Privacy Policy

Effective date: July 29, 2026 · Last updated: October 21, 2026

1. Who we are

Fude ("Fude", "we", "us") is an app for learning to write Japanese kana (hiragana and katakana) stroke by stroke. The data controller responsible for your information is Karim Ghezali. Contact: hello@fudejapanese.com. Website: https://fudejapanese.com. If you are in the EU/EEA and have questions about your data, contact us at the address above.

2. Our approach to your data

Fude is built to be local-first. Fude does not require an account. You do not create a username or password, and we do not ask for your name or email to use the app. Your learning progress and settings are stored locally on your device, not on our servers. We collect the minimum needed to make the app work, keep it stable, and understand how the app is used so we can improve it. The online services Fude uses — for analytics if you opt in, crash reporting and app updates — receive only the categories of data described in this policy, which include random identifiers and, as with any internet connection, your IP address, but never your name, email or an account.

Fude shows no advertising, uses no advertising identifiers (such as Apple's IDFA), does not track you across other companies' apps and websites, and does not display Apple's App Tracking Transparency permission prompt.

3. What data is processed, and where

a) Local learning data, settings and reminders

Learning progress (which kana you have practised, your fading level per character, review state, completion history) and settings, including your reminder configuration, are stored and used locally on your device. Reminders are scheduled as local notifications by your device; Fude does not use a remote push-notification service to deliver them. If you have opted in to analytics, the reminder-related analytics events described in section 3(b) may also be sent.

On Android, Fude opts out of Android's automatic backup of app data to your Google account. On iOS, the app storage that holds your learning progress and settings is excluded from device backups.

b) Usage analytics (PostHog)

Analytics are off by default and consent-gated: nothing is collected — the analytics client is not even created — until you opt in, and you can opt out again at any time in Settings. If you write during onboarding, that attempt's scores are held in memory on your device until you answer; they are sent only if you accept, and discarded otherwise.

When enabled, the app sends one event per practice attempt, so we can calibrate the handwriting recognition: the character practised and its codepoint, the practice group, mode and fading level; whether the attempt was accepted, which check failed if not, and the recognition scores and thresholds the engine compared — overall and per individual stroke (shape, direction, curvature, proportion, position), with each stroke's pass/fail status; counters and timing: attempt number, strokes drawn versus expected, duration, whether a hint was used, and whether it was your first attempt at that character.

We also send an event when a character is abandoned after repeated failures. In test versions of the app, such as TestFlight or Google Play testing builds, you can flag an attempt you believe was judged wrongly, which re-sends the same values marked as disputed.

If you have opted in to analytics, the app also sends events about how you move through it: when it is opened, when you finish onboarding, when a practice session starts, ends or is left early, when a character is skipped, when the hint is tapped, when the word list is opened, when a reading practice starts or is completed, when the paywall is shown or closed, when a kana is mastered or the course is finished, and when a purchase or restore is started and its outcome. These carry only counts, labels and the random identifiers described below — which kana group, how many cards, how many kana you have learned so far, whether a hint was used, which stroke it revealed, where the word list was opened from and how many words it shows, the reading mode, number of questions and score, whether the full content is unlocked, whether a purchase succeeded. Several carry nothing at all. If you use reminders, the app also sends events when a reminder is offered or dismissed, when notification permission is requested and what the result was, when reminders are turned on or off, when the reminder time is changed, when a reminder is scheduled, and when you open a reminder. Depending on the event, these include where the choice was made (after a session, in Settings or during onboarding), the notification permission status, whether it is a daily or a streak reminder, the reminder hour and minute you chose, your current streak count for a streak reminder, and the app's language and build number. They never include a notification identifier or a scheduled date.

The paywall and purchase events can include additional fields so we can check that the price you are shown is the right one for your store: the country of the app store your prices come from (the Apple App Store or Google Play), the currency code, and whether the price was loaded from that store or failed to load. For a completed purchase we may also receive which product was bought and the price you were shown. All of this is taken from the store itself. It describes the store you buy from — usually, but not necessarily, the country you live in — and it is never derived from your IP address or from your device location.

Analytics events also carry technical details, so we can tell one build or platform apart from another when something behaves differently. These include the app version and build number, the operating system name and version, whether the device is a phone or a desktop, the device language, the screen width and height, the name and version of the analytics library, timestamps, and random identifiers for each event, for each app session and, where relevant, for a practice session or purchase attempt. When analytics is on, the analytics library also retrieves its configuration from PostHog, using the identifier described below and some of these technical details. Before anything is sent, Fude removes other device details the analytics library would otherwise attach — your device model and device name, its manufacturer, your time zone, and whether the app is running on a simulator — and asks PostHog not to derive a location from your IP address. Those device details never leave your device.

Your handwriting never leaves your device. Only numbers and pass/fail results are sent — no stroke coordinates, no traces, no images, nothing from which your writing could be reconstructed.

