Privacy
Updated 16 October 2026
Bunbuku is an independently developed Japanese learning app. This page covers the Bunbuku website, web app, and mobile apps. For privacy questions or requests, contact support@bunbuku.com.
Adult learners
Bunbuku’s learning features are for adults aged 18 and over. Before learning, we ask you to confirm that you are at least 18. This is a self-declaration; we do not collect your date of birth or an identity document for this check. If you believe someone under 18 has used the learning service, contact support@bunbuku.com so we can investigate and handle any account or data request.
Information we use
- Account information: your email address, sign-in identifiers and display name, where provided. Our authentication provider manages passwords and sign-in sessions.
- Guest identity and preferences: a device identifier, reading and audio settings, and other information needed to continue your learning. Signing in can connect your guest progress to your account.
- Learning information: lessons and activities, practised vocabulary, review schedules, conversation history, corrections, scores, practice days and progress.
- Information you choose to share: messages, feedback, and details such as your name, country, occupation or interests when you use personal lesson activities. Avoid sharing sensitive information you do not need for learning.
- Audio: microphone recordings are sent for speech transcription. Bunbuku uses temporary recordings during processing and does not keep them as conversation history. Conversation text is stored. Personal generated speech is stored separately from shared lesson and vocabulary audio and linked to your account or guest identity for replay.
- Subscription information: on the web, Stripe processes checkout and card details. Bunbuku stores customer/subscription references and access status, not full card numbers. In the iOS and Android apps, Apple or Google processes subscriptions. We exchange an opaque account reference and purchase records with the store to verify access and handle renewals.
- Technical information: servers and service providers process network and device information to deliver the service, diagnose failures, secure accounts and enforce usage limits.
Speech and AI processing
Google Cloud Speech-to-Text processes recordings to produce text. Google Gemini processes relevant conversation text and lesson inputs to generate responses, examples and feedback. Google speech services generate audio for playback. Your messages may contain personal information you choose to include. AI responses can be incorrect.
On the web, Google processes these inputs to deliver the speech and AI learning features you request, as described here and at account entry. You can turn these features off in Settings under Speech and AI; previous explicit opt-outs remain respected. In the mobile apps, we ask permission before sending your inputs to Google, including before first recording. This permission is remembered for your account on that device and can be withdrawn in Settings under Speech and AI permission. Ordinary authored lesson audio does not require this permission. Turning these features off stops new processing of your inputs; it does not erase earlier processing or your saved history. We use these inputs to provide the learning features you request. We do not use your conversations to train our own AI models. Provider processing is governed by the applicable service terms and our provider configuration.
Service providers
| Provider | Purpose |
|---|---|
| Supabase | Authentication and storage of account, conversation and learning data |
| Google Cloud and Gemini | Backend hosting, speech transcription, AI responses and feedback, generated audio and audio-cache storage |
| Vercel | Website and web-app hosting |
| PostHog EU | Usage analytics, such as pages visited, activity completion, timing and acquisition source, linked to a device or account identifier when enabled |
| Sentry | Error and performance diagnostics |
| Apple App Store and Google Play | Native subscription purchases, payment processing, verification and subscription management |
| Stripe | Optional web subscriptions, payment processing and billing management |
| Expo, Apple Push Notification service and Google Firebase Cloud Messaging | Delivery of optional practice reminders |
| Kit | Optional email-updates signup, confirmation, delivery and unsubscribe records |
| Google Fonts | Serving website fonts; font requests include ordinary network information |
Bunbuku does not sell your personal information or use advertising identifiers. We keep learner transcripts, names and email addresses out of authored analytics events. Providers may process information in countries outside your own. You can contact us for information about the processing arrangements and applicable safeguards.
Cookies and browser storage
We use cookies and similar storage, including local storage and IndexedDB. Necessary storage keeps you signed in, recognises guest progress and remembers your choices. Usage analytics helps us understand how people discover and use Bunbuku. Website browsing is available without analytics. Free learning in the web app requires the usage-data agreement shown before entry; existing active Pro, founding and partner access is preserved without that agreement.
