Privacy Policy

Last updated: May 15, 2026

1. Who we are

LearnFromX is operated from France. For GDPR purposes, the data controller is LearnFromX, reachable at contact@learnfromx.com.

2. What we collect

Account data

• Email address: provided at signup or via Google OAuth
• Password hash: if you sign up with email (hashed with Argon2id, we never store your plaintext password)
• Google OAuth identifier: if you sign in with Google
• Account tier: free or paid

Learning data

• Study progress: which words you've learned, review history, spaced repetition state
• Shows enrolled: which anime you're studying from
• Calibration data: your self-assessed Japanese level and mode preferences
• Generated flashcards: card content created from your study sessions

Usage data

• IP address: for rate limiting and abuse prevention
• Generation history: which decks were generated, when, and their parameters
• Feedback messages: if you submit feedback through the app

Data we do not collect

• We don't collect your real name, phone number, or physical address
• We don't collect payment information directly (handled by the payment processor)

3. Why we process your data

Purpose	Legal basis (GDPR)
Provide the service (account, flashcards, study progress)	Contract performance
Send transactional emails (verification, password reset, deck ready)	Contract performance
Rate limiting and abuse prevention	Legitimate interest
Error monitoring (Sentry)	Legitimate interest
Analytics (Google Analytics)	Consent
Service improvement	Legitimate interest

4. Third-party services

We share data with these services to operate LearnFromX:

Service	Purpose	Data shared
Google Analytics	Usage analytics	Page views, anonymized usage patterns, IP address
Brevo	Transactional email	Email address, email content
Sentry	Error tracking	Error stack traces, request context (PII sending is disabled)
Anthropic	AI content generation	Anime sentences, vocabulary queries (no account data)
Google OAuth	Authentication	Email address (received from Google during login)

We do not sell your data. We do not use your data for advertising.

5. Cookies

We use a single session cookie to keep you logged in. It's HttpOnly, Secure (HTTPS only), and SameSite=Lax. It expires after 30 days of inactivity.

Google Analytics sets its own cookies for usage tracking. You can opt out using a browser extension or by blocking third-party cookies.

6. Data retention

Data type	Retention
Account data	Until you delete your account
Learning progress	Until you delete your account
Generation sessions	Automatically deleted after 24 hours
IP addresses (rate limiting)	Reset weekly (Mondays)
Feedback messages	Until resolved, then deleted
Authentication tokens	Expired tokens are periodically purged

7. Your rights (GDPR)

If you're in the EU/EEA, you have the right to:

• Access: request a copy of your data
• Rectification: correct inaccurate data
• Erasure: delete your account and associated data
• Portability: receive your data in a machine-readable format
• Restriction: limit how we process your data
• Objection: object to processing based on legitimate interest
• Withdraw consent: for consent-based processing (e.g., analytics), at any time

To exercise any of these rights, email contact@learnfromx.com. We'll respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority. In France, this is the CNIL.

8. Data security

We protect your data with:

• HTTPS-only connections
• Argon2id password hashing
• HttpOnly, Secure session cookies
• Rate limiting on authentication endpoints
• Anti-enumeration protections on login and reset flows

9. International transfers

Some third-party services (Google Analytics, Anthropic, Sentry) may process data outside the EU/EEA. These transfers rely on Standard Contractual Clauses or equivalent safeguards provided by each service.

10. Children

The service is not directed at children under 16. We don't knowingly collect data from children under 16. If you believe a child has created an account, contact us and we'll delete it.

11. Changes to this policy

We may update this policy. Material changes will be communicated via email or an in-app notice. The "last updated" date at the top reflects the most recent revision.

12. Contact

For privacy-related questions or GDPR requests: contact@learnfromx.com