What personal data we process when you visit gosekai.app or use the GoSekai app, why, for how long, and your rights under the EU General Data Protection Regulation (GDPR).
In short: the site sets no cookies and runs no analytics or tracking in your browser. Our server counts visits that arrive through our tagged links, and if you join the launch list, we note which link brought you, your country and your browser’s language. Learning in the app needs a free account, and your learning syncs with our server so it is safe on all your phones. We use no advertising, no advertising ID and no analytics, and we never sell data.
1. Who is responsible
The controller is:
Alexander SchmidtRömerstraße 63, 47249 Duisburg, Germany
Email: support@gosekai.app · contact form
We have not appointed a data protection officer because the law does not require one for a service of our size. Write to us with any privacy question or request.
2. Visiting gosekai.app
When you open the site, your browser sends technical data that our host needs to deliver the page: your IP address, the date and time, the page requested, the referring page, and your browser and device type. Our host keeps this in short-lived server logs for security and error analysis. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).
Some of our links carry a tag that says where we posted them, such as gosekai.app/?ref=tiktok. When you open the site through one, our server adds one to the count for that tag, together with the page and the country our host derives from your connection. The count holds nothing else about you: no IP address, no cookie and no browser details, and nothing is stored on or read from your device for it. We only look at the totals per tag, to see which of our posts and channels bring visitors. Cloudflare, our host, keeps the counts for three months. Legal basis: our legitimate interest in knowing which channels reach people (Art. 6(1)(f) GDPR).
The site sets no cookies and runs no analytics or tracking in your browser. Its fonts are served from gosekai.app itself, so your browser doesn’t contact a font service. If you switch between light and dark mode, that choice is saved in your browser’s local storage so the page looks the way you chose. It never leaves your device (§ 25(2) No. 2 TDDDG).
3. The launch list
If you enter your email to hear when GoSekai launches, we store the address, the phone you picked (Android or iPhone), the time of signup and the version of the consent text, and send you one email with a link to confirm that the address is yours (double opt-in). GoSekai launches on Android first and on iPhone later. Each confirmed address gets one email, when GoSekai launches on the phone picked. If you signed up before 10 October 2026, when the form didn’t ask yet, that is the Android launch. To change your pick, write to support@gosekai.app. We store when you confirmed, and delete addresses that aren’t confirmed within 7 days of the confirmation email. We use the address only for this. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future by writing to support@gosekai.app. Every launch email will also contain an unsubscribe link.
We also note where your signup came from, so we can see which of our posts and channels reach people: the tag of the link you followed to gosekai.app, if it had one (such as gosekai.app/?ref=tiktok), the country our host derives from your connection, and the first language your browser asks for (such as en-US). Your IP address itself is not stored with your signup. We keep these with your address and delete them with it, and we only look at them as totals, such as how many signups one link brought. Legal basis: our legitimate interest in knowing which channels reach people interested in GoSekai (Art. 6(1)(f) GDPR).
To stop abuse of the form, we also record a one-way keyed hash of your IP address with the time of the attempt. It can’t be turned back into your IP address, is used only to limit repeated attempts, and is deleted after one day (Art. 6(1)(f) GDPR).
We delete your address once the launch email for your phone has been sent, and in any case no later than 24 months after you signed up. The launch list is for people aged 16 or over.
4. The beta
If you sign up at gosekai.app/beta to test GoSekai before its launch, we store your email address, the time of signup and the version of the consent text, and send you one email with a link to confirm that the address is yours (double opt-in). When you confirm, we store the time, give you a place in the beta and send you one email with the steps to join and to turn on beta Premium. As with the launch list, we also note the tag of the link you followed, the country our host derives from your connection and your browser’s first language, but never your IP address. We use the address only to run the beta: for these emails, to answer you, and to write to you about the beta while it runs. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future by writing to support@gosekai.app. The beta signup is separate from the launch list.
Beta Premium turns on in the app, for the GoSekai account that signs in with the email address of your beta signup. When you tap “Activate beta Premium”, and then quietly at most once a day while the test runs, the app asks Google Play to confirm that it is the unmodified GoSekai app from Google Play on a genuine Android phone (Google’s Play Integrity service). Google makes this check on your phone under its own terms and sends our server only the result. We use it only to decide on beta Premium, and of it we keep only the app version. With your beta signup we store the account it is linked to, the day you turned on beta Premium, the day of the latest check and the app version. We use them to keep beta Premium on during the test, to show testers how far the group is towards Google Play’s 14 days (as a count, never with names or addresses), and to give Premium for life on launch day to testers who are still testing on the newest beta version. Beta Premium itself belongs to your account like any other gift (section 8, “Premium, gifts and invites”). Legal basis: providing the beta Premium you asked for (Art. 6(1)(b) GDPR) and our legitimate interest in giving it only to real testers (Art. 6(1)(f) GDPR).
