Privacy Policy

1Summary

This is the short version. The sections after it give the detail.

You can study in Infinilang for free without an account. If you do, what you study stays on your phone and the app sends nothing to us.

You need an account to subscribe, to sync your progress between phones and to use the AI reading features. Accounts are for people aged 13 and over. To make one, you sign in with Apple, with a code we send to your email address or, where the app offers it, with Google, and the app finds out which age group you are in. We never ask for your name or your date of birth.

Progress sync is your choice. If you turn it on, we keep a copy of your deck progress so your other phones can have it too. That copy can include progress you made on WaniKani, once you stop using WaniKani on a phone that also holds a deck (section 10).

If you subscribe, the app sends us a list of the kanji you have learned or are about to learn, so that passages written for you use only kanji you can read. If you have connected WaniKani, that list comes with your WaniKani level and includes the kanji you have started there. Your WaniKani token, WaniKani's content and your answers on WaniKani items never reach us.

Before any of your topics, or the passages written for you, are sent to an AI company outside our own servers, the app asks your permission. We do not use what you write to train AI.

We do not show advertising or sell information about you, and we do not track you across other companies' apps or websites.

You can delete your account in the app whenever you like. We do not delete it unless you ask, except in the few cases section 14 lists, such as an account that belongs to a child under 13. Some records stay for a limited time after a deletion: for example, backups are deleted within 40 days, and billing records are kept for up to 7 years. Section 15 lists them all.

We are bound by Australia's Privacy Act. If you have a question or a complaint, write to support@hex.pro.

2Who we are

Infinilang ("the app") is published by Ars Vitae Pty Ltd, an Australian company trading as Hex Pro ("we", "us", "our"). We decide how the information described in this policy is used, and we are responsible for it. "Our server" means the computers that run Infinilang's online services.

We have chosen, under section 6EA of the Privacy Act 1988 (Cth), to be treated as an organisation the Act applies to. The Act and the Australian Privacy Principles therefore bind us for everything this policy describes, and you can complain to the Office of the Australian Information Commissioner (section 20). People in the United Kingdom also have the rights set out in section 21.

3Using Infinilang without an account

Without an account, the app does not contact our server at all. The first request it makes to us is when you start to sign in.

What you study is kept in the app's own storage on your phone: the kanji and words you study, your answers and review schedule, the decks you import and, if you connect WaniKani, the copy of your WaniKani items and progress the app downloads. Your preferences, such as review order and reminder settings, are kept on the phone too. Deleting the app deletes all of this. Section 17 explains how device backups can include it.

Secrets, such as a WaniKani token, are kept in the iOS Keychain, the encrypted store the system provides, and are set so that they are never restored onto a different phone. iOS can keep Keychain items after an app is deleted, so use Erase this phone (section 15) first if you want them gone.

Review reminders are scheduled by the app on your phone, and no push server is involved. The app reads how you tilt your phone to move some of its visual effects. Those readings are used at that moment and are never stored or sent.

The app contains no advertising, analytics or crash-reporting software. To show you Infinilang Pro and its price, the app asks Apple's App Store, which Apple handles under its own privacy policy. If you have chosen in iOS to share analytics with app developers, Apple may give us crash reports and usage statistics for the app, which Apple prepares under its own privacy policy and which do not tell us who you are.

Links in the app, such as those on the About screen, open in your browser. Browsing is governed by your browser and the site you visit, not by this policy.

4Your Infinilang account

When you create an account, our server gives it a random identifier. That identifier names your account throughout our systems. It is not your name and is not made from anything about you.

For each way you sign in to the account, we keep:

• whether it is Sign in with Apple, Sign in with Google or an email address;
• the identifier Apple or Google gives us for you or, for an email sign-in, your email address;
• the email address Apple or Google shares with us, whether they say it is verified and whether Apple says it is a private relay address that forwards mail to you;
• when it was added and when it was last used.

We do not collect your name. The app asks Apple for your email address only, and asks Google for your email address and Google's identifier for you only.

For each phone signed in to the account, we keep a record that lets our server recognise it: a scrambled form of the phone's App Attest key identifier, the public half of that key, Apple's attestation receipt for it, a counter that stops an old request being used again, whether the app was a test build or a released one, which way of signing in the phone last used, and when the phone was added and last seen. Section 6 explains App Attest.

