Privacy Policy

The short version

• This policy covers the Ikkimi website and web app (ikkimi.app) and the Ikkimi Chrome extension.
• The website needs an account. What the Chrome extension keeps before your words reach your account stays in your own browser.
• With an account, we keep your email address and your learning progress (your words, reviews, XP and settings) so they are the same on every computer you sign in on.
• We do not sell your data, show ads of our own, or use advertising trackers. YouTube’s player, which we do not control, may show YouTube’s own ads.
• The website measures how it is used with PostHog: the pages people visit, a few steps such as signing up, and recordings of clicks and scrolling with everything you type and read hidden. In the European Union, the EEA, Switzerland and the UK it runs only if you say yes, and anywhere you can turn it off. Vercel, our host, also counts visits (pages, the site you came from, country and device) without cookies and without anything stored in your browser. The extension has no analytics, and nothing uses advertising cookies.
• On YouTube, Netflix and Crunchyroll only, the Chrome extension reads the subtitles, the show’s title and episode, the page address and the playback time. It keeps a list of the shows you watch (up to 100) and how long you watch each day, for “continue watching” and your watch-time totals. It never looks at other sites.
• Paddle, our reseller, takes your payment. We never see your full card number.
• You can delete your account and everything in it yourself, in Profile, at any time. For a copy of your data, use Export or email hello@ikkimi.app.

Who we are

Ikkimi is a website and web app (ikkimi.app) and a Chrome extension for learning Japanese from shows. An iPhone app is not available yet, and this policy does not cover one. Ikkimi is run by Graziabento, a company in Indonesia, which is responsible for your personal data under this policy (the “data controller”). In this policy, “Ikkimi”, “we” and “us” mean the service and the company that runs it.

Questions about privacy: hello@ikkimi.app.

Before you sign in

The website needs an account. The Chrome extension keeps the words and lines you save, your last 100 shows, how long you watched each day and its settings in the extension’s own storage in your browser. They are not sent to us until you open the Ikkimi website, signed in, in the same browser (see The Chrome extension). If you remove the extension before that, they are gone.

Subtitle files you open from your own computer in the extension, and backups you restore on the website, stay on that computer. They are never uploaded.

What we keep when you create an account

An account keeps your progress in sync between the website, the extension and every browser you sign in on. For that we store:

• Sign-in details. Your email address, and a salted, one-way hash of your password (never the password itself). If you sign in with Google, the name, email address and profile picture address Google shares. Where we offer Sign in with Apple and you use it, the ID Apple gives us for you and the email Apple shares (which can be Apple’s private relay address). We never see your Google or Apple password.
• Your learning progress. Your saved words and lines, with the Japanese sentence, the English line, the show, the page address and the moment each was saved from; your review history and when each card is due; XP, level, streak, quests, daily goal and learning settings; the display name you choose and your buddy and shop items; up to 100 shows you have watched, with their title, page address, cover, episode, where you stopped, the episodes you finished and how long you watched each show, so the website can say “continue watching” and show your totals; and how long you watched on each day, for up to about 400 days, for your weekly totals and watch-time goals.
• Sign-in sessions. A record of each device that is signed in, so we can keep you signed in and sign you out everywhere when you reset your password.
• Email codes. When we email you an 8-digit code, to confirm your address or to reset your password, we keep only a hash of it, and the code stops working after 15 minutes.
• Your subscription. Whether you have a plan, which one, its status and dates, the customer and subscription IDs Paddle gives it, your payments’ dates and amounts, and any refund you ask for. We use these to open Ikkimi for you, to cancel or refund your plan when you ask, and for our records. We do not get your card details.

The Chrome extension

The extension works only on YouTube, Netflix and Crunchyroll. On their pages it reads the video’s subtitles or captions, the show’s title, episode and cover picture, the playback time and the page address, so it can show a Japanese line you can click, keep it in time with the video, and take you back to the episode later. It does not read your account details, payment details, messages or browsing history on those sites, and it does not run on any other site except ikkimi.app (below).

• Subtitles. To find Japanese subtitles for an episode, it searches the public catalogue on Jimaku (jimaku.cc) with the show’s title, and downloads the file you pick from there. A subtitle file you choose from your own computer is read there and never uploaded.
• Levels on YouTube. On YouTube, for the videos on your screen, it asks YouTube (without your YouTube cookies) which captions each video has, reads the Japanese ones and works out how hard they are, to show a level on the thumbnail. The answers are kept in the extension’s storage and are not sent to us.
• Word recordings. When you play a word’s recording, it loads the audio file for that word from Innovative Language (LanguagePod101). Only the word is sent.
• English lines. Where an episode has no official English subtitles, the English line may come from YouTube’s own translation of its captions, or from the translator built into Chrome, which runs on your computer.
• Your words. Words and lines you keep (with the sentence, its English, the show’s title, the page address and the moment), your last 100 shows (where you stopped, the episodes you finished and how long you watched) with how long you watched each day, and your settings are saved in the extension’s storage on your computer. When you open ikkimi.app in the same browser, signed in, the extension hands that list to the page, which saves it to your account as described above. The extension itself sends nothing to our servers.