Testers who confirmed before beta Premium moved into the app got a gift code for Premium instead. It is stored only as a one-way hash, and once redeemed it belongs to the GoSekai account like any other gift.
To join the test on Google Play, you also join our Google Group for the beta and become a tester with your Google account. Google processes this under its own terms and privacy policy. As the group’s manager, we see the email addresses of its members.
The same protection against abuse applies as for the launch list: a one-way keyed hash of your IP address with the time of the attempt, deleted after one day (Art. 6(1)(f) GDPR). Addresses that aren’t confirmed within 7 days of the confirmation email are deleted. We delete the beta signups, with the account link, the days and the app version above, when the test ends, and in any case no later than 12 months after you signed up, and a signup is deleted together with a GoSekai account that uses the same address. The beta is for people aged 16 or over.
5. Contacting us
If you use the contact form, we receive your email address, your message and the time it was sent, as an email in our inbox. We use them only to answer you. If you email us directly, the same applies to your message and address. Legal basis: taking steps you ask for or answering questions about a contract with you (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering your enquiry (Art. 6(1)(f) GDPR). We keep the correspondence as long as needed for your request, and longer only where the law requires us to keep business letters.
To limit repeated messages, the server briefly keeps a keyed hash of your IP address in memory. It is not stored.
6. The security check on our forms
To keep bots off the launch list, the beta signup and the contact form, they use Cloudflare Turnstile. It loads only once you start on a form, so visitors who don’t fill one in never contact it. Cloudflare checks your browser and device, which involves technical data such as your IP address, and gives the form a one-time result that our server confirms with Cloudflare before going on. Most people never see it. Sometimes it asks you to tick a box. Turnstile sets no advertising cookies. Legal basis: our legitimate interest in keeping our forms free of automated abuse (Art. 6(1)(f) GDPR). The check is needed for the form you choose to send (§ 25(2) No. 2 TDDDG).
7. Our social media profiles
GoSekai has profiles on TikTok, Instagram, YouTube, X, Twitch, Reddit (r/GoSekai) and Discord. When you visit, follow, comment on or message one of them, the platform processes your data under its own privacy policy, as its own controller. We don’t control what a platform collects, which can include how you use it.
We see what you share with us there: your profile name and picture, your comments, reactions and messages. The platforms also give us statistics that don’t name anyone, such as how many people saw a post and in which countries. We use this to answer you, to look after our community and to see which posts work. Legal basis: our legitimate interest in presenting GoSekai and talking with people interested in it (Art. 6(1)(f) GDPR), or, when you ask us about using the app or a purchase, Art. 6(1)(b) GDPR. We keep messages as long as we need them to answer you.
For the statistics Meta provides about our Instagram account, Meta and we can be jointly responsible (Art. 26 GDPR). Meta has agreed to take primary responsibility for this processing and for answering your requests about it, as set out in Meta’s controller addendum. You can still write to us.
The platforms’ own privacy policies: TikTok, Instagram, YouTube (Google), X, Twitch, Reddit and Discord. Your rights in section 11 apply to what we process, and you can also contact a platform directly about what it processes.
8. The GoSekai app
The app for Android is available on Google Play. Google processes data about your download and your Google account under its own privacy policy. This section covers what the app itself does.
Your account
The app needs an account. For it we process your email address, a hash of your password (never the password itself), your sign-in sessions and when the account was created. We send you codes by email to confirm your address, reset your password or confirm a deletion. Once you’re signed in, your learning syncs with our server so it is safe and available on your other phones: the words and episodes you study, your answers and their timing, review schedules, words you mark as known or skipped, and the optional reflections, motivations and word reports you choose to enter. The first words you practise during the setup, before your account exists, stay on your phone until you create it, and are then added to it. Your sign-in session is kept in Android’s encrypted storage, and the app is excluded from Android backups. Legal basis: providing your account and syncing (Art. 6(1)(b) GDPR).
With Continue with Google, Google tells us your Google account ID, email address, name and the link to your profile picture, and we store them with your account. Legal basis: Art. 6(1)(b) GDPR.
