Privacy Policy

Last updated 31 October 2026

Who we are

Ippo (“Ippo”, “we”, “us”) is a spaced-repetition vocabulary app for Japanese, Chinese, German and French (for English speakers) and English and French (for Japanese speakers), available on iPhone, on Android and on the web at helloippo.app. It is run by Amos Cao, an individual and the app’s sole developer, who is responsible for your data. Questions about this policy go to the contact form on our Support page.

What we collect

Account

• Your email address, which is your login and where we send account emails.
• Your password, stored only as a salted hash. We cannot read it.
• The name you give during setup, so the app can greet you.

Study data

• The languages and decks you study, any cards you create, and each answer you give (which card, how you rated it and when).
• Placement test answers and results.
• Your settings, such as review scheduling, theme, haptics, notifications and your time zone (used to decide when your study day starts).
• Reports you send about example sentences, including any note you add.
• If you use the conjugation drill, records of what each drill session planned, when each item was shown and how the session ended, so we can check the drill works.
• A random ID for each install of the app, sent when it syncs, so the server can tell your devices apart. It is not tied to your phone’s hardware or advertising ID.
• Feedback you send from Settings → Send feedback, with the app version, whether you were on iPhone, Android or the web, and the language you were studying. It is stored on our server and usually also emailed to us with your account email address, so we can reply (above a daily limit, a message is only stored).

Contact form

When you use the contact form on the Support page, we receive the topic you choose, your name if you give one, your email address and your message. They are emailed to us so we can reply, and are not stored on our server. To stop abuse, each message is counted against hashed (pseudonymised) forms of your IP address and email address, used for a 15-minute limit and deleted after it expires, along with an overall cap on how many messages the form sends (a message that fails the robot check counts only against the IP address, and one that can’t be delivered doesn’t count at all), and the form is checked by Google reCAPTCHA (below).

Study data is stored on our server so it syncs between your devices. The iPhone and Android apps also keep a copy on your phone so they work offline. On Android, this copy and your login token are left out of Google’s cloud backups and of transfers to a new phone. The web app keeps your study data in memory only, for as long as the tab is open.

Error reports

When the app or our server hits an error, an error report is sent to Sentry. It contains the error message and stack trace, the app version, the type of device, operating system or browser, and, from the iPhone and Android apps, a random ID that Sentry creates for that installation of the app. The iPhone and Android apps also send Sentry a short record each time you start and stop using the app, with that installation ID, the app version and the type of device and operating system, so we can see how often the app crashes. Sentry may also receive your device’s IP address with a report or record; we don’t use it to identify you. We don’t attach your name or email address to reports, and we configure Sentry not to collect passwords, login tokens or the content of requests. We also record timing data for the server’s sentence-generation work, so we can see when it is slow or failing.

Security and server logs

• To block password guessing, failed logins are counted against a hashed form of your IP address and email for 15 minutes.
• Our server keeps short technical logs of the requests it handles for troubleshooting: the time, the full address requested (including any query parameters), the response code and size, the referring page and your app or browser’s user agent. They are overwritten as new logs come in.

What we don’t collect

We don’t use advertising, usage-analytics or tracking tools, and we don’t track you across other apps or websites; the only diagnostics are the crash and stability reports described under Error reports and the conjugation drill records described under Study data. We don’t collect your location, contacts or photos. Review reminders, on iPhone and Android, are scheduled on your phone itself; we don’t run a push notification service.

How we use it

• To run the app: sign you in, sync your study data, schedule your reviews and pick example sentences you can read.
• To generate new example sentences and translations for the words you are learning.
• To send account emails, such as invitations and verification codes.
• To find and fix bugs, and to keep the service secure.

We don’t sell, rent or share your personal data for advertising or marketing, and we don’t use it to build a profile of you beyond your own study progress.

Who processes it for us

We use a small number of service providers. Each only gets what it needs for its job.

• DigitalOcean hosts our server and database in the United States.
• OpenRouter, and the AI model provider it routes each request to, generate example sentences and translations. For this our server sends the word to practise, a list of words you know or are learning in that language, existing example sentences for that word, and the sentence to translate. It never sends your email, your name or your account ID. Generated sentences are stored and may be shown to other learners studying the same words. Writing example sentences this way is part of the service, so it can’t be turned off on its own. The app asks for your consent before any of your words are sent, and we send none of them without it. To withdraw your consent, delete your account (see below).
• Sentry receives the error reports and app session records described above.
• Resend delivers account emails, and delivers contact form messages and in-app feedback to us. It receives your email address and the message, for the contact form your name and what you wrote, and for feedback what you wrote and its details above. Resend keeps a copy of the messages it delivers, under its own retention policy.
• Google reCAPTCHA checks that the contact form on the Support page is sent by a person, not a bot. On that page Google receives your IP address, information about your browser and device and how you use the page, and sets a _GRECAPTCHA cookie, under Google’s Privacy Policy and Terms of Service. It isn’t used anywhere else on the site or in the app.
• Apple distributes the iPhone app through the App Store and TestFlight, under Apple’s own privacy policy.
• Google distributes the Android app through Google Play, under Google’s own privacy policy.

These providers may process data in the United States and other countries. We may also disclose data if the law requires it.

How long we keep it, and deleting your account

We keep your account and study data for as long as you have an account.

To delete your account, open Settings → Account → Delete account in the app. This immediately removes your account and all of its study data, settings and reports from our server. Logging out of the iPhone or Android app, or deleting it, removes the copy on your phone. If you can’t sign in, use the contact form on the Support page with the address on the account and we will delete it for you.

A few things outlast the account:

• Example sentences generated while you studied are shared content. They stay, with no link to you.
• Records of sentence-generation runs and their cost stay for our accounting, with no link to you.
• Database backups, made each time we update the service and once a night, still contain your data until newer backups replace them. We keep the ten most recent update backups and the last seven nightly ones, which are encrypted.
• DigitalOcean also keeps a daily snapshot of the whole server, including the database, for seven days.
• Error reports and session records stay in Sentry until its retention period ends.
• Contact form messages and feedback we received by email stay in our email inbox. Resend keeps its copy of those messages and of the account emails we sent you (invite, sign-in and reset codes).
• If you joined with an invite, we keep a record that it was used, without your email address or account, along with our own note on the invite, if we wrote one.

Your rights

You can ask us for a copy of your data, to correct it, or to delete it, and you can object to how we use it. Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California) you may have further rights, including complaining to your data protection authority. Use the contact form on the Support page and we will reply within 30 days. We don’t sell personal information.

Security

All traffic to helloippo.app is encrypted with HTTPS. Passwords are stored only as hashes. On iPhone your login token is kept in the system keychain, and on Android it is encrypted with a key held in the Android Keystore. No system is perfectly secure, but we take reasonable steps to protect your data.

Children

Ippo is not directed at children under 13, and we don’t knowingly collect data from them. If you are under 18 (or the age of majority where you live, if higher), you may use Ippo only with a parent or guardian’s permission. If you believe a child under 13 has an account, contact us and we will delete it.

Changes to this policy

If we change this policy we will update the date above. For significant changes we will also tell you in the app or by email before they take effect.

Contact

Amos Cao, through the contact form on the Support page