Privacy Policy

Last updated: May 10, 2026

1. Controller

The controller responsible for this website is:

Christian Wegermann
c/o IP-Management #5553
Ludwig-Erhard-Str. 18
20459 Hamburg
Germany

Email: info@jp343.com

2. General Information

Protecting your personal data is important to us. This privacy policy explains what data we collect, how we use it, and what rights you have.

You can visit our website without providing personal data. Some features (such as the Leaderboard) are publicly accessible. To use tracking and dashboard features, a free account is required. See Section 4 for details on local storage and Section 6 for account data.

3. Server Log Files

Our hosting provider automatically collects and stores information in server log files that your browser transmits:

  • Browser type and version
  • Operating system
  • Referrer URL (previously visited page)
  • Hostname of the accessing device
  • Time of server request
  • IP address

This data cannot be attributed to specific individuals. We do not merge this data with other data sources. The data is automatically deleted after 7 days.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in website security and stability).

4. Local Storage (Browser Only)

When visiting the website without an account, no personal data is stored on our servers. Only minimal UX flags (for example, dismissal of prompts or onboarding state) may be written to your browser's LocalStorage. These values remain exclusively on your device and are never transmitted to us.

To use tracking and dashboard features, a free account is required (see Section 6).

4.1 Legal Basis

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing basic functionality). No personal data is collected or transmitted without an account.

5. Browser Extension

We offer an optional browser extension ("jp343 Track Your Japanese Immersion") for Chrome, Edge, and Firefox that automatically tracks your immersion time on streaming platforms. The extension has its own dedicated privacy policy covering all data collection, storage, permissions, synchronization, and user controls.

→ Extension Privacy Policy

Community activity feed: If you use the jp343 browser extension and have an account, anonymized activity may appear on jp343.com as part of a community feed. Only the media title and session duration are shown — no account name, username, or any personally identifiable information is ever displayed or linked to this activity. If you use the extension without an account, all data stays on your device and is never shown publicly.

6. Account System (Optional)

Creating an account is completely optional. An account provides these benefits:

  • Cross-device synchronization of your data
  • Backup of your learning progress in our database
  • Access to your data after switching browsers

6.1 Data Stored Upon Registration

When you register for an account, we store:

  • Email address: For login, verification, and important notifications
  • Password: Encrypted as bcrypt hash (plaintext password is not stored)
  • Username: Optional display name (3-10 characters), if chosen
  • IP address: At registration and login for security and rate limiting
  • Timestamps: Registration date, verification date, last login, last activity
  • Verification status: Whether your email has been confirmed

6.2 Account-Related Feature Data

After creating an account, we synchronize the following data:

  • Learning time data: All learning sessions with project, duration (in seconds), activity type, and timestamp
  • Custom Projects: Your self-created projects with full metadata (title, URL, description, icon, color, genre, difficulty)
  • Favorites: Saved resource IDs
  • Achievements: Unlocked achievements and milestones with timestamps
  • Interactions: Your likes and difficulty ratings for resources
  • Rank system: Calculated points and rank level based on your learning activity (no comparisons with other users)
  • Streak data: Current learning streak and longest achieved streak
  • Display preferences: Timezone (IANA identifier), day start hour, daily learning goal, notification settings
  • Goal tracking: Daily goal completion history and counts
  • Leaderboard participation: Opt-in status, calculated season hours (only if opted in), earned and active titles
  • Public profile: When you enable your public profile, your username, rank, tracked hours, activity heatmap, earned titles, season history, and platform breakdown are visible at your profile URL. Leaderboard participation and public profile are independent settings.
  • Profile image: Optional avatar image you upload (stored on our server, resized to 256px and 64px variants). Visible on the leaderboard and your public profile if the respective settings are enabled. Original upload is deleted immediately after processing. Avatar files are removed when you delete the avatar or your account.
  • Personal notes: Optional free-text notes on milestones
  • Submitted resources: Titles and URLs of resources you submit via the submission form
  • Extension API token: Technical token that links our browser extension to your account (revocable at any time)

6.3 Data Processing

Legal basis: Art. 6(1)(b) GDPR (contract fulfillment - providing account services).

Storage period: Your data is stored as long as your account exists. After account deletion, all personal data is removed within 30 days.