When you sign in, our server gives the app a session token, which the app sends with each request. We keep only a scrambled form of the token (a hash), so our database cannot be used to sign in as you. A session token lasts up to 30 days, and the app swaps it for a new one as you use the app. On your phone, the token is kept in the Keychain with your account's identifier, how you signed in and, for an email sign-in, your email address. The phone's App Attest key identifier is kept there too, and so is your Apple user identifier if you signed in with Apple.

We also keep:

• when the account was created, and the last time you signed in or used the app while signed in (use is recorded at most once a day, and section 7 explains why);
• the version of the terms you accepted and when you accepted it, updated whenever you sign in with a later version;
• your age band, how it was declared and when (section 5);
• whether the account has an active Infinilang Pro subscription, and its dates (section 11).

We use this information to let you sign in on your phones, to keep your subscription, your progress and your kanji pool with your account, and to protect the account from misuse.

Each way to sign in belongs to one account only, and we never merge accounts. An email address that Apple or Google shows us is not itself a way to sign in. If you sign in with an email code for that same address, you create a separate account, unless you have first added the address to your existing account as a way to sign in.

5Your age band

Infinilang accounts are for people aged 13 and over. Each time you sign in, the app first works out which age band you are in. It does not do this when it only asks you to confirm a recent sign-in, for example before you delete your account.

On iOS 26 and later, the app first asks Apple. Apple shows its own screen, where you, or a parent or guardian who manages your Apple Account, choose whether to share an age range with Infinilang. If it is shared, Apple tells the app which of these bands you are in (under 13, 13 to 14, 15 to 17, or 18 or older) and how that was declared. Apple never gives the app your date of birth.

If no age range is shared, or Apple's feature is not available on your phone, the app asks you one question with four answers: "Under 13", "13 to 14", "15 to 17" and "18 or older". No answer is chosen for you.

If the answer is under 13, the app does not create an account and sends nothing to us. For the next 24 hours it does not ask again or offer a way to sign in on that phone. To do that, the app keeps the time of the answer on the phone, and nothing else about it. Once the 24 hours have passed, the app deletes that time the next time it starts or checks it. It never sends that time to us, and Erase this phone (section 15) deletes it sooner. Everything that works without an account keeps working.

Otherwise the app sends the band with the sign-in. When the sign-in creates your account, we keep the band with it, together with how it was declared and when. How it was declared means one of these: your answer to the app's question, a range you declared to Apple (or one Apple shared without saying who declared it), a declaration by a parent or guardian through Apple, an age that Apple has confirmed in another way, or a correction we made at a request (below). We never receive or keep a date of birth.

We use the band to apply rules suited to your age, which are described in sections 9 and 19, and for nothing else. A later sign-in does not change the band we hold. The one exception is an account for which we hold no band: there we keep the band that the next sign-in sends.

People grow older, so we treat a band as older as time passes. A 13 to 14 band counts as 15 to 17 from two years after it was declared, and as 18 or older from five years after. A 15 to 17 band counts as 18 or older from three years after it was declared. Wherever this policy applies a rule by age band, it uses the band as we treat it at the time.

If the band we hold is wrong, you, or a parent or guardian, can ask us to correct it (section 20). We then keep the corrected band, with a record that it was corrected at a request and when, and the years above count from the correction. The band stays with your account until the account is deleted.

6Signing in

If you sign in with Apple, Apple confirms who you are to the app, and our server checks Apple's confirmation. Our server also exchanges a one-time code from Apple for a refresh token, which we keep encrypted. We use that token for one purpose only: to ask Apple to end Infinilang's access to your Apple Account when you delete your account or remove Sign in with Apple from it.

Apple tells our server if you change the email settings for Infinilang in your Apple Account, and we update the address we keep.

If you stop using Sign in with Apple for Infinilang in your Apple Account settings, Apple tells us that too. We then sign out the phones that last signed in with that Apple Account and delete the refresh token. We keep your Infinilang account, because that notice is not a request from you to delete it, and you can sign in with Apple again later.

