Privacy Policy

Who we are and what this policy covers

Kotoba Kards LLC (“Kotoba Kards”, “we”, “us”) is a limited liability company formed in Ohio, United States, at 27801 Euclid Ave STE 250, Euclid, OH 44132. We provide a Japanese language learning service. This policy explains what personal information we collect, why, who we share it with, and what you can do about it.

It applies to:

• our marketing website at kotobakards.com, including our blog and help center;
• our web app at app.kotobakards.com;
• our mobile apps for iOS and Android;
• email and other messages between you and us; and
• the services we provide to you as a customer.

It does not apply to any other website or service, including those operated by the third parties listed in Service providers below. Where a third party collects information directly from you or your device, its own privacy policy governs what it does with that information, not this one.

If you do not agree with this policy, do not use Kotoba Kards. We may update this policy; see Changes to this policy.

Information we collect

Information you give us

Information we collect as you use Kotoba Kards

Advertising identifier

On mobile devices this includes your device’s advertising identifier — the Identifier for Advertisers (IDFA) on iOS, or the Advertising ID on Android — where you have allowed us to use it. We use it only for the advertising described below, and on iOS only if you permit it when Apple’s App Tracking Transparency prompt appears.

What we do not collect

We do not collect your phone number, your postal address, your photograph or your voice. We do not ask for your date of birth or your age (see Children). We do not collect precise location — your approximate region is inferred from your IP address and the time zone your device reports, not from GPS.

How we use your information

We use your information to:

• Run the service — create and secure your account, schedule your reviews, track your progress, and remember where you left off.
• Take payment — process subscriptions, renewals, refunds and failed payments, through Stripe or Apple.
• Send you service email — account verification, password resets, payment problems, and notices about changes to the service or to this policy. You cannot opt out of these while you hold an account, because they are how we tell you things you need to know.
• Send you optional email and push notifications — study reminders, streak nudges, and occasional news about Kotoba Kards. You can turn these off at any time in settings, or by using the unsubscribe link in any such email.
• Show advertising to free accounts — see Advertising. Paid subscribers are shown none.
• Measure our own advertising — understand which of our campaigns bring people to Kotoba Kards, so we do not keep paying for ones that do not.
• Improve the product — understand which features are used, where people get stuck, and whether the method actually works over months and years.
• Keep the service safe — detect fraudulent reward claims, abuse, and attempts to break into accounts.
• Meet our legal obligations and defend our legal rights.

We do not use your learning content — your answers, your progress, what you study — to target advertising, and we do not give it to any advertiser.

Advertising

Kotoba Kards offers a free tier that is supported by advertising. If you are on a paid subscription you are shown no advertising at all, and no advertising software is loaded for you.

For free accounts we work with Google — Google AdMob in our iOS and Android apps, and Google Ad Manager on app.kotobakards.com. There are two kinds of ad:

• Rewarded ads, which you choose to watch. Once you have reached the day’s free learning allowance you may watch a short ad to unlock more for that day. You never have to; the allowance resets each day, and everything you have already learned stays available.
• Interstitial ads, a full-screen ad shown occasionally at the end of a study session. These are limited in how often they can appear.

What Google receives

To show these ads, Google receives your device’s advertising identifier (the IDFA on iOS or the Advertising ID on Android, or cookie identifiers on the web), your IP address, information about your device and app version, and information about the ads you were shown and interacted with. Google uses this to select and measure advertising, and may use it to show you personalized ads. Google acts as an independent controller of that data, and its use is governed by Google’s own privacy policy at policies.google.com/privacy and business.safety.google/privacy, not by this one.

Your choices

In our mobile apps, where you are in the European Economic Area, the United Kingdom, or a US state whose law requires it, we ask for your choice before requesting any advertising, using Google’s consent form. Until you answer it we request no ads at all. If you decline, we still show advertising, but it is not selected using information about you, and your choice is passed to Google with every ad request. You can change or withdraw your choice at any time from Settings → Ad privacy settings in the app.

On our websites, we do not serve advertising to visitors in the European Economic Area or the United Kingdom at all. Elsewhere, you control advertising cookies through the consent banner, which you can reopen at any time.

You can also stop advertising entirely by subscribing to a paid plan.

On iOS you may deny tracking when the App Tracking Transparency prompt appears, or change it later under Settings → Privacy & Security → Tracking. On Android, Settings → Privacy → Ads lets you delete your advertising ID.

What we record ourselves

When you watch a rewarded ad we store a record of it against your account — which subject it applied to, how many extra items it unlocked, the date, the platform, and whether Google confirmed the ad genuinely played. We use that to grant what you earned, to enforce any daily limit on rewards, and to detect fraudulent claims. We also keep a count of how many ads have been shown, so as not to show them too often.

