Privacy policy
Application: KanjiQuizz (Android)
Website: kanjiquizz.camille-lupo.fr
Effective: 6 August 2026 · Last updated: 2 September 2026
This is a translation provided for convenience. In case of discrepancy, the
French version prevails.
In short
KanjiQuizz is a Japanese-learning application developed by one person. To keep your progress in sync across devices, the app needs an account: an email address, a password, and how far you have got in your lessons.
That is all. There is no advertising, no tracker, no analytics, no embedded social network, and your data is neither sold nor shared for commercial purposes. You can delete your account and all of your data at any time, from the app, in a few seconds.
1. Who is responsible for your data
The data controller is:
Camille Lupo, sole trader (entrepreneur individuel)
3 rue des Forgettes, 76000 Rouen, France
SIREN: 924 678 618
help.kanjiquizzapp@outlook.fr
There is no data protection officer: the activity does not require one. Your requests are handled directly by the person who develops the app.
2. Data stored on the server
When you create an account, the following information is stored on a server so that your progress follows you from one device to the next. The account is optional: without one, nothing personal is sent to the server.
Your account
- Your email address. It is your login identifier and lets us check that the account is really yours.
- Your password, stored as a hash. It is never stored in clear text and cannot be read back by anyone.
- A username, if you choose one.
- The account's creation date and the date you last used it. The latter is used solely to apply the inactive-account deletion described in section 8.
- A flag stating whether the account has access to the full version (see section 14).
Your progress
For every kanji, kana, vocabulary word and example sentence you work on:
- how many times it has been shown to you;
- how many correct and how many wrong answers you gave;
- your level in the spaced-repetition system;
- the date of your last review and of the next one.
Your quiz sessions
For every completed session: the JLPT level, your score, the number of questions and the date.
Your experience points, level, rank and daily streak are not stored: they are recomputed from this session history every time they are displayed. Erasing the sessions makes them disappear too.
3. What stays on your phone and is never sent
These items are kept only in the app's storage, on your device:
- your settings: language, theme, kanji font, sound, daily goal;
- your quiz preferences: selected levels, modes, session length;
- your favourites;
- content cached to reduce network round-trips.
If you uninstall the app, these items disappear with it. However, uninstalling the app does not delete your account: see section 10.
4. This website
The website kanjiquizz.camille-lupo.fr presents the app. It sets no cookie, uses no analytics tool and contains no form. Its fonts are hosted on the same server: nothing is loaded from a third-party service, and your visit is reported to no one. The server does not record visitors' IP addresses.
5. What KanjiQuizz does not do
These points have been checked in the code of the app and of the server. No such tool is installed.
- No advertising of any kind.
- No analytics: no Google Analytics, no Firebase Analytics, nothing equivalent.
- No automatic crash reporting: no Crashlytics, nothing equivalent.
- No social network button or component, hence no data shared with Facebook, X, TikTok or others.
- No advertising cookie, no tracker, no advertising identifier.
- No access log: the server does not record the IP addresses of the people using the app.
- No sale, no rental, no sharing of your data for commercial or marketing purposes.
- No automated decision with legal effects on you, no advertising profiling.
- Japanese audio playback uses the text-to-speech voice installed on your phone. Nothing is sent to a server for it.
- The app asks for neither your location, nor your contacts, nor your microphone, nor your camera.
6. Why this data, and on what legal basis
| What is processed | Why | Legal basis |
|---|---|---|
| Email, password, username | Create and secure your account, log you in | Performance of the contract |
| Verification email | Make sure the address exists and belongs to you, limit fake accounts | Legitimate interest: security of the service |
| Password reset email | Give you back access to your account when you have forgotten your password, without us ever knowing it | Performance of the contract |
| Progress and quiz sessions | Run spaced repetition and sync your progress across devices — this is the service itself | Performance of the contract |
| Full-version flag | Know which levels are available to you, including offline | Performance of the contract |
| Date of last use | Delete abandoned accounts, so as not to keep data nobody uses | Legal obligation: storage limitation |
No processing relies on your consent, because there is no advertising, no usage statistics and no newsletter. Should that change, this policy will be amended before the change takes effect, and your consent will be asked.
7. Who else sees your data
Three providers are involved, each for one specific task. None of them may use your data for its own purposes.
PulseHeberg — server hosting
The server holding your account and your progress is hosted by PulseHeberg, in a data centre located in Paris, France. This website is hosted on the same server.
Mailjet — account emails
Two emails may be sent to you through Mailjet, a French company: the one that verifies your address when the account is created, and the one that lets you choose a new password if you have forgotten it — the latter only when you request it from the app.
