Privacy Policy

The official YomiYomi support channel is [email protected], also reachable from Profile → Support in the app. See Support.

1. About YomiYomi

This policy uses “YomiYomi,” “we,” “us,” and “our” to refer to the operator of the YomiYomi service. For privacy questions or requests, use the official support channel shown within the app or on YomiYomi’s App Store listing.

2. Scope

This Privacy Policy explains how YomiYomi handles personal data when you use the YomiYomi iOS app, its home-screen widget, related authentication flows, and the backend services that synchronize your study progress. The related Terms of Use govern use of the service.

This policy does not govern third-party websites or services that you choose to open, including Apple, Google, Supabase, RevenueCat, or official JLPT websites. Their own privacy notices apply to their processing.

3. Data we handle

3.1 Guest and account identifiers

YomiYomi creates an anonymous Supabase account on first use so that core features, security controls, and synchronization can work without requiring your name or email. Supabase assigns:

• A unique account ID (UUID)
• Account-creation and authentication timestamps
• Session and authentication tokens used to keep you signed in

A guest account is still a backend account, but it is not linked to your name or email unless you later choose Apple or Google sign-in.

3.2 Optional Apple or Google sign-in

If you link a guest account or sign in using Apple or Google, we receive:

• A stable identifier from the selected provider
• The provider name
• An email address, if the provider supplies one (this may be an Apple private-relay address)

We do not receive or store your Apple or Google password. Google authentication requests the basic openid, email, and profile scopes; YomiYomi uses them only for account authentication and recovery.

3.3 Profile and preferences

We handle the settings you choose, including:

• Target JLPT level
• Optional target exam date
• Daily study goal
• Default review format
• Theme preference
• Onboarding completion status
• Premium entitlement status

3.4 Study progress and interactions

To provide the learning service, YomiYomi handles:

• SRS card state, due dates, intervals, repetitions, lapses, and review timestamps
• Answer grades and review history
• Current and longest streak and last-review date
• Reading and listening completion, scores, and timestamps
• Mock-drill level, score, duration, section breakdown, and completion time
• Daily free-feature usage stored locally for access-limit enforcement

This is educational activity data. It is not used for advertising or to make decisions that have legal or similarly significant effects.

3.5 Content error reports

If you voluntarily report a problem with a card, we receive the affected content reference, the predefined reason you select, your account ID, and the time of the report. Reports do not include a free-form message in the current app.

3.6 Local device and widget data

YomiYomi is local-first. A protected app database on your device stores downloaded learning content, progress, pending synchronization operations, settings, and study statistics. The YomiYomi widget reads only due-review times and your current streak from the app-group database. It does not contact our backend independently.

Signing out clears local user data. Deleting the app removes app-local data according to iOS behavior, but it does not by itself delete a remote linked account.

3.7 Notifications

Daily reminders are optional local iOS notifications. The enabled setting and selected reminder time are stored in iOS user defaults and the reminder is scheduled by the device. YomiYomi does not send the reminder time or a push-notification token to its backend.

3.8 Operational records

Supabase may generate limited authentication, security, and request records needed to operate and protect the service. These may include an account ID, request time, endpoint, status, and network information such as an IP address. We use these records only for security, reliability, rate limiting, troubleshooting, and abuse prevention.

3.9 Purchase and entitlement information

When you view, buy, or restore Premium, Apple and RevenueCat provide the product identifier, transaction and subscription status, purchase dates, storefront or currency information, and a RevenueCat customer identifier linked to your YomiYomi account. We use this information only to offer, validate, restore, and support Premium access. Apple processes payment-card and bank-account details; YomiYomi does not receive them.

4. Data we do not collect

The current version of YomiYomi does not intentionally collect:

• Precise or approximate location
• Contacts or address-book data
• Photos, camera input, or microphone recordings
• Health, fitness, or biometric data
• Advertising identifiers
• Browsing history from other apps or websites
• Payment-card or bank-account details
• User-generated public posts or social graphs

Listening exercises use Apple’s on-device speech synthesis to speak YomiYomi transcripts; YomiYomi does not record your voice.

5. How and why we use data

Where consent is required by applicable law, we rely on consent and you may withdraw it at any time. Withdrawing consent does not affect processing that was lawful before withdrawal.

6. Service providers and disclosures

We disclose data only as necessary for the purposes above:

• Supabase, Inc. provides authentication, database, API, synchronization, and security logging. Supabase processes account, authentication, profile, and study data for us.
• Apple processes authentication only if you choose Sign in with Apple and processes App Store purchases under Apple’s own terms.
• Google processes authentication only if you choose Google sign-in.
• RevenueCat, Inc. provides purchase validation, subscription status, and entitlement management as YomiYomi’s service provider.

