Legal

Privacy Policy

Last updated: October 20, 2026

This policy explains what information Hashidari ("Hashidari", "we", "us") collects when you use the Hashidari app at app.hashidari.com and the website at hashidari.com, how we use it, who we share it with, how long we keep it, and the choices you have. Hashidari is operated by Hashidari LLC, a Wyoming limited liability company, 30 N. Gould St. #69582, Sheridan, WY 82801, USA.

1. Before you log in

Using Hashidari requires a free account. Before you log in, the app shows only its Welcome screen and, if you choose, one sample lesson. Both run in your browser. The sample lesson's progress is saved only in your browser's local storage (IndexedDB) on that device and is not sent to our servers. It stays there until you create an account or log in from that browser (see "Progress you had before signing up" in section 2). Clearing your browser data, or using a different browser or device, means that progress is gone, because we don't have a copy.

A browser that isn't logged in can still send us a small amount of information:

• Anonymous usage events and error reports, as described in sections 6 and 7 below. These contain no account identifier and no learning content.
• Feedback you choose to send with the in-app "Send feedback" form (section 5), and a request for an invite to the beta, which reaches us the same way and contains the email address you give and anything you write with it.
• Standard web request information (such as your IP address and browser type) that any website receives when your browser loads it (section 8).

2. Information we collect when you create an account

Account information. You log in with your email address and a one-time code we email to you. We don't use passwords, so we never store one. We keep your email address, the date your account was created, and whether you've verified your email.

Login sessions. While you're logged in on a device, we keep a session record that includes the IP address and browser/device description (user agent) it was created from, and when it expires. A session ends when you log out, or after a year without use. We use it to keep you logged in, keep your account secure, and help prevent abuse (see section 9).

Learning history and progress. To sync your progress and schedule your reviews, we store:

• each review you complete: which item and skill were reviewed (for example, a word's meaning or reading), whether you answered correctly, whether you marked a miss as correct with "I was right", when it happened, and which of your devices it came from;
• when items were introduced to you, and any items you reset to study again or marked as already known;
• your current study state for each item, such as its review stage and when it's next due;
• which course items our server has delivered to your account, and when. We use this to apply the limits of your plan;
• a random identifier for each device you use (generated by the app; it is not a hardware or advertising identifier);
• your 10 most recent searches in the app, so they show on every device you log in on. You can clear them from the search screen at any time;
• your learning settings, such as your starting point in the course, lesson size, how Korean bridges are shown, Korean practice, and whether you share anonymous learning data.

We don't store the text of your typed answers on our servers. Only whether each answer was graded correct is recorded. Your devices also download your recent review history from your account, so features like "Review recent mistakes" work on all of them.

Progress you had before signing up. If a browser holds progress that isn't in an account yet (a sample lesson, or progress from an older version of Hashidari that could be used without an account), then when you create an account or log in there, the app uploads that progress to your account so you don't lose it. The one exception: if your starting point is already past the sample lesson, its progress is discarded instead.

Searches. When you're logged in, searches of the word, kanji, and radical library go to our server. We count your searches each day to apply daily limits, and we keep the text of your most recent search that day, so that one run of typing counts as one search. Your device also keeps a short list of your recent searches.

Subscription and billing status. If you start a free trial or subscribe to Hashidari Plus, we store your plan status (free, trial, or Plus), trial dates, your Stripe customer and subscription identifiers, and invoice records we get from Stripe (amounts, dates, and payment, refund, and dispute status). We don't store card numbers or other payment-method details (see section 3).

Codes, gifts, and referrals. If you create or redeem a gift or promotional code, or refer or are referred by a friend, we record the code, the dates it was issued and redeemed, and the referral's status. For fraud prevention we also store salted, one-way hashes of your email address, IP address, and device identifier at the moment you redeem a code (see section 9). A hash lets us check whether two values match, but it can't be reversed to reveal the original.

Beta testers. If we invite you to test Hashidari, we add your email address to our tester list, together with how many days of free Plus you get and which member of our team added you. When you sign up with that address, the free Plus is applied to your account automatically. We keep the list entry until the beta ends, or until you ask us to remove it.

