Privacy Policy

Effective date: July 12, 2026 1. Who is responsible kurota.app is responsible for personal data processed through Kurota. Privacy requests can be sent to . 2. Data we collect We process account data such as name, username, email, password hash, verification status, optional Google account identifier, profile fields, privacy choices, and email preferences. We process learning data including onboarding answers, Japanese course progress, answers, review history, goals, XP, levels, hearts, gems, and entitlements. Community use can include posts, images, reactions, follows, shares, and reports. Technical records may include session identifiers, IP address, user agent, timestamps, security events, delivery logs, and application errors. 3. Why we use data We use data to create and secure accounts; deliver lessons, review, progress, community, and support; send requested verification, recovery, security, and learning messages; prevent abuse; diagnose failures; meet legal duties; and improve product reliability. Depending on location, the legal basis is performance of our agreement, legitimate interests in a safe and reliable service, consent where requested, and compliance with law. 4. Sharing and processors We do not sell personal data. We share only what is needed with infrastructure, database, storage, email, captcha, and Google sign-in providers configured by the operator; professional advisers; authorities when legally required; or a successor in a properly managed business transfer. Providers are required to protect data and use it only for the contracted service. 5. Visibility and international transfers Profile and community information is shown according to your visibility settings and administrator safety controls. Providers may process data outside your country. Where required, the operator uses an approved transfer mechanism and appropriate safeguards. 6. Retention and security Account data is retained while the account is active. Verification and reset records expire; operational logs and backups are kept only as long as reasonably needed for security, recovery, and legal duties. Account deletion removes active account data and associated content, while limited backup copies may remain until the backup cycle completes. We use password hashing, encrypted stored secrets, access controls, short-lived verification credentials, and transport security, but no system can guarantee absolute security. 7. Your choices and rights Settings let you control profile visibility and optional email categories. You may download a structured copy of your account data or permanently delete the account from Settings. Depending on applicable law, you may also request access, correction, deletion, restriction, portability, objection, withdrawal of consent, or complain to a data-protection authority. Contact ; we may need to verify identity before acting. 8. Children and changes Kurota is not directed to children under 16. Contact us if you believe a child provided data contrary to this policy. We may update this policy as the service changes and will post a new effective date, with additional notice for material changes where required.