← Back

Privacy Policy

Last Updated: June 23, 2026

Introduction

Moji ("we", "us", "our", or "the App") is committed to protecting your privacy and being transparent about our data practices. This Privacy Policy describes how we collect, use, and share information when you use our iOS mobile application.

Information We Collect

1. Information You Provide Directly

When you use Moji, we collect the following information that you provide:

  • Onboarding preferences: Your Japanese experience level, JLPT goal, widget refresh rate, and daily new kanji limit
  • Account information: Your name and email address when signing in with Apple or Google via Supabase Auth
  • Notification preferences: Your preferred daily reminder time and whether notifications are enabled
  • Subscription information: Your subscription status (Free or Moji Pro) and purchase history through Apple's App Store
  • Promo code redemptions: Whether you have redeemed a promotional code for early access

2. Information Automatically Collected

We automatically collect certain information about your device and how you use the App:

  • Device information: Device type (iPhone), operating system version, app version, and unique device identifier
  • Usage analytics: How you interact with the app (which screens you visit, app lifecycle events, sign-in and sign-out activity, and subscription purchase events), collected through PostHog
  • SRS review data: Which kanji you reviewed, your responses (Again / Hard / Good / Easy), review timestamps, and computed intervals — used to power the spaced repetition scheduling
  • Learning progress: Your streak, total cards learned, JLPT readiness percentages, and milestone completions
  • Subscription data: Subscription status and renewal information processed through RevenueCat and Apple's payment system

3. Information Stored Locally on Your Device

The following data is stored only on your device via SwiftData and is never transmitted to our servers:

  • Your full SRS review history and card intervals
  • The kanji database (2,000+ characters bundled with the app — no network required for core content)
  • Daily streak tracking data
  • Widget queue state (the next kanji scheduled to appear on your lock screen)

How We Use Your Information

We use the collected information for the following purposes:

  • Service delivery: To power the lock screen widget, schedule SRS reviews, track your streak, and deliver push notifications
  • Account management: To authenticate you via Apple or Google Sign In and link your subscription state to your account
  • Subscription management: To process and manage your Moji Pro subscription and unlock premium features
  • App improvement: To analyze usage patterns, understand how features are used, and improve the app experience
  • Customer support: To respond to your feedback and support requests

Third-Party Services

We use the following third-party services that may collect information:

Supabase

  • Purpose: Authentication (Apple Sign In, Google Sign In) and account/profile storage
  • Data shared: User identifier, email address, display name, onboarding state, subscription status, and promo entitlement state
  • Privacy policy: supabase.com/privacy

RevenueCat

  • Purpose: Subscription and payment processing
  • Data shared: User identifier, subscription status, purchase information
  • Privacy policy: revenuecat.com/privacy

PostHog

  • Purpose: Product analytics and usage tracking
  • Data shared: Usage patterns, screen views, app lifecycle events, sign-in activity, purchase events, device information, and (when signed in) your user identifier, email, display name, and sign-in provider
  • Privacy policy: posthog.com/privacy

Apple App Store

  • Purpose: Payment processing for subscriptions and Sign In with Apple
  • Data shared: Payment information and purchase history (handled directly by Apple)
  • Privacy policy: apple.com/privacy

Data Retention

  • SRS and learning data: Stored locally on your device indefinitely. You can delete all data through the app's Settings at any time.
  • Account data: Retained as long as your account is active. You can initiate account deletion from Settings, which removes Moji account data from Supabase. App Store subscription cancellation must be managed separately through Apple.
  • Subscription data: Retained as long as your subscription is active. After cancellation, retained for billing purposes as required by law.
  • Analytics data: Retained by PostHog according to their policy (typically up to 90 days to 2 years).

Data Security

We implement appropriate technical and organizational measures to protect your personal information:

  • Encrypted connections (HTTPS/TLS) for all data transmission between the app and Supabase
  • Supabase Row Level Security (RLS) policies ensuring users can only access their own data
  • Limited access to personal data by authorized personnel only
  • Core learning content (kanji database) operates fully offline — no server access required

However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security of your data.

Your Privacy Rights

Depending on your location, you may have the following rights:

  • Access: Request a copy of the personal data we hold about you
  • Correction: Request correction of inaccurate or incomplete data
  • Deletion: Request deletion of your personal data and account
  • Portability: Request your data in a portable format
  • Opt-out: Opt out of non-essential data processing

To exercise these rights, please contact us at the email address provided in the "Contact Us" section below.

Deleting Your Data

You can delete your account and all associated data directly in the app through Settings → Account → Delete Account. This will permanently erase:

  • Your Moji account and profile from Supabase
  • Your onboarding state and preferences stored on our servers
  • Your promo code entitlement state

Your locally stored SRS review data and streak history will remain on your device until you uninstall the app. This action cannot be undone.

Children's Privacy

Moji is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected information from a child under 13, we will take steps to delete such information and terminate the child's account.

Parents or guardians who believe their child has provided information to Moji should contact us immediately.

Push Notifications

Moji uses local push notifications to support your learning habit. These notifications:

  • Are scheduled locally on your device via UNUserNotificationCenter — no server involved
  • Include daily review reminders at your chosen time, streak protection alerts, and milestone celebrations
  • Are completely optional and can be disabled at any time through app settings or device settings
  • Are never used for marketing or advertising purposes

European Users (GDPR)

If you are located in the European Union, you have additional rights under the General Data Protection Regulation (GDPR):

Your GDPR Rights

  • Right of access (Article 15): Request confirmation of what personal data we process and obtain a copy
  • Right to rectification (Article 16): Request correction of inaccurate or incomplete data
  • Right to erasure (Article 17): Request deletion of your data ("right to be forgotten")
  • Right to restriction (Article 18): Request that we limit how we use your data
  • Right to data portability (Article 20): Receive your data in a structured, machine-readable format
  • Right to object (Article 21): Object to processing of your data
  • Right to withdraw consent: Withdraw consent at any time without affecting the legality of prior processing
  • Right to lodge a complaint: File a complaint with your local data protection authority

Data Protection Authority

For GDPR-related complaints or inquiries, you can contact your national data protection authority (e.g., CNIL in France, ICO in the UK, BfDI in Germany).

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. We will notify you of material changes by:

  • Posting the new Privacy Policy in the app
  • Updating the "Last Updated" date at the top of this document
  • Sending you a notification if required by law

Your continued use of the app after changes become effective constitutes your acceptance of the revised policy.

Acknowledgements

Kanji meanings, readings, and related Japanese dictionary data are derived from KANJIDIC2 and JMdict, distributed by the Electronic Dictionary Research and Development Group under Creative Commons licenses. Moji includes this attribution to honor those data sources.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

For GDPR-related requests, please include "GDPR Request" in your subject line and specify which right you wish to exercise. We will respond within one month of receipt of your request, as required by GDPR.

Acknowledgment

By using Moji, you acknowledge that you have read and understood this Privacy Policy and agree to the collection, use, and sharing of your information as described herein.

Last Updated: June 23, 2026 · Version 1.1