Privacy Policy — Jaju
Last updated: 10 November 2026
This policy explains what the Jaju app ("Jaju", "the app") and its website do with your data. Jaju is made by Niklas Angert, an individual developer ("I", "me"). Questions and requests: jajuhelp@gmail.com.
What Jaju stores about you
Your account
- Your email address and a user ID, from signing up with email and password, with Google, or with Apple (on iPhone and iPad). If you hide your email when signing in with Apple, Jaju gets an address at privaterelay.appleid.com that Apple forwards to you.
- The display name you choose (it starts as the name from your Google or Apple account or the part of your email before the @).
Your learning
- The decks and cards you create or import, including example sentences.
- Every answer you give: which card, when, how you rated it, how long it took, and, in typing and listening practice, the text you typed.
- Your practice sessions, daily goal, streak, XP, level and badges, and your learning settings.
- Your sentence sheets: the sentences, your answers and their grades.
- Whether you allowed Jaju to share with OpenAI, and since when.
- A record of each AI request: when it was made and whether it ran on Jaju's OpenAI account or your ChatGPT plan, and on Jaju's account which feature it was for, how many tokens (the units OpenAI counts text in) it used and what it cost. It holds nothing you sent or got back. It keeps each account within its daily allowance, and I look at these records to keep track of what Jaju's AI costs.
Reports and blocks
- The people you block.
- The reports you send: who or which card you reported, the reason and the details you wrote.
- Reports about you: your display name and, for a card, its text and its deck's name, as they were when the report was sent. Only I read reports, to act on them.
Kept only on your phone
- Your daily reminder settings, theme and per-deck preferences.
- The sign-in tokens for ChatGPT, if you connect it, in the phone's secure storage. Each AI request carries the access token to Jaju's server, which passes it on to OpenAI and does not keep it.
- The photo of a handwritten sentence sheet: the phone reads its text itself, and only that text is used.
Jaju contains no advertising and no tracking, and does not use your advertising ID. It measures two things: crashes, through Firebase Crashlytics (below), meaning when the app crashes or hits a fault and how often it runs without one; and each AI request, in the record described above.
Who processes it
| Service | What it receives | Why | Where |
|---|---|---|---|
| Firebase Authentication (Google) | Email, password, user ID, IP address | Signing in | United States |
| Google Sign-In (Google) | Your Google sign-in, which gives Jaju your Google account's email and name | Signing in with Google, if you choose it | United States |
| Sign in with Apple (Apple) | Your Apple sign-in, which gives Jaju your name and your email address, or the forwarding address Apple makes for Jaju if you hide yours | Signing in with Apple, if you choose it | Ireland |
| Supabase | Your account details and learning data listed above; your IP address and its approximate location (city and network), which Supabase's request logs keep for up to 7 days; the content of each AI request and, if you connected ChatGPT, its access token, on their way to OpenAI | Storing and syncing your decks and progress across your devices; passing AI requests to OpenAI | European Union (Frankfurt) |
| Firebase Crashlytics (Google) | When the app crashes or hits a fault: the kind of error and where in Jaju's code it happened, what the app was doing (starting, syncing or an AI request), the app's state at that moment, and the phone's model and operating system. Each time the app starts: the app's version, the phone's model and operating system, and how long the app stays open. A random ID for this installation of the app. Never your decks, cards, answers, sign-in details or the text of an error message | Finding and fixing crashes and faults in the app | United States and other countries |
| OpenAI | Only when you use an AI feature: the word and meaning of a card you ask examples for; the photo of a word list you scan; the sentence you write in a writing drill when it does not match the stored answer; for sentence sheets, the words you have studied in the deck, your answers, and the text the phone read from your sheet's photo | Generating example sentences and sentence sheets, reading scanned word lists, grading written sentences and sheets | United States |
Before an AI feature first sends anything, Jaju asks whether it may share with OpenAI. Turning off Profile → AI features withdraws this on all your devices, and no AI feature sends anything after that. AI features send OpenAI only what is listed above, and only when you use them. If you connect your ChatGPT Plus or Pro plan in the app, through OpenAI's own sign-in, the requests run on your plan; otherwise they run on Jaju's own OpenAI account, within a daily allowance. Disconnecting ChatGPT only changes which of the two pays. Your email and name are not sent. Jaju asks OpenAI not to store these requests, and Jaju's server does not keep them, only the record of each request described above.
I do not sell your data or share it with anyone else.
What other users can see
The leaderboard: other signed-in users see your display name and level, your XP, how many words you have met and mastered, your current streak and how many of the last 30 days you practised, and your XP and new words for this week and last week. Turning off Settings → Show me on the leaderboard removes you from it at once.
Nobody is told who reported them or who blocked them. Someone who blocks you no longer sees you on the leaderboard or your public decks.
The app also contains public decks (a deck you choose to share, with your display name), but they are switched off. If they are switched on, this policy will be updated first.
How your data is protected
All traffic between the app and these services is encrypted (HTTPS). On the server, the database itself limits each account to its own data. As the developer, I can access the data to run and support the app, and I count from it, across all accounts, how many learners keep practising and how many use each feature.
How long it is kept, and how to delete it
Your data is kept as long as you have an account, except the records of your AI requests, which are deleted once they are 90 days old, by a job the server runs every day. Crash reports are kept for 90 days and are not linked to your account. A copy of the server's database is made every day on my own computer, whose disk is encrypted, and each copy is deleted after 14 days; after you delete your account, your data is in these copies for up to 14 more days.
Delete your account in the app: Profile → Delete Account. After you confirm with your password (or a fresh Google or Apple sign-in), Jaju immediately deletes your profile, decks, cards, answers, sessions and progress from the server, removes them from your phone, disconnects ChatGPT, ends its access to your Apple ID if you signed in with Apple, and deletes your sign-in account. The reports you sent stay, without the link to your account; your blocks and reports about you are deleted. The records of your AI requests lose their link to your account and are still deleted once they are 90 days old, as described above. Google removes the sign-in account from its backup systems within 180 days. Another phone that was signed in to the account keeps its copy until someone signs in on it, and then removes it first.
Without the app: email jajuhelp@gmail.com from the address you signed up with, and your account will be deleted within 30 days.
Signing out removes your data from that phone only. What reached the server stays there for your next sign-in; changes that have not reached it yet are removed from the phone, and the app says how many before you sign out.
The website
The website jaju.app counts visits with Cloudflare Web Analytics. For each page you open, your browser sends Cloudflare the page's address without anything after a "?", the page that led you there, your browser, operating system and device type, and how fast the page loaded; Cloudflare works out your country from your IP address. It sets no cookies and stores nothing in your browser, so it cannot recognise you on a later visit. It tells me how many people visit and where they come from. Cloudflare keeps these counts for six months, in the United States and other countries.
Your rights
You can ask for a copy of your data, have it corrected or deleted, or object to its use, by writing to jajuhelp@gmail.com. If you live in the EU, you can also complain to your data protection authority.
Children
Jaju is not directed at children under 13, and I do not knowingly collect data from them. If you believe a child has given Jaju personal data, write to jajuhelp@gmail.com and it will be deleted.
Changes
If this policy changes, the new version will be posted on this page with a new date.