Privacy Policy

Last updated: May 29, 2026

1. Controller

The controller responsible for this website is:

Christian Wegermann
c/o IP-Management #5553
Ludwig-Erhard-Str. 18
20459 Hamburg
Germany

Email: info@jp343.com

2. General Information

Protecting your personal data is important to us. This privacy policy explains what data we collect, how we use it, and what rights you have.

You can visit our website without providing personal data. Some features (such as the Leaderboard) are publicly accessible. To use tracking and dashboard features, a free account is required. See Section 4 for details on local storage and Section 6 for account data.

3. Server Log Files

Our hosting provider automatically collects and stores information in server log files that your browser transmits:

  • Browser type and version
  • Operating system
  • Referrer URL (previously visited page)
  • Hostname of the accessing device
  • Time of server request
  • IP address

This data cannot be attributed to specific individuals. We do not merge this data with other data sources. The data is automatically deleted after 7 days.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in website security and stability).

4. Local Storage (Browser Only)

When visiting the website without an account, we do not store learning or tracking data on our servers. Minimal UX flags (for example, dismissal of prompts, onboarding state, or your most recent podcast playback position) are written to your browser's LocalStorage. These values remain exclusively on your device and are never transmitted to us.

Two narrow exceptions apply when guests use the Podcast Player: (1) to prevent abuse, a short-lived rate-limiting counter (keyed to a hashed value derived from your IP address) may be stored on our server for up to 60 seconds (see also Section 6.7); and (2) when you play an episode or view podcast artwork, your browser connects directly to the respective podcast's hosting provider (see Section 7.8).

To use tracking and dashboard features, a free account is required (see Section 6).

4.1 Legal Basis

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing basic functionality and protecting against abuse).

5. Browser Extension

We offer an optional browser extension ("jp343 Track Your Japanese Immersion") for Chrome, Edge, and Firefox that automatically tracks your immersion time on streaming platforms. The extension has its own dedicated privacy policy covering all data collection, storage, permissions, synchronization, and user controls.

→ Extension Privacy Policy

Community activity feed: If you use the jp343 browser extension and have an account, anonymized activity may appear on jp343.com as part of a community feed. Only the media title and session duration are shown — no account name, username, or any personally identifiable information is ever displayed or linked to this activity. If you use the extension without an account, all data stays on your device and is never shown publicly.

6. Account System (Optional)

Creating an account is completely optional. An account provides these benefits:

  • Cross-device synchronization of your data
  • Backup of your learning progress in our database
  • Access to your data after switching browsers

6.1 Data Stored Upon Registration

When you register for an account, we store:

  • Email address: For login, verification, and important notifications
  • Password: Encrypted as bcrypt hash (plaintext password is not stored)
  • Username: Optional display name (3-10 characters), if chosen
  • IP address: At registration and login for security and rate limiting
  • Timestamps: Registration date, verification date, last login, last activity
  • Verification status: Whether your email has been confirmed

6.2 Account-Related Feature Data

After creating an account, we synchronize the following data:

  • Learning time data: All learning sessions with project, duration (in seconds), activity type, and timestamp. Podcast listening sessions are included and additionally record the podcast and episode title, author, and cover image
  • Custom Projects: Your self-created projects with full metadata (title, URL, description, icon, color, genre, difficulty)
  • Favorites: Saved resource IDs
  • Podcast subscriptions: The podcasts you subscribe to in the Podcast Player (feed URL, title, author, and your per-show skip-intro/outro settings)
  • Podcast playback progress: Your playback position, completion status, and play count per episode
  • Podcast playlists & favorites: Episodes you save to a playlist or your favorites list (episode title, audio URL, and date added)
  • Podcast queue & now playing: Episodes you add to your up-next queue and a pointer to the episode you are currently playing, kept in sync across your devices (feed URL, episode title, and position in the queue)
  • Achievements: Unlocked achievements and milestones with timestamps
  • Interactions: Your likes and difficulty ratings for resources
  • Rank system: Calculated points and rank level based on your learning activity (no comparisons with other users)
  • Streak data: Current learning streak and longest achieved streak
  • Display preferences: Timezone (IANA identifier), day start hour, daily learning goal, notification settings
  • Goal tracking: Daily goal completion history and counts
  • Leaderboard participation: Opt-in status, calculated season hours (only if opted in), earned and active titles
  • Public profile: When you enable your public profile, your username, rank, tracked hours, activity heatmap, earned titles, season history, and platform breakdown are visible at your profile URL. Leaderboard participation and public profile are independent settings.
  • Profile image: Optional avatar image you upload (stored on our server, resized to 256px and 64px variants). Visible on the leaderboard and your public profile if the respective settings are enabled. Original upload is deleted immediately after processing. Avatar files are removed when you delete the avatar or your account.
  • Personal notes: Optional free-text notes on milestones
  • Submitted resources: Titles and URLs of resources you submit via the submission form
  • Extension API token: Technical token that links our browser extension to your account (revocable at any time)
  • Support tickets: Subject, message, page URL, and browser info when you submit feedback. Admin replies are stored with the ticket. Ticket data is retained while your account exists and deleted on account deletion. Not shared with third parties.

6.3 Data Processing

Legal basis: Art. 6(1)(b) GDPR (contract fulfillment - providing account services).

Storage period: Your data is stored as long as your account exists. After account deletion, all personal data is removed within 30 days.

6.4 Your Rights (GDPR)

As an account holder, you have the following rights:

  • Access & Export: You can download all your data at any time via My Account → Export Data as a JSON file
  • Rectification: Email and username can be changed in account settings
  • Deletion: Complete account deletion via My Account → Delete Account
  • Data portability: The export contains all data in machine-readable JSON format

6.5 Email Service (Brevo)

For sending emails (verification, password reset), we use the service Brevo (formerly Sendinblue).

  • Data transmitted: Email address, email content
  • Purpose: Transactional emails (verification, password reset, account changes)
  • Provider: Brevo SAS, France (formerly Sendinblue)
  • Privacy: Brevo Privacy Policy

Legal basis: Art. 6(1)(b) GDPR (necessary for account functionality).

6.6 Cookies & Session

When logging in, we set technically necessary session cookies:

  • wordpress_logged_in_*: Authentication cookie for logged-in users
  • wordpress_sec_*: Security cookie

These cookies are required for login functionality and are deleted upon logout or session end.

Legal basis: Art. 6(1)(b) GDPR (technically necessary).

6.7 Rate Limiting

To protect against abuse, we limit registrations to 3 per hour per IP address. IP addresses are temporarily stored (1 hour) in a transient for this purpose.

6.8 Data Security

  • Passwords are stored as bcrypt hash (not in plaintext)
  • All data transfers are encrypted (HTTPS/TLS)
  • CSRF protection via WordPress nonces on all AJAX requests
  • Verification tokens expire after 24 hours

7. Third-Party Services

7.1 Koko Analytics

This website uses Koko Analytics, a privacy-friendly analytics plugin.

  • No cookies: Koko Analytics does not set any cookies
  • No personal data: No IP addresses or other personal data is stored
  • Local processing: All data is processed on our own server

Data collected: Page views, referrer (anonymized), device type

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in website analytics).

Additionally, we count aggregate daily page views split by login status (logged-in vs. guest). Only two integer counters per day are stored. No personal data, IP addresses, or cookies are involved.

7.2 YouTube Videos (Lite Mode)

We embed YouTube videos via lite-youtube-embed. This means no connection to YouTube is made when loading the page.

  • Thumbnail: Loaded from YouTube servers (image only, no tracking scripts)
  • Video loading: The full YouTube player loads only when you click Play

When playing, the Google Privacy Policy applies.

Legal basis: Art. 6(1)(a) GDPR (consent by clicking Play).

