Privacy Policy

Your Privacy Matters

The KitsuKana Team respects your privacy. We are committed to being transparent about what data we collect (spoiler: almost none) and how it's used. This Privacy Policy explains our practices in plain, honest language.

This policy complies with the EU General Data Protection Regulation (GDPR) and applicable Hungarian data protection laws (such as Act CXII of 2011 on the Right to Information Self-Determination and Freedom of Information, and Act C of 2003 on Electronic Communications).

Data Controller

Name: Péter Varga (individual developer)
Location: Hungary, European Union
Contact Email: vargapeter.workmail@gmail.com
Feedback: Via the feedback form

We use PostHog for telemetry and event tracking which processes data on our behalf. We have not appointed a Data Protection Officer (DPO) as we are an individual developer with minimal data processing.

TL;DR (Summary)

• ✅ Guest Mode keeps all learning data on YOUR device (localStorage)
• ✅ Optional accounts securely sync your progress to the cloud (Frankfurt, EU)
• ✅ We use PostHog for anonymous usage and telemetry statistics (only with your explicit consent)
• ✅ No advertising or tracking for ads
• ✅ Feedback is voluntary and goes to a private GitHub repository
• ✅ We use Web Speech API (processed locally by your browser)
• ✅ Full GDPR compliance

Data We Do NOT Collect

We explicitly do not collect:

• ❌ Phone numbers or physical addresses
• ❌ Precise GPS coordinates or exact location
• ❌ Any data for advertising purposes

Note: PostHog does collect anonymized usage data (page views, approximate location, device type) if you give us permission. See the Analytics and Telemetry section below for full details.

1. Guest Mode (Local Storage)

If you do not create an account, KitsuKana stores all your learning progress locally in your browser using localStorage. This data never leaves your device.

Local data includes:

• Learning progress (completed lessons, mastered characters)
• SRS (Spaced Repetition System) flashcard data
• Personal dictionary entries
• Theme preference

2. Registered Accounts (Cloud Sync)

If you choose to create an account to sync your progress across devices, we collect:

• Email address: Used exclusively for authentication and account recovery.
• Learning progress: Completed lessons, mastered characters, and SRS data.

Legal Basis (GDPR Article 6(1)(b)): Contract performance - processing necessary to provide the cross-device sync service you requested.

Storage Location: Your learning data is securely stored in a database hosted in Frankfurt, Germany (European Union) via Supabase, ensuring strict adherence to EU data protection laws.

Authentication: Account security and sign-in is managed by Clerk, a certified authentication provider that complies with the EU-US Data Privacy Framework.

Right to Erasure: You can instantly delete your account and all associated data at any time from your Profile page.

Data We May Receive

1. Feedback Submissions (Voluntary)

When you voluntarily submit feedback through our feedback form:

• Feedback type (bug, feature request, etc.)
• Title and description you provide
• Timestamp of submission

Security & Rate Limiting: During the submission process, client IP addresses are processed temporarily in-memory on our serverless endpoint strictly for security and rate-limiting purposes. This data is not stored in our database or shared.

Legal Basis: For feedback data, your explicit consent (GDPR Article 6(1)(a)), given when you voluntarily submit the form. For in-memory IP address rate-limiting, legitimate interest (GDPR Article 6(1)(f)) to protect the service from abuse.

Storage: Feedback is stored in our private GitHub repository. Only The KitsuKana Team can access it. It is not publicly visible.

Retention: Feedback is retained indefinitely to track feature requests and bug reports. You may request deletion at any time.

2. Donations (Voluntary)

If you choose to donate, payment processing is handled by Ko-fi and their payment partners (Stripe, PayPal).

What we receive: Only confirmation that a donation was made. We do NOT receive your payment card details, bank account, or personal information.

Legal Basis: Contract performance (GDPR Article 6(1)(b)) - processing necessary to complete your donation.

Please refer to Ko-fi's Privacy Policy for their data handling practices.

Analytics and Telemetry

We use PostHog to understand how visitors use our application, track event completions, and improve the learning experience. PostHog only runs if you have explicitly granted consent through our cookie consent banner.

What PostHog collects:

• Page views and navigation patterns
• Approximate geographic location (country/city level, not precise)
• Device type and browser information
• Session duration and feature engagement metrics (like character flips or lesson completion)

What PostHog does NOT collect:

• ❌ Your name, email, or personal credentials
• ❌ Precise location or GPS data
• ❌ Any data for advertising or cross-site tracking

Legal Basis: Consent (GDPR Article 6(1)(a)) - we only activate PostHog capturing after you choose to click "Accept" on our consent banner.

See PostHog's Privacy Policy for more information.

