Privacy Policy for Manabu: Learn Japanese.

About this policy

ManabuLab (Manabu: Learn Japanese), operated by Çağatay Türkileri, provides Japanese learning lessons, practice, reviews and related services. This policy explains how we handle information in the app and on manabulab.app. Questions and privacy requests can be sent to cagatay19992015@gmail.com.

Information we process

Account and learning information

If you create an account, we process your account identifier, email address, display name and authentication information. Supabase provides authentication and stores account-related app data. We also process lesson and deck progress, learned or saved words, review activity, points, streaks, achievements, preferences and any profile or social content you choose to share. Some learning information can be stored on your device before you sign in and may be linked to your account when you sign in.

Purchases and subscriptions

Apple App Store or Google Play processes payments. RevenueCat helps us validate purchases, manage premium access and restore purchases. Relevant records can include customer and transaction identifiers, product, purchase date, subscription status, renewal or cancellation information, store and purchase amount. We do not receive your payment card number or store your card details.

Account-linked installation observations

In app versions with installation observation enabled, we record a randomly generated installation identifier linked to your signed-in account, platform, app version/build, release channel and first/last observation times. We use this information to understand account use across installations, including premium accounts, and investigate support or reliability issues. Observations are sent to Supabase while the app is in the foreground, at most once every 15 minutes per account during a running session; the server also limits repeated observations.

This feature does not collect hardware or advertising identifiers, device names or precise location. An installation is not necessarily a distinct physical device or person: reinstalling or restoring a backup can affect the count. Observation results do not impose device limits, sign you out, or restrict lessons, learning progress or premium access. Records last seen more than 90 days ago are eligible for daily cleanup; deleting your account also deletes its installation observations, subject to separate provider backup retention.

Product analytics with PostHog

We use PostHog to understand onboarding, lesson and quiz starts, completions and exits, use of decks and review, important Home interactions, and which premium offers lead to purchases. Events may include screen or feature names, lesson or chapter identifiers, answer counts, time spent, paywall source, app version, platform and device language.

Before sign-in, activity uses an app analytics identifier. When you sign in, we link that activity to your account identifier. RevenueCat sends verified purchase and subscription events to PostHog so we can relate learning activity to premium conversion. This means account-linked analytics is not fully anonymous, even though we do not intentionally include your name, email, password, raw search text or individual answer content in PostHog events.

PostHog Session Replay and screen recording are disabled. We do not use PostHog to record the contents of your screen. The app disables client IP-based location enrichment for this analytics setup. Provider-side events may contain network-derived metadata; we do not use that metadata as a verified statement of your location.

Advertising measurement

Separately from PostHog product analytics, the app may use Meta/Facebook SDK and RevenueCat attribution tools to measure advertising performance. Depending on your permission and platform settings, these services may process app events, purchase status, vendor or app-instance identifiers and advertising identifiers. On iOS, access to IDFA and permission-dependent tracking follows Apple's App Tracking Transparency setting. Declining tracking does not disable lessons or prevent purchases; permitted limited or aggregate measurement may still occur.

Notifications, support and website analytics

If you enable notifications, we process your push token, language, platform and notification preferences through Supabase, Expo Push Service, Apple APNs or Google FCM. Delivery records help us resolve failures and stop sending to invalid tokens. You can change notification permission in your device settings.

If you contact support, we process your message and information you choose to provide. Please do not send passwords, payment card details or unnecessary private information. Our website uses Google Analytics, which may process page views, browser/device information and cookies or similar identifiers. Your browser's privacy settings and content blockers may limit website analytics.

Why we use this information

• Provide accounts, learning progress, reviews, social features and requested notifications.
• Validate premium access, restore purchases and handle subscription-related support.
• Understand feature use, onboarding drop-off and purchase conversion to improve the product.
• Provide support, protect the service against abuse and investigate technical problems.
• Measure marketing effectiveness where permitted by your settings and applicable law.

The applicable legal basis depends on the purpose and the laws that apply to you. It can include providing the service you request, complying with legal obligations, legitimate interests where permitted, or consent where required. Using the app or accepting the Terms is not a replacement for a separate consent that the law requires.

Service providers and international processing

We use Supabase for authentication and app data, PostHog for product analytics, RevenueCat for purchase management and analytics integrations, Meta for advertising measurement, Google Analytics for website analytics, and Expo/APNs/FCM for notification delivery. Apple and Google also process purchases under their own terms and privacy policies.

Providers can process information outside your country. Our current PostHog projects use US Cloud hosting. Provider agreements and applicable transfer safeguards govern processing where required. We do not sell your personal information. Advertising-related processing is described above and must not be confused with the separate PostHog product analytics purpose.

Retention and deletion

We retain account and learning information while it is needed to provide the service, unless you request deletion or another retention requirement applies. Analytics is subject to the configured provider retention period and can be erased earlier through the account deletion process. Support, security and payment-related records may have different retention needs. Backups follow the relevant provider's deletion and rotation processes.

You can initiate account deletion in the app through Profile → Settings → Account → Delete account. Account and cloud progress removal is followed by deletion requests for associated PostHog profiles and events, including previously linked anonymous activity. Provider deletion runs asynchronously and is retried if a service is temporarily unavailable. We aim to complete associated analytics deletion within 30 days; contact us if you need a status update.

We keep limited deletion records and blocked analytics identifiers to honor the request, verify completion and prevent delayed events from recreating the deleted analytics profile. These records are restricted and are not used for product analytics or marketing. Some purchase records may remain with RevenueCat or the app stores for transaction management, fraud prevention or legal obligations; deleting your app account does not erase your store purchase history.

Deleting your account does not cancel an Apple or Google subscription. Cancel it through the store's subscription settings if you do not want further renewals. Uninstalling the app also does not cancel a subscription or send us an account deletion request. See our account deletion guide.

Your choices and rights

You can manage device notification and iOS tracking permissions in your device settings. Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to processing by contacting us. You may also have a right to complain to your local data protection authority. We may need to verify your request without asking for your password.

If you use the app without an account, contact us for help with a privacy request. Guest activity may not be identifiable from an email address alone; we will explain what limited information is needed to locate any associated records. We do not claim that uninstalling removes server-side analytics.

Children, security and updates

The service is not directed to children under 13. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action. Minors should involve a parent or guardian where required by applicable law.

We use access controls and other safeguards appropriate to the services we operate, but no online service can guarantee absolute security. We may update this policy when our practices change and will update the date above. Important changes will be communicated where required.