Privacy

Short version: what you learn stays on your phone. Without an account, only three things leave it: a count of finished sessions, crash reports, and the dictionary download if you tap it. If you use Ask Momo, your questions go to the AI to be answered, and nobody keeps them. We keep a small account record so chat knows you're allowed in.

Who we are

Momo is a one-person project. The data controller — the person responsible for everything on this page — is:

Name: Grigorii Zaripov, in the Netherlands
Email: momo@zaripov.dev
EU representative: not needed, we're based in the EU

The app without an account

Everything you do in Momo — the kana and words you learn, your review history, your streak, your word lists, your chats and the photos in them — is stored in a database on your phone. We can't see it. If you have iCloud backups on, Apple backs it up with the rest of your phone.

No account is needed to learn.
No ads, ever.
Nothing you learn is sold or shared.

Here's what does leave your phone without an account:

Session counts. When you finish a review session we record that it happened, which module it was, roughly how well it went as a band (not a score), and milestones like a continued streak. When you look words up in a chat, we count how many were found — never which words. That's how we find out whether the lessons land.
Crash reports. When the app breaks, a technical report of where it broke. No learning data.
The dictionary download. If you tap Download under Settings → Dictionary, your phone fetches the dictionary file from our server, which runs on Cloudflare. Like any download, the request carries your IP address and your phone's user agent. It carries no account, no ID and nothing about what you study. Cloudflare keeps request logs for 3 days. Looking words up afterwards happens entirely on your phone.

Session counts and crash reports are on by default, and you can switch both off in Settings, under Sharing. Turning off crash reports takes effect the next time you open the app — the reporter is installed at launch and can't be removed mid-session.

Not linked to you. The app makes a random ID for itself, so sessions from one install can be told apart from another. That ID is never joined to an Ask Momo account.
Who processes it. PostHog, on their EU servers.
How long. 12 months, then it's deleted.
Deleting it. Settings → Sharing → "Copy my ID", then email it to us and we'll erase what's tied to it. Switching the toggles off stops new data; it doesn't remove what was already sent.

No tracking across other apps or websites happens, so iOS won't ask you about tracking — there's nothing to ask about.

Ask Momo

Ask Momo is the chat. It's optional, it needs an account, and it's for people 16 and over. This is everything it involves:

Your account. You sign in with email, Apple or Google, through Clerk. Clerk keeps your email address and your sign-in identity. Our own database keeps an account ID, nothing else about who you are.
Your birthday. You tell us your date of birth once, so we can check you're 16 or older. Clerk keeps the date with your account. Our database keeps the day you turn 16 — which, to be straight with you, reveals the date too. It never goes into your chats.
Your consent. We record which version of the "what gets sent" screen you agreed to, so we can show you a new one if it changes.
Your subscription. Apple bills you and handles refunds. RevenueCat records the purchase against your account ID, and our database mirrors whether your subscription is active.
What you ask. When you send a message, your phone sends it straight to OpenRouter, who pass it to Nebius, who run the AI. That's your question, the last few messages in that chat, the word or kana you're asking about, the newest photo in that chat if you sent one, and which words in Momo's answer you already know (so she can point out the new ones). It goes with zero data retention and no training: neither OpenRouter nor Nebius keeps it or learns from it. It never passes through Momo's servers, and we don't store it. Your chats, photos too, stay on your phone.
Photos. Photos are shrunk and stripped of location and camera details before they're sent. A photo can show more than Japanese, like a name on a letter — send what you'd show a friend.
Your AI key. Our server gets you a personal key from OpenRouter with a monthly allowance. We keep it sealed, with its allowance and expiry. OpenRouter keeps the key and how much it has spent.
Momo's voice. When you tap to hear Momo say something, we send her Japanese text — never yours — to our voice server in Frankfurt (Fly.io), with no account ID. The clip is cached by Cloudflare for up to a year, filed under the text, not under you. We count how many new clips each account asks for per day, to keep the allowance fair.

Legal bases

Session counts and crash reports: our legitimate interest in keeping the app working and finding out whether it teaches well (Article 6(1)(f) GDPR). The data isn't tied to an identity, and you can object at any time with the switches in Settings.
Account, chat, voice and subscription: we need them to give you Ask Momo, which you asked for (Article 6(1)(b)).
The age check: keeping chat for people 16 and over is in our legitimate interest, and yours (Article 6(1)(f)).
This website's analytics: your consent, in the banner.

