Privacy Policy

Hanaso is a Japanese conversation-practice app run by an independent developer. This page says what we collect, why, who processes it, how long we keep it and how to delete it. Questions: wi2404@gmail.com.

What we collect

• Account: your name, email address, and either a hashed password (bcrypt) or your Google account ID if you sign in with Google.
• Learning data: what you write in scenes and the characters' replies, your words deck, level and settings, progress, coins, rank and in-game items.
• Payments: if you subscribe, Stripe handles your card. We store only your Stripe customer and subscription IDs and your plan.
• Security: your IP address and email are kept briefly to rate-limit sign-in and sign-up attempts (deleted within 2 days).

We don't use advertising or third-party analytics trackers, and we don't sell your data.

AI processing

The characters you talk to are generated by an AI model. To produce each reply, the text of your conversation, your level and your target words are sent to OpenRouter, which routes the request to the model provider (currently Google Gemini). A short recent portion of the same conversation may also be sent to TypeSafe Jev (directly or through OpenCode Zen) to judge learning progress and resist prompt injection. Generated character portraits and backgrounds are created through OpenRouter. Don't type anything into a scene that you wouldn't want processed by these services.

Who processes your data

• Vercel: hosting (servers in Japan and the US).
• Turso: database (Tokyo region).
• OpenRouter and Google: AI conversation and image generation.
• TypeSafe and OpenCode Zen: typed conversation-progress and safety decisions, when enabled.
• Stripe: payments, if you subscribe.
• Google: sign-in, if you choose Continue with Google.
• Resend: password-reset emails.
• Your browser's speech features (voice playback and the microphone) are provided by your browser or operating system, which may send audio to Apple or Google under their own policies.

Cookies

One sign-in cookie that keeps you logged in for 30 days, and a short-lived cookie during Google sign-in. Nothing else.

How long we keep it

Your account and learning data are kept until you delete your account. Rate-limit records are deleted within 2 days and password-reset links expire after 1 hour. When you delete your account, everything above is removed from our database immediately; encrypted database backups held by our provider age out within 30 days.

Your choices and rights

• Export: for a copy of your words or your data, email us.
• Delete: You → Delete account removes your account and all of its data and cancels any subscription.
• Correct: change your name, level and settings on the You page.

Age

Hanaso is for people aged 13 and over (16 and over in the EU and UK). We don't knowingly collect data from younger children; if you believe a child has an account, email us and we'll delete it.

Changes

If this policy changes in a way that matters, we'll update the date above and tell you in the app.