Privacy Policy
Effective September 29, 2026
This policy explains what data Nihora stores, why, and who it is shared with. In short: we keep only what the features need, we don't sell data, and we run no ads or analytics trackers.
1.What we store
Account data:
- email, display name and profile photo URL (both optional), interface language and JLPT level;
- your password as an argon2id hash, never the password itself;
- your plan, its expiry date, and admin notes about payment;
- if you sign in with Google: your Google account ID, email and the basic profile (name and photo) Google provides.
Learning data:
- lesson and grammar progress, exercise answers and scores, exam attempts and their answers;
- your SRS review schedule, saved words and study schedule.
Technical and security data:
- sign-in sessions: IP address, browser (user agent) and last active time;
- an audit log of sensitive actions such as signing in, changing your password and editing your profile, with IP address and user agent.
2.Cookies and on-device storage
- an httpOnly session cookie that keeps you signed in;
- a "locale" cookie for the interface language and a "tz" cookie for your time zone, used to count your daily streak;
- your light or dark theme choice, in the browser's local storage;
- translator history, in the browser's local storage on your device only, and only while you're signed in.
Nihora uses no advertising or third-party tracking cookies.
3.How we use it
- to run the features: save progress, count streaks, schedule reviews, show exam history;
- to send verification and password reset emails;
- to activate and manage paid plans;
- to keep accounts secure and prevent abuse.
4.Third-party services
- Google: Sign in with Google; Google Calendar if you connect it; Google Translate and Google text-to-speech receive the text you translate or play.
- DeepL, LibreTranslate (a public mirror) and MyMemory receive the text you translate when that engine is used. Don't put personal or confidential information into the translator.
- Speech recognition in speaking exercises runs in your browser. Browsers such as Chrome may send the audio to the browser vendor's servers. Nihora only receives the recognised text as your answer.
- Emails are sent through the Nihora operator's own mail server (SMTP).
- WhatsApp: when you press an upgrade button, WhatsApp opens with a message containing the plan name and your email. That conversation is covered by WhatsApp's policies.
- Jisho and Tatoeba are dictionary data sources. Our server contacts them, without any of your personal data.
5.Caching
To make the translator faster, translated text and results are cached on the server without being linked to an account. Text-to-speech audio files are cached for up to 30 days.
6.Storage and security
- Google tokens used for calendar sync are encrypted with AES-256-GCM before they are stored.
- Passwords are stored only as argon2id hashes.
- Requests that change data are protected against CSRF, and every endpoint is rate-limited.
- Sessions expire after 30 days. Verification links are valid for 24 hours and password reset links for 1 hour.
7.How long we keep data
Account and learning data are kept for as long as your account exists. When an account is deleted, its account data, sessions, progress, saved words, schedule and exam history are deleted immediately, and we ask Google to revoke Nihora's calendar access. Security audit logs may be kept longer to investigate abuse.
8.Your rights
Under Indonesia's Personal Data Protection Law (Law No. 27 of 2022) you can:
- see your profile data on the Profile page;
- correct your name, photo, language, level and password on the Profile page;
- download a copy of all your data and delete your account from the Security tab on your Profile page;
- revoke Nihora's access to your Google account at any time in your Google account settings.
9.Children
Nihora is open to everyone. Users under 13 should use it with the permission and supervision of a parent or guardian.
10.Self-hosted Nihora
Nihora's code can be run on your own server. If you use Nihora on someone else's server, that server's operator is responsible for your data.
11.Changes
If this policy changes, the effective date at the top will be updated and we will email you about significant changes.
12.Contact
Questions about these terms or your data? Contact the admin through the WhatsApp button on the Pricing page.