If you delete your Apple Account, Apple tells us, and that Apple Account can never be used to sign in again. We sign out the phones that last signed in with it and delete the refresh token. If signing in with that Apple Account was the only way to sign in to your Infinilang account, nobody can ever reach that account again, so we delete the account as section 15 describes. If the account has another way to sign in, we keep the account and remove that Apple Account from its ways of signing in. To keep an account that you sign in to only with Apple, add another way to sign in, such as your email address, before you delete your Apple Account.

If you sign in with Google, the app opens Google's sign-in page and deals with Google directly. iOS first asks whether the app may use google.com to sign in, which lets the page use a Google sign-in you already have in Safari. Google gives the app a signed statement of Google's identifier for you, your email address and whether Google has verified it, and the app sends only that statement to our server. Google's access and refresh tokens are thrown away on the phone and never reach us. Our server checks the statement against Google's public keys, and fetching those keys sends Google nothing about you. We use what Google tells us only to sign you in and to show the address in Settings. We do not sell it or use it for advertising.

If you sign in with an email code, you type your address and our server sends a six-digit code to it from infinilang@hex.pro, through Microsoft's email service. The code appears in the email's subject and in its text. It works once, and only for 10 minutes.

Until the code's record is deleted (section 14), we keep the address and the code only in scrambled forms made with a secret key, together with a scrambled form of the network address your request comes from and either the App Attest key of the phone that asked for it or, when you are adding the address to an account, that account's identifier. Our mailbox keeps no copy of the email. Microsoft keeps a delivery record, which includes your address and the subject line, for 90 days. When you enter the code to sign in, the address is kept with your account as section 4 describes. We never send a code to an Apple private relay address.

We send no marketing email. At present the only email Infinilang sends is the sign-in code.

Each phone proves itself when it signs in. When a phone with no key linked to an account signs in or asks for an email code (the first time, or the first time after signing out), the app creates a key on the phone and asks Apple's App Attest service to confirm that the key belongs to a genuine copy of Infinilang on a real Apple device. Our server checks Apple's answer and keeps the record described in section 4. Later sign-ins from that phone are proved with the same key, without contacting Apple. Signing out discards the key.

To stop people guessing codes or flooding the service, our server counts attempts and refuses more for a while once a limit is reached. Each count is tied to one of these: a scrambled form of the network (IP) address your request comes from, a scrambled form of an email address, the scrambled identifier of a phone's key, or an account's random identifier. The counts are deleted within four days.

7Progress sync

Progress sync is optional and free for every account. The app offers it when you first sign in, and you can turn it on or off at any time in Settings. While it is on, the app sends changes automatically, and our server keeps a copy of:

• the decks you have imported and the kanji you chose in the app, with each deck's identifier, where it came from (an Anki or Mochi file, or the app's Choose kanji screen) and its name, which may be text you typed;
• which cards belong to each deck, and their order;
• each card's study state, such as its stage, when it became available for lessons, when it was started, passed or burned, when it is next due and when you last got it wrong, and for a word, the readings taken from your deck;
• your answers on those cards, with when you answered, whether you got the meaning or the reading wrong, how the card's stage changed and an identifier for the study session;
• a random identifier for each phone's installation of the app, stamped on every change that phone makes.

These never sync: WaniKani's content (its subjects, with their meanings, readings and mnemonics), your answers on WaniKani items, your WaniKani token and your app preferences.

Progress you made on WaniKani reaches the synced copy in one way only: when a phone that also holds a deck stops using WaniKani. That happens when you disconnect WaniKani in Settings, and when you choose Continue without WaniKani, which the app offers on the screen that asks for your WaniKani token again and on the screen that downloads your WaniKani data. A card in that deck for a kanji or word that WaniKani was teaching you can then take your WaniKani progress for it: its stage, the dates it became available, was started, passed or burned and is next due, and when it last changed on WaniKani. That card then syncs like any other deck card (section 10).

We use the copy only to keep your progress the same on every phone signed in to your account. Our server does not read your progress to decide anything. It stores what your phones send and passes it on to your other phones.

Turning progress sync off deletes the copy on our server straight away, and keeps your progress on your phone and in its backups. The deleted records remain in our database backups, which are deleted within 40 days. We keep the setting itself, so your other phones know that sync is off.

