Privacy policy

Who runs Rakuko

Rakuko is run by Rakuko's operator (whose name is given without delay on request), who is responsible for your data. The address is given without delay on request; ask at the email address at the bottom of this page.

What we store

Your email address, so you can sign in. A password if you choose to set one; it is stored by our sign-in provider as a hash, never as the password itself.

What you do in the app: the words you save, how well you know them and any meanings you write for them, your decks and review history, what you have read and how far you got, the star ratings you give, reading lists, interests, the language you are learning, any Aozora Bunko works you import, and anything you imported with earlier versions of the app.

If you answer it when you sign up, where you heard about Rakuko (for example X, a friend or a teacher). It is optional, and we use it only to count which places bring new readers.

If you subscribe: your plan, its status and renewal date, and the reference numbers Stripe uses for your customer record and subscription. We never see or store your card number.

The app shows no advertising and uses no analytics or tracking scripts, we do not sell data, and nothing you read or save is sent to an AI service.

What we use it for

Only these: to run the app for you (signing you in, the reader, reviews, downloads); to take payment and manage your plan; to answer your questions and tell you about your account or changes to the service; to count where new readers hear about us; and to keep the service secure and stop misuse. We do not use it for anything else without asking you first.

We do not give your data to anybody else except the services named below, which handle it for us, or where the law requires it.

Who else handles it

Supabase stores the database and handles sign-in, on servers in Singapore. Vercel runs the app itself, also in Singapore. Both process your data only to provide the service.

Pictures on vocabulary cards and library covers are loaded from Wikimedia, so your browser contacts Wikimedia's servers when it shows one.

Sign-in emails are sent through Supabase.

Payments are handled by Stripe. When you subscribe, Stripe receives your email address and the payment details you enter on its page, and processes them under its own privacy policy.

If you choose to sign in with Google or LINE, that company tells us your email address and, if you allow it, your name and profile picture, and it learns that you signed in to Rakuko. We use the address to find or create your account and to write to you about it - sign-in emails and anything affecting your account, never marketing; the name and picture are stored with your sign-in record and not used for anything else. That company's own privacy policy covers what it does on its side.

Data held outside Japan

Supabase, Vercel and Stripe are United States companies. Your data is stored and processed on their servers in Singapore (Supabase, Vercel) and the United States (Stripe), and requests to the app may pass through Vercel's network in other countries on the way. Each is bound by contract to protect personal data to the standard Japan's law requires (Article 28 of the Act), and we will tell you more about those measures on request.

Emails you send to support are received through Google and may be processed by Anthropic to help write replies; both are United States companies.

Singapore has a general data-protection law (the Personal Data Protection Act 2012). The United States has no single federal one; protection comes from sector and state laws. Japan's Personal Information Protection Commission publishes a summary of each country's rules at ppc.go.jp.

How we keep it safe

Everything travels encrypted (HTTPS). The database only lets each account read its own data. Passwords are stored only as hashes and card numbers never reach us. Only the operator can reach the administration tools, and keeps their own accounts protected. We chose providers who publish their security practices, and we know which countries they hold data in, as listed above.

On your device

The app keeps a sign-in cookie, which is needed for it to work. Reader settings such as text size are kept in your browser's local storage.

If you download decks or pieces for offline use, they are stored on your device until you remove them, sign in as somebody else, or delete your account.

The listen buttons use your device's own voice; no audio is sent anywhere.

Your choices

You can delete your account from the account page. That removes your account and everything in it from our database straight away. Copies in routine backups are overwritten in the normal course of things.

You can also ask us to show you the data we hold about you, correct it, stop using it, delete it, or show you records of passing it to anybody else. Most of it you can see and change in the app yourself. For anything else, write from your account's email address to the address at the bottom of this page; we answer without delay and charge nothing.

Questions and complaints about how we handle your data go to the same address.

Changes

If this policy changes, the date at the top changes with it. A change that affects what we do with data you have already given us will be announced in the app first.