This policy explains what personal data Kiku collects, how we use it, and the rights available to you.
1. Personal data we collect
Kiku uses Supabase Auth for Apple and Google sign-in, and email verification links on the account-deletion website. We receive account identifiers and email addresses, but not your Apple or Google password. We also store your preferences, learning progress, review schedules, lesson answers and feedback, and purchase records needed to validate subscriptions and restore purchases.
Kiku is not intended for children under 13. Contact us if you believe a child has supplied personal data.
2. How we use this information
We use account and learning data to provide the service under our agreement with you: sign-in, learning activities, answer marking, progress synchronization and support. We rely on our legitimate interests to secure the service, prevent fraud and resolve billing disputes, and on legal obligations where records must be kept. We obtain consent for advertising personalization where required.
Pronunciation practice uses your device's speech service, which may send audio to its provider. Kiku stores recognized text and practice results, but does not upload pronunciation recordings to its own storage. You control microphone and speech access through device permissions.
The current app does not use Google Analytics or send crash reports to Sentry.
3. Third-party processing
Edward Coventry operates Kiku and is its data controller. Supabase provides authentication and database services. Production data is hosted in London; the separate developer environment is in the US. Kiku Beta and normal Kiku share Production accounts and learning data.
Resend delivers account emails and processes recipient addresses and message contents. Encrypted database backups are stored privately in Google Drive.
Apple and Google provide sign-in and process store payments; Kiku does not receive full card details. Google Cloud Storage serves learning media. For AI-assisted marking, OpenAI receives submitted text, learning context and a hashed account identifier for abuse monitoring. AI marking is a core learning feature. Your email and sign-in credentials are not included in this request. Answers and feedback are stored in Kiku's learning history. Kiku disables OpenAI Responses storage; OpenAI's separate abuse-monitoring retention may still apply.
Google AdMob and its advertising partners may process device identifiers, approximate location and ad interactions and diagnostics for advertising, measurement and fraud prevention. Dev and Beta use test ads. Available consent choices can be changed in Your data → Advertising privacy options. We do not sell your personal data.
4. Data security
We use encrypted network connections, database access controls and restricted administrative access. No system can guarantee complete security.
5. Your rights
You can export the included account and learning data, clear progress or delete your account under Your data in the app, or request deletion on this website. Exports do not include every individual lesson attempt. Apple-linked accounts require fresh Apple confirmation.
Depending on applicable law, you may request access, correction, deletion, restriction or portability by emailing privacy@kiku.email. You may object to processing based on legitimate interests and withdraw consent where processing relies on it. You can complain to the UK ICO or your local data-protection authority.
6. Retention
Account and learning data is kept while your account is active. Deletion removes your authentication account, active learning data, preferences and account-owned files. Limited billing records are separated from your former account using a random identifier and reviewed for retention after 24 months; legal requirements or unresolved disputes may require longer retention. A hash of the erased account identifier is kept to prevent old access tokens from recreating deleted data.
Provider security logs and backups follow their applicable retention schedules; deleting active data does not instantly erase those copies. Deleting an account in Beta also deletes it from normal Kiku. Deletion does not cancel store subscriptions; cancel those separately through Apple or Google Play.
7. International compliance
Providers may process data outside the UK, including in the US. Their applicable data-processing terms describe transfer safeguards; contact us for information about safeguards relevant to your data. See the privacy information for Supabase, Google, Apple, Resend and OpenAI.
8. Contact
Questions or concerns? Email privacy@kiku.email.
Changes to this policy
We may update this page when our practices change. Where consent is required, continued use does not replace that consent.
Effective date: 1 October 2026