Removing a deck sends a marker saying it was removed. The study states of its cards and your answers on them stay in the synced copy until you turn sync off, the copy is deleted under the rule below, or the account is deleted.

The synced copy is also deleted after a long time without use. Apart from deleting a whole account in the cases section 14 lists, this is the only deletion of your study data that we make without a request from you. The synced copy is deleted 3 years after the later of two dates: the last time you signed in or used the app while signed in, and the end of your last Infinilang Pro subscription. It is never deleted while you have an active subscription. Only the synced copy is deleted. Your account and everything else it holds stay, and so does the progress on your phones. We do not currently send a warning before this deletion.

8Your kanji pool

To write passages you can read, our server needs to know which kanji you know. While you are signed in and the app knows your account has an active Infinilang Pro subscription, the app sends our server your kanji pool:

• the kanji you have started learning, in your decks or on WaniKani;
• kanji you are likely to recognise, which are the kanji in deck words you have started and, with WaniKani, the kanji of your next two WaniKani levels;
• the next kanji the app plans to introduce and, when it comes from WaniKani, its WaniKani level;
• your WaniKani level, if you have connected WaniKani;
• a short fingerprint of the pool, so a phone can tell whether its pool has changed.

So if you have connected WaniKani, the pool tells us your WaniKani level and which kanji you have started on WaniKani. The pool is made of kanji characters and numbers only, and holds no other WaniKani content, such as meanings, readings or mnemonics. We keep the latest pool with your account, replacing it whenever it changes, until the account is deleted. Turning progress sync off does not remove it, and the 3-year rule in section 7 does not apply to it.

9The AI reading features

This section describes how the AI reading features handle your information. Until they are available in your version of the app, none of it happens.

When you ask for a passage, you can give a topic. Our server checks the topic and then writes a passage about it using only the kanji in your pool. We keep your topics, the passages written for you, which passages you have read and counts of how much you have generated, which the fair-use limits in the terms rely on. All of this stays with your account until the account is deleted. You can also ask us at support@hex.pro to delete a particular topic or passage sooner.

Our own servers in Australia do this work where they can. Other providers may also be involved:

• when our own servers cannot answer, Anthropic's API (Anthropic, PBC, United States) or a DeepSeek model run by DeepInfra (DeepInfra, Inc., United States) may process your topic and write the passage;
• Jev, a service of TypeSafe AI, Inc. (United States), may check drafts of a passage written for you, choose between them, and rate whether the passage suits your age band;
• before a passage enters the shared library described below, a DeepSeek model run by DeepInfra checks it.

None of these providers receives any of your text, including your topics and the passages written for you, unless you have given the app your permission, so none of them checks, rates or chooses between your passages without it. The app asks for it before any of your text reaches a provider outside our own servers. Without it, that work is done on our own servers or not at all. You can withdraw the permission at any time by writing to support@hex.pro, and from then on none of your text is sent to them. If your age band is 13 to 14, the app does not ask, and your text stays on our own servers. Your passages are checked and rated for your age there, and a passage that cannot be checked and rated there is not shown to you (section 19). The providers process what we send in order to give us an answer, under their own terms, and each of them states that it does not train its models on what its customers send.

We do not use your topics, or the passages written from them, to train any AI model, our own included.

Passages that many learners can read are kept in a shared library. Our software writes some of them from everyday subjects with no learner involved. A passage written for you goes there only if your topic was generic, meaning it describes an everyday subject and names no person, place or anything else that could identify someone, and only if your age band is 18 or older. A topic from a learner under 18 never leads to a shared passage. A shared passage has no owner and carries no link to you or your account. Instead of your words, it keeps a short description of its subject that our software writes. It stays in the library after your account is deleted.

Passages in the shared library are rated for age before one is shown to a learner under 18, and a learner under 18 is shown only passages rated as suitable for their age band.

So that a common topic does not need checking twice, we keep the result of the check for a topic judged generic, with the topic in a normalised form and no link to anyone. We never keep the result of the check for a topic that is not generic.