Content usage counts. To enforce daily limits and to detect automated copying of our course content, we keep daily per-account counts of the content items, lessons, searches, placement questions, and "I already know this" skips you've requested, along with a few derived usage signals.

Emails we send you. We email your log-in codes, a welcome message when you create an account, and a confirmation when a Plus subscription starts or is set to cancel. These are service emails, sent through Resend (section 10), and we keep a record of which ones we sent and whether they were delivered.

Reminders. If you turn on daily reminders on a device, we store that device's push subscription (a web address issued by your browser's push service, plus encryption keys), your time zone, your chosen reminder time, when we last sent you a reminder, and how many in a row went without a review afterwards (so we can pause them). We use your review history to count how many reviews are waiting and to suggest a reminder time near when you usually study.

Email preferences. If you turn on Email updates, we record that you agreed and when. You can turn it off at any time. We don't currently send product-update emails; if we start, we will send them only to people who turned this on, and the service that sends them will be added to the list in section 10.

3. Payments

Subscriptions are processed by Stripe. When you subscribe, you enter your payment details on Stripe's own checkout page, and you manage or cancel your subscription through Stripe's billing portal. Your card number and payment credentials go directly to Stripe and never reach our servers. To set up your Stripe customer record, we give Stripe your email address and your internal Hashidari account ID. Stripe's checkout page also asks for your billing country (and, in some countries, a postal code or address), which Stripe saves on that customer record and uses to work out the sales tax or VAT included in the price. Stripe handles your payment information under its own privacy policy (stripe.com/privacy). We receive only what we need to know about your subscription: its status, billing period, invoices, and whether a payment succeeded, failed, was refunded, or was disputed.

4. How we study learning data

We analyze review history across many learners to see how well our review schedule, lesson order, and content work, and to improve them. This is for our own internal use. For example, we look at how often reviews are passed by level, item type, and skill, how often learned items are forgotten, how many reviews learners do on a day they study, and how long learners keep studying at different paces. We use the results only as aggregate findings. We don't use this analysis to make decisions about you individually, sell it, or use it for advertising, and we don't publish it.

5. Feedback you send us

If you use Send feedback (in the Account menu and the "Report a problem" links), we store the category you pick (bug, suggestion, how you found Hashidari, or other), your message, the app screen you were on, the app version, and your browser's user-agent string. If you choose to attach a screenshot, it's a picture of the Hashidari page you were viewing, taken inside your browser. It shows whatever that page showed, which might include your email address or your answers, so check the preview before you send it. If you're logged in, the report is linked to your account.

When a report arrives, we also email a copy to our team mailbox through Resend: the category, your message, the page, the app version, and, if you were logged in, your internal account ID. The screenshot isn't included in that email. Our team mailbox is a Gmail account provided by Google. Feedback is never shared with analytics providers. Please don't include sensitive personal information in feedback.

6. Product analytics

We use PostHog to understand, in aggregate, how Hashidari is used (for example, how many lesson and review sessions are started and completed). Our analytics are deliberately limited:

• No cookies. PostHog runs in cookieless mode. It sets no cookies and stores no analytics identifier on your device.
• A fixed list of events. We record only specific events: app opened; Welcome screen shown; sample lesson started and completed; log-in code sent and log-in completed; "Do you know any Japanese?" answered; lesson or review session started and completed (with counts, how many answers were right, and a rounded duration); first lesson completed; sign-up completed; trial started; checkout started and completed; Korean practice turned on or off; install prompt answered; and search opened or used. Search events record only the kind of query (for example English or Japanese) and the kind of page you opened, never what you typed or which item you chose. We don't record individual answers, which words you study, what you type, page addresses, or screen recordings. PostHog's software also records basic device information, such as your browser, operating system, device type, screen size, and language.
• Routed through our own server. The app sends analytics requests to our own server, which forwards them to PostHog (United States). We remove cookies and login credentials, and pass on only a few technical headers, such as the content type and your browser's user-agent string. Your IP address isn't passed on, and PostHog is set not to store IP addresses.
• Account link. If you're logged in, events are linked to your internal account ID (a random identifier), never to your email address. Logging out resets this.

