Privacy Policy

Last updated: July 8, 2026

1. Controller

The controller responsible for this website is:

Christian Wegermann
c/o IP-Management #5553
Ludwig-Erhard-Str. 18
20459 Hamburg
Germany

Email: info@jp343.com

2. General Information

Protecting your personal data is important to us. This privacy policy explains what data we collect, how we use it, and what rights you have.

You can visit our website without providing personal data. Some features (such as the Leaderboard) are publicly accessible. To use tracking and dashboard features, a free account is required. See Section 4 for details on local storage and Section 6 for account data.

3. Server Log Files

Our hosting provider automatically collects and stores information in server log files that your browser transmits:

  • Browser type and version
  • Operating system
  • Referrer URL (previously visited page)
  • Hostname of the accessing device
  • Time of server request
  • IP address

This data cannot be attributed to specific individuals. We do not merge this data with other data sources. The data is automatically deleted after 7 days.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in website security and stability).

4. Local Storage (Browser Only)

When visiting the website without an account, we do not store learning or tracking data on our servers. Minimal UX flags (for example, dismissal of prompts, onboarding state, or your most recent podcast playback position) are written to your browser's LocalStorage. These values remain exclusively on your device and are never transmitted to us.

Two narrow exceptions apply when guests use the Podcast Player: (1) to prevent abuse, a short-lived rate-limiting counter (keyed to a hashed value derived from your IP address) may be stored on our server for up to 60 seconds (see also Section 6.7); and (2) when you play an episode or view podcast artwork, your browser connects directly to the respective podcast's hosting provider (see Section 7.9).

To use tracking and dashboard features, a free account is required (see Section 6).

4.1 Legal Basis

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing basic functionality and protecting against abuse).

5. Browser Extension

We offer an optional browser extension ("jp343 Track Your Japanese Immersion") for Chrome, Edge, and Firefox that automatically tracks your immersion time on streaming platforms. The extension has its own dedicated privacy policy covering all data collection, storage, permissions, synchronization, and user controls.

→ Extension Privacy Policy

Community activity feed: If you use the jp343 browser extension and have an account, anonymized activity may appear on jp343.com as part of a community feed. Only the media title and session duration are shown — no account name, username, or any personally identifiable information is ever displayed or linked to this activity. If you use the extension without an account, all data stays on your device and is never shown publicly.

6. Account System (Optional)

Creating an account is completely optional. An account provides these benefits:

  • Cross-device synchronization of your data
  • Backup of your learning progress in our database
  • Access to your data after switching browsers

6.1 Data Stored Upon Registration

When you register for an account, we store:

  • Email address: For login, verification, and important notifications
  • Password: Encrypted as bcrypt hash (plaintext password is not stored)
  • Username: Optional display name (3-10 characters), if chosen
  • IP address: At registration and login for security and rate limiting
  • Timestamps: Registration date, verification date, last login, last activity
  • Verification status: Whether your email has been confirmed

6.2 Account-Related Feature Data

After creating an account, we synchronize the following data:

  • Learning time data: All learning sessions with project, duration (in seconds), activity type, and timestamp. Podcast listening sessions are included and additionally record the podcast and episode title, author, and cover image
  • Custom Projects: Your self-created projects with full metadata (title, URL, description, icon, color, genre, difficulty)
  • Favorites: Saved resource IDs
  • Podcast subscriptions: The podcasts you subscribe to in the Podcast Player (feed URL, title, author, and your per-show skip-intro/outro settings)
  • Podcast playback progress: Your playback position, completion status, and play count per episode
  • Podcast playlists & favorites: Episodes you save to a playlist or your favorites list (episode title, audio URL, and date added)
  • Podcast queue & now playing: Episodes you add to your up-next queue and a pointer to the episode you are currently playing, kept in sync across your devices (feed URL, episode title, and position in the queue)
  • Achievements: Unlocked achievements and milestones with timestamps
  • Interactions: Your likes and difficulty ratings for resources
  • Rank system: Calculated points and rank level based on your learning activity (no comparisons with other users)
  • Streak data: Current learning streak and longest achieved streak
  • Display preferences: Timezone (IANA identifier), day start hour, daily learning goal, notification settings
  • Goal tracking: Daily goal completion history and counts
  • Leaderboard visibility: If you choose a username, your name, tracked hours, rank and streak appear on the public leaderboard by default. You can appear anonymously by not setting a username, or by clearing it later. We store your visibility status, calculated season hours, earned and active titles, and daily position snapshots during active seasons. Archived season standings keep their placement history; if you delete your account, your name in past season archives is replaced with an anonymous placeholder.
  • Public profile: Your profile page (username, rank, tracked hours, activity heatmap, earned titles, season history, and platform breakdown) is public by default once you have a username. You can make it private in your account settings; this hides only the profile page, while your name and hours stay on the leaderboard. Leaderboard visibility and public profile are independent settings. Which statistics cards the profile shows (activity heatmap, immersion mix, platforms, records, consistency, weekly trend, recent sessions, Anki, reading) is controlled by per-card toggles in the profile studio; newly added cards start hidden until you enable them.
  • Profile customization: Optional about text, social links, card design settings (banner, frame, accent, flair, featured milestones), favorite picks, and your stats card visibility settings you configure in the profile studio. Included in your data export and removed when you delete your account.
  • Profile image: Optional avatar image you upload (stored on our server, resized to 256px and 64px variants). Visible on the leaderboard and your public profile if the respective settings are enabled. Original upload is deleted immediately after processing. Avatar files are removed when you delete the avatar or your account.
  • Cheers and follows: If you cheer another member's profile or follow them, we store your account, the target account, the reaction type and the time. Cheer counts appear on the target's public profile; when two members follow each other, the pair can appear in both profiles' Mutuals section (hideable in the profile studio, and only shown while both profiles are public). These entries power the recipient's notification bell; your name is only shown there if your own profile is public. Unfollowing or removing a cheer deletes the entry. Included in your data export (received entries without sender identity) and deleted with your account.
  • Notification state: So the bell can highlight what is new, we store, per notification type, the point in time up to which you last opened it. If you dismiss a single notification, we additionally remember which one it was and when, solely so that it does not reappear. A daily cleanup routine removes dismissal entries once they are older than four months; the read timestamps are removed together with your account. Both are included in your data export.
  • Personal notes: Optional free-text notes on milestones
  • Submitted resources: Titles and URLs of resources you submit via the submission form
  • Extension API token: Technical token that links our browser extension to your account (revocable at any time)
  • Extension version: The version number of your installed browser extension, transmitted with sync requests so we can ensure compatibility and safely roll out security updates
  • Support tickets: Subject, message, page URL, and browser info when you submit feedback. Admin replies are stored with the ticket. Ticket data is retained while your account exists and deleted on account deletion. Not shared with third parties.
  • Anki study data: Daily study time, review counts, retention, and card/known-word counts — only if you enable Anki tracking in the browser extension settings. Aggregated Anki statistics appear on your public profile only if you additionally enable the Anki card in the profile studio (off by default)
  • Reader reading data: Reading time, book/manga series or volume titles read, and character count, only if you enable Mokuro or ttu reader reading tracking in the browser extension settings (beta). For Mokuro specifically, this also includes your reading progress per volume (current page and whether it is finished). Aggregated reading statistics appear on your public profile only if you additionally enable the Reading card in the profile studio (off by default)
  • Difficulty ratings: If you rate a video's difficulty from the browser extension, your rating and the channel and video it applies to, used to refine the community difficulty levels shown to everyone. If you delete your account, your ratings are kept as anonymous community data — the link to your account, the specific video, the exact date, and your hours figure are removed or coarsened — so the community levels stay accurate for everyone. On channels with too few other contributors to anonymize safely, your ratings are deleted outright instead.

6.3 Data Processing

Legal basis: Art. 6(1)(b) GDPR (contract fulfillment - providing account services).

Storage period: Your data is stored as long as your account exists. After account deletion, all personal data is removed within 30 days. Two categories are anonymized instead of deleted: your placement in past leaderboard season archives, and your difficulty ratings (see Section 6.2). In both cases the link to your account and any other identifying detail is removed; only a non-identifying community contribution remains.

6.4 Your Rights (GDPR)

As an account holder, you have the following rights:

  • Access & Export: You can download all your data at any time via My Account → Export Data as a JSON file
  • Rectification: Email and username can be changed in account settings
  • Deletion: Complete account deletion via My Account → Delete Account
  • Data portability: The export contains all data in machine-readable JSON format

6.5 Email Service (Brevo)

For sending emails (verification, password reset), we use the service Brevo (formerly Sendinblue).