Analytics data is linked to a random identifier, created on your device by the analytics library when you first turn analytics on — not when you first open the app. It stays the same across app launches, and turning analytics off and back on does not reset it; it is removed when you uninstall Fude, although on iOS it may be restored if you restore your device from a backup. It is never your name, email, or a Fude account. Fude does not pass it to the crash reporting described below, which uses a separate identifier of its own, and Fude never builds a profile of you from it. It is hosted in the European Union, is not used to track you across other apps or websites, and is never sold. Fude contains no advertising or attribution software of any kind.

This website uses no analytics, tracking scripts or advertising pixels. Its web fonts are hosted on Fude's own website, not loaded from Google Fonts.

c) Crash and error reporting (Sentry)

To keep the app stable, we use Sentry to collect crash and error diagnostics from the app, stored in the European Union. Crash reporting is on by default: it starts the first time you open Fude, before any choice is offered. Crash reports contain technical information (error details, app and build version, device and OS details such as model, language and time zone, and app state at the time of the crash) and are linked to a random identifier created on your device by the crash-reporting library; they do not include your name, email or an account. The app also reports when it becomes unresponsive or is terminated by the system, so we can identify and fix these problems. You can turn crash reporting off in Settings. If it is off when Fude starts, the crash handler is not started. If you turn it off while the app is running, Fude immediately stops sending new reports from the app and asks the crash handler to shut down; a report already in progress may still finish during that brief shutdown. From the next time you open Fude, the handler stays fully off.

d) Purchases (Apple and Google)

Fude offers a free tier and a one-time in-app purchase to unlock full content. Depending on your device, purchases are processed by Apple through the App Store or by Google through Google Play Billing. We do not receive or store your payment details. We may receive anonymised, aggregate purchase information from Apple or Google, never your payment method or identity.

e) App updates (Expo)

When Fude starts, it automatically checks Expo's update service for an update to the app's code, and downloads it if one is available, so fixes can be delivered without a new store release. This check does not depend on your analytics or crash reporting choices. It can send technical update information, such as the platform (iOS or Android), version information for the app and its installed update, identifiers of the current and built-in updates, diagnostic information about an update or app start that recently failed, if any, and a random installation identifier created by the update component on your device. As with any internet connection, Expo's servers also receive your IP address. The update check does not include your learning progress, settings, handwriting or analytics identifier.

4. Legal bases (GDPR)

For users in the EU/EEA, we rely on: consent (for usage analytics — you can withdraw at any time); legitimate interests (for crash/error diagnostics needed to keep the app secure and functioning); and performance of a service (to provide the learning features you request).

5. Who we share data with

We do not sell your data. PostHog (EU) processes the analytics events described above, Sentry (EU) processes crash diagnostics, and Expo provides the app update service described in section 3(e). Data sent to these services is limited to the categories described in this policy. Fude for iOS is available through the Apple App Store in supported regions, and Fude for Android is available through Google Play in supported regions; in-app purchases are handled by Apple or Google depending on your device. Apple and Google operate these stores and payment services under their own terms and privacy policies; we do not send them your learning progress or settings.

6. International transfers

We host analytics and diagnostics in the European Union. Where any provider processes data outside the EU/EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

7. Data retention

On-device data (progress, settings) is kept until you uninstall the app. "Reset my progress" in Settings erases your learning progress, including your streak and the words you have seen; your settings, purchase status and privacy choices are kept. Analytics and crash data are retained only as long as needed for the purposes above, in line with our providers' standard retention periods, then deleted or anonymised.

8. Your rights

Subject to applicable law (including the GDPR), you have the right to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability. Because most of your data is stored on your device, you can exercise much of this directly: uninstall the app to remove local data. For analytics, crash reporting or app update data, you can request deletion as described in section 9. You may also lodge a complaint with your local data protection authority (in France, the CNIL).

9. Data Deletion Requests

Fude does not require users to create an account.

You may request deletion of personal or pseudonymous data associated with your use of Fude, such as analytics, crash reporting or app update data linked to the random identifiers described in section 3, by contacting hello@fudejapanese.com.

Please provide enough information for us to reasonably identify the relevant data where possible. Some anonymous or aggregated data may not be technically attributable to an individual user and therefore may not be identifiable for deletion.

Learning progress and settings stored only on your device are not held by us. You can remove them by uninstalling the app, and you can erase your learning progress at any time with "Reset my progress" in Settings.

We will process valid deletion requests in accordance with applicable data protection laws.

10. Children

Fude is suitable for learners of all ages but is not directed to children under 16, and we do not knowingly collect data from them. The analytics and crash data described above do not include names, email addresses or accounts; they are linked only to the random identifiers described above. If you believe a child's data has been collected in error, contact us.

11. Security

We use reputable providers and reasonable technical measures to protect data. No method of transmission or storage is completely secure, but keeping your learning data on your device by default reduces exposure.

12. Third-party content

Fude uses stroke-order data from KanjiVG (© Ulrich Apel), licensed under CC BY-SA 3.0. This is embedded reference data and does not involve any collection of your information. The derived stroke data we use is published separately under CC BY-SA 3.0 at https://github.com/karimghezali/fude-kana-data.

13. Changes to this policy

We may update this policy as the app evolves. We will post the updated version here and change the "Last updated" date. Material changes will be communicated in-app where appropriate.

14. Contact

Questions about privacy: hello@fudejapanese.com