Legal
Privacy Policy
This policy explains what Tako JLPT collects, why, how long we keep it, who processes it and what rights you have. It is written from what the app's code actually does.
1. Who runs the app
Tako JLPT (Vietnamese brand “Học cùng Tako”, website takolingo.com, and the Google Play / App Store apps once published) is developed and operated by Nguyen Cong Tung, an individual resident in Japan (“we”). The operator decides the purposes and means of processing personal data in the app. Privacy contact: support@takolingo.com.
2. Data we collect
2.1 Account information (you provide)
- Email, display name and password when you sign up with email. Passwords are stored only as a PBKDF2-SHA256 hash (100,000 iterations, per-user salt).
- If you choose Sign in with Google: email, whether it is verified, name, profile-picture URL and your Google account identifier (“sub”). We never receive your Google password, contacts or Drive data.
- Account management fields: role, plan (all accounts are free today), creation time, last sign-in, email-verification time, account status.
2.2 Learning data (created as you use the app)
- Settings: current level, daily goal, onboarding state, listen-once mode.
- Progress: completed roadmap days, lessons/videos watched, lesson-loop steps, stars and XP.
- Answers you choose in drills, mock exams and OTAFF practice, correctness and timestamps.
- Exam-attempt data: start/submit times, section scores, time spent per question, number of answer changes, listening plays, section deadlines.
- Spaced-repetition and ability data (adaptive learning): flashcard memory state (stability, difficulty, next review), review history, estimated ability per skill, goals (target level, exam date, minutes per day).
- An archive of your past attempts on exams that were removed from the app, so your history is not lost.
2.3 Technical and security data (collected automatically)
- IP address and user agent (browser/device type, up to 300 characters) stored with each sign-in session.
- Sign-in attempts: email entered, IP address, success or failure, time — to stop password guessing.
- Rate-limit counters keyed by IP, account ID or email; 6-digit verification codes (hashed only); idempotency keys with the stored response of that same request.
- Cloudflare system logs (Workers Logs): requested path, timing, status codes, request ID and connection metadata Cloudflare attaches (which may include IP, country and user agent).
- Cloudflare derives an approximate time zone from your IP to greet you (“good morning”); it is not stored.
We do not collect precise location, contacts, photos, microphone, camera, advertising IDs, payment or health data. The app shows no ads and we do not sell data.
3. Purposes and legal bases
- Providing the service you ask for (contract): account creation and sign-in, saving and syncing progress across devices, grading, scheduling reviews, recommending what to study next, post-exam reports.
- Security and abuse prevention (legitimate interest / data-security obligations): stopping password guessing, rate limiting, debugging, incident investigation.
- Transactional email: email-verification and password-reset codes. We send no marketing email.
- Your consent: by signing up and using the app you consent to these purposes; you can withdraw at any time by deleting your account (section 9).
We do not use your data for advertising, marketing profiles, or to train third-party AI models.
4. Service providers and third parties
We do not share personal data with anyone for their own purposes. These services process data on our behalf, or are contacted directly by your browser when you use the related feature:
| Service | Role | Data involved |
|---|---|---|
| Cloudflare, Inc. (Workers, D1, R2, Email Sending, CDN) | Hosting, database, sending verification emails, system logs | All account and learning data; IP, user agent; recipient email of codes |
| Google LLC — Sign in with Google | Authentication if you choose it | Google learns you signed in to the app; the app receives email, name, picture, account ID |
| Google LLC — Google Drive player | Plays embedded lesson videos | When you open a video your browser connects to drive.google.com; Google may receive IP and user agent and set cookies under Google's policy |
| Google LLC — Google Fonts | Serves the Be Vietnam Pro / Noto Sans JP fonts | Your browser sends IP and user agent to fonts.googleapis.com / fonts.gstatic.com |
| Your browser's / OS speech engine | Reads Japanese words aloud in some games | The Japanese text being read; some browsers may use their vendor's online voices |
We use no analytics or advertising tools. Cloudflare Web Analytics currently collects nothing from the app; if we enable it we will update this policy first. We may disclose data where the law requires it (for example a valid request from a competent authority).
