Privacy

What is kept, and why

• Your account: your email address, how you sign in (email code, Google or passkey) and when you joined. Needed to sign you in.
• What you learn: the texts you type or that are read from your photos, their translations, your words, cards and example sentences, your answers and when you gave them, your points, your world, your Match games and your Expedition runs (which way you went at each obstacle, whether you cleared it and how long it took; no words), and the Expedition gold you found and what you bought with it. Needed to run the app for you.
• Friends: the name and character appearance you choose, your friendships, requests and gifts. Your character is stored as choices from the app’s parts and colours, never an uploaded picture. Current friends see your name, character, world, streak, gifts, current study language, and counts of collection words and completed answers by language. Friends can view your friends list; your name and character also appear in your friends’ lists to their current friends. Viewing a list does not grant access to anyone else’s world or learning totals. They cannot see your vocabulary or learning text. Your friends’ Feed also shows your milestones, such as streak lengths, how many words you’ve reached Known or Mastered, landmarks you build, days you finish five or more rounds (and new bests), reaching Match’s top two levels, your Expedition bests and the landscapes you reach, how far you got on a day you and they both walked the Expedition trail, adding all of a week’s new words, and how many cards you made, gems you earned and Expedition gold you found each day, with the day you reached them, unless you turn that off in your profile. We keep a record of when each of your words reached a new level and when you last opened your Feed; it holds no text. Anyone can find you by typing your exact name, unless you turn that off. When you change your character, your friends’ Feed shows it before and after, so we keep each character you save. Character choices are included in your data export and cleared when your account is erased.
• Portals: if you build a portal in your world and leave it open, other people with an open portal can find your world (in Explore, rankings and by searching for your name) and look at it: your name, character, land, buildings and the ikimono standing there, in your world’s colours. They never see who gave your ikimono, your learning, streak, gems or friends. Visitors can choose one word for your world (such as Cosy), save it to a private list, ask to be friends (you can turn this off) or report it. You see how many chose each word and how many saved your world, never who. We keep each visitor’s choice and saved list, people you block, and reports with the reason, the world as it was then and its picture, so it can be reviewed. While your portal stands, the app makes a small picture of your land and buildings after you change them and keeps it with us, so Explore can show it on your world’s card; each new one replaces the last, unless a report needs the old one. To count how often a world is shown, we note which worlds you visited on each day and delete that note after 7 days. Closing or removing your portal stops all of this at once; friends can still visit as before.
• Messages from Kartemachi: short notes an administrator sends you appear in your Feed. We keep the text, which administrator sent it and when, until account erasure. They are in your export, and erasure removes the text. Announcements to everyone are not about you and hold nothing of yours.
• Account controls: changes an administrator makes to account access, AI allowances and testing permissions, whether the account is marked as a test account (so it can be left out of our usage statistics), and when an administrator signed the account out of every device, including which administrator did it and when. These records contain setting values, never learning text. They are included in your export and hidden when your account is erased; an erased administrator’s identity is removed from other accounts’ control records.
• Subscription and item testing: administrators can simulate subscriptions, item ownership and refunds in a separate sandbox, and save a separate test World and character to check delivery. We keep these test actions, appearances, item grants, account and administrator IDs and times until account erasure. Ownership-check records protect collection placement and equipment from conflicting changes. Your export includes your records; erasure hides them, clears saved test events and appearances, and removes an erased administrator’s ID from other accounts’ records. Sandbox tests do not change your real World, character or gems. These are not real payments, and no payment service receives this data. Separately, an administrator can put your live account on the Free or Plus plan without payment, optionally until a set date, and can give your live account collection items (and take them back) for support; we keep which plan or items, the end date or reason, which administrator and when, until account erasure.
• Purchases: if you buy Plus or an item pack in the Android app, Google Play takes the payment; we never see your card or bank details. Your account gets a random purchase ID, which is not your email or your user ID. We keep what you bought, Google Play’s order number for it, whether it was a test purchase, when it renews or ends, and whether it was cancelled or refunded, so you get what you paid for on every device you sign in on. The first paid Plus also gives you a welcome gift of World and character items, once. Kept until account erasure; your export includes these records. Erasure clears the order details, removes the purchase ID’s link to you and asks RevenueCat to delete its record of your purchases. Google keeps its own records of the payment. Deleting your account does not cancel a Google Play subscription: cancel it in Google Play.
• Usage allowances: when enabled, we keep allowance periods, their time zone, action IDs, request fingerprints, temporary reservations, successful unit counts and build-undo records. A generated sentence suggestion may be saved so retrying the same action returns it without using another unit. Photos and photo hashes are never included. Free and Plus accounts have daily limits on translations, new words and World buildings; these records count them, and on Free your daily bonus rounds add saved buildings. An administrator can reset a day’s counts or add extra units or Match lives for the day, and we record how many, which administrator did so and when. An administrator can also add or remove gems; we keep the amount, a reason from a fixed list, which administrator and when, until account erasure. Administrators can also test separate sandbox counters without using AI or gems. Your export includes your own records; account erasure hides them, clears fingerprints and saved suggestion text, and removes an erased administrator’s identity from others’ test records. These records are kept until account erasure.
• Starter card reports: if you send one, the published starter entry, your chosen reason and optional note, linked to your account. The app owner can read these to correct starter decks. Your personal card edits are not included. Reports and notes are kept until your account is erased, including after a report is resolved.
• Private ikimono names: optional names you give the ikimono in your World. Only you can see them in the app; friends, visitors and the giver cannot. Names are included only in your export. You can change or remove them at any time; account erasure clears them. They are never sent to the AI.
• Settings: your theme, sounds, cards per day, time zone and when your day starts.
• Keeping sign-in safe: your sign-in sessions, with the IP address and the kind of device or browser, for up to 60 days after your last visit; sign-in codes for 10 minutes; a count of sign-in attempts per IP address; and, for a day, when each sign-in code was sent, with a scrambled form of the address it went to (not the address itself), so no address gets too many. All to stop abuse.
• Technical logs: for each request to the server, when it happened, the address asked for, your IP address and any error. Kept for at most 7 days, to find and fix faults.
• AI use: for each AI request, when it happened, how big it was and its known or estimated cost. We reserve a maximum cost before a call and keep its status until the cost is known. Never the text itself. Needed for your daily AI allowance and to keep costs in check.
• Card quality: when an AI entry was generated, its language and AI model; when you save an actual card change, which field names changed and whether it was a manual edit, word replacement, saved AI suggestion or accepted starter correction. These records contain IDs and times, never card text or old/new values. Used in aggregate to find patterns in output quality. Kept until your account is erased.

