1. Scope and contact

This Privacy Policy applies to the Npass 日本語 mobile application, its learning services, and the public website at npassnihongo.com. In this policy, "Npass", "the app", "we", and "our" refer to NAY KO KO OO, trading as Ciel Labs, the provider of Npass 日本語 and the controller responsible for the processing described here.

For privacy questions or requests, contact support@npassnihongo.com. Please do not send passwords, access tokens, or other authentication secrets by email.

2. Information we process

The information processed depends on the features you use. You can choose not to provide optional content, but some features will not work without the information they require.

Account information, such as your email address, account identifier, authentication provider, and any name or profile information supplied by Google or Apple when you choose that sign-in method.
Learning information, such as vocabulary and kanji cards, grammar data, custom sets, study progress, spaced repetition history, quiz results, study sessions, reading progress, language settings, and sync state.
Writing information, such as essay titles and text, JLPT goals, translations, furigana, AI feedback, review results, and narration status.
Community information, such as a published set, author name, title, description, tags, cards, reports, blocks, and moderation records when you use community features.
AI request information, such as words, kanji, sentences, pasted text, selected passages, essays, instructions, target language, JLPT level, and other content you submit to an AI feature.
Images you select from the camera or photo library for vocabulary or kanji extraction. The source image is sent with the extraction request and is not added to your Npass account as a saved image.
Generated audio information, including requests for pronunciation audio and private narration made from essay text.
Service and diagnostic information, such as IP address, request time, route, response status, device and app information made available by the platform, rate-limit records, errors, and security events.
Plan and usage information, such as entitlement status and daily or monthly use of limited AI features. Any store transaction information is handled by the relevant app store under its own terms.
Support information you choose to send by email, including your email address, message, attachments, and the information needed to investigate your request.

3. Information stored on your device

Npass stores learning data, settings, caches, and sync queues on your device so study features can work quickly and, where supported, offline. Home-screen or lock-screen widgets may receive a limited study feed through the operating system.

You can remove local app data through the app, your device settings, or by uninstalling the app. Copies stored in device backups are controlled by your operating system and backup provider.

4. How we use information

Create and authenticate your account.
Provide learning, review, reading, writing, pronunciation, narration, sync, and community features.
Personalize meanings, explanations, exercises, and study order using your selected language, level, and progress.
Generate, translate, review, or extract learning content through AI services when you request those features.
Keep your account data synchronized across devices and restore it after sign-in.
Apply quotas, prevent abuse, secure the service, diagnose failures, and maintain reliable operation.
Moderate community content, respond to reports, enforce these Terms, and protect users.
Answer support, privacy, security, and account-deletion requests.
Meet legal obligations and establish, exercise, or defend legal claims where necessary.

5. Reasons we may rely on for processing

The legal basis for processing depends on your location and the feature involved. Where applicable, we process information to provide the service you request, with your consent, to comply with law, and for legitimate interests such as service security, fraud prevention, support, moderation, and product reliability. We balance legitimate interests against your rights.

Where processing depends on consent, you may withdraw that consent through the relevant device permission, app setting, or by contacting us. Withdrawal does not affect processing that was lawful before withdrawal.

6. Service providers and other recipients

We use specialist providers to operate Npass. They may process information on our behalf or as independent providers for the services you choose.

Supabase provides account authentication, hosted database services, and access controls for synced account data.
Cloudflare provides Workers, Queues, object storage, content delivery, network security, and operational request handling.
Google Cloud Vertex AI and Gemini models process text, images, and speech requests for AI-assisted learning features. Google states that Vertex AI customer data is not used to train or fine-tune AI models without prior permission or instruction. Google may log prompts for abuse monitoring under its service terms.
Google processes information when you choose Sign in with Google. Apple processes information when you choose Sign in with Apple.
Google Fonts may deliver a font file to the app at runtime. That request can include network metadata such as an IP address. A font already cached on the device may not require another request.
The current released configuration does not send crash data to Sentry. If crash reporting is enabled later, this policy and the related app-store disclosures will be updated before that release.
Apple App Store and Google Play may process download, device, account, and transaction information under their own policies.

7. AI features

AI features send the content needed for the requested task to the Npass backend and the configured Google Cloud model. This can include an uploaded scan, pasted word list, essay, selected sentence, writing instruction, or text to be narrated.