5. Cookies and on-device storage
- jlpt_session: sign-in session cookie (HttpOnly, Secure, SameSite=Lax, 30 days). Strictly necessary.
- jlpt_gstate: 10-minute cookie during Google sign-in (anti-forgery).
- jlpt_reauth: 10-minute cookie after you re-confirm with Google to delete your account.
- localStorage: last level, offline progress buffer, recently answered items (to avoid repeats), a font flag. Clearing site data in your browser removes it.
- Service worker: caches static interface files so the app opens fast and offline. No personal data.
6. Retention
| Data | Kept for |
|---|---|
| Account and learning data | Until you delete your account (deletion is immediate) |
| Sessions (with IP, user agent) | Up to 30 days, or until sign-out / account deletion |
| Sign-in attempts (email entered, IP) | 30 days |
| Rate-limit counters | 24 hours |
| Verification / reset codes | Valid 15 minutes; deleted once used or expired |
| Cloudflare system logs | Up to 7 days (deleted by Cloudflare) |
| Database backups (D1 Time Travel) | Up to 30 days, then expire automatically |
| Emails you send to support | Until your request is resolved, at most 12 months |
| Account-deletion log (non-identifying: time, confirmation method, rows deleted) | Kept as proof that deletions happen — contains no email, account ID or IP |
7. International transfers
Data is stored and processed on Cloudflare's global infrastructure (headquartered in the United States) and, for the features in section 4, by Google (United States). Your data may therefore be processed outside Vietnam and Japan, including in the United States, whose data-protection rules differ. Cloudflare and Google protect data under their data-processing terms and certifications (e.g. standard contractual clauses, data privacy frameworks, ISO 27001/27701). By using the app you consent to these transfers.
8. Your rights
- Vietnam — Personal Data Protection Law No. 91/2025/QH15 (in force since January 1, 2026) and Decree 356/2025/ND-CP (which replaced Decree 13/2023/ND-CP): rights to be informed, to consent or withdraw consent, to access and obtain your data, to rectify, delete, restrict and object to processing, to complain, and to claim compensation.
- Japan — Act on the Protection of Personal Information (APPI): rights to request disclosure of retained data and third-party provision records, correction/addition/deletion, and cessation of use or of third-party provision.
- Users elsewhere (e.g. GDPR in the EU/UK, US state laws) have similar rights: access, rectification, erasure, objection, and complaint to a supervisory authority.
How: display name and goals can be edited in the app; account deletion is self-service (section 9). For other requests (a copy of all your data, email correction, restriction) write to support@takolingo.com from your account email. We may ask for information to verify ownership and will reply within 30 days, free of charge for reasonable requests.
9. Deleting your account
Delete your account and all its data at any time: in the app via Profile → Account → Delete account, or on the web at the Delete account page (which also explains what to do if you cannot sign in). Deletion is permanent and immediate; technical backups expire within 30 days.
10. Age
The app is intended for people aged 13 and over and is not directed at children. If you are under 16 (or under the age of digital consent where you live), use the app with a parent's or guardian's permission. If we learn an account belongs to a child under 13, we will delete it; parents can contact support@takolingo.com.
11. Security
- HTTPS everywhere (HSTS). Passwords and verification codes are stored only as hashes. Session cookies are HttpOnly and Secure.
- Each account can read only its own data; administrators cannot see passwords or reset codes.
- Password-guessing lockouts, rate limiting and a strict Content Security Policy.
- If a data breach affects you, we will notify you and the competent authorities within the legally required time.
12. Changes and contact
For material changes we update this page with a new effective date and notify you in the app before they apply. Questions or complaints: support@takolingo.com (operator: Nguyen Cong Tung, Japan). You may also complain to your local data-protection authority (e.g. Vietnam's Department of Cybersecurity and High-Tech Crime Prevention, Ministry of Public Security; Japan's Personal Information Protection Commission).
Vietnamese version: Chính sách quyền riêng tư. If the versions differ, the Vietnamese version prevails.