Legal basis (GDPR): providing the app you signed up for, and what you buy in it (Art. 6(1)(b)); keeping sign-in safe, finding faults and keeping costs in check, our legitimate interest (Art. 6(1)(f)); the AI, your consent (Art. 6(1)(a)).

Photos are never stored

A photo is sent to the AI so it can read the text, and then dropped. It is never saved, not in the database and not in any log. A photo you share into the app from another app is held on your phone until the app opens, which removes it at once; from then on it is only in the app’s memory until it is sent or you leave.

The AI: Claude, by Anthropic

Only if you allow it, the text you enter, the photos you take and the words you pick are sent to Claude, an AI made by Anthropic PBC in the USA, to translate them and write your cards. Anthropic handles them on our behalf and does not use them to train its models. It may keep them for a limited time for safety and abuse checks.

You can take your permission back at any time in Settings, under Your data. Translating and making cards then stop; everything else keeps working.

Other services

• Cloudflare (Cloudflare, Inc., USA) runs the app and its database.
• Resend (Resend, Inc., USA) sends sign-in emails.
• UptimeRobot checks whether the public sign-in service responds and sends fault alerts to the app owner. These checks use no sign-in credentials and send no learner data.
• Google, only if you sign in with Google: it learns that you are signing in to Kartemachi.
• Google Play (Google Ireland Ltd.), only if you buy something in the Android app: it takes the payment and handles refunds and subscriptions under its own terms and privacy policy.
• RevenueCat (RevenueCat, Inc., USA), only if you buy or restore something in the Android app: it checks purchases with Google Play for us. It receives your random purchase ID, what you bought and Google Play’s receipt for it, your phone’s app version, system version, language and IP address. It never receives your email, name or learning.

Where data goes to the USA, it is protected as GDPR requires: by the EU–U.S. Data Privacy Framework or the European Commission’s standard contractual clauses.

Cookies

One cookie keeps you signed in. Your phone also keeps your theme, answers not yet sent and similar things in its own storage. There is no advertising or cross-site tracking. Internal usage and quality counts help run and improve the app; they are not sent to an analytics service. The app’s fonts come from our own server, not from Google.

How long it is kept

Until you delete your account: Settings, Your data, Delete my account. You are signed out at once, and signing in within 30 days undoes it. After 30 days your texts, words, name, email and sign-ins are erased. What remains are numbers that no longer point to you, such as when an answer was given and how it was rated, or what an AI request cost. Your world leaves Explore at once when deletion is asked for, and its reactions, saves, blocks, reports and pictures end when it is erased.

Your rights

You can ask to see, correct or delete your data, to limit or object to how it is used, and to take it with you. Settings has Download my data and Delete my account; for anything else, email privacy@kartemachi.com. Taking back your consent doesn’t affect what was done before.

You may also complain to a data protection authority, for example the one where you live or work.

Children

Kartemachi is not meant for children under 16.

Contact

Questions about your data: privacy@kartemachi.com

Kartemachi is run by Thomas Cheung, Germany.

Changes

When this policy changes, the date at the top changes too. Important changes will also be shown in the app.