Last updated: 25 June 2026
This Privacy Policy explains what personal data Wakatta ("Wakatta", "we", "us", "our") collects when you use the Wakatta mobile app and the wakatta.app website (together, the "Service"), how and why we use it, who we share it with, how long we keep it, and the rights you have. Wakatta is a Japanese-learning app that turns real podcasts into tappable lessons with transcripts, a dictionary, AI explanations, and spaced-repetition review. We aim to collect as little personal data as we reasonably can to run the Service.
We currently offer sign-in by email + password, an email sign-in link ("magic link"), and Google Sign-In. We do not currently offer Sign in with Apple. We will update this Policy before adding any new sign-in method.
| Purpose | Legal basis |
|---|---|
| Create and run your account; deliver the Service (transcripts, dictionary, AI explanations, saved words, review, progress, streaks); send sign-in emails | Performance of a contract (Art. 6(1)(b)) |
| Keep the Service secure, prevent abuse, enforce fair-use limits, and debug/improve the product | Legitimate interests (Art. 6(1)(f)) — you can object (Section 7) |
| Tell you when Premium launches, if you asked us to ("notify me" / waitlist) | Consent (Art. 6(1)(a)) — withdraw any time |
| Comply with legal obligations | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have weighed our interest against your rights and limited the data accordingly; you may ask us for more detail. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects (Art. 22). AI explanations are a study aid and make no decisions about you.
We do not sell your data. We use a small number of trusted service providers ("processors") that process data on our behalf, under contract and on our instructions. Podcast audio is not routed through them as user content (see Section 5).
| Provider | What it does & what it processes | Where |
|---|---|---|
| Railway | Hosting — runs our servers and database; all stored personal data | EU and/or US |
| Cloudflare | DNS, CDN, security/WAF; "Turnstile" anti-bot check on the website waitlist; IP & request metadata | Global edge network |
| Sentry | Crash/error diagnostics; device info, IP, request metadata | EU region (Germany); some account metadata may be in the US |
| Google (Gemini AI) | Generates AI explanations; receives only the Japanese word/sentence you ask about and your output language — not your name or email | United States / Google regions |
| Speech-to-text (Soniox; and/or OpenAI / Groq Whisper) | Transcribe podcast audio into text, once per episode — no user personal data | EU and/or US, per provider |
| Resend | Transactional email (sign-in links, waitlist confirmation); your email and the message | United States |
| Google (Sign-In) | Lets you sign in with your Google account, if you choose | Per Google |
When you ask for an AI explanation, only that Japanese text and your chosen output language are sent to the AI provider — not your identity. Results are cached and reused across users by content. We may also disclose data where required by law, to enforce our Terms, or to protect the rights, safety, and security of our users, the public, or Wakatta.
Some providers process personal data outside the European Economic Area (EEA), including in the United States. Where that happens, we rely on one or more safeguards under GDPR Chapter V: the provider's certification under the EU–US Data Privacy Framework (where applicable) and/or the European Commission's Standard Contractual Clauses, with additional measures where needed. We have chosen our crash-reporting provider's EU (Germany) data region to keep diagnostic data within the EU where possible. Ask us (Section 8) for more information about the safeguards for a specific transfer.
Wakatta is a learning layer on top of podcasts created and published by third parties. When you play an episode, the audio is streamed directly from the podcast's own host (the public feed's media URL); we do not host or re-stream it as your personal content. Separately, our servers download each episode's audio once to generate a shared transcript (cached per episode, not per user) — this involves the third-party podcast audio, not your personal data.
If you are in the EEA (and similarly under UK law) you have the right to access, rectify, erase, restrict, and port your data, to object to processing based on our legitimate interests, and to withdraw consent at any time (without affecting processing already done). To exercise any of these, email [email protected] from your account address so we can verify it is you; we respond within the time the law allows (generally one month), free of charge. You may also lodge a complaint with a supervisory authority — in Spain, the Agencia Española de Protección de Datos (AEPD), aepd.es — though we would appreciate the chance to address your concern first.
You can delete your account and associated personal data at any time and free of charge by requesting deletion on the web at wakatta.app/delete-account, or by emailing [email protected] from your account address. We then permanently delete your account, email, saved words and their context, listening progress, daily goal and streak, marks, review data, and the lookups tied to your account, keeping only what the law requires or briefly for security/abuse-prevention. See wakatta.app/delete-account for full details.
Wakatta is intended for an adult, general audience and is not directed to children. We do not knowingly collect personal data from children below the age of digital consent in their country (in Spain, 14; in many EU countries, 16). If you believe a child has provided us data, contact us and we will delete it.
We protect your data with measures including encryption in transit (HTTPS), storing passwords only in hashed form, keeping sign-in tokens in the device's private app storage, and limiting access to our systems. No method is completely secure, but we work to protect your information and will notify you and the relevant authority of a personal-data breach where the law requires.
We may update this Policy as the Service evolves. We will revise the "Last updated" date above and, for material changes, give you notice in the app or by email before the change takes effect where required.
Questions about this Policy or your data: [email protected].