Premium, gifts and invites
Premium is sold through Google Play. Google handles the payment, and we never see your payment details. To check and restore Premium we use RevenueCat, which receives your account ID (or an anonymous ID for this phone), Google Play’s purchase record and order history, subscription dates, trial and billing status, and the phone’s platform, app version and store country. Our server stores until when you have Premium, whether it is a trial, and the trials used, so each account gets one free trial. If you redeem a gift code or turn on beta Premium, we store when and until when it gives Premium. Codes themselves are stored only as hashes. If you use an invite code, we store who invited whom and when, so each friend counts once. For the Premium statistics the app sends the IDs of the words you have practised, and our server answers without storing them. Legal basis: Art. 6(1)(b) GDPR, and our legitimate interest in preventing abuse of trials and rewards (Art. 6(1)(f) GDPR).
Limits against bulk downloading
Our server counts requests per hour for each account and for a keyed hash of your network address, and deletes the counts after 2 days. Your IP address itself is not stored for this. Legal basis: Art. 6(1)(f) GDPR.
Crash reports
When the app crashes or a screen fails, it sends a report to Sentry: the error and where in the code it happened, the screen, recent taps and screen changes, the app version, phone model and Android version. Reports contain no account, no IP address and none of your learning history, and are kept for up to 90 days. Legal basis: our legitimate interest in finding and fixing errors (Art. 6(1)(f) GDPR). You can object at any time by writing to us.
The app also remembers its last 5 errors on your phone. They are added to a support email only if you write to us from Help, and you can see them before you send it.
On your phone only
Reminders are notifications scheduled on your phone, and the app only shows them if you allow notifications. Pronunciation plays a recording of each word, which the app downloads from our server with the episode’s word list, and uses your phone’s own text-to-speech for any word without one. Downloaded word lists and recordings are stored on the phone. The app doesn’t access your location, contacts, camera, microphone, photos or files.
How long we keep app data, and deleting your account
We keep your account and learning data until you delete your account. You can do this in the app under You → Account and sync → Delete account, or by writing to us from your account’s email address, as described on gosekai.app/delete-account. Deleting removes your account, your synced learning, reports and reflections, Premium and gift records, invite links, a launch-list entry with the same email, and your customer record at RevenueCat. It does not cancel a Google Play subscription, so cancel that in Google Play. Google keeps its own purchase records. Backups and the providers’ security logs expire under their own retention periods. The app is for people aged 16 or over.
9. Service providers
We use these providers:
- Supabase Inc. (USA): the database and sign-in service for the launch list, the beta signups, app accounts, synced learning, Premium records and the word lists and recordings the app downloads, in the United States (AWS region us-east-1).
- RevenueCat, Inc. (USA): checking and restoring Premium purchases made in the app.
- Functional Software, Inc. (Sentry) (USA): crash reports from the app, stored in the EU.
- Resend (Plus Five Five, Inc., USA): backup delivery of the app’s sign-in emails, the website’s confirmation and beta emails and contact-form messages, when Cloudflare can’t send them.
- Cloudflare, Inc. (USA): hosting of gosekai.app, its server logs and the counts of visits through our tagged links, delivery of the app’s sign-in emails, of the launch list’s and the beta’s emails and of contact-form messages to our inbox, the domain’s name service, forwarding of emails sent to our @gosekai.app addresses, and the Turnstile check.
- Google (Google Ireland Limited): the email inbox (Gmail) in which we receive and answer your messages, Continue with Google, and the Google Group for the beta. Google Play distributes the app, runs the beta’s test and sells Premium under Google’s own terms and privacy policy.
Supabase, RevenueCat, Sentry, Resend and Cloudflare process data on our behalf under data processing agreements (Art. 28 GDPR).
10. Transfers outside the EU
Some providers are based in, or process data in, the United States. Where a provider is certified under the EU–US Data Privacy Framework, the transfer relies on the European Commission’s adequacy decision (Art. 45 GDPR). Otherwise, as with Supabase, it relies on the Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).
11. Your rights
You have the right to access your data (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20), and to object to processing based on our legitimate interests (Art. 21). You can withdraw consent at any time without affecting processing before the withdrawal (Art. 7(3)). Write to support@gosekai.app or use the contact form. We answer within one month.
You can also complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the EU country where you live or work, or where you think your rights were infringed.
You don’t have to give us any data to visit the site. The app needs an account, and without an email address we can’t give you one, add you to the launch list or answer you. We make no automated decisions about you (Art. 22 GDPR).
12. Security
All connections to gosekai.app, and between the app and our providers, are encrypted. The launch list can only be written through our server, and nobody can read it through the website. Each account can only reach its own data.
13. Changes
We update this policy when our processing changes. The date at the top shows the latest version.