Privacy Policy

1. Introduction

JLPTLab ("we", "us", or "our") operates the website at jlptlab.com (the "Service"). This Privacy Policy explains what information we collect, how we use it, and the choices you have regarding your data.

By using the Service you agree to the practices described in this policy. If you do not agree, please discontinue use of the Service.

2. Information We Collect

We collect the following categories of information:

• Account information — name, email address, and (if you sign in with Google) the Google account identifier and profile picture URL.
• Learning data — vocabulary you mark, flashcard reviews, SRS schedules, deck configurations, search history, and other activity generated as you use the Service.
• Usage data — IP address, browser type, device type, operating system, referring page, pages visited, features used, and timestamps. Collected automatically via server logs and our own first-party analytics as well as third-party analytics tools. When you are logged in, usage data may be linked to your account.
• Cookies and similar technologies — see Section 4.
• Billing information — if you purchase Premium, payments are processed by Polar (see Section 5). We receive your plan type, purchase and subscription status, and order metadata. We never receive or store your full card details.
• Communications — content of messages you send us via email or contact forms.
• Newsletter subscription — if you sign up for launch notifications (no account required), we store the email address you provide. It becomes active only after you confirm via the email we send, and every email includes an unsubscribe link.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service, including features like SRS scheduling and weakest-words tracking.
• Analyse how the Service is used — both individually and in aggregate — to understand user behaviour, improve existing features, and develop new ones.
• Authenticate users and secure accounts.
• Personalise study recommendations and adapt content to your level.
• Display advertising (see Section 5).
• Process purchases, activate and manage your Premium plan, and handle billing-related requests such as refunds.
• Send account-related emails such as email verification, password reset, and security notices.
• Detect, investigate, and prevent fraudulent or abusive activity.
• Comply with legal obligations and enforce our Terms of Service.
• For other purposes described to you at the time of collection, or with your consent.

4. Cookies and Similar Technologies

We use cookies and similar storage technologies (such as localStorage) to operate the Service and analyse traffic. You can disable cookies through your browser settings, but parts of the Service may stop working correctly.

Categories of cookies we use:

• Strictly necessary — session cookies required for login, CSRF protection, and remembering your dark-mode preference.
• Analytics — our own first-party analytics, plus third-party tools such as Google Analytics and Microsoft Clarity, to understand usage patterns.
• Advertising — Google AdSense uses cookies to serve ads, including personalised ads based on your prior visits to this and other websites.

5. Third-Party Services

We share limited information with the following third-party providers in order to operate the Service. Each provider has its own privacy policy that governs its handling of your data.

• Google AdSense — displays advertising. Google may use cookies (including the DoubleClick DART cookie) to personalise ads. You can opt out at https://www.google.com/settings/ads or https://www.aboutads.info.
• Google Analytics — measures aggregate site usage. Anonymises IP addresses where supported.
• Microsoft Clarity — provides anonymised heatmaps and session replays to help us improve usability. See https://privacy.microsoft.com/privacystatement.
• Google OAuth (Sign in with Google) — used to authenticate users who choose this option. We receive your email, name, profile picture, and Google account ID.
• Polar — processes payments for JLPTLab Premium as the Merchant of Record. When you make a purchase, Polar receives your email address, billing details, and payment information, and shares your purchase and subscription status with us. See https://polar.sh/legal/privacy.
• Cloudflare — provides CDN and DDoS protection. Cloudflare processes IP addresses and request metadata.
• OpenAI / Anthropic / Google AI — when you use AI-assisted features, the text you submit and relevant learning data (such as your study history or level) may be sent to these providers to generate the response. Each provider processes this data under its own privacy policy.

6. Advertising and Personalisation

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites. Google’s use of advertising cookies enables it and its partners to serve ads based on your visit to our site and/or other sites on the Internet.

We use Google Analytics and Google Ads to measure whether our ads lead to sign-ups. If you arrive from a Google ad, Google may use cookies and a click identifier to attribute your visit and sign-up to that ad. We also store the campaign details of your first visit with your account.

You may opt out of personalised advertising by visiting Google Ads Settings (https://www.google.com/settings/ads), or by visiting https://www.aboutads.info to opt out of third-party vendors’ use of cookies for personalised advertising.

7. How We Share Your Information

We do not sell your personal data. We share information only in the following circumstances:

• With service providers (listed in Section 5) who process data on our behalf under appropriate contractual safeguards.
• With your consent or at your direction.
• To comply with applicable laws, valid legal processes, or governmental requests.
• To enforce our Terms of Service or to protect the rights, property, or safety of JLPTLab, our users, or others.
• In connection with a merger, acquisition, or sale of assets, in which case affected users will be notified before their data is transferred.

8. Data Retention

We retain account information and learning data for as long as your account remains active. If you request deletion of your account (see Section 9), we will delete or anonymise your personal data within 90 days, except where retention is required to comply with legal obligations, resolve disputes, or enforce our agreements. After anonymisation, remaining records (such as aggregated learning statistics) can no longer be linked to you.

Usage data and server logs are retained for as long as they are needed for the purposes described in this policy, and are periodically deleted or anonymised once no longer needed. Account-linked usage data is deleted or anonymised together with your account as described above. Analytics data held by third-party providers is retained according to each provider’s policy.

9. Your Rights

Depending on where you live, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to fix data that is inaccurate or incomplete.
• Deletion — ask us to delete your personal data, subject to legal exceptions.
• Portability — receive your data in a structured, machine-readable format.
• Object or restrict — object to or restrict certain processing of your data.
• Withdraw consent — where processing relies on consent, you may withdraw it at any time.
• Lodge a complaint — file a complaint with your local data protection authority.

10. Exercising Your Rights and Account Deletion

You can delete your account from Settings → Profile. For security, we first send a confirmation link to your account email; once you confirm, the account is deactivated and the personal data associated with it is deleted or anonymised, as described in Section 8.

To exercise any other right above — or if you cannot access your account email — contact us at [email protected] with "Privacy request" in the subject line. We will verify your identity and respond within the timeframes required by applicable law.

11. Children’s Privacy

The Service is not directed to children under the age of 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children below this age. If you believe a child has provided us with personal information, please contact us and we will delete the information promptly.

12. International Data Transfers

The Service is operated from Taiwan and uses providers located in multiple countries. By using the Service, you understand that your information may be transferred to and processed in countries that may have different data protection laws than your own.

13. Data Security

We implement reasonable technical and organisational measures to protect your information, including encryption in transit (HTTPS) and hashed passwords. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the Effective Date at the top of this page and, for material changes, provide additional notice (for example, via email or an in-app notification). Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

15. Contact Us

If you have any questions or requests regarding this Privacy Policy or your personal data, please contact us at [email protected].