Optional: share anonymous learning data. On Account → Privacy & data there is a setting called Share anonymous learning data, off by default. If you turn it on, the app may send a very small summary of how a practice technique worked for you (for example, which kind of item it was and whether your first review afterwards was correct). It never includes which words you studied, your answers, or timestamps. When you're logged in, this choice is saved to your account and applies on all your devices. When you're logged out, it applies only to that device.

7. Error reports

We use Sentry (United States) to find and fix crashes and errors, in both the app and our servers. An error report includes technical details such as the error message, the code involved, the app screen, your browser and operating system, the app version, and (if you're logged in) your internal account ID. Sentry also counts app sessions, so we can see how often the app runs without crashing. We configure Sentry so that error reports exclude your email address, log-in codes, cookies, authorization headers, the contents of requests you send us, what you type, URL query strings, and gift and referral codes. We don't use session recording or screen replay. Browser error reports are sent through our own server rather than directly to Sentry.

8. Hosting, server logs, and the website

Hashidari runs on Render (application hosting) and Neon (database hosting), both in the United States (Oregon). Our domain's DNS and edge network, and the forwarding of mail sent to our support address, are provided by Cloudflare. Like any web service, our servers process your IP address and basic request information to deliver the app, and they keep operational logs. Our logs record events such as errors and account IDs, and are designed to exclude email addresses, log-in codes, cookies, and payment signatures.

Our emails (log-in codes, account and subscription messages, and copies of feedback reports sent to our team) are delivered through Resend (United States), which processes the recipient's email address and the message to deliver it.

The website (hashidari.com) counts visits without cookies. When a page loads, it tells our server only which page and which landing link were used, and the server adds one to that day's total. No cookie, browser storage, user agent, referrer, or visitor identifier is used for this. Your IP address is used only as a short-lived (10-minute) rate-limit key, to stop abuse of the counter; that record expires and is removed in periodic clean-up, and the address is never stored with the count. Nothing is sent if your browser sends Do Not Track or Global Privacy Control. The website and the app host their own fonts and load nothing from third-party font services.

9. How we use information

We use the information above to:

• provide the service: log you in, sync your progress, schedule your reviews, deliver course content, and send service emails;
• run subscriptions, trials, gift codes, and referral rewards, and show you offers that fit your plan history (for example, a discount after your Plus has ended);
• keep Hashidari secure and prevent abuse. This includes rate limiting (which briefly uses your IP address in records that expire within 24 hours and are removed in periodic clean-up), detecting automated content scraping, and detecting repeat trials, self-referrals, and gift-code abuse. For gift-code and referral abuse, we compare your email address (normalized so that variants like "a.b+tag@gmail.com" and "ab@gmail.com" match), IP address, and device identifier with the account that referred you or issued the code. A match may mean a referral or code doesn't earn a reward. Where we keep these values for this purpose, we store only salted one-way hashes;
• improve Hashidari: fix bugs, understand aggregate usage, and study learning data in aggregate (section 4);
• respond to your feedback and support requests;
• send the daily review reminders you turned on;
• send you product updates, only if you've turned on Email updates;
• comply with legal obligations and enforce our Terms.

We don't sell your personal information, share it for cross-context behavioral advertising, or use it to build advertising profiles.

10. Who we share information with

We share information only with service providers that help us run Hashidari, and only for that purpose:

We may also disclose information if the law requires it, to protect the rights, safety, or property of Hashidari or others, or as part of a merger, acquisition, or sale of assets. In that last case we'd tell you before your information became subject to a different privacy policy.

Hashidari LLC is based in the United States and our providers process data in the United States. If you use Hashidari from another country, your information is transferred to and processed in the United States.

11. Your choices and rights

From Account → Privacy & data you can:

• Download your data. Get a JSON file of every review event and study-again event on your account, your current study state for every item, and any progress carried over from before you signed up, and your recent searches. For a copy of other information we hold about you (such as your email address, settings, subscription records, or feedback you've sent), email support@hashidari.com.
• Turn email updates on or off.
• Turn anonymous learning-data sharing on or off (off by default).
• Delete your account. This takes effect immediately and can't be undone. It ends any Plus subscription straight away, and any paid time left is forfeited (see our Terms). It permanently deletes your account, email address, learning history, settings, subscription and entitlement records we hold, codes and referrals linked to you, and feedback you sent while logged in. It doesn't erase progress stored in a browser on your own devices; you can clear that yourself.

