Privacy Policy

Effective Date: October 15, 2026

1. Introduction

Welcome to eevy ("we", "us", "our"), a Japanese language learning tool run by Squeaky Robot, LLC. This Privacy Policy explains how we collect, use, and protect your personal information when you use our website and our mobile apps (the "Service").

We are committed to protecting your privacy. We do not use any third-party analytics, advertising, or tracking services.

2. Information We Collect

Account Information: When you create an account, we collect your email address, username, password (securely hashed), and display name. If you sign in with Google or Apple, we also receive and store your profile picture URL from those providers (Google only; Apple does not provide profile pictures).
Date of Birth: We request your date of birth at signup solely to confirm that you meet the minimum age requirement for an account. We do not store it. For users under 16, we retain only the calendar year in which marketing preferences become available, and we remove that year once it arrives.
Marketing Preferences: During registration, you may opt-in to receive educational content, feature announcements, and other marketing communications from eevy via email. This preference is stored with your account and can be updated at any time in your account settings.
Profile Details: Anything you choose to add to your profile, such as a bio, an avatar image, and your time zone. Your profile is private unless you make it public.
Learning Activity: Your study sessions, answers to exercises, review schedules, progress, streaks, XP, achievements, and the learning paths you enroll in.
Content You Create: Collections, learning paths, knowledge cards, glossary entries, comments, ratings and reviews, follows, reports, and files or text you import. Content you make public, and every comment, rating and review, can be seen by anyone, together with your username, and public pages can appear in search engines.
Guest Passes: If we give you a guest pass, we keep the pass, a note saying who it was for, and which account claimed it and when. If you delete your account, we remove that note and keep only that the pass was used.
Purchases and Plans: If you buy a paid plan, we store which plan you have, who bills it (an app store, a payment provider, or eevy support), the subscription or transaction id it carries, its status, and the date your paid access runs through. We use these to unlock your plan on every device, to tell you when your plan changes or is about to end, and to answer billing questions. We never receive or store your card number or bank details.
Web Purchases: When you open web checkout, we send Stripe your email address, your display name (or username if you have none) and an eevy account id so it can make your customer record, and we keep that email in step with your account email. We store the customer id Stripe gives back. When you open our Plans page or the sign up page, open checkout, or manage a web plan through Stripe, we read the country your connection comes from to show the right prices and whether web purchases are offered there. We do not store that country.
Push Notifications: If you allow push notifications in our apps, we store a push token and basic device details (platform, device name and app version) to deliver them.
Messages and Requests: If you use our contact form or ask to hear when a feature launches, we keep your email address and message to reply or send that notice.
Login History and Authentication Tracking: For security purposes, we maintain a login audit log that records: the date and time of each login attempt, the authentication method used (email/password, Google Sign-In, Apple Sign-In), your IP address, your browser's user agent string, and whether the login attempt succeeded or failed. This data is used to detect unauthorized access attempts, prevent account takeover, and investigate security incidents.
User Preferences: For logged-in users, we store your user-configurable preferences (like your preferred theme) in our database as part of your account.
Usage Data: We may collect pseudonymous information about how you interact with our Service, such as the features you use and the time you spend on the site. This data is not linked to your personal email address and is used only to understand user behavior and improve our Service.
Cookies and Local Storage: We use cookies and local browser storage for essential functions like user authentication and session management. For users who are not logged in, we may use a cookie to remember preferences, subject to your consent. For more details, please see our Cookie Policy.
Security and Anti-Spam Information: When you submit forms on our Service (such as our contact form or registration), we use Cloudflare Turnstile to verify that you are a human user and not an automated bot. This process may temporarily process your IP address and browser characteristics. Turnstile tokens are single-use and expire after 5 minutes. This data is processed by Cloudflare and is subject to Cloudflare's Privacy Policy.

3. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our Service.
Personalize your experience by remembering your settings.
Run your study sessions, show your progress, and deliver the notifications you turn on.
Unlock the paid plan you bought on every device, check its status with whoever bills it, tell you when it changes or is about to end, and help you with billing questions.
Review content for compliance with our Terms of Use and handle reports.
Communicate with you about your account or our services (e.g., email verification, password resets).
Send marketing emails and feature announcements (only if you opted in during registration or in your account preferences).
Ensure the security and integrity of our Service.
Detect and prevent unauthorized access and account takeover attempts.
Investigate security incidents and suspicious account activity.
Maintain an audit trail for account security purposes.
Protect against spam, abuse, and automated attacks through anti-bot verification.

4. Our Legal Basis for Processing (GDPR)

Under the GDPR, we process your personal information on the following legal bases:

Performance of a Contract: We process your Account Information, Profile Details, Learning Activity, Content You Create, Purchases and Plans, Push Notifications data, and User Preferences to provide the Service you requested, as outlined in our Terms of Use.
Legitimate Interest: We process pseudonymous Usage Data to understand how our Service is used and to improve it. We process Login History and Security and Anti-Spam Information to protect accounts and the Service from abuse. We review content and reports to keep the community safe and to enforce our Terms of Use.
Consent: We send marketing emails only if you opt in, and we set non-essential cookies (see our Cookie Policy) only if you accept them. You can withdraw consent at any time in your account settings or through the cookie banner.

5. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. Creating an account requires you to confirm that you meet the minimum age requirement described in our Terms of Use.

If we discover that an account belongs to a user under 13, we delete the account together with the personal information held for it.

