何時漢字？

何時漢字？ (Nanji Kanji) ("the game", "we") is a free kanji learning game run by an individual in Japan. This policy explains what personal information the game handles and how, in line with Japan's Act on the Protection of Personal Information (個人情報保護法, APPI). In short: we collect as little as possible, we don't show ads, we don't use tracking or analytics, and we never sell your data.

1. What we collect

• Your email address, if you create an account. It's used to send you one-time sign-in links. You can play as a guest without giving any email.
• Game data: your points, streak, chosen level, the rounds you play (your answers, hints used and scores), the kanji you discover in the Radical Workshop, and the words and kanji you save to your notebook.
• Sign-in sessions: a random session ID stored in a cookie on your device, and with each session the IP address and browser type (user agent) it was started from.
• Technical logs: like any website, our servers briefly record requests (IP address, time, page, browser type) to keep the site running and secure.

We don't ask for your name, address, phone number, date of birth or payment details, and we don't collect sensitive information (要配慮個人情報).

2. Why we use it

• To run the game: save your progress, streak and notebook, and show today's challenges.
• To let you sign in, by emailing you sign-in links.
• To keep the game fair and safe: checking scores, limiting abuse and blocking attacks.
• To answer you if you contact us.

We use your information only for these purposes, and won't use it for anything else without your consent.

3. Cookies and storage on your device

• One sign-in cookie, which is necessary for the game to remember you (it can't be read by scripts).
• Your light/dark theme, chosen level, last game tab and Workshop chapter are remembered in your browser's local storage. They never leave your device.

There are no advertising, analytics or tracking cookies.

4. Services that process data for us

We use the following providers to run the game. They process data on our behalf and only as needed for their service:

• Amazon Web Services: the server, the database and its backups. Location: Amazon Web Services (AWS), Asia Pacific (Sydney) region, Australia.
• Cloudflare (USA, global network): delivers the website, protects it against attacks and handles email sent to [email protected]. Your requests, including your IP address, pass through Cloudflare.
• Resend (USA): sends the sign-in emails, so it receives your email address and the email's contents.
• Google Fonts (USA): the game's fonts are loaded from Google's servers, which receive your IP address and browser type when the page loads.

Data outside Japan (外国にある第三者への提供). Because of these providers, your information is stored or processed in Australia and the United States. Australia has a national privacy law (the Privacy Act 1988 and its Australian Privacy Principles). The United States has no single comprehensive federal privacy law; protection there comes from sector-specific and state laws. Each provider above has published security and privacy commitments for the data it processes. Japan's Personal Information Protection Commission publishes information about other countries' systems on its website. If you would like more detail, contact us.

We don't share your personal information with anyone else, except when required by law.

5. How long we keep it

• Accounts: until you delete them.
• Guest accounts are deleted automatically, with everything in them, once their session has expired (7 days without a visit).
• Sign-in links expire after 5 minutes; sessions expire after 7 days without a visit.
• Server logs are overwritten automatically, usually within days.
• Backups of the database are kept for up to about 5 weeks, then deleted automatically. Deleted accounts disappear from backups when those backups expire.

6. How we protect it

All traffic is encrypted (HTTPS). The server has no open ports to the internet; the database can't be reached from outside it, and its disk and backups are encrypted. We store no passwords: you sign in with one-time email links. Access to the systems is limited to the operator and protected by two-factor authentication.

7. Your rights

• Delete your account at any time on the Account page. This immediately deletes your account and everything linked to it: points, streak, rounds, discoveries and notebook.
• You can also ask us to disclose, correct, stop using or delete the personal information we hold about you (開示・訂正・利用停止・消去等の請求), or ask how it is used, by writing to [email protected]. We may need to confirm that the request comes from the account's owner. There is no fee.

8. Children

The game is suitable for all ages. If you are under 16, please ask a parent or guardian before creating an account. Parents can contact us to have a child's account deleted.

9. Changes

If we change this policy, we'll update the date at the top and, for important changes, tell you in the game before they take effect.

10. Contact (お問い合わせ窓口)

Questions, requests and complaints about personal information: [email protected]. The operator's name and address will be provided without delay on request.