Only your email address is passed to Mailjet, together with the relevant link. Mailjet receives neither your password, nor your progress, nor any other data. No other email is ever sent to you: there is no newsletter and no promotional message.
These emails contain no tracking pixel and no redirect link: open and click tracking, on by default at Mailjet, is turned off message by message. We therefore do not know whether you opened them.
Microsoft — inbox for your requests
The contact address above is an Outlook mailbox. If you write to exercise your rights, the content of your message passes through Microsoft, like any email. That is this provider's only role.
Nobody else
No other company, partner or advertiser receives your data. It can only be handed to an authority on a lawful judicial request, in the cases provided for by law.
8. How long your data is kept
| Data | Retention |
|---|---|
| Account and progress | As long as the account exists. Erased when you delete the account. |
| Account created but never confirmed | 30 days after the verification email was sent, then automatic deletion. If that email could never be sent, the period does not run: the account is not deleted on that ground. |
| Inactive account | 3 years without any use, then automatic deletion. |
| Technical server logs | A few days, by automatic rotation. They contain no access log and no user IP address. |
When you delete your account yourself, deletion is immediate: it does not depend on any of these periods.
No backup of your personal data is kept. What is deleted therefore no longer exists anywhere, not even in an archive.
9. Where your data is stored
Your data is stored on a server located in Paris, France, hence in the European Union. It does not leave it.
Two exceptions, limited to what section 7 describes: the email address passed to Mailjet to send verification and reset messages, and the content of the emails you send us, received in a Microsoft mailbox.
Exchanges between the app and the server are encrypted (HTTPS).
10. Deleting your account
You can delete your account at any time, without having to justify it and without contacting us.
In the app: Profile tab → your profile card at the top of the screen → Account screen → Danger zone section → Delete my account.
Deletion is immediate and permanent. The following is erased: your email address, your password, your username, all your progress, your review schedule and your quiz session history. Nothing is kept "just in case"; there is no recycle bin and no cooling-off period.
The dedicated page, reachable without installing the app, describes the procedure in detail — including if you have uninstalled the app or lost your password: kanjiquizz.camille-lupo.fr/en/suppression-compte
11. Your rights
The GDPR gives you rights over your data. All of them are exercised at the same address: help.kanjiquizzapp@outlook.fr
- Right of access — obtain a copy of the data about you.
- Right to rectification — correct inaccurate information. Your username and password can be changed directly in the app's Account screen.
- Right to erasure — have your account and data deleted. The fastest way is to do it yourself in the app; it is immediate.
- Right to data portability — receive your data in a machine-readable format. This request is handled manually, by email.
- Right to object — object to processing based on legitimate interest, on grounds relating to your situation.
- Right to restriction — ask for a processing to be temporarily frozen while a dispute is examined.
How it works
Write to the address above from your account's email address. You will get an answer within one month at most. That period may be extended by two months for a complex request; in that case you are told before the end of the first month, with the reason.
If there is serious doubt about your identity, additional proof may be requested. It is destroyed as soon as the request has been handled.
If you are not satisfied with the answer
You can lodge a complaint, free of charge, with the French data protection authority, the CNIL:
- online at www.cnil.fr/plaintes
- by post: CNIL — 3 place de Fontenoy — TSA 80715 — 75334 Paris Cedex 07, France
You may also contact the supervisory authority of your own EU country.
12. Security
- Passwords are hashed, never stored in clear text.
- Exchanges between the app and the server use an encrypted connection (HTTPS).
- The database is reachable only from the server itself: it is not exposed on the internet.
- Administrative access is limited to one person.
- The email address is verified at sign-up.
- Account deletion requires your password and is protected against repeated attempts by a third party.
No system is infallible. In the event of a data breach posing a risk to your rights, you will be informed, and the CNIL will be notified within 72 hours, as the law requires.
You have a part to play too: choose a password you use nowhere else.
13. Minimum age
The app is not intended for children under 15 and asks them for no specific data. If you are a parent and find that an account has been created by your child under 15, write to us: the account will be deleted.
14. Purchases
No purchase is possible in the app at this time and no payment data is processed. The full unlock announced on this website is not yet on sale.
When it is, Google will be the merchant of record and will handle payment end to end: your card number and billing address will never pass through the app. The app will only receive a technical purchase identifier, used to verify the purchase and restore it if you change phones. This policy will be updated before that goes live.
15. Changes to this policy
In the event of a significant change — new data collected, new provider, new purpose — you will be informed in the app before the change takes effect. The date of the last update appears at the top of this page.