Privacy Policy
Datenschutzerklärung gemäß DSGVO / GDPR
1. Responsible party (Controller)
The controller responsible for the processing of personal data on this website is the operator named in the Impressum, where you will find the operator's name, postal address, and contact details. (Impressum)
2. Data we collect
We collect the following data when you use this service:
- Email address (from the account you use to sign in)
- First name and full name (via Google account, used to display who is logged in)
- Children's learning data: quiz answers, kanji mastery levels, date of birth (for grade calculation)
- Usage data: which pages you open while signed in, how long each page is used, and the browser your device reports — recorded by us, not by a third-party analytics service
3. Purpose and legal basis
- Account authentication and identification — Art. 6(1)(b) GDPR (contract performance)
- Providing the learning service and tracking progress — Art. 6(1)(b) GDPR
- Service analytics and improvement — Art. 6(1)(f) GDPR (legitimate interest)
- Measuring, in aggregate, how many visitors are interested in the app — Art. 6(1)(a) GDPR (consent)
We do not sell personal data, and we do not pass learning data to third parties for their own purposes. Using your data for a purpose beyond those listed above would need a new legal basis — we would ask for your consent rather than simply updating this policy, and if you declined you would keep the service exactly as before. Anonymous statistics that cannot be traced back to any account or learner are not personal data and are not covered by this.
4. Sub-processors (third-party services)
- Amazon Web Services (AWS) — cloud infrastructure, database, AI inference
- Stripe — payment processing
- Amazon Cognito / Google Sign-In — authentication
Some features use AI. When you use one, only the text needed to produce the answer is sent to Amazon Bedrock, the AI service we use, and it is processed solely to produce that answer.
Your data is not used to train AI models. Neither we nor the AI provider use what you or your children enter — learning data, quiz answers, or messages you write to us — to train or improve any AI model, and it is not shared with the provider's other customers.
For each AI request we keep a short accounting record — the model used, token counts, and the opening of the text sent and of the reply — so that we can monitor cost and quality.
5. International data transfers
Our infrastructure, database, and AI inference run on Amazon Web Services in a United States region (North Virginia), and Stripe and Google likewise process data in the United States. Your personal data is therefore transferred to and processed in the United States, which is a third country under the GDPR.
These transfers are protected by appropriate safeguards pursuant to Chapter V of the GDPR — in particular the EU-U.S. Data Privacy Framework, under which these providers are certified, and/or the European Commission's Standard Contractual Clauses (Art. 46 GDPR). Copies of these safeguards are published by the respective providers and are available on their websites.
6. Children's data
Kanjidou is designed to be used by a parent or legal guardian on behalf of their child. Children do not create their own account and do not sign in themselves; the account holder manages all learner profiles and their data.
- When adding a learner, the account holder must confirm that they are the parent or legal guardian and give explicit consent to the collection and processing of that learner's learning data. For learners under 16, this parental consent is required, and the date and time it was given are recorded (legal basis: Art. 6(1)(a) and Art. 8 GDPR).
- We process only the learning data needed to provide and personalise the service: quiz answers, kanji mastery levels, and the learner's date of birth (used solely to determine the appropriate grade level). We do not request or store a child's email address, phone number, or other direct contact details.
- The account holder can review, correct, or delete a learner's data at any time from within the app, and can delete the entire account — which erases all associated learner data — at any time.
7. Data retention
We retain personal data only for as long as your account exists and the data is needed to provide the service.
- When you delete your account, the associated personal data — including all learning data and account information — is erased from our live systems immediately. Any residual copies contained in automated database backups age out automatically within our backup retention window (currently 35 days, kept solely for disaster recovery). Erased data is not reinstated from these backups.
- Some records are kept longer where the law requires it: payment and invoice records are retained by our payment processor (Stripe) for accounting and tax purposes, while the customer object holding your contact and payment details is deleted.
- We keep a minimal deletion-confirmation record as proof that an erasure request was fulfilled. It contains no personal data — only a reference number, timestamps, and per-category deletion counts.
8. Your rights
Under GDPR you have the right to access, rectify, erase, restrict processing of, and port your data, and to object to processing. To exercise these rights, contact us via the address in the Impressum.
9. Cookies
We use a small number of first-party cookies. Some are strictly necessary to run the service — they keep you signed in, protect forms against CSRF, remember your language, and store your cookie choice — and are used without consent.
With your consent, we also set one first-party analytics cookie (about 12 months) that lets us measure, in aggregate, how many people are interested in the app. It is not required to use Kanjidou, we set no third-party or advertising cookies, and you can decline it or withdraw at any time via the cookie banner; declining keeps the service exactly as before. Legal basis for this cookie: your consent — Art. 6(1)(a) GDPR and § 25(1) TTDSG.
10. Contact
For privacy-related enquiries, please use the contact details in the Impressum.
Last updated: 2026-08-09. The German-language version is the legally binding reference.