  • Data transmitted: Email address, email content
  • Purpose: Transactional emails (verification, password reset, account changes)
  • Provider: Brevo SAS, France (formerly Sendinblue)
  • Privacy: Brevo Privacy Policy

Legal basis: Art. 6(1)(b) GDPR (necessary for account functionality).

6.6 Cookies & Session

When logging in, we set technically necessary session cookies:

  • wordpress_logged_in_*: Authentication cookie for logged-in users
  • wordpress_sec_*: Security cookie

These cookies are required for login functionality and are deleted upon logout or session end.

Legal basis: Art. 6(1)(b) GDPR (technically necessary).

6.7 Rate Limiting

To protect against abuse, we limit registrations to 3 per hour per IP address. IP addresses are temporarily stored (1 hour) in a transient for this purpose.

6.8 Data Security

  • Passwords are stored as bcrypt hash (not in plaintext)
  • All data transfers are encrypted (HTTPS/TLS)
  • CSRF protection via WordPress nonces on all AJAX requests
  • Verification tokens expire after 24 hours

7. Third-Party Services

7.1 Koko Analytics

This website uses Koko Analytics, a privacy-friendly analytics plugin.

  • No cookies: Koko Analytics does not set any cookies
  • No personal data: No IP addresses or other personal data is stored
  • Local processing: All data is processed on our own server

Data collected: Page views, referrer (anonymized), device type

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in website analytics).

Additionally, we count aggregate daily page views split by login status (logged-in vs. guest). Only two integer counters per day are stored. No personal data, IP addresses, or cookies are involved.

7.2 YouTube Videos (Lite Mode)

We embed YouTube videos via lite-youtube-embed. This means no connection to YouTube is made when loading the page.

  • Thumbnail: Loaded from YouTube servers (image only, no tracking scripts)
  • Video loading: The full YouTube player loads only when you click Play

When playing, the Google Privacy Policy applies.

Legal basis: Art. 6(1)(a) GDPR (consent by clicking Play).

7.3 Metadata APIs

To display information about external learning resources, we use the following APIs. Data is fetched only when you actively add a resource (the Podcast Player additionally queries Apple/iTunes and, as a fallback, the Podcast Index API server-side; see Section 7.9):

  • Spotify Web API: Podcast and music metadata (title, cover, description)
    Privacy: Spotify Privacy Policy
  • Apple Podcasts / iTunes API: Podcast information
    Privacy: Apple Privacy Policy
  • Steam Store API: Game and visual novel metadata
    Privacy: Steam Privacy Policy
  • AniList GraphQL API: Anime, manga, and visual novel metadata (title, cover image, description)
    Privacy: AniList Terms & Privacy
  • noembed.com: Generic URL titles for OpenGraph fallback

Data transmitted: The resource URL, your IP address (to the respective service)

Additionally, cover images and thumbnails are loaded directly by your browser from external providers (e.g. image.tmdb.org, s4.anilist.co, i.ytimg.com) when you view resource tiles. The provider sees your IP address when its image is loaded.

Legal basis: Art. 6(1)(a) GDPR (consent by actively adding a resource); Art. 6(1)(f) GDPR for passive image loading on pages you view (legitimate interest in functional display).

7.4 Icon Services

For platform icons and symbols, we use:

  • Iconify API (api.iconify.design): SVG icons for platforms (YouTube, Spotify, Steam, etc.)
  • Google Favicon API: Website favicons as fallback for unknown domains

Data transmitted: Your IP address; for Favicon API also the domain name

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in functional display).

7.5 CDN Services

We load external resources from Content Delivery Networks:

Data transmitted: Your IP address, user agent, referrer

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in fast and reliable delivery).

7.6 Discord Account Linking

You can optionally connect your Discord account to your JP343 account via Discord OAuth2 (Authorization Code Grant).

  • Scope: identify only (your Discord user ID, username, and avatar)
  • No access to your messages, servers, friends, or email
  • Access token is not stored. It is used once to retrieve your profile, then discarded
  • Data stored: Discord user ID, display name, avatar hash, and connection timestamp
  • Purpose: Linking your accounts enables Discord role assignment and stats display via our Discord bot

You can disconnect your Discord account at any time in your account settings. Upon disconnection or account deletion, all stored Discord data is removed.