10WaniKani and deck files

WaniKani is a kanji-learning service run by Tofugu LLC, a third party, under its own terms and privacy policy. To connect it, you give the app a WaniKani personal access token, which the app keeps in the Keychain on your phone. The app talks to WaniKani directly from your phone. It downloads your WaniKani account details, items and progress, and it sends WaniKani your reviews and the lessons you start, so that your WaniKani account stays up to date.

Your WaniKani token never reaches our server, and neither do WaniKani's content (its subjects, with their meanings, readings and mnemonics) or your answers on WaniKani items. Two things that come from WaniKani can reach us. If you subscribe to Infinilang Pro, your kanji pool can include your WaniKani level, the kanji you have started on WaniKani and the kanji of your next two WaniKani levels (section 8). Progress you made on WaniKani can also reach the synced copy when a phone that also holds a deck stops using WaniKani, as the next paragraph describes.

Disconnecting WaniKani in Settings removes the token from your phone. On a phone that holds no deck, everything the app downloaded from WaniKani stays on the phone. On a phone that also holds a deck, disconnecting removes WaniKani's items from the phone, and so does choosing Continue without WaniKani, which the app offers on the screen that asks for your WaniKani token again and on the screen that downloads your WaniKani data. Either way, a card in your deck for a kanji or word that WaniKani was teaching you can take your WaniKani progress for it (section 7). If progress sync is on, or you turn it on later, that progress syncs like the rest of your deck progress. What WaniKani holds about you is controlled by Tofugu, not by us.

A deck file, such as an Anki or Mochi export, is read on your phone. You choose it with the system file picker, which gives the app only the file you pick. The app copies the file into its temporary storage to read it and deletes the copy when the import ends. If the app is closed in the middle of an import, the next import removes the leftover copy, or iOS clears it. What the app keeps is what it recognised: the kanji and words, readings taken from the deck, and the deck's name. It does not keep the file and does not change it. Nothing from a deck reaches our server unless you turn on progress sync (section 7).

11Purchases

Infinilang Pro is sold through the App Store, and Apple handles the payment. We never see your card details or the details of your Apple Account.

To buy Infinilang Pro you must be signed in. The app gives Apple your account's random identifier with the purchase, so that the purchase records name the account the subscription belongs to. The app sends our server Apple's signed record of the purchase, and Apple's servers send our server signed notices when the subscription renews, lapses, is refunded or changes in other ways. These records include details such as the product, its dates, Apple's transaction numbers, the App Store country and the price.

We keep the subscription's status and dates with your account, so that it works on any phone where you sign in. We also keep Apple's records in a billing ledger as financial records, which Australian company law requires us to keep for 7 years. When your account is deleted, we remove your account's identifier from the ledger and delete each record when it is 7 years old.

Apple holds your purchase history in your Apple Account, under Apple's own privacy policy.

12When you contact us

If you write to us, we receive your email address and whatever your message contains, and we use it to answer you. Microsoft runs our email for us (section 13). We keep the conversation for as long as we need it to deal with your request and anything that follows from it.

13Who handles your information, and where

These organisations handle information about you in connection with Infinilang, each only for the purpose given here:

• Amazon Web Services runs our server, its database, its backups and its logs, in Sydney, Australia.
• Cloudflare, Inc. (United States) runs the network that every request to our server passes through, and it also carries traffic between our own servers. A request is usually handled at a Cloudflare location near the person making it, which can be in any country where Cloudflare operates. Because it passes each connection on, Cloudflare can see what is sent through it, including your IP address, and it keeps its own records under its own privacy policy.
• Apple Inc. (United States) provides Sign in with Apple, App Attest, the age range feature in section 5, the App Store and its purchases, and device backups.
• Google LLC (United States) is involved only if you sign in with Google.
• Microsoft Corporation (United States) sends the sign-in code emails and runs our email. Microsoft may handle email in Australia, the United States and other countries where it runs its services, and an email then travels to whoever runs your inbox.
• Anthropic, PBC, DeepInfra, Inc. and TypeSafe AI, Inc., all in the United States, may take part in the AI reading features with your permission (section 9). Otherwise those features run on our own servers in Australia.

Information about you may therefore be handled in Australia, in the United States and, as it passes through Cloudflare's and Microsoft's networks, in other countries. Before we use a provider, we take reasonable steps to make sure it protects information as the Australian Privacy Principles require, normally through its contract terms.

