Privacy policy

Data controller

to be completed, to be completed. Contact about your data: to be completed.

What we store

Account: email address, display name, and with Google sign-in, the Google account's ID and photo.

Learning: progress (spaced repetition), game sessions, XP, streak, daily goal, records, challenges, quests, favorites, mnemonics, reported mistakes.

Preferences: level, game settings, reminder time and time zone.

Social (if you use it): friend code, friend list, challenges, weekly league, public leaderboard (display name, level, XP), duel games; referral: who invited you, and how many friends signed up with your link.

Notifications (if you turn them on): the push subscription address your browser provides.

Emails: your email address, whether you chose to get our tips, reminders and offers (and when), and which emails were sent to you.

Premium subscription (if you take one): your Stripe customer ID and subscription status. Card details are entered at Stripe and never go through our servers.

Sign-up origin: the source of your first visit (search engine, social network, website, campaign) and the landing page, to know which channels bring learners.

Technical: your IP address is used for the duration of a request to limit abuse; the host keeps short-lived technical logs.

Why (purposes and legal bases)

Providing the service — account, progress, reviews, duels, leagues: performance of the contract (terms of use).

Study reminders: your consent, which you can withdraw anytime in the settings.

Emails about your account (welcome, end of the free trial): performance of the contract. Tips, reminders when you stop for a few days, and offers: your consent (unchecked box at sign-up, a switch in the settings), withdrawn in one click from any email.

Security and abuse prevention (rate limits, moderation): legitimate interest.

Cookieless audience measurement: legitimate interest (consent exemption under the French CNIL guidance). Google Analytics and PostHog, if used: your consent.

No ads, no advertising trackers, no selling of data.

Browser storage

The app stores in your browser the Firebase sign-in session, language, theme, content downloaded for offline use, and today's mistakes. This is needed for the app to work: it requires no consent and is never used for tracking.

Audience measurement and cookies

KanaLearn measures its audience without cookies: page views, origin (referring site or campaign), country, device type, and the main steps of use (sign-up, Premium offer viewed, subscription). A visitor is only recognised for the day, by a keyed fingerprint of their IP address and browser that changes every day and is erased after 2 days; no IP address is kept. Only daily totals are kept.

The origin of your first visit is kept for 30 days in your browser, to link it to your sign-up. This measurement only serves our statistics, is never combined with other data and is shared with no one.

A preference cookie, kanalearn_locale (1 year), remembers the language you use, to open the app in it: it is needed for the service and is not used for any measurement.

Recipients and transfers

Processors: Google (Firebase — authentication and database), Vercel (hosting), Stripe (Premium subscription payments), Resend (sending emails), your browser's push service (Google, Mozilla or Apple) for notifications.

These providers may process data outside the European Union; such transfers rely on the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.

Other users only see what is public: display name, level and XP on the leaderboard and in leagues, and your profile for your friends.

Retention

As long as the account exists. When you delete your account, all related data is erased immediately, except the host's technical logs (a few weeks at most).

An expired push subscription is deleted on its first failed delivery.

Invoices and payments: kept for 10 years by Stripe for our accounting obligations, even after the account is deleted. Deleting the account ends the subscription at once.

Your rights

You can access, correct, erase or export (portability) your data, object to processing, or ask for it to be restricted.

In the app: Settings → My data → “Download my data” (full JSON export) and “Delete my account” (immediate, permanent erasure).

For any other request: to be completed. We reply within one month.

You may also lodge a complaint with your data protection authority (in France, the CNIL — cnil.fr).

Minors

In France, a child under 15 may only sign up with the consent of a holder of parental authority.