Tanuki Deck1. Who we are
Tanuki Deck ("we", "us") is operated by Blue Star S.R.L. (Via Ghega 2, 34132 Trieste, Italy · P.IVA 01395180324 · REA TS-211910), which is the data controller for the personal data described in this policy. For anything in this policy, write to support@tanukideck.com.
2. What we collect
- Account. Your email address and a password (stored only as a secure hash by our authentication provider), or — if you sign in with Apple — the identifier Apple shares with us. Optionally, a collector name you choose.
- Your deck. The words you capture, the cards built from them (readings, meanings, example sentences, pictures, audio) and your review history and settings, so your deck syncs across devices.
- Photos. When you scan a word, the photo is sent to our servers, read for the Japanese words in it, and discarded. Photos are never stored, and we never open your photo library — you pick or take each picture yourself.
- Setup analytics. During first-run setup the app records which steps a device reached, under a random identifier that is not linked to your account. This tells us where setup loses people; it identifies no one.
- Purchases. Payments are handled entirely by Apple (or Google). We never see your card number — we receive only your subscription status (which plan, active or not).
- Support. If you email us, we keep the correspondence.
- Diagnostics. If the app crashes, a crash report (device model, OS version, what the code was doing) may be sent to our error-reporting service so we can fix it. Crash reports don't include your cards or photos.
3. What we use it for
To run the service: building your cards, syncing your deck, scheduling reviews, restoring your subscription, answering support, and fixing crashes. We also look at aggregate, non-identifying numbers (how many cards are made, where setup drops off) to improve the app. Nothing else — no advertising, no profiling, no sale of personal data, ever.
4. Who processes it for us
We use a small number of service providers, each receiving only what its job needs:
| Provider | Job | What it sees |
|---|---|---|
| Supabase | Database, authentication, file storage | Your account, cards and media |
| Anthropic | Reading photos, writing example sentences | The photo you scan (transiently), the word being made into a card |
| fal.ai | Card illustrations | The word's meaning and example text — nothing about you |
| Google Cloud | Card audio (text-to-speech) | The Japanese text being spoken — nothing about you |
| Apple / Google | Payments and app distribution | Handled under their own privacy policies |
| RevenueCat | Subscription status | An anonymous app-user id and purchase state |
| Sentry | Crash reporting | Crash and device diagnostics |
Some of these providers process data in the United States. Where personal data leaves the EU, the transfer is covered by the European Commission's Standard Contractual Clauses or an adequacy decision (such as the EU–US Data Privacy Framework).
5. What other users can see
If you set a collector name, it is shown on cards you were the first to capture, together with how many collectors hold the same word. Leave the name blank and you appear as anonymous — your email is never shown to anyone either way. The dictionary facts of a card (word, reading, meaning) are shared across users through a common catalog; your photos, review history and personal deck are not.
6. How long we keep it
For as long as you have an account. Deleting your account (Settings → Delete account) permanently removes your account and your cards; it cannot be undone. Setup analytics are anonymous and kept only in aggregate. Support emails are kept as long as needed to help you.
7. Legal bases
Under the GDPR we process your data to perform our contract with you (running the app you signed up for), under our legitimate interest in keeping the service reliable and improving it (diagnostics, aggregate setup analytics), and to comply with legal obligations (tax records of purchases, handled by Apple/Google).
8. Your rights
You can ask for a copy of your data, have it corrected or deleted, restrict or object to processing, and take your data elsewhere — the in-app Anki export already gives you your whole deck in an open format, and account deletion is built into Settings. For anything else, email support@tanukideck.com. If you believe we've handled your data badly, you can complain to your local supervisory authority — in Italy, the Garante per la Protezione dei Dati Personali.
9. Children
Tanuki Deck is not directed at children. You must be at least 13 years old — or the higher minimum age your country sets for consenting to data processing — to create an account.
10. Changes
If this policy changes in a way that matters, we'll say so in the app before the change applies. The effective date at the top always tells you which version you're reading.
11. Contact
Blue Star S.R.L. — data controller
Via Ghega 2, 34132 Trieste, Italy
support@tanukideck.com