Who processes it

These companies handle data for us, on our instructions and under a data processing agreement.

Who	What for	Where	Transfer safeguard
Clerk	Sign-in and accounts: email, sign-in identity, birthday	US	EU–US Data Privacy Framework / standard contractual clauses
RevenueCat	Subscription records, keyed by your account ID	US	Standard contractual clauses
Cloudflare	Our server, database, dictionary file, voice cache, request logs	Database and dictionary in the EU; requests answered near you	EU–US Data Privacy Framework / standard contractual clauses
OpenRouter	Passes your Ask Momo messages to the AI; manages your AI key	US	Standard contractual clauses / Data Privacy Framework
Nebius	Runs the AI that answers you, with zero data retention	EU company; the EU or elsewhere, including the US	Through OpenRouter, under its terms with Nebius
Fly.io	Momo's voice: her text only, no account ID	Frankfurt, Germany	Standard contractual clauses / Data Privacy Framework
PostHog	Session counts, crash reports, website analytics	EU	Their subprocessors outside the EU: standard contractual clauses

Apple runs the App Store, TestFlight, payments and iCloud backups as its own controller, under Apple's privacy policy. Momo's word and kana audio was made ahead of time (VOICEVOX, Google Cloud Text-to-Speech) and ships inside the app, so playing it sends nothing.

Where it sits

Momo's own database — your eligibility, subscription status and voice counts — is stored in the EU. Your messages go from your phone to OpenRouter in the US and to Nebius, a Dutch company, which may run your request in its data centres in the EU or elsewhere, including the US. Neither keeps them. Our servers answer each request close to where you are, and that can be outside the EU. We won't tell you everything stays in the EU, because it doesn't.

How long

What	How long
Your messages and photos (OpenRouter, Nebius)	Not kept after the answer
Your account record in our database	Until you delete your account
Clerk (email, birthday) and RevenueCat (purchases)	Until you delete your account, except billing records the law makes us keep
Request logs at Cloudflare	3 days
Session counts and crash reports (PostHog)	12 months
Cached voice clips (Momo's text only, no account)	Up to a year
Subscription event IDs (no personal data)	Kept, so a payment event is never applied twice

Deleting

With an account: Profile → Delete account. We remove your RevenueCat record, revoke your AI key at OpenRouter, delete your Clerk account, then delete your rows in our database.
Your subscription is separate. Deleting your account doesn't cancel it — do that in Settings → Apple Account → Subscriptions.
Without an account: delete the app, and your learning goes with it. For the session counts, email us the ID from Settings → Sharing.

Children

Ask Momo is for people 16 and over, going by the birthday you give us. The rest of the app needs no account and collects nothing about who you are.

This website

Different story, and we'd rather say it plainly. If you accept analytics in the banner, we count things like which page you landed on and whether you tapped through to the App Store. It tells us whether this page is doing its job. If you decline, nothing loads and nothing is sent — the banner isn't decoration.

What's collected. Pages viewed, how far down you scrolled, and which download link you tapped — plus the usual technical bits your browser sends, like rough country-level location, device type, and the site you came from.
Legal basis. Your consent. You give it in the banner, and you can take it back whenever you like.
Who processes it. PostHog, on their EU servers, acting on our instructions. Some of their subprocessors operate outside the EU under standard contractual clauses.
How long we keep it. 12 months, then it's deleted.
Taking it back. Reopen the banner from the footer link and decline. That stops collection from that moment — it doesn't erase what was already sent, so email us if you'd like that too.

What Apple handles

The app is distributed through Apple's App Store. Apple may collect crash reports and basic usage statistics under Apple's privacy policy and shares crash logs and aggregate figures with us so we can fix bugs and see how many people are using the app. Those contain technical and aggregate detail, not your learning data. Apple also takes the payment for an Ask Momo subscription; we never see your card.

Your rights

If you're in the EU or UK, you can ask for a copy of what we hold, ask us to correct or delete it, take it with you, or object to how we use it. Email us and we'll sort it out — there's no form to fill in. You can also complain to your local data protection authority if we've handled something badly.

If the app changes

If a future version collects anything beyond what's listed above, this policy changes before that version ships, and we'll spell out what changed and how to turn it off. If what Ask Momo sends changes, the app shows you the new "what gets sent" screen before your next chat.

Questions

Email momo@zaripov.dev — a human reads it.

Last updated: 30 October 2026