Privacy policy
1. Controller
Manuel Killert, Geschwister-Scholl-Straße 27, 49610 Quakenbrück, Germany. Email: lernen@ikuzojapanese.com. We have not appointed a data protection officer; we are not required to.
This policy covers the website ikuzojapanese.com and the ikuzo learning app (in the browser at ikuzojapanese.com/app).
2. What ikuzo stores
Without an account
You can use the website and the app without an account. Your progress (finished lessons, flashcards, points, streak) and your language are then stored only in your browser (localStorage) and never sent to us.
With an account
For an account we need your email address and a password (stored only as a hash). We also store your progress, points (XP), streak, flashcards, language and a league name you choose yourself. Your league name and weekly points are visible to other learners in your league group; your email address and everything else are not. We store reports and blocks of other users to keep the league clean.
The legal basis is Art. 6(1)(b) GDPR (performance of the user contract). For the AI tutor we also count how many requests you make per day, to enforce the daily limits (Art. 6(1)(f) GDPR).
Server logs
Our server keeps technical logs of each request (IP address, time, requested address, browser). They serve secure operation and troubleshooting (Art. 6(1)(f) GDPR) and are deleted after 14 days at the latest.
3. Who receives data
This list was taken from the source code: every entry matches a request the website or app really makes.
Hetzner Online GmbH
- Purpose
- Hosting of website, app, database and sign-in on a server we rent in Germany.
- Data transferred
- All requests to ikuzojapanese.com, account data, learning progress.
- Provider, location
- Hetzner Online GmbH, Gunzenhausen, Germany
- Legal basis
- Art. 6(1)(b) and (f) GDPR; data processing agreement
OpenAI
- Purpose
- The AI tutor “Sensei”, explanations of wrong answers and new memory tricks. Only with an account and only when you use the feature.
- Data transferred
- Your chat messages, the exercise and your answer, the characters you already know, your language. No email address, no name.
- Provider, location
- OpenAI Ireland Ltd., Dublin, Ireland
- Legal basis
- Art. 6(1)(b) GDPR
- Third country
- Processing may take place in the USA, secured by EU standard contractual clauses. According to OpenAI, data sent through the API is not used to train its models.
Google Fonts
- Purpose
- Fonts on the website (Noto Sans JP, Shippori Mincho). The app bundles its fonts and loads nothing from Google.
- Data transferred
- IP address and browser when the font is loaded.
- Provider, location
- Google Ireland Ltd., Dublin, Ireland
- Legal basis
- Art. 6(1)(f) GDPR
- Third country
- USA, secured by the EU-US Data Privacy Framework
Google Analytics
- Purpose
- Anonymous audience measurement on the website, only after your consent in the cookie notice. The app has no analytics.
- Data transferred
- Truncated IP address, pages viewed, device, rough location, events such as “lesson completed”.
- Provider, location
- Google Ireland Ltd., Dublin, Ireland
- Legal basis
- Art. 6(1)(a) GDPR, § 25(1) TDDDG
- Third country
- USA, secured by the EU-US Data Privacy Framework
Not on this list: the audio recordings (ElevenLabs) were generated once in advance and are served as ready files from our own server. No user data goes there during use.
4. Cookies and local storage
ikuzo keeps your sign-in, your language and your progress in your browser’s local storage. This is required for the service and needs no consent (§ 25(2) TDDDG).
Cookies for audience measurement (Google Analytics) are set only after your consent. You can withdraw it at any time via “Cookie settings” at the bottom of every page.
5. How long we keep data
Account data and progress stay until you delete your account. You can do that yourself at any time in the app under “You” → “Delete account”, or by emailing us. All linked data is deleted immediately with the account; backups are overwritten after 14 days.
6. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). You can withdraw any consent at any time with effect for the future.
An email to lernen@ikuzojapanese.com is enough.
You can complain to a data protection authority, for example the Data Protection Commissioner of Lower Saxony, Germany.
7. Changes
When ikuzo changes, this policy changes with it. The version published here applies.
Last updated: 3 November 2026
This is a translation for your convenience. The German version is the binding one.