Ad content

We limit the advertising Google may serve in our apps to a “PG” maturity rating or lower. We cannot review individual ads before they are shown. If you see an ad you believe is inappropriate, please tell us at contact@kotobakards.com and include a screenshot if you can.

Our own advertising

We advertise Kotoba Kards on other platforms, including Meta (Facebook and Instagram). When you install our app or visit our site we may receive information about which of our ads or links brought you to us — on iOS through Apple’s AdServices framework, on Android through the Google Play install referrer, and on the web through campaign parameters in the link you followed, which we store in cookies on kotobakards.com so that the campaign survives your click through to the sign-up form.

We also share a one-way encrypted (hashed) form of your email address with Meta when you sign up or subscribe, so that Meta can tell us which of our advertisements led to it. Meta can match that hashed address to an account it already holds. This is how we measure our own advertising; it tells Meta about the advertisement, not about anything you study. We do not send this information to Meta about learners in the European Economic Area or the United Kingdom.

You may opt out of interest-based advertising more generally through the industry tools at optout.aboutads.info, optout.networkadvertising.org and youronlinechoices.com. Note that those are browser cookie tools and do not affect advertising inside a mobile app — use the in-app controls above for that.

Service providers and other third parties

We use the following companies to operate Kotoba Kards. Each has its own privacy policy governing how it handles data. This list is kept current as our providers change.

Beyond these, we may disclose information:

• when a court, regulator or law requires it;
• when we need to investigate suspected fraud, abuse, or a breach of our terms, or to protect someone’s safety; and
• to a buyer or successor if our business is sold or merged, in which case we will say so here before your information is transferred.

We do not otherwise share your information with anyone, and we do not sell it for money. For what US state law counts as a “sale” or “sharing” regardless, see US state privacy rights.

Cookies and similar technologies

A cookie is a small file a website stores in your browser. We use them, and a small number of our providers use them, for the purposes below. Our mobile apps do not use cookies; they use the device advertising identifier described above.

Your choices

When you first visit our websites you are shown a consent banner. In the European Economic Area and the United Kingdom, nothing but strictly necessary cookies is set until you choose. Elsewhere, you may turn off any category at any time, and we treat that as a request to stop.

You can reopen the banner at any time from the link in our site footer to change your mind. You can also set your browser to refuse some or all cookies, though parts of the service may then not work properly.

How long we keep your data

We keep your personal data only as long as we have a reason to:

We keep activity logs for three years because they are how we understand whether the product actually helps people learn over time, which is a question that cannot be answered in a few months. They record what was used and when, not what you wrote.

If you delete your account, or ask us to delete it, we remove your personal data from all of these straight away, whatever its age. You do not have to wait for a retention period to expire. See Your choices and rights for how to ask.

Older records are removed automatically on a daily schedule rather than when somebody remembers to do it.

We are not responsible for removing information from the systems of third parties if it has already been shared with them as described in this policy. Where you want that information removed, the Service providers table links to each company’s own privacy policy, which explains how to ask them directly.

We may keep a minimal record — for example that an account with a given email address was closed — where we need it to meet a legal obligation, resolve a dispute, or stop a closed account being silently recreated.

Your choices and your rights

Wherever you live, you may ask us to:

• explain how we use your personal information;
• give you a copy of the information we hold about you;
• correct anything that is wrong;
• delete your information and close your account;
• stop sending you marketing email or push notifications; and
• stop advertising-related sharing — see Advertising for the controls, and US state privacy rights for the opt-out.

Where you gave us consent — for cookies, or for advertising in the app — you may withdraw it at any time. Withdrawing it does not affect anything we did while it was in force.

How to ask

Email contact@kotobakards.com with “Privacy Request” in the subject line, and tell us what you want us to do. Please write from the email address on your account, or give us enough information for us to be confident the request is yours — we will ask if we cannot tell. We will confirm we have your request within 10 days and answer it within 45 days, extending once by a further 45 days if it is complicated, in which case we will tell you why.

You may use an authorized agent. We will ask for proof that you authorized them, and for enough information to verify you.

We will not treat you differently for exercising any of these rights. Your service, your price and your progress stay exactly as they were.

We may refuse a request where the law allows — for example where we cannot verify who you are, or where keeping the information is itself a legal obligation. If we refuse, we will tell you why.

Turning off messages without contacting us

Study reminders and push notifications can be turned off in settings in the app or web app. Marketing email has an unsubscribe link at the bottom of every message. Service email about your account and payments cannot be turned off while your account is open.

Security

We take reasonable technical and organizational measures to protect your information. Traffic between your device and our servers is encrypted in transit. Passwords are stored hashed, never in readable form. Access to the production database is restricted, and the account our application uses cannot alter or drop data structures. We choose providers that offer at least comparable protection.