Legal basis: Art. 6(1)(a) GDPR (consent by initiating the connection).

7.7 Ko-fi (Voluntary Support)

This website links to our Ko-fi page for voluntary support. Clicking the link takes you to ko-fi.com, operated by Ko-fi Labs Limited; any data you provide there is governed by the Ko-fi Privacy Policy.

If you make a payment on Ko-fi, Ko-fi sends our server a notification (webhook). To unlock a "Supporter" badge on your JP343 profile, you may include a personal support code (shown in your account settings) in the Ko-fi message; we use that code to link the payment to your account.

  • Data stored: payment type, amount, currency, tier name, the Ko-fi transaction ID, and the support code you entered, kept for badge attribution and audit.
  • Not stored: we deliberately do not store the donor name or email from Ko-fi. Attribution happens via your code, not your email address.
  • Internal notification: we may forward a payment notice to an internal team Discord channel (the donor name appears only if you chose to make the donation public on Ko-fi; the support code is removed beforehand).
  • Deletion: the stored payment record is removed when you delete your account. Payment records that could not be linked to any account are deleted automatically after 180 days.

Legal basis: Art. 6(1)(b) GDPR (providing the Supporter badge you requested by submitting your code) and Art. 6(1)(f) GDPR (legitimate interest in attribution and abuse prevention).

7.8 Patreon (Account Linking)

You can optionally connect your Patreon account to your JP343 account via Log in with Patreon (OAuth2, Authorization Code Grant) to receive a live "Active Patreon Supporter" badge.

  • Access token is not stored. It is used once to read your Patreon user ID and your membership status for our page, then discarded.
  • Data stored: your Patreon user ID, current tier, active-status flag, and connection timestamp.
  • Not stored: we do not store your Patreon email. Attribution is by your Patreon account ID (proven via OAuth).
  • Status refresh: to keep your badge current, our server periodically queries Patreon's API for our campaign's membership using our own creator credentials.
  • Real-time updates (webhook): Patreon also sends our server a signed notification when your membership changes (created, updated, cancelled). We verify its signature, then update your badge status and store a minimised record (membership status and amount only). We do not store your Patreon name or email from this notification.
  • Purpose: displaying your Supporter badges on your profile.

You can disconnect at any time in your account settings. Upon disconnection or account deletion, your stored Patreon link data is removed.

Legal basis: Art. 6(1)(a) GDPR (consent by initiating the connection).

7.9 Podcast Player

Our Podcast Player lets you search for, subscribe to, and listen to public podcasts. It involves two kinds of data flow:

a) Server-side lookups. The following requests are made by our server (and cached for performance), so these providers see our server's IP address, not yours. They run when you search, view recommendations, open or refresh a feed, or subscribe:

  • Apple / iTunes Search API: podcast search and recommended-show lookups. Transmitted: your search terms and podcast/collection IDs.
  • Podcast RSS feeds: a podcast's own feed is fetched to list its episodes (also refreshed periodically in the background).
  • Podcast Index API (fallback only): used only if a direct RSS fetch fails. Transmitted: the podcast's feed URL.
    Search powered by Podcast Index.

Although these run server-side, your search terms reflect your interests and are processed as personal data to provide the feature.

b) Direct connections from your browser. When you press play, your browser streams the audio file directly from the podcast's own hosting/CDN provider, which differs from podcast to podcast. Episode and cover images are likewise loaded directly from the podcast's hosting provider and from Apple's artwork CDN (mzstatic.com). These providers receive your IP address, user agent, and, for audio, information about your playback. We do not proxy this traffic through our servers, so the recipient is whichever provider hosts the podcast you choose.

Legal basis: Art. 6(1)(a) GDPR (consent, given by pressing play) for audio streaming; audio is not requested before you start playback. Art. 6(1)(f) GDPR (legitimate interest in displaying functional cover artwork) for podcast images.

8. Contact & Right to Complain

For questions about data protection, you can contact us at any time:

Email: info@jp343.com

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data.

9. Changes to This Privacy Policy

We reserve the right to update this privacy policy as needed to reflect changes in legal requirements or service changes. The current version is always available on this page.