We may also disclose information when required by applicable law, valid legal process, or when reasonably necessary to protect users, the service, or legal rights. We do not disclose personal data to advertising networks or data brokers.

We require service providers acting for us to protect personal data consistently with their contracts, applicable law, and the commitments in this policy.

7. Purchases

YomiYomi may offer monthly and annual subscriptions and a separate lifetime purchase. Apple processes payment information and provides the purchase details needed to complete and restore transactions. RevenueCat validates purchases and maintains the entitlement status used to unlock Premium. YomiYomi links that status to the learner’s account so purchased access can be provided across sessions and restored devices. Neither YomiYomi nor RevenueCat receives the user’s full payment-card details from Apple.

8. Storage and international transfers

Study data is stored locally first and synchronized over HTTPS to YomiYomi’s Supabase project. The primary database is hosted in Tokyo, Japan (ap-northeast-1). Supabase and its authorized subprocessors may process limited information in other countries to provide authentication, infrastructure, security, and support.

Where European Economic Area, United Kingdom, or other transfer rules apply, transfers are handled using an available lawful mechanism, such as an adequacy decision or contractual safeguards. Supabase incorporates Standard Contractual Clauses into its Data Processing Addendum.

9. Security

We use reasonable technical and organizational safeguards appropriate to a small mobile service, including:

• HTTPS/TLS for data in transit
• Supabase authentication and Row-Level Security that restrict learner records to the owning account
• Least-privilege database grants and protected server functions
• iOS app sandboxing and an app-group container shared only with the YomiYomi widget
• Access controls and rate limits designed to reduce unauthorized use

No system is completely secure. Please protect access to your device and linked Apple or Google account and contact us if you suspect unauthorized access.

10. Retention

• Active account, profile, progress, and settings data remain while needed to provide the account and study service.
• Content reports remain until resolved, anonymized for content-quality records, or deleted with the reporting account.
• Signing out clears local user data but does not delete the remote account. App deletion removes device-local app data according to iOS behavior but does not itself delete the remote account.
• Supabase operational logs are kept according to the hosting plan, configured retention schedule, and security need.
• If database backups are enabled, deleted records may remain in time-limited disaster-recovery backups until those backups expire. Backup copies are not restored as active accounts except as necessary for disaster recovery.
• We may retain specific information longer where required by law or reasonably necessary to investigate a security incident or establish, exercise, or defend legal claims.

11. Account deletion

You can delete either a guest profile or a linked account from Profile → Delete guest profile / Delete account. This removes the active Supabase authentication account and linked profile, SRS records, review history, study statistics, reading, listening and mock-drill attempts, content reports, and other account-linked study data. It also clears local user data from the device.

Deletion cannot be undone. Residual operational logs and time-limited backups expire under Section 10 and are not used to recreate an active account.

Deleting an account does not automatically cancel billing managed by Apple. You must cancel an active subscription separately in your Apple Account subscription settings.

12. Your rights and choices

Depending on where you live, you may have rights to:

• Be informed about processing
• Access a copy of your personal data
• Correct inaccurate or incomplete data
• Object to or restrict certain processing
• Request erasure or blocking
• Receive portable data where applicable
• Withdraw consent where processing relies on consent
• File a complaint with a data-protection authority
• Seek damages where provided by law

To exercise a right, use the official YomiYomi support channel shown within the app or on its App Store listing. We may need to verify your identity or authority before acting. We will respond within the period required by applicable law.

Philippine residents can learn about their rights or file a complaint with the National Privacy Commission. EEA residents may contact their national supervisory authority, and UK residents may contact the Information Commissioner’s Office.

You may disable daily reminders in YomiYomi Profile or iOS Settings. You may unlink access by signing out, but remote deletion requires the deletion control described in Section 11 or a verified request to us.

13. Children

YomiYomi is not directed to children under 13, and children under 13 may not use the service. We do not knowingly collect personal data from a child under 13. Where local law requires a higher age for a person to authorize processing or enter this agreement, a parent or legal guardian must provide any required authorization.

If you believe a child has provided personal data contrary to this section, contact YomiYomi through the official support channel shown within the app or on its App Store listing so we can investigate and delete it.

14. No sale, advertising, or cross-app tracking

We do not sell personal data, share it for cross-context behavioral advertising, serve third-party ads, or track activity across other companies’ apps or websites. We do not use an advertising SDK or Apple’s AppTrackingTransparency identifier.

15. Changes to this policy

We may update this policy when the app, providers, or legal requirements change. The revised policy will show a new “Last updated” date at this URL. If a change materially affects how we use personal data, we will provide additional notice in the app or by another appropriate method and obtain consent where required.

16. Contact

For privacy questions, rights requests, or concerns, use the official YomiYomi support channel shown within the app or on YomiYomi’s App Store listing.