6.4 Your Rights (GDPR)

As an account holder, you have the following rights:

  • Access & Export: You can download all your data at any time via My Account → Export Data as a JSON file
  • Rectification: Email and username can be changed in account settings
  • Deletion: Complete account deletion via My Account → Delete Account
  • Data portability: The export contains all data in machine-readable JSON format

6.5 Email Service (Brevo)

For sending emails (verification, password reset), we use the service Brevo (formerly Sendinblue).

  • Data transmitted: Email address, email content
  • Purpose: Transactional emails (verification, password reset, account changes)
  • Provider: Brevo SAS, France (formerly Sendinblue)
  • Privacy: Brevo Privacy Policy

Legal basis: Art. 6(1)(b) GDPR (necessary for account functionality).

6.6 Cookies & Session

When logging in, we set technically necessary session cookies:

  • wordpress_logged_in_*: Authentication cookie for logged-in users
  • wordpress_sec_*: Security cookie

These cookies are required for login functionality and are deleted upon logout or session end.

Legal basis: Art. 6(1)(b) GDPR (technically necessary).

6.7 Rate Limiting

To protect against abuse, we limit registrations to 3 per hour per IP address. IP addresses are temporarily stored (1 hour) in a transient for this purpose.

6.8 Data Security

  • Passwords are stored as bcrypt hash (not in plaintext)
  • All data transfers are encrypted (HTTPS/TLS)
  • CSRF protection via WordPress nonces on all AJAX requests
  • Verification tokens expire after 24 hours

7. Third-Party Services

7.1 Koko Analytics

This website uses Koko Analytics, a privacy-friendly analytics plugin.

  • No cookies: Koko Analytics does not set any cookies
  • No personal data: No IP addresses or other personal data is stored
  • Local processing: All data is processed on our own server

Data collected: Page views, referrer (anonymized), device type

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in website analytics).

Additionally, we count aggregate daily page views split by login status (logged-in vs. guest). Only two integer counters per day are stored. No personal data, IP addresses, or cookies are involved.

7.2 YouTube Videos (Lite Mode)

We embed YouTube videos via lite-youtube-embed. This means no connection to YouTube is made when loading the page.

  • Thumbnail: Loaded from YouTube servers (image only, no tracking scripts)
  • Video loading: The full YouTube player loads only when you click Play

When playing, the Google Privacy Policy applies.

Legal basis: Art. 6(1)(a) GDPR (consent by clicking Play).

7.3 Metadata APIs

To display information about external learning resources, we use the following APIs. Data is fetched only when you actively add a resource:

  • Spotify Web API: Podcast and music metadata (title, cover, description)
    Privacy: Spotify Privacy Policy
  • Apple Podcasts / iTunes API: Podcast information
    Privacy: Apple Privacy Policy
  • Steam Store API: Game and visual novel metadata
    Privacy: Steam Privacy Policy
  • AniList GraphQL API: Anime, manga, and visual novel metadata (title, cover image, description)
    Privacy: AniList Terms & Privacy
  • noembed.com: Generic URL titles for OpenGraph fallback

Data transmitted: The resource URL, your IP address (to the respective service)

Additionally, cover images and thumbnails are loaded directly by your browser from external providers (e.g. image.tmdb.org, s4.anilist.co, i.ytimg.com) when you view resource tiles. The provider sees your IP address when its image is loaded.

Legal basis: Art. 6(1)(a) GDPR (consent by actively adding a resource); Art. 6(1)(f) GDPR for passive image loading on pages you view (legitimate interest in functional display).

7.4 Icon Services

For platform icons and symbols, we use:

  • Iconify API (api.iconify.design): SVG icons for platforms (YouTube, Spotify, Steam, etc.)
  • Google Favicon API: Website favicons as fallback for unknown domains

Data transmitted: Your IP address; for Favicon API also the domain name

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in functional display).

7.5 CDN Services

We load external resources from Content Delivery Networks:

Data transmitted: Your IP address, user agent, referrer

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in fast and reliable delivery).

7.6 Ko-fi (External Link)

This website contains a link to our Ko-fi page for voluntary support. Clicking this link takes you to ko-fi.com, which is operated by Ko-fi Labs Limited. We do not receive any personal data through this link. Any data you provide on Ko-fi is governed by the Ko-fi Privacy Policy.

8. Contact & Right to Complain

For questions about data protection, you can contact us at any time:

Email: info@jp343.com

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data.

9. Changes to This Privacy Policy

We reserve the right to update this privacy policy as needed to reflect changes in legal requirements or service changes. The current version is always available on this page.