No Advertising

We do not use:

• ❌ Facebook Pixel or social media trackers
• ❌ Advertising networks or targeted advertising
• ❌ Tracking pixels or beacons for ads
• ❌ Fingerprinting or device tracking

Your learning progress stays on your device and is never used for advertising purposes.

Cookies and Telemetry Consent

Telemetry Cookies: If consent is granted, PostHog uses cookies (such as ph_*_posthog) to distinguish unique visits, track engagement, and aggregate site statistics. These cookies are stored on your device and are not used for advertising.

Local Storage: Your browser uses localStorage to store your learning progress and your cookie consent preference (kitsukana_cookie_consent). This is stored locally on your device and does not track you across other websites.

Managing Your Consent: You can opt in or out of telemetry tracking at any time. Clicking the button below will clear your saved consent preference and let you make a new choice:

Third-Party Services

Hosting Provider (Vercel)

Our website is hosted on Vercel. As part of standard web hosting, Vercel may collect basic server logs including:

• IP addresses
• Access timestamps
• Browser type and version
• Referring URLs

Legal Basis: Legitimate interest (GDPR Article 6(1)(f)) - necessary for security, fraud prevention, and service operation.

We do not access or analyze this data. See Vercel's Privacy Policy.

Sentry (Error Telemetry)

We use Sentry to capture runtime errors and log diagnostic information when the application crashes or encounters an issue. This helps us ensure application stability.

Data processed by Sentry: JavaScript error logs, device operating system, browser version, and approximate location. We do not use Sentry Session Replay, and no personal user identifiers are recorded.

Legal Basis: Legitimate interest (GDPR Article 6(1)(f)) - necessary for diagnosing errors, maintaining application security, and ensuring service reliability.

GitHub (Feedback)

Feedback submissions are sent to our private GitHub repository via a serverless function.

Data processed by GitHub: Only the feedback content you submit. See GitHub's Privacy Statement.

Web Speech API

We use your browser's built-in Web Speech API for Japanese pronunciation. This is processed entirely locally by your browser - no audio data is sent to our servers.

KanjiVG (Stroke Order)

Kanji stroke order animations are sourced from the KanjiVG project. This data is fetched directly from GitHub's public servers. See KanjiVG Project.

PostHog

We use PostHog to analyze website usage. PostHog processes data on our behalf. Telemetry data is only captured with your consent. See the Analytics and Telemetry section above for details and PostHog's Privacy Policy.

AI in Development

AI coding assistants (Claude, Gemini) were used in development. These tools:

• Process code during development only
• Do NOT have access to any user data
• Are not used at runtime

All AI-generated code and content has been reviewed and tested by humans.

Children's Privacy

KitsuKana is designed to be suitable for all ages. We do not:

• Collect personal information from any user
• Require age verification
• Use targeted advertising
• Have features that require parental consent

Since no personal data is collected, there are no special COPPA or child privacy concerns. However, we recommend parental guidance for children under 13 using any online service.

Your Rights Under GDPR

As an EU resident, you have the following rights:

• Right to Information (Article 13-14): You have the right to know what data we collect - this policy fulfills that right
• Right of Access (Article 15): You can request a copy of any data we hold about you
• Right to Rectification (Article 16): You can request correction of inaccurate data
• Right to Erasure (Article 17): You can request deletion of your data
• Right to Restriction (Article 18): You can request we limit processing
• Right to Data Portability (Article 20): You can export your local data from the Profile page
• Right to Object (Article 21): You can object to processing based on legitimate interest
• Right to Withdraw Consent: You can withdraw consent at any time

Since we collect minimal data, most of these rights are automatically satisfied. For feedback submissions, contact us via the feedback form or email to exercise your rights.

Data Retention

• Local data: Stored until you delete it
• Feedback: Retained indefinitely unless you request deletion
• Server logs (Vercel): Per Vercel's retention policy
• PostHog Telemetry: Anonymized usage data is retained in accordance with PostHog's data storage policies

International Transfers

Our hosting provider (Vercel), GitHub, and PostHog may process data in the United States or other locations outside the European Economic Area. These transfers are protected by:

• EU-US Data Privacy Framework
• Standard Contractual Clauses (SCCs)

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be indicated by updating the "Last updated" date. We encourage you to review this page periodically.

Supervisory Authority

If you believe we have violated your privacy rights, you have the right to lodge a complaint with a supervisory authority. In Hungary:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
Website: https://www.naih.hu

Governing Law

This Privacy Policy is governed by the laws of Hungary and the European Union, including the General Data Protection Regulation (GDPR).

Contact

For privacy-related questions, concerns, or to exercise your rights, please contact us directly at vargapeter.workmail@gmail.com or use the feedback form. We take privacy seriously and will respond within 30 days as required by GDPR.