7.3 Metadata APIs

To display information about external learning resources, we use the following APIs. Data is fetched only when you actively add a resource (the Podcast Player additionally queries Apple/iTunes and, as a fallback, the Podcast Index API server-side; see Section 7.8):

  • Spotify Web API: Podcast and music metadata (title, cover, description)
    Privacy: Spotify Privacy Policy
  • Apple Podcasts / iTunes API: Podcast information
    Privacy: Apple Privacy Policy
  • Steam Store API: Game and visual novel metadata
    Privacy: Steam Privacy Policy
  • AniList GraphQL API: Anime, manga, and visual novel metadata (title, cover image, description)
    Privacy: AniList Terms & Privacy
  • noembed.com: Generic URL titles for OpenGraph fallback

Data transmitted: The resource URL, your IP address (to the respective service)

Additionally, cover images and thumbnails are loaded directly by your browser from external providers (e.g. image.tmdb.org, s4.anilist.co, i.ytimg.com) when you view resource tiles. The provider sees your IP address when its image is loaded.

Legal basis: Art. 6(1)(a) GDPR (consent by actively adding a resource); Art. 6(1)(f) GDPR for passive image loading on pages you view (legitimate interest in functional display).

7.4 Icon Services

For platform icons and symbols, we use:

  • Iconify API (api.iconify.design): SVG icons for platforms (YouTube, Spotify, Steam, etc.)
  • Google Favicon API: Website favicons as fallback for unknown domains

Data transmitted: Your IP address; for Favicon API also the domain name

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in functional display).

7.5 CDN Services

We load external resources from Content Delivery Networks:

Data transmitted: Your IP address, user agent, referrer

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in fast and reliable delivery).

7.6 Discord Account Linking

You can optionally connect your Discord account to your JP343 account via Discord OAuth2 (Authorization Code Grant).

  • Scope: identify only (your Discord user ID, username, and avatar)
  • No access to your messages, servers, friends, or email
  • Access token is not stored. It is used once to retrieve your profile, then discarded
  • Data stored: Discord user ID, display name, avatar hash, and connection timestamp
  • Purpose: Linking your accounts enables Discord role assignment and stats display via our Discord bot

You can disconnect your Discord account at any time in your account settings. Upon disconnection or account deletion, all stored Discord data is removed.

Legal basis: Art. 6(1)(a) GDPR (consent by initiating the connection).

7.7 Ko-fi (External Link)

This website contains a link to our Ko-fi page for voluntary support. Clicking this link takes you to ko-fi.com, which is operated by Ko-fi Labs Limited. We do not receive any personal data through this link. Any data you provide on Ko-fi is governed by the Ko-fi Privacy Policy.

7.8 Podcast Player

Our Podcast Player lets you search for, subscribe to, and listen to public podcasts. It involves two kinds of data flow:

a) Server-side lookups. The following requests are made by our server (and cached for performance), so these providers see our server's IP address, not yours. They run when you search, view recommendations, open or refresh a feed, or subscribe:

  • Apple / iTunes Search API: podcast search and recommended-show lookups. Transmitted: your search terms and podcast/collection IDs.
  • Podcast RSS feeds: a podcast's own feed is fetched to list its episodes (also refreshed periodically in the background).
  • Podcast Index API (fallback only): used only if a direct RSS fetch fails. Transmitted: the podcast's feed URL.
    Search powered by Podcast Index.

Although these run server-side, your search terms reflect your interests and are processed as personal data to provide the feature.

b) Direct connections from your browser. When you press play, your browser streams the audio file directly from the podcast's own hosting/CDN provider, which differs from podcast to podcast. Episode and cover images are likewise loaded directly from the podcast's hosting provider and from Apple's artwork CDN (mzstatic.com). These providers receive your IP address, user agent, and, for audio, information about your playback. We do not proxy this traffic through our servers, so the recipient is whichever provider hosts the podcast you choose.

Legal basis: Art. 6(1)(a) GDPR (consent, given by pressing play) for audio streaming; audio is not requested before you start playback. Art. 6(1)(f) GDPR (legitimate interest in displaying functional cover artwork) for podcast images.

8. Contact & Right to Complain

For questions about data protection, you can contact us at any time:

Email: info@jp343.com

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data.

9. Changes to This Privacy Policy

We reserve the right to update this privacy policy as needed to reflect changes in legal requirements or service changes. The current version is always available on this page.