Privacy Policy

Last updated 22 October 2026

We collect what the app needs to work: your email, a hashed password and your study data.
No ads, no analytics or tracking, and we never sell or rent your data.
To write example sentences we send words, never your email or name, to an AI service, and only if you allow it.
You can delete your account and its data at any time from Settings → Account → Delete account.

Who we are

Ippo (“Ippo”, “we”, “us”) is a spaced-repetition vocabulary app for Japanese and Chinese, available on iPhone and on the web at helloippo.app. It is run by Amos Cao, an individual and the app’s sole developer, who is responsible for your data. Questions about this policy go to the contact form on our Support page.

What we collect

Account

Your email address, which is your login and where we send account emails.
Your password, stored only as a salted hash. We cannot read it.
The name you give during setup, so the app can greet you.

Study data

The languages and decks you study, any cards you create, and each answer you give (which card, how you rated it and when).
Placement test answers and results.
Your settings, such as review scheduling, theme, haptics, notifications and your time zone (used to decide when your study day starts).
Reports you send about example sentences, including any note you add.
A random ID for each install of the app, sent when it syncs, so the server can tell your devices apart. It is not tied to your phone’s hardware or advertising ID.
Feedback you send from Settings → Send feedback, with the app version, whether you were on iPhone or the web, and the language you were studying. It is stored on our server and also emailed to us with your account email address, so we can reply.

Contact form

When you use the contact form on the Support page, we receive the topic you choose, your name if you give one, your email address and your message. They are emailed to us so we can reply, and are not stored on our server. To stop abuse, each message is counted against hashed (pseudonymised) forms of your IP address and email address, used for a 15-minute limit and deleted after it expires, along with an overall cap on how many messages the form sends (a message that fails the robot check counts only against the IP address, and one that can’t be delivered doesn’t count at all), and the form is checked by Google reCAPTCHA (below).

Study data is stored on our server so it syncs between your devices. The iPhone app also keeps a copy on your phone so it works offline. The web app keeps it in memory only, for as long as the tab is open.

Error reports

When the app or our server hits an error, an error report is sent to Sentry. It contains the error message and stack trace, the app version, and the type of device, operating system or browser. Sentry may also receive your device’s IP address as part of the report; we don’t use it to identify you. We don’t attach your name or email address to reports, and we configure Sentry not to collect passwords, login tokens or the content of requests. We also record timing data for the server’s sentence-generation work, so we can see when it is slow or failing.

Security and server logs

To block password guessing, failed logins are counted against a hashed form of your IP address and email for 15 minutes.
Our server keeps short technical logs of the requests it handles for troubleshooting: the time, the full address requested (including any query parameters), the response code and size, the referring page and your app or browser’s user agent. They are overwritten as new logs come in.

What we don’t collect

We don’t use advertising, analytics or tracking tools, and we don’t track you across other apps or websites. We don’t collect your location, contacts or photos. Review reminders are scheduled on your phone itself; we don’t run a push notification service.

How we use it

To run the app: sign you in, sync your study data, schedule your reviews and pick example sentences you can read.
To generate new example sentences and translations for the words you are learning.
To send account emails, such as invitations and verification codes.
To find and fix bugs, and to keep the service secure.

We don’t sell, rent or share your personal data for advertising or marketing, and we don’t use it to build a profile of you beyond your own study progress.

Who processes it for us

We use a small number of service providers. Each only gets what it needs for its job.

DigitalOcean hosts our server and database in the United States.
OpenRouter, and the AI model provider it routes each request to, generate example sentences and translations. For this our server sends the word to practise, a list of words you know or are learning in that language, existing example sentences for that word, and the sentence to translate. It never sends your email, your name or your account ID. Generated sentences are stored and may be shown to other learners studying the same words. Writing example sentences this way is part of the service, so it can’t be turned off on its own. The app asks for your consent before any of your words are sent, and we send none of them without it. To withdraw your consent, delete your account (see below).
Sentry receives the error reports described above.
Resend delivers account emails, and delivers contact form messages to us. It receives your email address and the message, and for the contact form your name and what you wrote. Resend keeps a copy of the messages it delivers, under its own retention policy.
Google reCAPTCHA checks that the contact form on the Support page is sent by a person, not a bot. On that page Google receives your IP address, information about your browser and device and how you use the page, and sets a _GRECAPTCHA cookie, under Google’s Privacy Policy and Terms of Service. It isn’t used anywhere else on the site or in the app.
Google Fonts: this website and the web version of the app load fonts from Google’s servers, which see your IP address when they do. The web app’s rendering engine is served from our own server, not Google’s. For Japanese text, the web app also sends Google the characters it may show (in code-point order, not as sentences), so Google can return a font with just those characters. The iPhone app includes its fonts and doesn’t do this.
Apple distributes the iPhone app through the App Store and TestFlight, under Apple’s own privacy policy.

These providers may process data in the United States and other countries. We may also disclose data if the law requires it.

How long we keep it, and deleting your account

We keep your account and study data for as long as you have an account.

To delete your account, open Settings → Account → Delete account in the app. This immediately removes your account and all of its study data, settings and reports from our server. Logging out of the iPhone app, or deleting it, removes the copy on your phone. If you can’t sign in, use the contact form on the Support page with the address on the account and we will delete it for you.

A few things outlast the account:

Example sentences generated while you studied are shared content. They stay, with no link to you.
Records of sentence-generation runs and their cost stay for our accounting, with no link to you.
Database backups, made each time we update the service and once a night, still contain your data until newer backups replace them. We keep the ten most recent update backups and the last seven nightly ones, which are encrypted.
Error reports stay in Sentry until its retention period ends.

Your rights

You can ask us for a copy of your data, to correct it, or to delete it, and you can object to how we use it. Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California) you may have further rights, including complaining to your data protection authority. Use the contact form on the Support page and we will reply within 30 days. We don’t sell personal information.

Security

All traffic to helloippo.app is encrypted with HTTPS. Passwords are stored only as hashes, and on iPhone your login token is kept in the system keychain. No system is perfectly secure, but we take reasonable steps to protect your data.

Children

Ippo is not directed at children under 13, and we don’t knowingly collect data from them. If you are under 18 (or the age of majority where you live, if higher), you may use Ippo only with a parent or guardian’s permission. If you believe a child under 13 has an account, contact us and we will delete it.

Changes to this policy

If we change this policy we will update the date above. For significant changes we will also tell you in the app or by email before they take effect.

Contact

Amos Cao, through the contact form on the Support page