AI output can be incomplete, inaccurate, or unsuitable. It is provided as a learning aid and is not used by Npass to make legal or similarly significant decisions about you. Review generated meanings, translations, corrections, scores, and explanations before relying on them.

Do not include confidential information or personal information about another person in an AI request unless you have a lawful reason and permission to do so.

8. The public website

The Npass website is delivered by Cloudflare. Cloudflare processes ordinary request information such as IP address, requested page, browser headers, response status, timing, and security signals to deliver and protect the site.

The website does not add behavioral analytics or advertising scripts and does not include a support form. Choosing an email link opens your own email application, and your message is then handled by your email provider and the Npass support mailbox provider.

9. Community and shared learning content

When you choose to publish a learning set, its author name, title, description, tags, cards, level, and related activity can be visible to other signed-in users. Do not publish personal information or content you do not have permission to share.

Other users may import a published set for offline study. Removing or moderating the source set prevents future discovery or import, but copies already imported to another user device may remain.

Generated dictionary entries, example sentences, translations, stroke-order data, and pronunciation audio may be stored as shared learning resources. These resources are intended to be content-based rather than linked to the person who first requested them.

10. Retention

Account and learning information is generally kept while your account is active and for as long as needed to provide the feature, maintain security and integrity, resolve disputes, and comply with legal obligations. Retention can vary by data type and service provider.

Operational logs, rate-limit records, error records, moderation records, and backups may remain after other account data is deleted when needed for security, service recovery, legal compliance, or the integrity of shared services. Where practical, account identifiers are removed or detached when they are no longer needed.

Shared dictionary data and public learning audio may be retained because they are not intended to identify the requesting user. Community content is removed or detached according to the feature and moderation requirements.

Essay narration audio is stored in restricted object storage and delivered through short-lived signed links. Deleting an individual essay asks the service to remove its narration. Account deletion removes the associated database records, but a detached narration object may remain in restricted storage after account deletion and will no longer be available through the deleted account. Contact support if you want us to investigate additional cleanup.

11. Account deletion

You can permanently delete your account from the Profile screen in the app. The deletion process removes the authentication account and account-linked database records, including synced study data, reading data, essays, usage records, and entitlements. It also attempts to clear local study data and sign the device out.

Some information may be retained or detached as described in the Retention section, including shared learning resources, security records, moderation records, backups, and a restricted narration object that has become detached from its deleted database record.

If you cannot access the app, follow the account-deletion instructions at npassnihongo.com/account-deletion or email support@npassnihongo.com. We may need to verify that you control the account before acting on an email request.

12. Security

Npass uses technical and organizational safeguards designed to protect information. These include authenticated access, database row-level access controls, encrypted network transport, restricted service credentials, request validation, rate limits, and short-lived signed links for private narration audio.

No system is completely secure. Protect your device and sign-in account, keep your software current, and contact us promptly if you believe your account or information has been compromised.

13. Your choices and privacy rights

Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability, or objection, and to withdraw consent. You may also have the right to complain to a data protection authority.

Use the in-app controls where available or email support@npassnihongo.com. Describe the request and the account email involved. We may ask for reasonable verification and may limit or decline a request where permitted or required by law. We will not ask you to send your password.

Camera and photo access can be changed in your device settings.
You can delete individual essays and community content through the available app controls.
You can delete the full account through Profile, then Delete Account.
You can stop future processing by discontinuing the relevant optional feature or deleting the app, subject to information already stored in your account.

14. International processing

Npass and its providers may process information in countries other than the one where you live. Those countries may have different data protection laws. Where required, appropriate contractual or legal safeguards are used for international transfers.

15. Children

Npass is a general language-learning service for people aged 13 and over. It is not directed to children under 13, and we do not knowingly collect personal information from them. If you are under the age at which you can consent on your own under the law where you live, use Npass only with permission from a parent or guardian.

A parent or guardian who believes a child under 13 has provided personal information, or that a child provided information without the required authorization, can contact support@npassnihongo.com to request review and deletion. We will delete the account and its associated personal information once we can verify the situation.

16. Changes to this policy

We may update this policy when the app, providers, or legal requirements change. The updated version will be posted on this page with a new effective date. If a change materially affects how information is processed, we will provide additional notice where required.

17. Contact

Npass 日本語 is provided by NAY KO KO OO, trading as Ciel Labs. Questions, privacy requests, and account-deletion requests can be sent to support@npassnihongo.com. Include enough information for us to understand the request, but do not include your password or authentication secrets.