Privacy Policy

Your account

• Email address (required), and whether it is verified
• Display name (optional, chosen by you)
• Profile picture (optional): one you upload, the address of an image you link to, or your Google account photo if you sign in with Google
• How you sign in (email and password, or Google), when you created the account and when you last signed in
• When you accepted our Terms of Service and this Privacy Policy, which versions, and where (the sign-up form, or the notice when continuing with Google)
• Your marketing email choice, and when and where you made it
• A pending email change (the new address), while you confirm it
• Your free trial: when it ends, and whether we have sent the email saying it is about to end

Signing in and security

• Passwords: your password goes over an encrypted connection to our server, which passes it to our authentication provider (Google Firebase) to create your account or change your password. Firebase stores it hashed. We never store or log it.
• Google sign-in is handled by Google; we receive your name, email address and profile photo.
• Two-factor authentication: if you turn it on, your authenticator is registered with Firebase. (Accounts that set up two-factor authentication with our earlier system may still have an encrypted authenticator secret and hashed backup codes stored with us, until they set it up again.)
• Sign-in session: a secure cookie keeps you signed in (see Cookies).
• One-time links: for email verification, password reset and email change we store a random code with your email address and an expiry time (24 hours, or 60 minutes for password reset).

Your learning

• Characters, words and kanji you have learned or mastered; XP, level, streak and daily goal
• Game history: each game's type, score, accuracy, time and hints, and each answer (which item, which skill, how well you did, and whether you typed or chose)
• Smart Review scheduling for each item (when it is next due and how well you know it), your daily review limit and holiday mode
• Learning path results: placement tests and stage tests
• Daily challenge results and weekly league points (see Leaderboards and competitions)
• Your device's time zone offset, used to work out your day for streaks, reviews and competitions (not stored). If you turn on study emails, your time zone is stored so they arrive at the time you chose.

The welcome questions (optional)

On your first visit to Today we ask a few questions, each one skippable: your display name and whether your profile is public, your country and time zone, why you're learning, how much Japanese you know, how you heard about us, and whether you'd like tips and offers by email. We keep your answers with your account, with when you answered (or that you closed the questions). The time zone is also used for your study emails. We count the answers, without names, to see who is joining and where they found us.

What you create or send us

• Custom quizzes (name, description, questions, settings, and whether you listed them in the community library) and your tags
• Reports about a public quiz ("Report this quiz"): the reason, your message, and the quiz's name and description at the time. We tell you what we decided.
• Problem reports ("Report a problem" in a game): the item, what you answered, your message and the page you were on. We read them to fix content.
• Quiz ratings: after some finished sessions we ask how it went (👍 or 👎). We keep your rating, the game or quiz and the answer mode, your note if you add one after a 👎, and when we last asked and how many times you dismissed it (so we don't ask too often).
• Roadmap votes (on the Feedback page): the items you voted for. Only the totals are public, never who voted. If you tick "Email me when this ships", we keep that with your vote and use it for that one email only; take your vote back to cancel it. Ideas you send from that page are support messages (below).
• Messages you send us by email or through the contact form
• A refund request (on the refund page, in Settings or through the contact form): your name, the email address for our reply, the purchase you name, your note, where and when you sent it, to end the plan, refund it and show we did.

People who answer a shared quiz

We store the name you type, your answers and your score, for the person who shared the quiz to see. We don't store your email or IP address with it. If you play signed in, your answers are also linked to your account, and your first attempt goes on the quiz's board (see Leaderboards). They are deleted when the quiz owner resets or deletes the quiz or deletes their account, or when you delete yours. You can also ask us to delete them (see Contact).

Membership and payments

• Membership type (free, monthly, annual, lifetime), subscription status and billing period
• Your Stripe customer and subscription ids. Card details go straight to Stripe and never reach our servers.
• Records of payment disputes, if any (amount, reason, status)

Emails and settings

• Study email choices (review reminders, the daily email): which ones you turned on, how often, the time and day, your time zone, when each was last sent, and when you switched each one on or off
• Settings: theme, public profile, membership badge, game settings
• The email delivery log: for each email we send you, whether it was delivered, bounced, reported as spam or unsubscribed (from Postmark), with a bounce's type and short description, its kind and when. Never its content, and never whether you opened it or clicked a link. A hard bounce or a spam report on a study or news email turns those emails off.

Keeping the Service safe

• Rate limiting: to stop abuse we count requests per account, per email address or per IP address. We store only a one-way hash of these, never the IP address itself, and the counters are deleted automatically within 24 hours.
• Sign-up check: Cloudflare Turnstile checks that a real person is signing up, or writing to us signed out (see Service providers).
• Spam prevention: to find accounts created by bots, a score proposes accounts for a person to review, from signals such as the display name, the email domain, whether the email was verified and sign-ins (see Spam and bot accounts).
• Moderation and our team's log: reports, our decisions and the statements of reasons we send, and a log of what our team did on an account (who, what and when), so every action can be checked.
• Server logs: our hosting provider (Vercel) records requests (IP address, browser, pages, time) to run and secure the Service.
• Error reports: when something breaks, we may receive a technical error report (see Better Stack under Service providers).