If you are a parent or guardian and believe that your child holds an account with us, please contact us with our Online Contact Form so that we can remove it.

Users under 16 do not receive marketing communications from us and cannot opt in to them. The marketing preference described in this policy becomes available only once a user reaches 16.

6. Information Sharing

We do not sell, share, trade, or otherwise transfer your personal information to any third parties for marketing, advertising, or analytics purposes.

We only disclose your information to the essential service providers who help us run our Service, and to the companies you sign in or buy a plan through, including:

Cloudflare: Hosts and delivers our Service, stores files such as avatar images, and provides security services including Turnstile anti-bot verification. Turnstile processes verification data (IP address, browser characteristics) solely to tell people from automated bots. This data is not used for tracking or advertising.
Apple and Google push services: Deliver push notifications to your device. They receive your device's push token and the notification.
Cloudflare Email Service: Sends eevy's account and notification email: the codes that confirm your email or recover your account, account notices (such as a welcome, an email change or an account deletion), the notification emails you turn on, and the messages you send us through our contact form. To deliver an email, Cloudflare receives the address it goes to and the full message, including any code in it. The codes in these emails expire after 15 minutes. Cloudflare processes email on its global network and keeps a delivery record (the address, the subject and whether the email arrived) for up to 31 days. We set Cloudflare not to keep copies of the emails themselves. Cloudflare's privacy practices are governed by Cloudflare's Privacy Policy.
Apple (App Store): When you buy a plan in our iOS app, Apple sells it to you and handles the payment under Apple's Privacy Policy. We attach an eevy account id to the purchase so we can match it to your account. We receive the purchase's ids, product, status and dates to unlock your plan, and never your payment details.
Google (Google Play): When you buy a plan in our Android app, Google sells it to you and handles the payment under Google's Privacy Policy. We attach an eevy account id to the purchase so we can match it to your account. We receive the purchase's ids, product, status and dates to unlock your plan, and never your payment details.
Stripe and Link: Plans bought on the web are sold through Link, a Stripe service. Link acts as the seller and handles your payment and billing details, receipts and billing support under the Link Privacy Policy. Stripe processes the payment under the Stripe Privacy Policy. We receive the customer id Stripe gives your purchase, the plan, its status and dates, and never your full card number. If you delete your Link account, Link cancels your web plan. Stripe keeps the customer record made when you opened checkout under its own policies, even if you never buy.
Google and Apple (OAuth Providers): When you sign in using Google or Apple Sign-In, we receive your profile information directly from those providers:
- Google: We receive your email address, name, and profile picture from Google. The profile picture URL is stored in our database to display your avatar.
- Apple: We receive your email address and name from Apple. Apple does not provide profile pictures.
Google and Apple act as identity providers in this context. Their use of your data is governed by their respective privacy policies: Google's Privacy Policy and Apple's Privacy Policy.

Our service providers (Data Processors), such as Cloudflare, are contractually bound to keep this information confidential and are prohibited from using it for any purpose other than providing these essential services to us. The companies you sign in or buy a plan through use your data under their own privacy policies, linked above.

7. Data Security

We implement a variety of security measures to maintain the safety of your personal information when you create an account, enter, submit, or access your information.

8. Data Retention

We retain your Account Information for as long as your account is active. If you delete your account, we will permanently delete your personal information within 30 days. Public collections, learning paths, glossary entries, comments, ratings and reviews you posted stay on eevy after you delete your account, shown as by [deleted] instead of your username. We may retain fully anonymized, aggregated Usage Data indefinitely.

Login History: Login history records (including IP addresses, user agents, and timestamps) are kept for up to 90 days, and are deleted when you delete your account.

Plan Details: Plan and billing details are deleted with your account. Whoever billed your plan keeps its own records under its own policies and tax law.

Stripe keeps its own records of any web checkout you opened, under its own policies and tax law.

Session Tokens: Access tokens expire after 15 minutes. Refresh tokens expire after 30 days or when explicitly revoked (e.g., when you log out).

Turnstile verification data (IP addresses and browser characteristics) is processed in real-time by Cloudflare and is not stored by us. Turnstile tokens expire after 5 minutes and are single-use only.

9. International Data Transfers

eevy is operated in the United States. If you are located outside of the U.S. (such as in the EU or UK), please be aware that your information will be transferred to, stored, and processed in the United States. Where the law requires a safeguard for information our service providers handle, we use one, such as the Standard Contractual Clauses.

Apple, Google and Stripe may process purchase data in the United States and other countries under their own safeguards.

10. Your Data Protection Rights (GDPR & CCPA)

You have specific rights regarding your personal information.

Right to Access: You have the right to request a copy of the personal information we hold about you.
Right to Rectification: You have the right to request the correction of inaccurate personal information.
Right to Erasure (Deletion): You have the right to request the deletion of your personal information.
Right to Object/Restrict Processing: You have the right to object to or request the restriction of our processing of your personal information.
Right to Data Portability: You have the right to request a copy of your personal data in a common, machine-readable format.
Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection supervisory authority.

Your California Privacy Rights (CCPA)

We do not "sell" or "share" your personal information as defined by the CCPA. California residents have the right to:

Know, Access, Correct, and Delete their information, as described above.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise any of these rights, please contact us.

11. Changes to this Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. Any changes will be posted on this page, and the "Effective Date" at the top of the policy will be updated. We encourage you to check this page regularly for updates.

12. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us with our Online Contact Form.