacy policy

Darumoji works without an account: your progress stays in your browser. If you sign in (Google or magic link email), an account is created and your translations and favorites are stored on our servers in Europe to follow you across devices. You can request account deletion at any time.

Without sign-in, the app only uses your browser's local storage. Nothing is sent to a server. Keys used:

• darumoji:bestStreak — your best streak in endless mode
• darumoji:filters — your type choice (hiragana / katakana / both)
• darumoji:dailyHistory — the last 90 Daily Challenge results
• darumoji:kanaStats — how many times you've seen / passed / failed each kana
• darumoji:locale — your language preference (fr / en)
• darumoji:sfxEnabled — your sound preference (on / off)

This data is strictly necessary for the app to work and is exempt from consent (CNIL). Clear your site data in your browser to wipe everything.

If you sign in, we store the following on our servers in Europe:

• your email and name (provided by Google OAuth or by you via magic link)
• your translations and their history (source text + translation + furigana)
• your favorites (words, kanji, phrases) with their metadata
• your review activity and per-card statistics
• your session statistics and streak counters

We never sell this data. We share it only with the subprocessors listed below, and only to keep the service running.

We rely on these providers to run the app. All are bound by contract to comply with the GDPR:

• Vercel Inc. (United States) — web hosting, CDN, privacy-friendly audience analytics and speed insights (no cookies).
• Vercel Postgres / Neon (Europe) — database for accounts, favorites and translations.
• Better Auth — self-hosted authentication library (no data sent to an external service).
• Resend (United States) — sending of transactional emails (sign-in magic link, deletion request acknowledgement).
• Google (United States) — Gemini API for sentence translation, OAuth for sign-in, Google Fonts for typography.
• Microsoft (United States) — Edge Neural text-to-speech engine for Japanese pronunciation.
• Upstash (Europe/United States) — Redis for rate limiting and short-term cache.

A single cookie is set: the Better Auth session cookie (sign-in). No tracking cookies, no advertising. Vercel Analytics works without cookies.

Vercel Analytics and Vercel Speed Insights measure audience and performance: no cookies, no cross-site tracking, no personal identification. Data is aggregated and anonymized.

You have the following rights over your personal data:

• Right to erasure : from the Settings screen, you can request the deletion of your account. We process the request within 7 days and confirm by email. Local data is cleared via your browser settings.
• Right of access : email us to receive a copy of your data (account, translations and favorites).
• Right to object : you can use the app without an account, or delete your account at any time.
• Right to portability : email us to receive your data in a reusable format (JSON).

Your server data is kept for as long as your account exists. A deletion request triggers full erasure within 7 days. Local data is kept by your browser without expiration.

For any question about your data or to exercise a right: [email protected]