Anonymous counts

We count how often some things happen on the Service, such as a game started, a pricing page viewed, a checkout started or an error in the page, sometimes with a general detail (the type of game or the plan). Each count is only a number per day, per month and in total: it carries no account id, no cookie, no IP address and no browser details, and it can't be linked to you. These counts need no consent and are kept as totals. To block floods of fake counts, your IP address is used briefly, only in our server's memory, and is never stored.

Only with your consent

• Analytics (Google Analytics): pages you visit, the device and browser, and learning events (game started, finished or left, hints, purchases, sign-ups). When you are signed in, analytics are linked to your account id and to your membership type, sign-up method and sign-up date.

None of these load until you agree in the cookie banner, and you can change your choice any time with "Cookie settings" at the bottom of every page.

While you have an account

We keep your account, learning data, quizzes, tags and reports until you delete them or your account. "Reset progress" deletes your progress, game history and Smart Review data (but not past competition results).

When you delete your account

We delete your profile, progress, game history, Smart Review data, competition entries and results, quizzes (with the answers people gave to them), tags, problem reports, quiz ratings, roadmap votes (taken off the totals), support messages (with their screenshots) and our notes on them, a student proof, one-time links, your uploaded picture and your sign-in account, straight away. You can't delete an account while a subscription is still being billed; cancel it first.

What we keep: Invoices and billing records (what was bought, when, the amount, the VAT and the invoice) are kept for 10 years, as Portuguese tax and commercial law requires. Everything else is kept to what the Service needs and is deleted with your account. For you, that means: if you ever paid, a short purchase record (your account id, Stripe customer and subscription ids, membership type and status, and the deletion date), your payments, refunds and refund requests, and any payment dispute records, for 10 years from the end of the year they belong to. Stripe keeps its own records under its policy.

Backups

Our database is backed up for disaster recovery. Deleted data disappears from backups when they expire, within 30 days.

Short-lived data

• One-time links (verification, password reset, email change): deleted automatically about a day after they expire.
• Rate-limit counters: deleted automatically about a day after they expire.
• Emails: Postmark keeps records of sent emails for 45 days.

Kept by our providers

• Google Analytics (with consent): event data is kept for the period set in our Google Analytics account, at most 14 months.
• Student discount: a proof is deleted once we decide (and with your account); the decision and its dates are kept while you have an account.
• Our team's log of actions on accounts: kept for 2 years.
• Spam checks: the records of accounts set aside for review, and of suspensions, are deleted with the account, or 30 days after a suspension is lifted or ends; the record of each review batch is kept for 2 years.
• A suspension: kept while the account is suspended.
• Refund requests: kept for 10 years with the billing records; a request that matches no purchase, for 1 year.
• Failed payments (which invoice, the amount, the attempt and the next retry; never card details): kept for 1 year, so we can help when a payment doesn't go through.
• Payment disputes, and the records of a compensation we give (such as lifetime membership and refunds after an outage, and the email telling you): billing records, kept for 10 years.
• Push notification tokens: deleted when you turn notifications off on that device, when the browser stops accepting them, or with your account.
• A record of the emails we send you (which email and when, never its content): kept for two years, so we can help when one doesn't arrive. Deleting your account deletes it straight away.
• The email delivery log (delivered, bounced, reported as spam or unsubscribed): kept for 1 year, to deliver service emails and to stop sending to addresses that don't work. Deleting your account deletes it straight away.
• Support messages: kept for two years after the last message in the conversation, then deleted automatically, with any screenshot sent in it. Deleting your account deletes the ones you sent signed in, their screenshots, and our notes, straight away. Email you send us is kept the same way (two years after the last message in the conversation, with its attachments); deleting your account removes its link to your account and the name kept with it. A record of each email handled (its identifier, and which conversation it went to) is kept 30 days, so an email our server reads again is not kept twice. Emails and replies also stay in our support mailbox (our EU mail host) as ordinary email; ask us and we'll delete them.
• Server logs and error reports: kept by Vercel and Better Stack for a limited time under their own policies.

On your device

Data stored in your browser stays until you clear it (see Cookies).

Strictly necessary (always on)

• __session (cookie, 5 days): keeps you signed in.
• csrf_token (cookie, 24 hours): protects forms against cross-site request forgery.
• km-maintenance-bypass (cookie, 12 hours, our team only): lets our team see the site while it is closed for maintenance.
• Firebase sign-in data (browser storage): your sign-in, until you sign out.
• Preferences (browser storage): theme, game settings, your cookie choice, dismissed notices, and a short wait before resending a verification email.
• Push notifications (only if you turn them on): a small background script that shows them, and this device's notification token.
• Games saved while offline (browser storage): results waiting to be sent, removed once they are. They stay if you sign out before they are sent, so on a shared device sign in again to send them.
• Your name for a shared quiz (browser storage, until you close the tab).
• Offline pages (if the Service is installed as an app): copies of our public pages, not your data.

Analytics (only with consent)

Google Analytics cookies _ga and _ga_* (up to 2 years): tell visits apart.