We do not sell or rent information about you. We share it with no one else, except where the law requires us to, for example under a court order.

14How long we keep information

We keep your account, with your ways of signing in, your age band, the terms you accepted, your subscription record and your kanji pool, until you delete it, except in the cases listed below. We never delete an account because it has not been used. People often come back to learning a language after a long break, and expect their account to be there when they do.

We delete an account without a request from you only in these cases:

• if we learn that it belongs to a child under 13 (section 19);
• if its only way to sign in was Sign in with Apple with one Apple Account, and Apple tells us that this Apple Account has been deleted, because nobody can sign in to the account again (section 6);
• if it was made for testing before Infinilang's first public release, at that release.

Other records have their own limits:

• A phone's record stays until that phone signs out, until the way it signed in is removed or revoked, or until the account is deleted.
• A session token lasts up to 30 days unless the app replaces it sooner. Signing out deletes it at once, and an expired one is deleted within two days of expiring.
• An email code stops working after 10 minutes. Its record is deleted as soon as it is used, and otherwise within a day after it expires.
• The counts that limit attempts are deleted within four days.
• The synced copy of your progress stays until you turn sync off, until it is deleted under the 3-year rule in section 7, or until the account is deleted.
• Billing records are deleted 7 years after we receive them.
• An Apple refresh token queued for revocation is deleted when Apple confirms the revocation. If an attempt fails, we keep trying, and delete the token once 30 days have passed since the first failed attempt.
• We keep a record of what we did and when, with the account's random identifier, each time we correct an account's age band, delete an account because the person it belongs to asked us to, delete an account because we learned that it belongs to a child under 13, or delete an account that was made for testing. Each record is deleted within a day after it is 30 days old.
• If you write to us, we keep the conversation for as long as we need it to deal with your request and anything that follows from it (section 12).
• Our server's logs are kept for 30 days. They name accounts and devices by their random identifiers, and we do not write email addresses, sign-in codes or tokens into them.
• Our database backups are kept in Sydney, and each one is deleted within 40 days.
• Microsoft deletes its delivery record of a code email after 90 days.

Once the AI reading features are available, your topics, private passages, reading history and usage counts stay with your account until the account is deleted, unless you ask us to delete one sooner. Passages in the shared library, and the results we keep of checks on generic topics (section 9), carry no link to anyone, and we keep them for as long as the shared library exists.

15Deleting your account, signing out and erasing this phone

You can delete your account in Settings, under Infinilang account, by choosing Delete account. If you have not signed in during the last ten minutes, the app asks you to sign in again first.

Our server deletes an account in one step, both when you delete it in the app and when we delete it at your request or in one of the cases that section 14 lists. It deletes everything kept with the account: your ways of signing in, your phones' records and sessions, your age band, your terms record, your subscription record, your kanji pool, your synced progress and, once the AI reading features are available, your topics, private passages, reading history and usage counts. Any Apple refresh token is queued so that we can ask Apple to revoke it.

Some records remain after a deletion, for a limited time:

• copies in our database backups, which are deleted within 40 days;
• our server's logs, for up to 30 days;
• our record of the deletion, for up to 31 days, if we deleted the account because you asked us to, because we learned that it belonged to a child under 13 or because it was made for testing;
• billing records, with your account's identifier removed, until they are 7 years old;
• counts that limit attempts, for up to four days;
• an Apple refresh token waiting to be revoked, until Apple confirms the revocation or 30 days have passed since the first failed attempt;
• Microsoft's delivery record of any code email, for up to 90 days;
• records that Cloudflare, Apple and Google keep under their own privacy policies.

Passages in the shared library, and the results we keep of checks on generic topics, also remain, because they carry no link to you.

Deleting your account does not cancel an Infinilang Pro subscription. Apple keeps billing your Apple Account until you cancel the subscription in your Apple Account settings. What is on your phone stays unless you also choose to erase this phone when you delete the account. If you cannot use the app, write to support@hex.pro, and we will delete the account once we have checked that it is yours.

Sign out, in the same part of Settings, ends this phone's session on our server and removes the sign-in details from the phone. Your account, your study data and your WaniKani token stay.