What its permissions are for: storage, to keep your words, shows and settings in your browser; YouTube, Netflix and Crunchyroll, to show the Japanese line on their videos; jimaku.cc, to find and download subtitle files; languagepod101.com and innovativelanguage.com, to play word recordings; and ikkimi.app, to pass your saved words to your account.

Ikkimi’s use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use it only to provide the features above. We do not sell it, transfer it except to the services that run Ikkimi (listed under Who we share it with), use it for advertising or to decide anyone’s creditworthiness, or let people read it, except with your permission, for security, or when the law requires it.

The feedback board

The website has a board where people post ideas and problems and vote on them. What you post there can be read by other people using Ikkimi: its title, text, the name you give, and when it was sent. Your email address is not shown to them. We see the address on the post, and each new post is emailed to us through Resend with your name and address on it. You can delete your own post at any time. We may answer it, hide it or remove it. Posts with the worst words are turned away, and you can report a post or block its writer; we see who reported or blocked what, and a post several people report is hidden until we look at it. Please do not put private details in a post.

Analytics on the website

The website uses PostHog (United States) to see which pages people use and where they get stuck, so we can fix what is confusing. The Chrome extension has none.

• What it records. The pages you open; a few steps we chose, namely each step of the welcome questions, creating an account or signing in (and whether with email, Google or Apple), opening and completing a checkout and its plan, changing your card, and clicking through to the Chrome Web Store or the App Store; your browser, device type and screen size; the page you came from; and recordings of the session: where you move, click and scroll. In recordings every piece of text and everything you type is hidden on your computer before anything is sent, so they do not show your words, lines, email address or other people’s feedback posts.
• What it does not record. Your email address, what you type, the Japanese you save and the text on the page. Page addresses are sent without their query part, which can hold sign-in and payment codes.
• Who it is about. PostHog gives your browser a random ID, kept in local storage (not a cookie). When you sign in, your events are linked to your Ikkimi account’s ID, never your email address. PostHog receives your IP address, keeps it with the events, and uses it to estimate your country and city.
• Your choice. If you are in the European Union, the EEA, Switzerland or the UK (going by your browser’s time zone and language), nothing is recorded until you choose “Accept all” on the cookie notice the site shows. Elsewhere it is on unless your browser sends Global Privacy Control or Do Not Track. Anyone can change it at any time with Privacy choices at the bottom of the page or the switch in Profile. The choice is kept in this browser.
• How long. Recordings are deleted after 30 days. Other events are kept while they help us improve Ikkimi.

Visit counts. Vercel Web Analytics, from the company that hosts the website, counts page views on every visit: the page (without its query part, except campaign tags), the page you came from, your country, and your browser, operating system and device type. It uses no cookies and stores nothing in your browser. It tells visits apart with a hash of the request that changes every day, so it cannot follow you from one day to the next or from one site to another, and we cannot see who you are. Because it identifies no one, it runs for every visitor.

How we use your data

• To run Ikkimi: sign you in, keep your words and progress, sync them between your devices, and open the plan you paid for.
• To send emails you ask for, such as a sign-up or password reset code. We do not send marketing emails. Paddle sends receipts and payment notices for plans bought on the website.
• To run the feedback board, answer your posts and emails, and improve Ikkimi from what people tell us.
• To see how the website is used and where people get stuck, with analytics you can turn off (see Analytics on the website).
• To fix problems and keep the service safe, for example by stopping abuse of sign-in, refunds or the feedback board.
• To meet legal obligations, such as tax and accounting records.

Under the GDPR and similar laws, we process your data because it is needed to provide the service you asked for (our contract with you); because we have a legitimate interest in keeping Ikkimi working, safe and improving, and in running the feedback board; for analytics in the European Union, the EEA, Switzerland and the UK, because you said yes; or because the law requires it. Where we ask for your consent, you can take it back at any time. We do not use your data for automated decisions about you, and we do not use it to train AI models.

