Legal

Privacy Policy

Last updated 9 October 2026

This policy explains how personal data is collected and used in the HeyShima mobile application and at heyshima.com (together, "the Service"), the lawful basis for each purpose, how long data is kept, who receives it, and the rights available to you.

1. Who is responsible for your data

The controller of the personal data described in this policy is Kazuya Yemi Kai-Olowu, a sole trader established in the United Kingdom and trading as HeyShima, of Prime Apartments, 483 Green Lanes, London N13 4FG, United Kingdom ("we", "us", "our").

Questions about this policy, and requests to exercise the rights in section 6, may be sent to privacy@heyshima.com.

2. What we collect, why, and on what basis

We process the categories of personal data set out below. Each states the purpose, the lawful basis under the UK GDPR and the EU GDPR, and how long the data is kept.

2.1 Use without an account

  • Learning progress and setup answers are stored on your device. While you remain signed out these are not transmitted to us, and we do not process them as a controller.
  • Setup answers given during onboarding, being your experience level, your goal, a study target, and how you heard about the Service, are used to configure the course. These questions are optional.

2.2 Account data

  • Data: your email address; where you sign in with Apple or Google, the account identifier returned by that provider; and any username you choose. If Apple or Google sends your name or profile photo when you sign in, it is discarded and not stored.
  • Purpose: to authenticate you and to synchronise your learning record across your devices.
  • Lawful basis: performance of a contract (Article 6(1)(b)), being the Terms of Use accepted when you create an account.
  • Retention: while your account exists. On deletion, see section 5.

2.3 Learning record

  • Data: completed lessons, test and mock-exam results, your daily streak, your review schedule, and any flashcard decks you create.
  • Purpose: to provide the Service, including spaced repetition and progress reporting, and to carry your progress between devices.
  • Lawful basis: performance of a contract (Article 6(1)(b)).
  • Retention: while your account exists. On deletion these records are retained in de-identified form as described in section 5.

2.4 Product events and session recordings

  • Data: a defined list of in-app events, being the onboarding step reached, the start, completion or early closure of a lesson, the completion of a review or an exam, and the display of the HeyShima Pro screen. Each event carries a randomly generated identifier for the installation, the application version, the device model, the screen in view, and details of the event itself. Events are not designed to carry free text or your email address. Session recordings capture how the screens are used, including taps, scrolls and screen content; text inputs, being email, password, username, feedback, searches and typed answers, are masked by default and are not intended to appear in a recording.
  • Purpose: to identify where the Service is unclear or failing, and to improve it.
  • Lawful basis: consent (Article 6(1)(a)), given through the notice shown when you first use the Service and withdrawable at any time at Settings › Share usage data. Withdrawal does not affect the lawfulness of processing carried out beforehand.
  • Retention: session recordings are deleted after 30 days. Product events are kept for 24 months from collection. On deletion of your account, see section 5.

2.5 Purchases

  • Data: the purchase receipt issued by Apple, your account identifier, the plan held, and its renewal or expiry date. Payment card details are handled by Apple and are not disclosed to us.
  • Purpose: to make paid content available on each device you sign in to, and to keep a record of the transaction.
  • Lawful basis: performance of a contract (Article 6(1)(b)); and, for records we are required to keep, compliance with a legal obligation (Article 6(1)(c)).
  • Retention: while your account exists, and thereafter for the period required by applicable tax and accounting law.

2.6 Advertising measurement

  • Data: that the application was installed and opened, and that a subscription began or renewed, together with an anonymous identifier generated for this installation by Meta's software development kit. Where you permit tracking, this also includes your device's advertising identifier (the IDFA) and vendor identifier. Data about what you study, and anything you type, is not included.
  • Purpose: to measure which advertising campaigns result in installations and subscriptions.
  • Lawful basis: consent (Article 6(1)(a)). Two separate consents apply and both may be withdrawn. The processing as a whole is governed by the control at section 2.4. The reading of the advertising identifier additionally requires your permission under Apple's App Tracking Transparency framework, which also serves as consent to access information stored on your device for the purposes of regulation 6 of the Privacy and Electronic Communications Regulations 2003.
  • Retention: as determined by Meta for the relevant advertising dataset. We keep no separate copy.
  • Tracking, and what it means: iOS asks you once whether HeyShima may track you across apps and websites owned by other companies. If you allow it, your advertising identifier is included in the measurement above, which enables Meta to connect your activity in this application with your activity on its own services and so to attribute an installation or a subscription to a particular advert. If you decline, the identifier is not read, nothing is sent that Meta can join to you in that way, and campaign measurement relies instead on Apple's SKAdNetwork and on Meta's Aggregated Event Measurement, both of which report in aggregate and identify no individual.
  • Changing your answer: at any time, in iOS Settings under Privacy & Security › Tracking. Withdrawal takes effect immediately and does not affect the lawfulness of processing carried out beforehand.

