Privacy Policy

What changed in this version: the Service is now operated by Redmoon Systems OÜ (Estonia) instead of a French sole proprietorship, and the governing law and contact address follow from that. Your rights, the pricing and the way the Service works are unchanged.

This Privacy Policy explains how Yomimaru collects, uses, and discloses your information when you use our website and application (collectively, the "Service"). The Service is operated by Redmoon Systems OÜ, a private limited company (osaühing) registered in Estonia under registry code 17506382, with its registered address at Ruunaoja tn 3, Lasnamäe linnaosa, Tallinn, Harju maakond 11415, Estonia ("Redmoon", "Company", "we", "us", or "our"). Yomimaru is a product of Redmoon Systems OÜ; the company's website is redmoon.red.

Data controller. The controller of your personal data under the General Data Protection Regulation (GDPR) is Redmoon Systems OÜ, registry code 17506382, Ruunaoja tn 3, Lasnamäe linnaosa, Tallinn, Harju maakond 11415, Estonia. You can reach the controller at [email protected].

We are committed to complying with the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.

1. Information We Collect

A. Account & Identity Information (PII)

When you create an account, we collect your email address, display name, and a unique user identifier (uid) via Firebase Authentication. This information is stored in your User Profile schema to manage your access to the Service.

B. Learning & Behavioral Data

To personalize your learning experience, we track:

Your Japanese Language Proficiency Test (JLPT) levels.
Vocabulary mastery scores.
WaniKani API keys (if provided).
Assessment method results and specific topics of interest.

C. Content & Usage Data

We store data related to how you use the Service, including:

Imported reading materials.
AI-generated text snippets.
Reading session durations and daily reading streaks.
Full chat histories with the AI (stored pseudonymously).
AI-generated metadata related to your reading progress.

D. Analytics & Device Identifiers

We store a randomly generated identifier in your browser's local storage the first time you open Yomimaru. That includes our public articles and library pages, before you have an account. It is a string of random characters. It carries no name, no email address, and nothing that describes you.

We use it to count one reader as one reader rather than one per visit, and to connect the pages you read before signing up with the account you create afterwards. That is how we learn which of our free reading material actually helps people get started. When you sign out, we replace the identifier with a new one, so the next person to use the same browser starts fresh.

Alongside it we record the pages you open, the things you click, the features you use, the site or campaign that referred you, an approximate location derived from your IP address, and your browser and device type.

E. Data Retention

We store your personal data only for as long as your account remains active. If your account is inactive for more than 24 months, we will delete your Personal Identifiable Information (PII) and scrub your learning data, unless a longer retention period is required by law (e.g., for financial records stored by Stripe).

We keep your analytics profile for as long as your account is active. That profile covers the identifier described above, the activity recorded against it, and any session recordings. We delete all of it when you delete your account, as described in Section 4.

2. How We Use Your Information

We use the collected data for various purposes:

To provide, maintain, and personalize the Service.
To process transactions and manage your subscription.
To analyze learning progress and adjust difficulty dynamically.
To communicate with you (e.g., password resets, verification emails).
To see which of our public articles and library pages lead people to start learning, so we can make more of what works.
To detect, prevent, and address technical issues.

3. Third-Party Integrations & Data Transfers

We partner with third-party services to operate the Service. Your data may be transferred to or processed by these providers:

Google Cloud / Firebase: We use Firebase for authentication, database hosting (Firestore), and Cloud Functions. While our primary database (Firestore) is hosted in the europe-west9 region (Paris, France), our Cloud Functions are deployed in the asia-northeast1 region (Tokyo, Japan) to ensure optimal performance for our global user base.
Stripe: All payments are processed securely through Stripe. Raw credit card numbers never touch or pass through our servers. Stripe handles all PCI-compliant payment data.
Resend & MailerSend: We use these providers to deliver email, including password resets, account verification, and learning reminders. They process your email address and the contents of those messages.
OpenAI, Google Gemini & Other AI Providers: User chat messages, imported texts, and prompts are transmitted to external AI APIs (such as OpenAI or Google Gemini) for analysis, translation, and content generation. We use pseudonymous identifiers (hashed IDs) when communicating with these providers where possible to protect your identity.
PostHog: We use PostHog for product analytics, to understand how people use Yomimaru. Our analytics data is stored in PostHog's European Union region and reaches it through a first-party endpoint on yomimaru.app that forwards to PostHog's EU servers. We identify you there by the device identifier described in Section 1.D and, once you have an account, by a cryptographic hash of your internal user ID, never by your email address or your name. We also record occasional session replays to debug interface problems. We mask the text you type into form fields before the recording leaves your browser, and you enter payment details inside Stripe's own frame, so we never record them.
Algolia: We use Algolia to power search across our public library. It processes your search terms and IP address to return results.
Cloudflare: Our domain runs on Cloudflare, which delivers the site and protects it from abuse. Every request passes through Cloudflare, so it processes your IP address and basic request information.

Note regarding cross-border transfers: Some of these third parties (such as OpenAI or Stripe) may process data outside the European Economic Area (EEA). We ensure that such transfers are protected by appropriate safeguards, such as Standard Contractual Clauses (SCCs).

Depending on your location, you may have the following rights regarding your personal data:

The right to access, update, or delete the information we have on you.
The right of rectification if your information is inaccurate or incomplete.
The right to object to our processing of your Personal Data.
The right of restriction to request that we restrict the processing of your personal information.
The right to data portability to receive a copy of your personal data in a structured, machine-readable format.
The right to withdraw consent at any time where we relied on your consent to process your personal information.
The right to lodge a complaint with a data protection authority. Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee); you may also complain to the authority of the EU country where you live.

Deletion Workflows

You can delete your account yourself, at any time, from Settings → Account. Deleting it:

erases your profile, texts, vocabulary, chat histories, reading sessions, and every other record we hold under your user ID;
deletes your Firebase Authentication record;
erases your analytics profile at PostHog, including the activity recorded against it and any session recordings;
cancels your subscription, so you are not billed again. We do not wait for the end of the period you are in, and the remainder of a period you have already paid for is not refunded.

Two things are not deleted, and that is deliberate. Stripe keeps your invoices and payment records, because the law requires us to retain accounting records. And if you subscribed to our newsletter, that list is keyed to your email address and sits outside your account: deleting the account does not remove you from it, so use the unsubscribe link in any newsletter.

If you would rather we handled it, or you want to exercise any other right listed above, email us at [email protected], or use the form at yomimaru.app/contact. We will respond within 30 days, as GDPR requires.

5. Security of Data

The security of your data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

6. Children's Privacy

Our Service does not address anyone under the age of 13. We do not knowingly collect personally identifiable information from anyone under the age of 13.

7. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Effective Date" at the top.

Contact Us:

If you have any questions about this Privacy Policy, or if you wish to exercise your data protection rights, please contact us at [email protected], or use the form at yomimaru.app/contact.