Privacy policy

Wika is a service of Kenjin Labs LLC (合同会社), a Japanese company and the parent company of Wika. “We” means Kenjin Labs LLC. The registered office is Private Booth 103, Umetsu Nishiuramachi 23-7, Ukyo-ku, Kyoto, Japan. Kenjin Labs handles personal information for Wika under Japan’s Act on the Protection of Personal Information. Kenjin Labs is described at kenjinlabs.com.

For a school’s teachers, students, classes, lessons, and results, the school decides to use Wika and is responsible for having a lawful reason to do so. We process that information to provide the service, following the school’s instructions and this policy.

For the public website and the contact form, we decide the purposes described here.

A school that wants a separate data-processing agreement can ask through the contact form. We provide one only when we agree to it in writing. Until then, this policy describes the processing.

The school and its users give us:

• The school’s name and time zone.
• An account name, email address, role (such as owner, teacher, or student), and a password. We store the password only as a hash, a scrambled form that cannot be read back.
• A student’s level, target level, and any note the school writes.
• Classes, class membership, and assignments, including an optional due date.
• Lesson topics, settings, and lesson text, including edits and quizzes.
• Study activity: lessons opened, words saved, recall grades, quiz answers, and scores.
• A contact-form note: name, email address, school if you include one, role, topic, and message.

We also collect, automatically:

• A sign-in session, so you can stay signed in.
• The IP address and time of sign-in attempts and contact-form submissions, so repeated attempts can be limited.
• Basic server records, such as IP address, browser type, the page requested, and the time, to keep the site secure and to fix faults.
• A short record of each lesson generation: which account asked, when, whether it succeeded, and which provider was used. That record does not contain the lesson itself.
• A light or dark theme choice, stored on your device, if you set one.

If a portrait is stored on an account, it is shown inside that school. We do not ask students to send a photo through the public site.

We do not use advertising trackers, and we do not build marketing profiles.

We use personal information to:

• Open and run the school’s account, and keep each school separate.
• Generate, store, assign, and play lessons, and show teachers the progress of their own school.
• Save words a student chooses to recall, and schedule that practice.
• Reply to a contact-form note at the address the person typed. That address is used to reply. It is not added to a mailing list, and it is not published.
• Protect the service, enforce the terms, limit abuse, and keep security records.
• Fix failures.
• Meet a legal duty.

Teachers in a school can see that school’s classes, students, lessons, and results. A student sees their own assigned lessons, saved words, and results. One school cannot see another school’s information through the service.

We do not sell personal information. We do not share it for advertising. We do not use school or student content to train a Wika model.

Companies that help us run Wika may process information for that purpose:

• DigitalOcean hosts the application and the database in the New York area of the United States.
• Anthropic receives the lesson request when Claude writes or rewrites lesson text. If the service is set to use Google Gemini for text, Google receives that request instead.
• Google receives a line of text when audio is created, through Google Cloud Text-to-Speech, or through Gemini speech if that option is in use.

A lesson request includes the topic, the level, the lesson settings, and the lesson text needed for that request. Audio includes the line being spoken. We do not send class lists, account email addresses, or quiz scores to those providers for this purpose. A topic or a line can still contain a name if the school or a student wrote one there.

We may also disclose information to the school, about its own account. We may disclose it if we believe a law, a court, or an authority requires it. We may disclose it to protect Wika, a user, or the public, or to enforce the terms. If the service is sold or reorganized, the information may pass to the successor, who must follow this policy or give notice before a different use.

Student work and contact-form notes are not published.

The public site is for schools and the adults who work with them. A child does not open their own Wika account. The school creates student accounts.

The school must have the authority to give us a student’s information. That includes a parent’s or guardian’s permission wherever the law requires it, including under Japanese law when it applies. Where a school’s own law lets the school authorize an educational service for its students, the school is responsible for that authorization.

If you believe a child’s information reached us without the school’s authority, use the contact form. If we confirm that, we will delete it or send the question back to the school.

We use one essential cookie, named wika_session. It keeps you signed in and protects forms. It is limited to our site, scripts on the page cannot read it, and in production it is sent only over an encrypted connection. It ends when the browser session ends. On the server, an idle sign-in ends after about eight hours.

If you choose a light or dark theme, the choice is stored on your device under the name wika-theme. It stays there. It is not a cookie, and it is not used to recognize you across sites.

We do not use analytics cookies or advertising cookies. An account needs the session cookie in order to stay signed in.

We keep a school’s information while the account is open, and afterward for as long as we need it to close the account, resolve a dispute, meet a legal duty, or protect the service. We then delete it or remove the identifiers. Copies in backups disappear on the backup cycle. Database backups are kept for about 14 days.

Contact-form notes are kept while we need them to respond and to keep a record of the request.

Security counters that store an IP address, or an IP address together with an email address for sign-in limits, cover a short window and then expire.

Spoken audio is stored as a cache of the line that was read, so the same line is not generated twice. It is not filed under a student’s name.

We may keep de-identified or combined information, which does not identify a person or a school, for as long as it is useful.

Kenjin Labs is in Kyoto, Japan. The Wika application and database are hosted in the New York area of the United States. Lesson text and spoken lines are also processed by the providers named above, in the United States or in other countries where those providers operate.

Sending personal information to those providers is a transfer outside Japan. The school, by using Wika, agrees to that transfer for the school’s information. The school will obtain any notice or consent that Japanese law, including the Act on the Protection of Personal Information, requires from its teachers and students. The school is also responsible for any permission another country’s law requires.

We protect accounts with hashed passwords, encrypted connections, separated school data, and access limits. Teachers see their school. Students see their own work.

No method of storage or transmission is perfectly secure. The school chooses who receives a password and removes access when someone leaves.

Where the law gives a person a right to see, correct, delete, or receive a copy of their information, or to stop a use, they may use that right. In Japan, this includes the rights under the Act on the Protection of Personal Information.

Students and teachers should ask their school first. The school runs the account, and we follow the school’s instruction for school information. The school may pass a request to us through the contact form.

Anyone else may use the contact form. Say that the note is about privacy, and include the school name if there is one. We may ask for enough detail to confirm the request and to find the records. We may decline a request the law does not require us to fulfill, including one we cannot verify, one that would reveal another school, or one that is excessive.

A person may also complain to a data-protection authority where they have that right. In Japan, that authority is the Personal Information Protection Commission. Write to us through the contact form first so we can try to resolve it. This policy does not offer a right the applicable law does not give.

We may update this policy by posting a new version on this page and changing the date above. The new version applies when it is posted. If the school does not agree, it must stop using Wika and ask us, through the contact form, to close the account.

Privacy questions and requests go through the contact form. We do not publish an email address for privacy requests.