2.7 The website (heyshima.com)

This section covers heyshima.com only. The cookie banner on the website lets you accept or reject each category of cookie separately, and you may change your choice at any time through the cookie settings link shown on every page.

  • Waitlist, data: the email address you enter; the answers you choose to give to the optional questions that follow, being why you are learning Japanese, where you are starting from, whether you would like to be an early tester, and any suggestion you write; and the campaign tags (utm_source, utm_medium and utm_campaign) carried in the link that brought you to the website, if any.
  • Waitlist, purpose: to tell you when HeyShima launches and to send you news about the application, and to understand which campaigns bring people to the waitlist.
  • Waitlist, lawful basis: consent (Article 6(1)(a)), given when you submit the form. You may withdraw it at any time by writing to the address in section 1. Withdrawal does not affect the lawfulness of processing carried out beforehand.
  • Waitlist, retention: until 12 months after the application launches, or sooner if you withdraw consent. We then delete it unless you have created an account.
  • Cheat sheets, data: when you ask for a free cheat sheet on the website, the email address you enter and which cheat sheet you asked for. That form also joins you to the waitlist, so everything above about the waitlist applies to it too.
  • Cheat sheets, purpose and basis: to email you the cheat sheet you asked for. We send it once, relying on your consent (Article 6(1)(a)) given when you submit the form, and we record which cheat sheet you asked for alongside your waitlist entry, for the same period as the waitlist.
  • JLPT registration alert: if you tick the box on the JLPT N5 checklist form, we record that you asked, alongside your waitlist entry, and send you one email when registration opens for the July 2027 JLPT at UK test centres. We rely on your consent (Article 6(1)(a)), given by ticking the box. After that email, we stop using the record for this.
  • Google Analytics, data: the pages you visit, how you arrived, the fact that you joined the waitlist and, if you asked for one, which cheat sheet and whether you ticked the JLPT registration alert, a summary of your answers to its questions (the broad reason you are learning and whether you would like to be an early tester, but not anything you write), and the identifiers Google Analytics sets or reads in your browser.
  • Google Analytics, purpose and basis: to understand how the website is used and to improve it. These cookies are set only if you accept the Analytics category in the cookie banner, which is your consent both under Article 6(1)(a) and for the purposes of regulation 6 of the Privacy and Electronic Communications Regulations 2003.
  • Meta pixel, data: the pages you visit, and the fact that you joined the waitlist and, if you asked for one, which cheat sheet, together with the identifiers the pixel sets or reads in your browser and the technical information your browser sends with any web request, such as your IP address and browser type. Your email address and your answers to the waitlist questions are not sent to Meta.
  • Meta pixel, purpose: to measure and improve our advertising on Facebook and Instagram, including which adverts lead people to join the waitlist.
  • Meta pixel, lawful basis: consent (Article 6(1)(a)), and consent under regulation 6 of the Privacy and Electronic Communications Regulations 2003 for the cookies and similar technologies the pixel uses. The pixel does not load at all unless you accept the Advertisement category in the cookie banner.
  • Meta pixel, recipient: Meta Platforms Ireland Limited. In respect of this data Meta determines its own purposes and means and acts as an independent controller, as at section 2.6, and its own privacy policy governs that processing.
  • Meta pixel, retention: as determined by Meta for the relevant advertising dataset. We keep no separate copy.
  • Withdrawing consent: open the cookie settings link and switch off the Analytics or Advertisement category. Withdrawal takes effect from that point and does not affect the lawfulness of processing carried out beforehand.

2.8 Feedback you send

  • Data: the message you write; your account email address or, if you are signed out, the per-installation identifier; your IP address; and diagnostic details, being application version, device model and operating system, language, region, time zone, the screen in view, and your active course.
  • Purpose: to investigate and respond to the issue reported.
  • Lawful basis: legitimate interests (Article 6(1)(f)), being our interest in diagnosing and correcting faults. You may object under section 6.
  • Retention: 24 months from receipt. Where you delete your account, the email address and IP address are removed from feedback previously sent.

2.9 Data we do not collect

The Service does not collect location data, contacts, photographs or biometric data. It reads no device identifier other than those described at section 2.6, and reads the advertising identifier only with your permission.

3. Who receives your data

We use the providers below. Each acts as our processor under a written agreement, except where stated otherwise.

