Privacy Policy for Karuta

Last updated: 2026-06-04  ·  Effective date: 2026-06-04

This Privacy Policy explains what information the Karuta mobile app (“Karuta”, “the app”, “we”, “us”) collects, how it is used, and the choices you have. Karuta is provided by Riccardo Senes.

By using Karuta you agree to this policy.

Summary (the short version)

• Karuta is a flashcard language-learning app with optional cloud sync and community features.
• You can use the core study features without an account. Your data then stays on your device.
• If you sign in with Google, your decks, study progress and settings are synced to the cloud, and you can use the community features (publishing decks, following people, etc.).
• We do not show ads, and we do not use any advertising or analytics/tracking SDKs.
• We use crash reporting (Sentry) to fix bugs. It does not attach your identity to reports.
• You can permanently delete your account and all associated data from inside the app at any time.

What we collect and why

1. Account information (only if you sign in)

When you sign in with Google, we receive and store:

• your email address,
• a unique account identifier provided by the sign-in provider,
• an internal user ID.

We use this to authenticate you, sync your data across devices, and operate the community features. Sign-in is handled through our backend provider (Supabase) and Google.

2. Profile information (only if you sign in)

To use the community you create a public profile: a username, a display name, an optional short bio, an avatar (a set of style choices — no photo upload), and a privacy setting (public or private). Public profiles and the username are visible to other users. A private profile limits visibility of your shared content to followers you approve.

3. Learning content and progress

Decks, cards (text and any images you add), review history, streaks, study statistics, practice/minigame results, and app settings. This data lives on your device. If you are signed in, it is synced to the cloud so you can restore it and use it on other devices.

4. Community data (only if you use those features)

• Decks you publish or make public, including their cards (and card images for published decks).
• Social graph: who you follow and who follows you, and follow requests.
• Engagement: your votes, favorites and reports on shared decks.
• Study-stats snapshots: an aggregate of your study activity (streaks, review counts, retention) used by the “challenge” feature. This is shared only with users you have an accepted follow relationship with.
• Notifications related to the above.

5. Images

Images you attach to cards are stored in object storage (Cloudflare R2). Images on published decks are accessible to other users who view those decks. Images on private/unpublished decks are tied to your account.

6. Push notification token

If you are signed in, we store a push notification token issued by Google Firebase Cloud Messaging (FCM) for your device, so we can notify you about community activity (new followers, likes, downloads and deck updates). The token identifies the app installation on your device, not you personally. It is removed when you sign out, and you can disable notifications at any time from your device settings. Push delivery is handled by Google (Firebase Cloud Messaging).

7. Diagnostics and crash reports

We use Sentry to collect crash and error reports so we can fix problems. A report may include the error and stack trace, the app version, and your device model and operating-system version. We have disabled the sending of personally identifying information, so reports are not tied to your name, email or account.

8. Feedback you choose to send

If you use Settings → Leave feedback, the app opens your own email app with a message pre-filled (including your app version and device model). The app does not send anything itself — you choose whether to send the email. If you do, we receive the message and whatever details you left in it, and we use it to respond and improve the app.

What we do NOT collect

• No advertising identifiers and no ads.
• No third-party analytics or tracking SDKs.
• No location data.
• No access to your contacts, photos library, microphone or camera (images are picked by you, one file at a time, through the system picker).

How your information is shared

We do not sell your personal information. Information is shared only:

• With other users, for the community content you choose to make public/published (profile, username, published decks, and — with accepted followers — your study-stats snapshot). Private profiles restrict this to approved followers.
• With service providers (processors) that run the app's infrastructure on our behalf:
  • Supabase — authentication, database, and storage of your synced/community data. Hosting region: EU (Frankfurt, Germany).
  • Cloudflare R2 — storage of card images.
  • Sentry — crash/error reporting. Reports are processed in the EU (Germany) region.
  • Google — sign-in (authentication).
• When required by law, or to protect the rights, safety, and security of users and the service (e.g. acting on moderation reports).

Data retention

• Data synced to the cloud is retained while your account exists.
• On-device data remains until you delete it, sign out, or uninstall the app.
• Crash reports are retained according to Sentry's retention settings.
• Moderation records may be retained as needed to keep the community safe.

Deleting your data

You can permanently delete your account at any time: open Settings → Danger zone → Delete account and confirm. This erases your account and everything tied to it — your profile, decks, review progress, published decks, followers, study stats and notifications — from both your device and the cloud. This action cannot be undone.

Signing out (without deleting) removes the session from the device but keeps your cloud data under your account.

If you need help, contact us at support.karuta@gmail.com.

Your rights

Depending on where you live (for example, under the EU/UK GDPR), you may have the right to access, correct, export, restrict, or delete your personal data, and to object to certain processing. You can exercise most of these directly in the app (edit your profile, export a backup, delete your account). For anything else, contact support.karuta@gmail.com. You also have the right to lodge a complaint with your local data-protection authority.

Security

We use encrypted connections (HTTPS) for all network traffic. Authentication tokens are stored in the device's secure storage. No method of transmission or storage is 100% secure, but we take reasonable measures to protect your information.

International transfers

Your data may be processed on servers located outside your country (see the service providers above). Where required, appropriate safeguards are used for such transfers.

Children's privacy

Karuta is not directed to children under 16. We do not knowingly collect personal information from children under that age. If you believe a child has provided us personal information, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. We will update the “Last updated” date above and, for significant changes, provide a notice in the app. Continued use after a change means you accept the updated policy.

Contact

Riccardo Senes
Email: support.karuta@gmail.com
Italy