Privacy Policy

Last updated: September 20, 2026

The short version: Kotoba collects the minimum needed to run a voice-first study app: your email if you make an account, your study progress, and your voice while you're answering (processed for speech recognition, never stored by us). No ads, no tracking across the web, and we never sell your data.

What we collect and why

Email address: only if you create an account, used to send one-time sign-in codes and to sync your progress across devices.
Study progress: which words you've studied and your review history, so spaced repetition works and syncs across devices. Without an account this stays only on your device.
Voice audio: while a session is listening, microphone audio is streamed to our speech-recognition provider to transcribe your answer. Audio is processed transiently for transcription; Kotoba does not store recordings. You can decline microphone access and use the on-screen buttons instead.
"Build it" answers. In the sentence-building exercise, your transcribed answer (text, not audio) is sent to an AI model for grading. After grading it is kept only in the diagnostic log described below.
Study session summaries: when a session ends we record counts only: how many items you answered, how many were new, correct or missed, whether the session finished, and whether the microphone or connection failed, plus the app version and a random session id. No audio, no transcripts, no words. Without an account this isn't linked to you.
Diagnostic logs. Kotoba keeps a log of each session: which step the app was on, whether audio, the microphone and speech recognition worked, any errors, the app version, your browser and device type, and a random session id. It also includes the text of what speech recognition heard and the feedback you were given, so we can fix cases where Kotoba mishears you. Never audio. You can turn the heard text off in Settings ("Share what Kotoba heard"). Logs are deleted after 30 days, and you can ask us to delete yours sooner. Without an account this isn't linked to you.
Feedback. If you use the in-app report form, we store your message, an optional contact address you choose to give, and the page URL and browser version to help reproduce bugs. If you leave "Include a diagnostic log" ticked, the app's recent log is sent with it, under the same rules as above.
Local storage: your settings, session token, and cached audio live in your browser's storage so the app works offline. These are strictly necessary for the app to function; we set no advertising or cross-site tracking cookies, which is why you don't see a cookie banner.
Aggregate analytics: we measure site performance and traffic with Cloudflare Web Analytics, which is cookieless and does not build profiles of individual visitors.

Who processes data for us

Kotoba runs on a small set of infrastructure providers, each receiving only what their job requires:

Provider	What it does	What it sees
Cloudflare	Static site and API hosting, database, audio delivery	Account email, progress data, feedback, request metadata (IP)
Deepgram	Speech recognition	Voice audio during answers (transient)
Anthropic	AI grading of built sentences	Your answer as text (transient)
Resend	Sign-in code emails	Your email address
Google Fonts	Font delivery	Request metadata (IP)
Cloudflare Web Analytics	Aggregate, cookieless site analytics	Page views and performance timings (no visitor profiles)

YouTube API Services

Kotoba publishes its own short study videos to the Kotoba YouTube channel using an internal uploader tool built on YouTube API Services. That tool is used only by the Kotoba team, is authorized only against our own Google account and channel, and uploads only content we created ourselves. It does not access, collect, or store YouTube user data from you or anyone else, and no part of kotobaapp.com reads, stores, or displays data from the YouTube API. When you watch or interact with our videos on YouTube itself, that's governed by the YouTube Terms of Service and the Google Privacy Policy. If you ever authorize a Google account against a Kotoba tool, you can revoke that access at any time in your Google security settings.

What we don't do

We do not sell or share your personal information for advertising. Because nothing is sold or shared, opt-out signals like Global Privacy Control have nothing to opt out of. You're already there.
We do not profile you or make automated decisions with legal effect.
We do not store your voice.

Retention and deletion

Account data (email + progress) is kept while your account exists. To delete your account and all synced data, ask via the in-app feedback form or email support@kotobaapp.com and we'll remove it. Diagnostic logs are deleted automatically after 30 days. To have yours removed sooner, email the same address. Local data can be cleared any time by clearing your browser storage.

Your rights

Depending on where you live (e.g. GDPR in Europe, CCPA/CPRA in California), you may have rights to access, correct, export, or delete your personal data, and to complain to a supervisory authority. Contact us through the channels above and we'll honor these requests regardless of where you live.

Children

Kotoba is not directed at children under 13, and we don't knowingly collect their data. If you believe a child has created an account, contact us and we'll delete it.

Changes

If this policy changes materially, we'll update the date above and note the change on the site. Continued use after a change means you accept the updated policy.

Contact

Questions? Use the in-app feedback form or email support@kotobaapp.com.