No method of transmission or storage is completely secure, and we cannot guarantee that unauthorized access, loss or alteration will never occur. If we suffer a breach affecting your personal information, we will notify you and the appropriate authorities as required by law.

Children

Kotoba Kards is not intended for children under 13. When you create an account on our website we ask for the year you were born, and we do not create an account for anyone under 13. Our apps are not directed to children, and we are not registered with the app stores as a child-directed service.

If you are a parent or guardian and believe your child has given us personal information, email contact@kotobakards.com with “Underage Use” in the subject line. We will delete the account and the information associated with it.

If you are under 16, we do not sell or share your personal information. In practice that means we do not pass information about you to Meta to measure our advertising, and advertising shown to you is not selected using information about you. We apply the same treatment to any account where we do not know the age, so being asked nothing never means being treated as an adult.

We ask for a year rather than a full date of birth because the year is all we need to apply these rules, and we would rather hold less. We do not show it on your profile and we do not use it to decide what you study.

US state privacy rights

Sharing for advertising

We do not sell your personal information for money. However, we share identifiers and device information with Google so that advertising can be shown in our free tier, and with Meta so that we can measure our own advertising. Under California law and several other state privacy laws that sharing is treated as a “sale”, or as “sharing for cross-context behavioral advertising” — and as “targeted advertising” under the Virginia, Colorado, Connecticut and Texas statutes. We disclose it on that basis rather than relying on the absence of payment.

You can stop this at any time, and nothing else about your account changes if you do:

• In the apps — open Settings → Ad privacy settings to change or withdraw your consent where that choice is offered to you. On iOS you can also deny tracking when the App Tracking Transparency prompt appears, or change it later under Settings → Privacy & Security → Tracking. On Android, Settings → Privacy → Ads lets you delete your advertising ID.
• On the web — use the “Do Not Sell or Share My Personal Information” link in our cookie banner, which is shown to visitors in the United States. You can reopen the banner at any time from our site footer.
• Or — subscribe to a paid plan, which serves no advertising at all.

We honor these requests regardless of whether a particular statute applies to us.

Categories we collect

In the language these statutes use, we collect: identifiers (name, email address, IP address, device and advertising identifiers); commercial information (your subscription and payment history); internet activity (pages and screens used, and your interaction with advertising); approximate location inferred from IP address and device time zone; and inferences drawn from your learning activity about what you should study next. The purposes are set out in How we use your information, the recipients in Service providers, and the periods in How long we keep your data.

We do not collect sensitive personal information as those statutes define it, and so we offer no “limit the use of my sensitive personal information” control.

Your rights

Depending on your state, you may have the right to know what we collect, to access a copy, to correct it, to delete it, to opt out of sale, sharing or targeted advertising, to opt out of profiling with legal or similarly significant effects, and to appeal a refusal. We do not profile you in any way that produces legal or similarly significant effects.

To exercise any of these, see Your choices and your rights. If we refuse your request you may appeal by replying to our decision; if we refuse the appeal, you may complain to your state Attorney General.

We offer everything in this section whether or not a particular statute requires it of us. Kotoba Kards does not meet the thresholds that make the California Consumer Privacy Act apply, and we are not claiming to be regulated by it — we would rather give you these controls anyway than leave you to work out which law covers where you live.

If you are in the European Economic Area or the United Kingdom

For the information described in this policy, Kotoba Kards LLC is the data controller.

Why we are allowed to use your information

Where advertising is concerned we rely on your consent and not on legitimate interests. In our apps we collect it through Google’s consent form when you first open the app, and we request no advertising until you have answered it. You may withdraw it at any time from Settings → Ad privacy settings, and doing so stops personalized advertising from that point on. We do not serve advertising on our websites to visitors in the EEA or the UK.

Your rights

You have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to how we use it, to receive it in a portable form, and to withdraw any consent you have given. Where we rely on legitimate interests, you may object and we will stop unless we have compelling grounds not to.

To exercise these, see Your choices and your rights.

You also have the right to complain to your local supervisory authority. In the UK that is the Information Commissioner’s Office (ico.org.uk). In the EEA it is the authority for the country you live in.

Accessibility, changes, and contact

Accessible formats

If you have a disability and cannot read this policy, email us and tell us what format would work for you. We will make reasonable efforts to provide it.

Changes to this policy

We may update this policy. When we do, we will change the date at the top and describe what changed. If a change materially affects how we use information we already hold about you, we will tell you — by email or in the app — before it takes effect, and where the law requires your consent we will ask for it rather than assume it.

We will not apply a materially different use to information we already collected without telling you first.

Contact us

For any question about this policy, or to exercise any right in it:

Email: contact@kotobakards.com

Post: Kotoba Kards LLC, 27801 Euclid Ave STE 250, Euclid, OH 44132, United States

We aim to answer within 45 days, and will confirm receipt within 10 days.