Erase this phone, in Settings under This phone, first tells our server that this phone has signed out, if it was signed in. It then deletes your study data, the time of any under-13 answer to the age question and every Keychain item the app keeps on this phone, including your WaniKani token, and clears the app's reminders. Your app preferences stay. It deletes nothing else on our server. To remove what our server holds, turn off progress sync or delete your account.

Removing a way of signing in signs out every phone that last signed in that way. Stopping Sign in with Apple for Infinilang does not delete your Infinilang account. Deleting your Apple Account deletes your Infinilang account only if signing in with that Apple Account was the account's only way to sign in (section 6).

16Security

The app talks to our server only over encrypted (HTTPS) connections. We keep session tokens and email codes only as scrambled forms (hashes), and Apple refresh tokens only in encrypted form. On your phone, secrets are kept in the iOS Keychain and are never restored onto a different phone. Each phone has to prove itself with App Attest before it can sign in, and access to our servers is limited to the people who run them.

No system is perfectly secure, and we cannot promise that information will never be lost or misused. If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

17iCloud and device backups

The app does not use iCloud itself. Your phone's iCloud or computer backups can include the app's study data, as they do for other apps. That includes your answers, your decks, the time of a recent under-13 answer to the age question and, if you connected WaniKani, the copy of your WaniKani items, progress and username. Those backups are run by Apple under your Apple Account, and you manage them in iOS Settings.

The app's Keychain items are not restored onto a different phone. They include your WaniKani token, your session token (with your account's identifier and, for an email sign-in, your email address), the phone's App Attest key identifier, your Apple user identifier and the random identifier progress sync uses.

18Automated decisions

Some decisions about you are made by our software without a person looking at them first. These are the ones that can affect what you are able to do, with the information each one uses:

• whether you can create an account or sign in, based on the age range Apple shares or your answer to the age question: an under-13 band means the app creates no account and, for the next 24 hours, does not ask again or offer a way to sign in on that phone (section 5). The app makes this decision on your phone and sends us nothing about it;
• whether a phone may sign in, based on Apple's App Attest check of that phone;
• whether a sign-in or a request for an email code is refused for a while, based on counts of recent attempts tied to a network address, an email address, a phone's key or an account;
• whether your account has an active Infinilang Pro subscription, based on Apple's signed records of your purchase;
• when the synced copy of your progress is deleted, based on the last time you signed in or used the app while signed in and on the end date of your last Infinilang Pro subscription (section 7);
• whether an account is deleted when Apple tells us that an Apple Account has been deleted, based on Apple's notice and on whether the account has any other way to sign in (section 6).

Once the AI reading features are available, these decisions are made in the same way:

• whether the app asks for the permission in section 9, based on your age band;
• whether a topic is accepted, based on automated checks of the words you type;
• whether you have reached a fair-use limit, based on counts of what your account has generated;
• whether a passage written for you is shown, written again or withheld, based on automated checks of its content and, if you are under 18, its age rating;
• which shared passages you can be shown, based on each passage's age rating and your age band.

If you think one of these decisions is wrong, write to support@hex.pro, and a person will review it and tell you what they found. For the age check, tell us what happened, because the app sends us nothing about an under-13 answer. A review may not be able to bring back information that has already been deleted.

19Children and young people

Infinilang accounts are for people aged 13 and over. Anyone can use the study app without an account, and an under-13 answer to the age question never stops that (section 5). We do not knowingly keep an account for a child under 13. If we learn that an account belongs to one, for example because a parent or guardian tells us, we delete it, as section 15 describes. A parent or guardian who thinks the age band we hold for a child's account is wrong can ask us to correct it (section 20).

Many people learning Japanese are at school, so these protections apply to every account, whatever its age band. None of them depends on knowing how old you are:

• optional features, such as progress sync, stay off until you turn them on, and when the app offers one, it gives both answers the same weight and chooses neither for you;
• we show no advertising and send no marketing;
• this policy and the app's notices are written in plain language;
• you can delete your account in the app, and you can ask us to delete your account or anything in it at any time;
• you can complain to us, and to the regulators named in sections 20 and 21.