  • Supabase (Supabase, Inc.) hosts account, progress and profile data, subject to row-level access controls designed so that a signed-in user can read and write only their own records.
  • PostHog (PostHog, Inc.) processes product events and session recordings on infrastructure located in the European Union.
  • RevenueCat (RevenueCat, Inc.) processes purchase records and transmits the subscription events described at section 2.6 to Meta.
  • Meta Platforms Ireland Limited receives the advertising measurement data described at section 2.6 and, where you accept advertising cookies on the website, the data collected by the Meta pixel described at section 2.7. In respect of that data Meta determines its own purposes and means and acts as an independent controller, and its own privacy policy governs that processing.
  • Google (Google Ireland Limited and Google LLC) provides Google Analytics on the website and processes the data described at section 2.7 where you accept analytics cookies.
  • Discord (Discord, Inc.) receives in-app feedback messages, delivered to a private workspace accessible only to our team.
  • Cloudflare (Cloudflare, Inc.) hosts heyshima.com and runs the server code behind its forms, so it processes the requests your browser makes to the website, including your IP address and anything you submit, such as your email address. It also provides the "verify you are human" check on the website's forms, which assesses signals from your browser and device, and it forwards email sent to our heyshima.com addresses to our inbox. To limit abuse of the forms, a short-lived count of requests is kept against your IP address for a few minutes, and a one-way hash of your email address is kept for up to 24 hours after we send you a cheat sheet, so that the same one is not sent again.
  • Resend (Plus Five Five, Inc.) sends our emails: the sign-in and account emails from the application, the cheat sheets requested on the website, and the JLPT registration alert if you asked for it. It processes your email address and the content of those emails in order to deliver them.

We do not sell personal data, and we do not share it for third-party advertising beyond the measurement described at sections 2.6 and 2.7.

4. International transfers

Supabase, Inc., PostHog, Inc., RevenueCat, Inc., Discord, Inc., Cloudflare, Inc. and Plus Five Five, Inc. (Resend) are established in the United States. Where personal data is transferred outside the United Kingdom or the European Economic Area, the transfer is made under the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, or another mechanism permitted by Article 46, and is subject to a transfer risk assessment. A copy of the relevant safeguards may be requested at the address in section 1.

5. Deletion of your account

You may delete your account at any time in the application, at Profile › Settings › Change account details › Delete account. Deletion cannot be reversed.

On deletion, your authentication record, email address, sign-in identities, profile and review schedule are deleted. Your study records, being which items were studied and when, together with your stated goal, are retained with the link to your account removed, so that they no longer identify you. Feedback previously sent is retained with the email address and IP address removed.

Product events and session recordings linked to your account are also deleted. We request their deletion from PostHog within a few hours of your account being deleted, and PostHog completes it within 8 days. Events recorded before you signed in that were never linked to your account cannot be associated with you and are kept for the period at section 2.4.

RevenueCat retains the record of purchases made with your account, together with the identifiers sent to it for advertising measurement described at section 2.6, for as long as required for refunds, tax and accounting. That record holds no name or email address.

Deleted data may persist in routine encrypted backups for up to 30 days, after which those backups expire. A session already issued to a signed-in device may remain valid for a short period after deletion until it expires. Deleting your account does not cancel a subscription bought through Apple; subscriptions are cancelled in your Apple account settings.

Deletion may also be requested at the address in section 1, and will be actioned within one month of receipt in accordance with Article 12(3).

6. Your rights

Subject to the conditions set out in the UK GDPR and the EU GDPR, you have the right to:

  • obtain confirmation of whether we process your personal data, and a copy of it (Article 15);
  • have inaccurate personal data corrected (Article 16);
  • have personal data erased (Article 17);
  • restrict processing in the circumstances set out at Article 18;
  • receive personal data you provided to us in a portable format, and have it transmitted to another controller (Article 20);
  • object to processing carried out on the basis of our legitimate interests (Article 21); and
  • withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal (Article 7(3)).

Requests may be sent to privacy@heyshima.com and will be answered within one month. That period may be extended by two further months where a request is complex, in which case we will tell you within the first month.

If you consider that your data has been handled unlawfully you may complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF (ico.org.uk), or to the supervisory authority of the EU member state in which you live. We ask that you raise the matter with us first.

7. Children

The Service is intended for users aged 13 and over, or 16 and over in any country where 16 is the age of consent for information society services. It is not directed at younger children and we do not knowingly collect their personal data. If you believe that a child below the applicable age has created an account, contact privacy@heyshima.com and the account and the data held with it will be deleted.

8. Security

We maintain technical and organisational measures appropriate to the risk, including encryption of data in transit, row-level access controls on stored records, storage of authentication tokens in the operating system keychain, and restricted administrative access. No method of transmission or storage is completely secure, and we do not warrant that the Service will be free from unauthorised access.

9. Automated decision-making

We do not carry out automated decision-making that produces legal effects concerning you, or that similarly significantly affects you, within the meaning of Article 22.

10. Changes to this policy

We may amend this policy. The date at the head of this page records when it was last amended. Where a change materially affects how your personal data is used, notice will be given in the application before the change takes effect, and where the change relies on your consent, that consent will be sought again.