Privacy policy
Last updated: 26 September 2026
Ōkini teaches you to read Japanese. To do that it needs an account and your progress, and nothing else. No ads, no trackers, nothing is sold.
In short
- We keep your email and your progress (series, answers, characters you know), so the app knows where you are, on any phone.
- Data is hosted in the European Union (Frankfurt).
- No advertising, no analytics tools in the app, no tracking across apps.
- You can delete your account at any time from the app: everything is erased.
1. Who is responsible
Ōkini is published by Farah Doghri, the controller of your data under the EU General Data Protection Regulation (GDPR).
For any question about your data: [email protected].
2. What is collected, and why
| Data | Why | Legal basis |
|---|---|---|
| Email address and password | To create your account, sign you in, and send the confirmation link and password reset codes. The password is stored hashed: nobody can read it, us included. | Providing the service (Art. 6(1)(b)) |
| Progress | Current step, series done, the answers you typed, help used (kana chart, word boundaries), per-character stats, tips seen, badges, paused account. This is what picks the questions of your next series and moves you forward. | Providing the service |
| Interface language | Stored on the account so our emails reach you in your language. | Providing the service |
| Messages you send us | What you write in Settings → Contact us, with its type (question, idea, problem), the interface language, the phone's system and the app version, so we can answer and fix what goes wrong. The reply goes to your account email. | Legitimate interest (art. 6.1.f): answering you and improving the app |
| Beta testers' reward | We promised the kanji path free, when it launches, to testers who send us feedback during the TestFlight beta. To keep that promise, we check whether your account wrote to us through Settings → Contact us during the beta, and we use your account email to send you your reward (a code to redeem on the App Store). Nothing more is collected for this: it is all already in your account. | Keeping our promise to testers (art. 6.1.b) |
| Technical data | IP address, device and system type, sign-in times. They pass through our providers when the app connects, downloads content or an update, and are used to run and secure the service. | Legitimate interest (Art. 6(1)(f)): security and reliability |
What stays on your phone and is never sent to us: your settings (language, sound, voice, reminder time), cached content and audio, and your sign-in session.
Daily reminders are scheduled by the phone itself. No notification token is sent to any server.
The stand-in voice (when a recording is missing) is your phone's own: the text is read on the device, nothing is sent.
3. What the app does not do
- No advertising, and no data shared with advertisers.
- No analytics tools and no tracking across apps or websites. (The website counts its visits without cookies, see section 10.)
- No selling or renting of data.
- No access to your location, contacts, microphone, camera or photos.
4. Who else has access
Only these providers process data, on our behalf and following our instructions:
| Provider | Role | Location |
|---|---|---|
| Supabase | Accounts, database, audio files | European Union (Frankfurt) |
| Brevo | Sending confirmation and password reset emails | France / EU |
| Expo (650 Industries) | Delivering app updates | United States |
| Cloudflare | Hosting the website and counting its visits | United States, servers worldwide |
Supabase, Expo and Cloudflare are US companies. Where data may be processed outside the European Union, the transfer relies on the European Commission's Standard Contractual Clauses, or on the EU–US Data Privacy Framework where the provider is certified.
Apple (App Store) and Google (Google Play) distribute the app and apply their own privacy policies to downloads. We only receive aggregated, anonymous statistics from them.
We do not share your data with anyone else, unless the law requires it.
5. For how long
- Account and progress: as long as your account exists, paused or not. Everything is erased as soon as you delete it. An account left unused for 3 years is deleted, after a warning email that gives you time to keep it.
- Technical data and sign-in logs: kept by our providers for security, at most 12 months.
- Backups: the host's backups are overwritten automatically and do not keep deleted data for more than a few days.
- Messages and emails with us: as long as it takes to answer and follow up on your request, and at most as long as your account. Deleting it erases them.
- Beta testers' reward: the list of accounts entitled to it is kept until the reward is sent, and at most 6 months after the kanji path launches; then it is erased. If you delete your account before it is sent, we can no longer send it to you.
6. Deleting your account
In the app: Settings → Pause or delete → Delete my account. Deletion is immediate and permanent: your account, email, progress, answers and badges are erased.
If you no longer have access to the app, write to [email protected] from your account's address: we delete it within 30 days and confirm.
If you only need a break, Pause my account keeps everything and stops reminders until you sign back in.
7. Your rights
The GDPR gives you the right to access your data, correct it, erase it, receive a copy in a readable format (portability), object to its processing or ask for it to be restricted. To exercise any of these rights, write to [email protected] from your account's address. We answer within one month.
If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (cnil.fr), or with the authority of your own country.
8. Security
Traffic between the app and our servers is encrypted (HTTPS). Passwords are hashed. Each account can only read and change its own data: the database enforces it itself, not just the app.
9. Age
Ōkini suits every age and only collects what it strictly needs. If you are under 15, talk to a parent or guardian before creating an account.
10. The website
Launch notification. If you leave your email on okiniapp.com, we keep it, with the page's language, only to send you one email when the app launches. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time by writing to [email protected]. The address is stored in the European Union (Supabase, Frankfurt), is never used for anything else, and is deleted once the launch email has been sent.
Visit counting. To know how many people visit and which pages they read, the site uses Cloudflare Web Analytics. It sets no cookie, stores nothing on your device, does not fingerprint your browser and builds no profile: we only see totals (pages viewed, referring site, country, type of browser and device). Legal basis: legitimate interest (Art. 6(1)(f)) in knowing whether the site is useful.
11. Changes
If this policy changes, the date at the top changes too. If a change affects what is collected or who can access it, we tell you in the app before it applies.