Who we share it with

We do not sell or rent your personal data, and we do not “share” it for targeted advertising. It is handled only by the services Ikkimi is built on, each for its own part:

• Convex (United States): stores accounts and progress and runs the service’s back end.
• Vercel (United States): hosts the website and receives the usual request information (IP address, browser and time) when pages load, and counts visits without cookies (see Analytics on the website). It also tells the page which country you are in so prices show in your currency; we do not store that.
• PostHog (United States): records how the website is used, as described under Analytics on the website, if you allow it.
• Resend (United States): sends sign-up codes, password reset emails and new feedback posts to us.
• Cloudflare (United States): runs the domain’s DNS and passes on emails sent to hello@ikkimi.app.
• Paddle (Paddle.com, United Kingdom): our reseller and merchant of record, which sells the subscription. It takes your email address, country and payment details, charges you, handles tax, sends your receipts and handles refunds, under its own privacy policy. It may also use its Retain tools to recover failed payments and handle cancellations. We never see your full card number.
• RevenueCat (United States): keeps the record of your subscription (your account ID and the plan’s Paddle IDs, status, dates and amounts, which it reads from Paddle) so the same plan opens Ikkimi everywhere you use it. It does not get your card details. Deleting your account deletes what RevenueCat holds about it.
• Google: only if you choose to sign in with it. Apple too, where we offer it and you sign in with it.

Ikkimi’s use of information received from Google’s sign-in adheres to the Google API Services User Data Policy, including the Limited Use requirements: we use your Google name, email address and picture only to sign you in and show your account.

The website and the extension also load some content straight from other services, which then see your IP address and browser: fonts from Google Fonts, show covers from AniList, video thumbnails and the embedded player from YouTube, word audio from Innovative Language, subtitle files from Jimaku, and the checkout from Paddle. Their own privacy policies apply to that. We may also disclose data if the law requires it, or to someone who takes over Ikkimi, and we would tell you first.

Cookies and local storage

Ikkimi sets no cookies of its own and uses no advertising cookies. The website keeps your sign-in session, your progress, your plan’s status, the country used for prices and files you add yourself in your browser’s local storage, session storage and IndexedDB, which it needs in order to work. If analytics is on, PostHog keeps its random ID and the current session in local storage too, and your analytics choice is kept there; you can change it with Privacy choices at the bottom of the page (see Analytics on the website). The extension keeps your words, shows, settings and the YouTube levels in the extension’s own storage. Embedded YouTube videos may set YouTube’s own cookies, Google’s sign-in page sets Google’s, and Paddle’s checkout may set its own.

Where your data is kept

Account data is stored by Convex on servers in the United States. Paddle is in the United Kingdom, and our other providers are in the United States. If you live elsewhere, including in Indonesia or the European Union, your data is transferred there. We rely on our providers’ contractual safeguards for these transfers, such as the European Commission’s Standard Contractual Clauses.

How long we keep it

• Account data: for as long as you have an account. Delete your account in Profile (or by emailing us) and your account, sign-in details, progress, feedback posts and votes, reports, blocks and refund requests go at once. Copies in our host’s backups expire on their own after that. Words the Chrome extension keeps on your computer stay there until you remove the extension.
• Payment records: Paddle keeps its own. We keep the record of each subscription (its Paddle IDs, plan, status and dates) and of its payments (dates and amounts), with your account taken off them, for as long as tax and accounting law requires. Deleting your account stops your subscription straight away.
• Email codes: only a hash is kept, and the code stops working after 15 minutes. Counts we use to limit how often codes and reports can be sent are cleared within about a day.
• Feedback posts: until you or we delete them, or you delete your account.
• Website analytics: recordings for 30 days; other events while they help us improve Ikkimi.
• Data in your own browser: until you remove it.

Your rights

Wherever you live, you can ask us to:

• tell you what data we hold about you and give you a copy, in a form you can take elsewhere (you can also use Export on your profile on the website);
• correct it;
• delete your account and your data (you can do this yourself in Profile);
• stop or limit some processing, or object to it.

Email hello@ikkimi.app from the address on your account. We answer as soon as we can, within the time the law where you live sets, and never later than 30 days. We will not treat you differently for using these rights. You also have the right to complain to your data protection authority. In Indonesia this is under Law No. 27 of 2022 on Personal Data Protection; in the European Union, under the GDPR; in the United Kingdom, under the UK GDPR, to the Information Commissioner’s Office.

California and other US states. In the last 12 months we have collected the kinds of data described above: identifiers (email address, account ID), your learning activity, payment records, what you post on the feedback board, and how you use the website (analytics). We do not sell or share personal information, as the CCPA and other US state privacy laws define those words, and we do not use it for targeted advertising. You can still turn analytics off with Privacy choices, and we treat Global Privacy Control as a no.

Children

Ikkimi is not meant for children under 13, and we do not knowingly collect their personal data. If you are under 18, a parent or guardian must agree before you create an account, as Indonesian law requires; in some other countries the age is 16. If you think a child has given us personal data, email us and we will delete it.

Security

Connections to Ikkimi are encrypted (HTTPS). Passwords are stored only as salted scrypt hashes. Resetting your password signs out your other sessions. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

Changes to this policy

If we change this policy, we will update the date at the top. If a change matters, for example a new kind of data or a new use of it, we will say so on the website or by email before it applies.

Contact

Graziabento (Ikkimi), Indonesia
hello@ikkimi.app