Legal

Privacy Policy

Last updated 25 September 2026. The controller of your personal data is Gareth Fuller, trading as Kikase, Waldstrasse 8, Oberzeuzheim, 65589 Hadamar, Germany. Questions go to support@kikase.app.

1. What we collect

Account information

• Your email address, and a display name if you set one.
• If you sign in with Apple or Google: the identifier and email that service gives us. We don't receive your password.
• An avatar image, only if you choose to add one.

Learning information

• The language you're learning, your native language, and your level.
• Conversation transcripts, stories you've opened and finished, and your answers in the review games.
• Corrections we've made to your language, and the spaced-repetition schedule built from them.
• Streaks, counters, medals and stickers.
• Learner profiles you create inside your account.

Audio

• Recordings of what you say, when you use the microphone. See section 3.

Technical and device information

• Device type, operating system, app version, language and time zone.
• Crash reports and diagnostic logs.
• Usage statistics, only if you allow them: which screens you open and which buttons you tap, linked to a random account identifier (never your email or name).
• Your privacy choices: whether you allowed usage statistics and when you accepted the terms.
• A push notification token, if you turn notifications on.
• An anti-abuse attestation from your device, used to confirm requests come from a genuine copy of the app.

Purchase information

• Whether you have an active subscription, when it renews, and which store it came from. We never see your card details — the App Store or Google Play handles payment.

2. Why, and on what basis

• To run the service — hold conversations, correct you, generate speech, save progress, sync devices. Basis: performance of our contract with you.
• To improve the app — usage statistics. Basis: your consent (Art. 6(1)(a) GDPR), which we ask for when you first open the app. If you decline, nothing is collected. Withdraw any time in the app under Profile → Usage statistics.
• To prove your choices — a record of your consent decisions and terms acceptance. Basis: legal obligation (Art. 7(1) GDPR).
• To keep it working and safe — diagnostics, abuse prevention, rate limiting. Basis: our legitimate interest in a service that works and isn't abused.
• To support you — answering your emails. Basis: contract and legitimate interest.
• To send reminders — streak and practice notifications. Basis: your consent, withdrawable in your device settings or in the app.
• To bill you — validating a subscription. Basis: contract.
• To meet legal obligations — tax, accounting, lawful requests. Basis: legal obligation.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

3. Speech and audio

When you hold the mic, the app records what you say and sends it to be transcribed so the conversation can continue and your pronunciation can be scored. Depending on your device and the feature, transcription happens on the device itself or through a cloud speech service.

• The transcript is kept as part of your conversation history, so the app can correct you and build your review deck.
• The audio recording is processed for the purpose above and is not kept as part of your long-term profile.
• The microphone is only active while you're holding or have started a recording. The app doesn't listen in the background.
• Kikase is a speaking app: answers are spoken, not typed. Without microphone permission the app can't be used for its main purpose.

4. Who else processes it

We use a small number of providers, each under a data processing agreement, each limited to what they need:

• Google (Firebase) — authentication, database, serverless functions, crash reporting, push notifications and app attestation. Hosting of your account and learning data.
• Google Analytics for Firebase — usage statistics, only with your consent. Advertising features, ad personalisation and the device advertising ID are switched off.
• Google Cloud — text-to-speech for character voices, and speech recognition where it isn't done on your device.
• AI model providers (currently Google and OpenAI) — conversation, corrections and story rendering. Text is sent to generate a response; it is not used by us to train models, and we use API tiers whose terms exclude training on customer data.
• RevenueCat — subscription state, so the app knows what you've bought.
• Apple and Google — app distribution and payment. Their handling of your purchase is governed by their own policies.
• Our email provider — sending account and support email.

We also disclose information where the law requires it, and to a buyer if the business is ever sold — in which case we'll tell you before your data moves.

5. International transfers

Our providers operate globally, so your data may be processed outside your country, including in the United States. Where data leaves the UK or EEA, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision. Ask us for a copy of the safeguards at support@kikase.app.

6. How long we keep it

• Account and learning data — while your account is open. Delete your account and it's removed from our live systems within 30 days, and from backups within 90. Deleting your account also asks Google Analytics to erase your usage statistics.
• Audio recordings — processed and discarded; not retained as part of your profile.
• Diagnostic logs — up to 90 days.
• Usage statistics — 14 months, then deleted automatically.
• Consent records — while your account is open.
• Billing and tax records — as long as tax law requires, typically 6–7 years.

7. Your rights

Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider. You can also withdraw consent where we relied on it.

Most of this is a button in the app: your profile screen exports your data and deletes your account. For anything else, write to support@kikase.app and we'll respond within 30 days.

If you're in the UK or EEA and you think we've got it wrong, you can complain to your data protection authority. If you're in California, you have the rights to know, delete, correct and opt out under the CCPA/CPRA — and we don't sell or share your personal information as those terms are defined there.

8. Children's privacy

Kikase is for people aged 16 and over. It is not directed at children, and we don't knowingly collect personal data from anyone under 16. If you believe a child under 16 has an account, write to support@kikase.app and we'll delete it.

9. Security

Data is encrypted in transit and at rest. Access to production systems is limited to the people who need it and is logged. Database rules restrict every record to the account that owns it, and requests are attested so they can't be forged by a third-party client. No system is perfect; if a breach affects you, we'll notify you and the relevant authority as the law requires.

10. This website

about.kikase.app is a marketing and legal site. It sets one item of local storage to remember whether you chose light or dark — that's a preference, not a tracker, and it never leaves your browser. There are no advertising cookies. Fonts are served by Google Fonts, which receives your IP address as part of serving the request. Our host keeps standard server logs for security and troubleshooting.

We run no analytics on this site — no tracking scripts, no visitor measurement.

11. Changes

We'll update this policy when what we do changes. Material changes are announced in the app or by email before they take effect, and the date at the top always tells you which version you're reading.

12. Contact

support@kikase.app for privacy and data requests. support@kikase.app for everything else.

See also the Terms of Service.