Privacy policy
Last updated 15 September 2026
Kotoba Setto is a vocabulary app for learning Japanese. This page explains what we store about you, why, who else handles it, and how to get it changed or deleted. The short version: we keep what you need for your account and your deck, nothing for advertising, and you can delete it yourself at any time.
Who is responsible
Kotoba Setto is run by Samuel Andersen in Denmark, who is the data controller for the information described here. For anything about your data, write to privacy@kotobasetto.com.
What we store
- Your account: your email address, your password as a one-way scrypt hash (we cannot see the password itself), and when the account was created and confirmed.
- Your deck: the words, readings, meanings, example sentences, breakdowns and notes you add, your review progress (levels, due dates, counts of reviews and misses), and your settings, such as daily goal, streak and theme.
- Sign-ins and devices: a record of each signed-in session and each device token you create (its name, when it was created and last used). The session and token values themselves are stored only as hashes. Words a device sends wait in your inbox until you add or discard them.
- Security records: when we send you an email, the address and your IP address, so the forms can't be used to flood someone's inbox. Failed sign-in attempts are counted per IP address in memory. Our web server logs each request with the IP address, time, requested address and browser type.
- Emails you send us.
We don't ask for your name, and we don't collect payment details, location, contacts or anything from other apps. There are no analytics or advertising trackers.
Why, and on what legal basis
- To provide the app: keeping your account and deck, syncing them between your devices, and sending the emails the account needs (confirming your address, resetting your password, telling you when your email address changes). This is necessary to provide the service you signed up for (GDPR Article 6(1)(b)).
- To keep the service and your account safe: the security records above, used to stop abuse, block password guessing and fix problems. This is our legitimate interest (Article 6(1)(f)).
- To answer you when you write to us (Article 6(1)(f)).
We don't sell your data, use it for advertising or profiling, or send you newsletters.
Who else handles your data
- AlexHost SRL hosts our server in Chișinău, Moldova. Moldova is outside the EU and has no EU adequacy decision, so this transfer is covered by the European Commission's Standard Contractual Clauses in AlexHost's data processing agreement.
- Resend sends our account emails. It handles your email address and the message, and stores its data in the United States, covered by the EU–US Data Privacy Framework and Standard Contractual Clauses.
- ImprovMX forwards email sent to our kotobasetto.com addresses to our inbox.
- Backups of the database are kept on the server for 14 days, and a copy is kept on the operator's own computer in Denmark.
When you look up a word or fetch example sentences, our server asks Jisho.org, Tatoeba and kanjiapi.dev about that word. They receive the word, not who asked.
Pronunciation uses your browser's built-in speech. Some browsers send the text to their maker's online voice service (for example Google or Microsoft), which is covered by that browser's own privacy terms.
How long we keep it
- Account and deck: until you delete your account. Deleting it removes everything from the live database straight away; copies in backups are gone within 30 days.
- Accounts that are never confirmed: deleted after 7 days.
- Email links: expire after 1 hour (password reset) to 3 days (confirming an address), and are deleted once used or expired.
- Security records: the email-and-IP record for 1 day, failed sign-in counts for 15 minutes, web server logs for 14 days.
- Emails you send us: as long as needed to deal with them.
Cookies and storage in your browser
We set one cookie to keep you signed in, for up to a year or until you sign out, and the demo sets one for 7 days. The app also keeps a copy of your deck in your browser's local storage, so it opens quickly and works for a while without a connection. All of this is needed for the app to work, which is why there is no cookie banner. There are no tracking cookies.
Your rights
You can see and change everything in your deck in the app, download all of it with Export data on the Stats page, change your email address and password on the Account page, and delete your account there too. You also have the right to access, correct, delete, restrict or object to our use of your data, and to receive it in a portable format. For any of these, write to privacy@kotobasetto.com and we'll answer within a month.
If you think we handle your data wrongly, you can complain to the Danish Data Protection Agency, Datatilsynet, or the data protection authority where you live.
Security
The site is served only over HTTPS. Passwords, sessions and tokens are stored as hashes, the database can be read only by the app itself, and sign-in attempts are limited. If a breach puts your data at risk, we'll tell you and Datatilsynet as the law requires.
Children
Kotoba Setto is not meant for children under 13, who should not create an account.
Changes
If this policy changes, the date at the top changes with it. If a change affects how your data is used, we'll email you before it takes effect.