What we keep after deletion:

• a one-way hash of your email address (not the address itself), together with whether you started a free trial (and when), ever paid, redeemed one-time offers or were referred, and any payment-dispute or fraud hold. If you sign up again with the same email, the new account picks these up, so a trial or one-time offer can't be claimed twice. We keep this for 3 years after deletion;
• if you were on our beta-tester list, that list entry, including your email address, until the beta ends (or until you ask us to remove it);
• copies of feedback reports already emailed to our team mailbox;
• Stripe's own customer and transaction records, which Stripe keeps for its services and legal obligations;
• error reports, analytics events, and server logs already collected, until they expire under the periods in section 12. To have analytics events linked to your account ID deleted sooner, email us and we'll ask PostHog to delete them.

Reminders. Turn daily reminders off in Account → Display, or block notifications for Hashidari in your device or browser settings. Logging out removes that device's subscription, and deleting your account removes them all.

Logging out. When you log out on a device, you choose whether to keep that device's copy of your progress or clear it. Logging out doesn't delete anything from your account.

Depending on where you live, you may have additional rights, such as the right to correct your information, to object to or restrict certain processing, or to complain to a data protection authority. To make a request, email support@hashidari.com. We may need to verify that you control the account's email address.

12. How long we keep information

We keep account and learning data for as long as your account exists, and delete it when you delete your account. Other information is kept for these periods:

• login sessions: until you log out, or a year without use;
• rate-limit records: expire within 24 hours and are deleted in periodic clean-up;
• server logs: kept by Render for 7 to 30 days, depending on our hosting plan (never more than 30 days);
• Sentry error reports: 30 to 90 days, depending on our Sentry plan (never more than 90 days);
• PostHog analytics events: 1 year;
• feedback reports: 2 years, or until you delete your account if the report is linked to it;
• daily usage counts and the last search of each day: 90 days;
• reminder subscriptions: until you turn reminders off, log out on that device, or delete your account, or after 60 days with neither a delivered reminder nor an app open on that device;
• billing and invoice records: while your account exists;
• the deletion record described in section 11: 3 years after deletion;
• beta-tester list entries: until the beta ends.

13. Cookies and local storage

The app uses only essential, first-party, secure, HTTP-only cookies to keep you logged in. It sets no advertising or analytics cookies. It also sets one small cookie, hd_state, that the website can read: it holds only "member" (logged in) or "learner" (progress in this browser while logged out: a sample lesson, older progress not yet in an account, or progress kept after your login ended), identifies no one, lasts 90 days from your last visit to the app, and changes or is removed when you log out, so the website can show "Continue learning" instead of "Log in". The app also keeps information in your browser's local storage on your device: your progress and review history, your preferences (such as theme and lesson size), your recent searches, the email address you last logged in with (to fill in the log-in form), and, if you followed a referral link, the referral code for up to 30 days so it can be credited when you sign up. The app may ask your browser to keep this storage persistent so your offline progress isn't cleared automatically. The website (hashidari.com) sets no cookies and uses no browser storage.

14. Children

Hashidari is not directed to children. You must be at least 13 years old, or the age at which your country lets you consent to an online service on your own if that is higher (up to 16), unless a parent or guardian consents on your behalf. We don't knowingly collect personal information from anyone younger. If you believe a child has created an account, contact us at support@hashidari.com and we will delete it.

15. Security

We protect your information with measures including encrypted connections (HTTPS), passwordless log-in with one-time codes that are stored hashed and expire after 5 minutes, secure HTTP-only session cookies, rate limiting, and restricted administrative access. No system is perfectly secure, and we can't guarantee absolute security.

To report a security vulnerability, email support@hashidari.com with a description and steps to reproduce. We acknowledge reports within 5 business days. We don't run a paid bug bounty.

16. Changes to this policy

We may update this policy. If we make material changes, we'll update the date above and, where appropriate, notify you in the app or by email before they take effect.

17. Contact

Questions or requests: support@hashidari.com · Hashidari LLC, 30 N. Gould St. #69582, Sheridan, WY 82801, USA.