Privacy

What the app stores

The app stores your learning progress, review schedule, preferences, and practice history locally on your device so it can work without an account. In a web browser, this data lives in that browser's storage on your device. It is not sent to us.

Dictionary searches

The dictionary runs on your device and keeps no search history. What you type is never sent to us. The Android and iPhone apps carry all of the dictionary's data inside the app. The web version instead downloads the dictionary's data files from our website when you open the dictionary and as you search, and your browser keeps them for offline use. These are the same public files for everyone, but which files your browser asks for depends on what you look up, so the hosting logs described below can show which parts of the dictionary were downloaded.

Device backup

On Android, your learning progress is part of the standard Android app backup when device backup is turned on in your system settings. That copy goes to your own Google account and is never sent to us. It can be restored when you reinstall the app or set up a new phone, provided Android has actually completed a backup and you pick that backup during setup. Android runs these backups on its own schedule, so treat it as a safety net rather than a guarantee. On iOS, the app container is included in your iCloud or computer backup under the same rules. Turning device backup off in your system settings stops this. The app also lets you export a backup file yourself from Settings.

Visit counts, no tracking

The app has no analytics or advertising SDKs, tracking pixels, session recording, accounts, sync between devices, or server-side learning profiles, and it loads no third-party scripts. This website (not the app) counts visits with Cloudflare Web Analytics: a Cloudflare script on these pages reports each page view without cookies or storage in your browser, and we see only totals such as page views, referring sites, countries, and browser and device types. It does not follow you across other sites. The legal basis is our legitimate interest in knowing how the site is used. The app and this website use only their own fonts. Cloudflare may set a short-lived security cookie, as described below.

Feedback you choose to send

If you send feedback, we receive your message and category, app version, platform, language, current screen, any attached card context, and browser or device information (user-agent). These help us investigate the report. Your study history, answers, and timing data are not attached. We use a report only to investigate and answer it, which is our legitimate interest in keeping the app correct.

The form sends reports to our feedback service, which stores them with the submission time. We also forward a notification copy through Resend, our email processor, when notification delivery is configured. If you send a report through your email app instead, we also receive your email address and the information you include in the message.

We delete feedback reports and their app context within 12 months of submission. We remove them sooner when you ask us to and we can identify the report. Email reports and notification copies follow the same period.

Waitlist email

If you join the waitlist, we store your email address, browser language, the landing-page source, and submission time in our feedback service. We also forward a notification copy through Resend, our email processor, when notification delivery is configured. We use your address for one notification when Kimariji launches on Android, and for nothing else. This list does not include an iOS launch notification. The app itself does not require an email address.

The legal basis is your consent, which you give by submitting the form (GDPR Article 6(1)(a)). You can withdraw it at any time with the unsubscribe link in the launch email or by emailing us; we then delete your address and send you nothing more. Withdrawing does not affect what was done before. We send the launch email from our own mailbox or through an email delivery provider that handles the addresses only on our behalf.

We delete waitlist records within 30 days after sending the launch notification, or within 12 months of sign-up if no notification is sent. You can ask us to remove your address earlier.

Purchases

Only the Android app sells the Full version: a one-time purchase through Google Play, not a subscription. Google Play handles the payment under Google's own privacy policy, and we never receive your payment card details. To confirm a purchase or restore access, the app sends product and purchase details, such as the purchase token and the Play receipt, to our validation service, which checks them with Google. After a purchase, the app repeats this check with the saved purchase token when it starts, reconnects, or returns to the foreground, so that a refund is noticed. The validation service does not save purchase details. The legal basis is the purchase itself: we need these checks to give you what you bought.

Google also gives us order and sales reports, such as the order number, date, product, price, and the buyer's country. We use them for accounting, taxes, and refunds, as Finnish accounting law requires, and keep them for the period it sets.

Hosting and server logs

Our website, the web version of the app, and the feedback, waitlist, and purchase services run on Cloudflare. Like any web host, Cloudflare receives the technical details of each request: your IP address, the time, the page or file requested, and your browser's user-agent (browser and operating system, on some devices also the device model). For the web version, this includes the app, audio, font, and dictionary files it downloads as you use it. Cloudflare uses these details to deliver the site and protect it against attacks, and it shows us statistics built from them. We do not use them to identify or follow anyone. We keep no server logs ourselves: logging is switched off for our services, and Cloudflare handles its own request records under its privacy policy. The legal basis is our legitimate interest in running a working, secure website.

Cloudflare may also set a short-lived security cookie when it checks whether a visitor is a bot. Our feedback database, which also holds the waitlist, is in Western Europe and stores no IP addresses or cookies. Cloudflare and Resend are based in the United States; where they process data outside the EU and EEA, we rely on the safeguards in their data processing terms.

The Android app contacts our servers only when you send feedback or when a purchase is checked. Its lessons, audio, and dictionary are inside the app.

Your control

Clear the app's local data or the website's stored data to remove local progress and preferences. Your device backup is managed in your Google or Apple account settings. If you exported a backup file, delete that file separately.

You can ask us what personal data we hold about you and for a copy of it, and ask us to correct or delete it, or to restrict or stop its use. To make a request, or to remove a waitlist address or feedback message before its retention period ends, email the contact below with enough information to identify your submission, such as the email address or the date and text of a report. We have no accounts, so this is the only way we can find it. We answer within one month. You can also complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or to the data protection authority where you live.

Publisher and contact

Kimariji is published by Creativille Oy, Finland, which is the controller of the personal data described on this page. Postal address: Creativille Oy, c/o Askelvirta Offices, Ahjokatu 14-16 lt. 20, 40320 Jyväskylä, Finland. Questions about this policy or your data: [email protected].