This policy explains what OreNote collects, why, who it goes to, how long it is kept, and how to have it deleted. OreNote is run by Kenji Prahyudi Mudjono in Japan ("we"). We handle personal information under Japan's Act on the Protection of Personal Information (APPI).
1. What we collect
| What | Details |
|---|---|
| Your account | Name, email address, password (stored only as a one-way hash), whether your email is confirmed, and when you accepted the Terms of Use. Email codes for confirming your address or resetting your password are stored only as a one-way hash and expire. |
| What you save and write | The words, grammar points and sentences you keep; the notes, examples and custom fields you write; pictures you upload; sentences you write or paste for the phrase tools, and the context you add; your cards, decks and card layouts. |
| Study | Your study settings, review history and schedule, and your word-set plans. |
| Activity | Likes, reports and blocks you make; which content you open (used to limit bulk access); a record of each AI request (what was generated and whether it worked); your coins, monthly credits, plan and a record of how coins were spent. |
| Device | Your device's time zone, so your study day starts at your midnight. On Android, crash reports (device model, operating system and app version, and where the app failed). |
| Server logs | For each request: the time, the address requested, the result, how long it took and your account id. We do not log passwords, tokens or what you typed. Your IP address is used to limit how fast requests can be made before you sign in, and our hosting provider may record it in its own logs. |
We do not show ads, we do not use analytics or tracking tools, we do not read your contacts or location, and we do not sell personal information.
When you send cards to AnkiDroid, they are written into AnkiDroid on your own device. That copy is not on our servers.
2. Why we use it
- To run your account and keep it secure.
- To save, show and study what you keep.
- To write AI content when you or a word set asks for it.
- To send account emails: confirming your address, resetting your password, and confirming a deletion.
- To limit abuse: rate limits, the daily limit on how much content one account can open, and moderation of public content.
- To find and fix crashes and errors.
- To handle coins and plans.
3. What other people can see
A value you make public is shown to other OreNote users under Community, without your name or email address. A private value is shown only to you. Reports and blocks are never shown to the person they are about.
4. Services we use
These companies process personal information for us, only to provide their service to OreNote. Some are outside Japan.
| Service | What it receives | Country |
|---|---|---|
| OpenAI | The word, grammar point or sentence AI content is written about, the field asked for, text you ask to translate, and the sentences and context you give the phrase tools. Not your name or email address. | United States |
| Cloudinary | Pictures you upload, and pictures the AI draws. | United States |
| Neon | The database: everything in section 1 except crash reports. | Singapore |
| Koyeb | Hosts the server, so every request passes through it. | Singapore |
| Resend | Your email address and the account emails we send you. | United States |
| Google (Firebase Crashlytics) | Crash reports from the Android app. | United States |
| Google Play | Purchases, once coins and plans can be bought. We receive the purchase record, never your card details. | United States |
The United States has no single national privacy law; personal information there is protected by a mix of federal and state laws. The Personal Information Protection Commission of Japan publishes information on other countries' systems at ppc.go.jp. By creating an account, you agree to your information being sent to these countries for the purposes above.
5. How long we keep it
- Your account and everything in it: until you delete the account.
- After you delete your account: it is closed at once and permanently erased after 30 days.
- Sign-in sessions: at most 60 days without use.
- The record of which content you opened: removed after 90 days without opening it again.
- Email codes: 15 minutes for a password reset, 24 hours for confirming your address.
- Crash reports: as long as Firebase Crashlytics keeps them (90 days).
- A record of moderation actions (for example, that a value was removed and why) is kept after the account is gone. It names the account's id, not its name or email.
- Database backups roll off within our database provider's backup period.
6. Your choices and rights
- Edit or delete anything you wrote, at any time, in the app.
- Make a public value private again.
- Delete your account: in the app (Profile → Delete my account), or see Delete your account.
- Ask us to show, correct, stop using or delete the personal information we hold about you: email support@orenote.kenjipm.com from the address on your account.
7. Security
Connections are encrypted. Passwords, sign-in tokens and email codes are stored only as one-way hashes. On your phone, the sign-in token is kept in the system's secure storage. Access to our admin tools is limited to us.
8. Children
OreNote is not for children under 13, and they may not create an account. If you think a child under 13 has an account, email us and we will delete it.
9. Changes
We will post changes on this page with a new version number and effective date, and tell you in the app or by email when a change is important.
10. Contact
Kenji Prahyudi Mudjono · support@orenote.kenjipm.com