We do not rely on consent from anyone in the 13 to 14 age band. The permission described in section 9 is never asked of those accounts, so their topics and passages are handled only on our own servers, and a passage that cannot be checked and rated for their age there is not shown to them. A topic from a learner under 18 never leads to a passage in the shared library, and a learner under 18 is shown only shared passages rated as suitable for their age band.

If you are under 18, we suggest you read this policy with a parent or guardian. A parent or guardian with a question about a child's account can write to support@hex.pro.

20Access, correction and complaints

You can see the ways you sign in to your account in Settings, under Infinilang account. To ask for a copy of anything else we hold about you, write to support@hex.pro. We may need to check that the account is yours first, for example by asking you to write from an address you sign in with. We will answer within 30 days, and we do not charge for this.

To correct an email address you sign in with, add the right one as a way to sign in and remove the old one, or write to us. An address that Apple or Google shares with us comes from them, and a change you make there reaches us the next time you sign in that way.

To correct the age band we hold for your account, write to support@hex.pro. A parent or guardian can ask on behalf of a child. Once we have checked the request, we record the corrected band as section 5 describes.

If you have a complaint about how we handle your information, write to support@hex.pro. We will acknowledge it within 30 days, look into it, and tell you in writing what we found and what we will do. If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner at www.oaic.gov.au. People in the United Kingdom can also complain as section 21 describes.

21People in the United Kingdom

This section applies if you are in the United Kingdom. It adds to the rest of this policy the information that the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 require.

Ars Vitae Pty Ltd, trading as Hex Pro, is the controller of your personal data, and you can contact us at support@hex.pro. The UK GDPR requires a business outside the UK that offers its services to people in the UK to have a representative there. We will appoint one before Infinilang is offered in the United Kingdom, and name them in this section.

We rely on these lawful bases:

• to provide your account and the features you use, including signing in, progress sync, your kanji pool, Infinilang Pro and the AI reading features: our contract with you if you are 18 or older, and if you are 13 to 17, our legitimate interest, and yours, in providing the service you asked for;
• to keep accounts and our service secure, including App Attest, the limits on attempts, our logs and our backups: our legitimate interest in preventing misuse and keeping the service running;
• to keep your age band and apply the protections in section 19: our legitimate interest in giving young learners an experience suited to their age;
• to keep billing records: our legitimate interest in keeping the financial records that the laws that apply to us require;
• to send your text to an AI provider outside our own servers: your consent, which the app asks for first, which you can withdraw at any time, and which we never ask of anyone whose age band is 13 to 14;
• to answer your messages: our legitimate interest in helping you.

To create an account you must give us a way to sign in and an age band, because we cannot provide an account without them. Everything else is optional, including progress sync, Infinilang Pro and the permission in section 9.

Your personal data is handled in Australia, where we are, and by the providers in section 13, some of them in the United States and other countries. Where UK law requires a safeguard for this, we rely on one that it recognises, such as a provider's contract terms for international transfers, and you can ask us for a copy. Section 14 sets out how long we keep each kind of information.

You have the right to ask us for a copy of your personal data, to have it corrected (your age band included, as section 20 describes), to have it deleted, to restrict how we use it, and to receive the data you gave us in a portable form. Where we rely on your consent, you can withdraw it at any time, and that does not affect what we did before. You also have the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. Section 18 describes our automated decisions, and a person will review any of them if you ask.

Your right to object. You can object at any time to our use of your personal data where we rely on legitimate interests. We will then stop, unless we have compelling grounds that override your interests or we need the data to establish, exercise or defend legal claims.

If you have a complaint about how we handle your personal data, write to us at support@hex.pro first. We will acknowledge it within 30 days, investigate it and tell you the outcome. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

The protections in section 19 apply to every account, including those of people in the United Kingdom, whatever their age.

22Changes to this policy

When we change this policy, we change the effective date at the top, publish the new version at apps.hex.pro/infinilang/privacy and include it in the next version of the app. If a change is significant, for example a new use of information we already hold or a new provider that would receive your text, we will tell you in the app at least 30 days before it takes effect. Where a change needs your permission, we will ask for it first and will not apply the change to you without it.

23Contact

Questions, requests and complaints about privacy: support@hex.pro