| Storage | Purpose and duration |
|---|---|
| Guest device identifier | Necessary to connect your activity to your browser. The guest cookie has a configured lifetime of up to 400 days; browser restrictions may shorten it. Other local copies remain until cleared. |
| Sign-in and learning preferences | Necessary authentication/session and local preference storage. Retained until expiry, sign-out where applicable, or clearing the relevant storage. |
| Adult eligibility confirmation | Stores your confirmation, its version and the time you made it in this browser or device, separately for each guest or account identity. It is not transferred from a guest to an account or between accounts. It remains until you withdraw it in Settings, clear the relevant storage or delete the account on this device. Withdrawing it closes learning access while account and subscription management remain available. Requests to speech and AI services carry the confirmation version. |
| Speech and AI permission | Stores your mobile permission or web service preference, notice version and decision time separately for each account on this device, until you change it, delete your account on this device or clear storage. A recent guest choice may follow one explicit sign-in journey without replacing an existing account choice. |
| fluent_analytics_consent | Remembers your analytics choice for up to 180 days across the Bunbuku website and web app. An app-access agreement also records its notice version and decision time in this cookie. It is specific to this browser, not a permanent account record. |
| PostHog analytics storage | Cookies and local storage for usage measurement and acquisition attribution. Configured cookie lifetime: 90 days. Disabled until you allow analytics on the website or agree in the web app. |
You can decline analytics and continue browsing this website. In the free web app, Agree and continue enables learning; Leave Bunbuku returns to the website. You can withdraw through Analytics choices in app Settings or here. Withdrawal stops further web analytics and clears its browser storage. Free learning then requires a new agreement. Account settings, sign-in, billing, support and deletion remain available, and existing active Pro, founding and partner access is not removed. Withdrawal does not delete your learning history or automatically erase earlier analytics records. Contact us if you want those records removed.
Native apps use app storage rather than browser cookies. You can turn off usage analytics in Settings. Diagnostic processing needed to investigate errors is separate from optional usage analytics.
Why we use information
We process information to provide the learning features and account services you request, handle subscriptions, protect the service and respond to support requests. Where applicable, these purposes rely on performance of the contract for the service you request, legitimate interests in security and reliability, or legal obligations. Requested web speech transcription and AI replies, feedback and personal lesson generation form part of that learning service. This does not authorize unrelated model training, marketing or optional analytics. Web usage analytics starts after your explicit choice. The app-access notice explains the consequence for free web learning before you agree.
Optional email updates
If you choose to subscribe, Kit processes your email address and signup, confirmation and unsubscribe records to send Bunbuku news and offers. This is separate from creating an app account or agreeing to analytics. Confirm your subscription by email before receiving updates. You can unsubscribe using the link in any update or contact us to request removal. We retain subscription records while you subscribe and may retain a limited suppression record to respect an unsubscribe. Deleting an app account does not automatically unsubscribe a separately created email subscription; you can unsubscribe or request both deletions by contacting support.
Optional practice reminders
If you enable practice reminders in the phone app, we store a notification delivery token linked to your account or guest identity, your chosen time and time zone, and reminder preferences. We use completed practice and recent app activity to avoid interrupting you or reminding you after you have practised. Reminders become less frequent during inactivity and pause after two weeks. You can change the time, pause or turn them off in Settings. This choice is separate from usage analytics and email updates.
Expo and Apple or Google deliver these notifications using the delivery token and notification message. Reminder messages do not include your conversation text or personal lesson answers. Turning reminders off removes the active delivery token from our reminder preferences. Scheduled cleanup removes delivery tokens not refreshed for 30 days and reminder delivery records older than 30 days. Account deletion removes linked reminder preferences and delivery records. Notifications already handed to a delivery provider may still arrive.
Retention and deletion
Account-linked learning history stays available while your account exists unless you delete it. Guest history remains linked to its device identifier until removed; clearing browser storage alone does not delete server-side history. Temporary microphone files are cleaned up after processing. Provider logs, caches, backups and billing records have separate retention arrangements, including records that must be kept for legal or accounting reasons.
In Settings, Delete account removes your application data and authentication account and cancels a linked Stripe subscription. Apple and Google subscriptions must be cancelled separately through the store. Account deletion also queues a request to erase account-linked PostHog analytics, including linked events and recordings. The request is sent after a 24-hour delay to allow queued events to arrive, and failed requests are retried. Provider processing takes additional time. Anonymous activity that was never linked to your account may need a separate request. See account deletion and data requests.
Generated speech is different from microphone recordings. Personal generated speech may include text you supplied. Account deletion removes these clips and their replay links from our active storage, including guest clips connected to the account when you signed in. Speech generation finishing after deletion cannot restore the clips. Shared authored lesson and vocabulary audio is retained separately under a 180-day cache expiry rule. Older clips removed from the previous shared cache may remain recoverable for up to 7 days; copies already delivered to a device cannot be recalled. Provider processing, logs and backups follow their separate retention arrangements. We keep a hashed deletion marker to reject old sessions and late billing notifications, and temporarily retain the analytics account identifier until PostHog accepts the erasure request. Aggregate AI usage counts are kept without their conversation links.
Your choices and rights
You can edit available preferences in Settings, change your web analytics choice as described above, and request access, correction, a copy or deletion of your personal information. Depending on the law that applies, you may also have rights to object to or restrict processing and complain to a data protection authority. Contact us from your account email when possible; we may need to verify a request to protect your information.
For privacy requests, email support@bunbuku.com. We will explain any information we need to retain and why. Material changes to this policy will be reflected here with an updated date.