Privacy Policy

Last updated: October 13, 2026

1. Controller

The controller responsible for this website, including the jp343 Reader at reader.jp343.com, is:

Christian Wegermann
c/o IP-Management #5553
Ludwig-Erhard-Str. 18
20459 Hamburg
Germany

Email: info@jp343.com

2. General Information

Protecting your personal data is important to us. This privacy policy explains what data we collect, how we use it, and what rights you have.

You can visit our website without providing personal data. Some features (such as the Leaderboard) are publicly accessible. To use tracking and dashboard features, a free account is required. See Section 4 for details on local storage and Section 6 for account data.

3. Server Log Files

Our hosting provider automatically collects and stores information in server log files that your browser transmits:

  • Browser type and version
  • Operating system
  • Referrer URL (previously visited page)
  • Hostname of the accessing device
  • Time of server request
  • IP address

This data cannot be attributed to specific individuals. We do not merge this data with other data sources. The data is automatically deleted after 7 days. The same applies to reader.jp343.com, including when the Reader loads its own files or a dictionary.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in website security and stability).

4. Local Storage (Browser Only)

When visiting the website without an account, we do not store learning or tracking data on our servers. Minimal UX flags (for example, dismissal of prompts, onboarding state, or your most recent podcast playback position) are written to your browser's LocalStorage. These values remain exclusively on your device and are never transmitted to us.

Two narrow exceptions apply when guests use the Podcast Player: (1) to prevent abuse, a short-lived rate-limiting counter (keyed to a hashed value derived from your IP address) may be stored on our server for up to 60 seconds (see also Section 6.7); and (2) when you play an episode or view podcast artwork, your browser connects directly to the respective podcast's hosting provider (see Section 7.9).

To use tracking and dashboard features, a free account is required (see Section 6).

4.1 Legal Basis

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing basic functionality and protecting against abuse).

4.2 jp343 Reader (Browser Storage)

The jp343 Reader stores your books, manga, reading positions, bookmarks, reading history, settings and installed dictionaries in your browser (IndexedDB). For offline use, it keeps a copy of its own program files in the browser cache. A few small settings (for example whether Anki pictures are turned on) are kept in LocalStorage. Book files are opened in your browser and never uploaded. Backups you create are saved as a file on your device and do not contain your account token.

When you install a recommended dictionary, your browser downloads it from reader.jp343.com. No third party is involved, and we do not record which dictionary you installed beyond the server log files (Section 3).

If you turn on Anki pictures, the Reader connects to the AnkiConnect add-on on your own computer (127.0.0.1) and sends it the picture of the speech bubble and the book title. This connection does not leave your device, and nothing is sent to us.

Clearing your browser's website data for reader.jp343.com deletes all of this.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing the Reader's basic functionality); for Anki pictures and account connection, the action you start yourself.

5. Browser Extension

We offer an optional browser extension ("jp343 Track Your Japanese Immersion") for Chrome, Edge, and Firefox that automatically tracks your immersion time on streaming platforms. The extension has its own dedicated privacy policy covering all data collection, storage, permissions, synchronization, and user controls.

→ Extension Privacy Policy

Active/passive tag: Time entries from the browser extension may include an active/passive tag, derived from whether the video tab was visible and focused during playback. The tag can be edited afterwards.

Community activity feed: If you use the jp343 browser extension and have an account, anonymized activity may appear on jp343.com as part of a community feed. Only the media title and session duration are shown — no account name, username, or any personally identifiable information is ever displayed or linked to this activity. If you use the extension without an account, all data stays on your device and is never shown publicly.

6. Account System (Optional)

Creating an account is completely optional. An account provides these benefits:

  • Cross-device synchronization of your data
  • Backup of your learning progress in our database
  • Access to your data after switching browsers

6.1 Data Stored Upon Registration

When you register for an account, we store:

  • Email address: For login, verification, and important notifications
  • Password: Encrypted as bcrypt hash (plaintext password is not stored)
  • Username: Optional display name (3-10 characters), if chosen
  • IP address: At registration and login for security and rate limiting
  • Timestamps: Registration date, verification date, last login, last activity
  • Verification status: Whether your email has been confirmed

6.2 Account-Related Feature Data

After creating an account, we synchronize the following data:

  • Learning time data: All learning sessions with project, duration (in seconds), activity type, and timestamp. Sessions you log manually also store the link you entered, if any, and a preview image (the YouTube thumbnail for YouTube links, otherwise the image address you entered, if any). Podcast listening sessions are included and additionally record the podcast and episode title, author, and cover image
  • Custom Projects: Your self-created projects with full metadata (title, URL, description, icon, color, genre, difficulty)
  • Favorites: Saved resource IDs
  • Podcast subscriptions: The podcasts you subscribe to in the Podcast Player (feed URL, title, author, and your per-show skip-intro/outro settings)
  • Podcast playback progress: Your playback position, completion status, and play count per episode
  • Podcast playlists: Your playlists (name, optional description, and color) and the episodes in them (episode title, feed and audio URL, cover image, duration, and date added)
  • Podcast queue & now playing: Episodes you add to your up-next queue and a pointer to the episode you are currently playing, kept in sync across your devices (feed URL, episode title, and position in the queue)
  • Podcast folders: Folders you create to organize your subscriptions (folder name, color, and which of your subscribed podcasts are in it)
  • Shared podcast lists: When you actively share a playlist or a selection of your subscribed podcasts, a public snapshot (list title, description, episode and show titles with cover art) is hosted at a non-guessable random URL until you end the share or delete your account
  • Podcast bookmarks: Timestamps you set within an episode (position in seconds) with an optional title
  • Achievements: Unlocked achievements and milestones with timestamps
  • Interactions: Your likes and difficulty ratings for resources
  • Rank system: Calculated points and rank level based on your learning activity (no comparisons with other users)
  • Streak data: Current learning streak and longest achieved streak
  • Display preferences: Timezone (IANA identifier), day start hour, daily learning goal, notification settings
  • Goal tracking: Daily goal completion history and counts
  • Leaderboard visibility: The public leaderboard has two boards. The Season board lists only members who joined the current season. Joining requires a username and a verified email address, and the board shows your username, verified hours, rank and streak. The All Time board lists every member with at least 1 verified hour (time tracked automatically by the browser extension or the Podcast Player; manually logged time does not count). There you appear with your username once you have one. Without a username you appear as the anonymous placeholder 仲間, with your hours, rank and streak but without name, avatar or profile link. Accounts created before July 12, 2026 that never joined a season also appear as 仲間 there. Without a username, or after you clear it, your name does not appear on either board. We store your visibility status, calculated season hours, earned and active titles, and daily position snapshots during active seasons. Archived season standings keep their placement history; if you delete your account, your name in past season archives is replaced with an anonymous placeholder.
  • Public profile: Your profile page (username, rank, tracked hours, activity heatmap, earned titles, season history, and platform breakdown) is private by default. It only becomes public when you turn on "Public profile" in the Privacy tab of the profile studio, which requires a username and a verified email address. You can turn it off again at any time. A private profile hides only the profile page; your leaderboard entry stays as described above. Leaderboard visibility and public profile are independent of each other. Which statistics cards the profile shows (activity heatmap, immersion mix, platforms, records, consistency, weekly trend, recent sessions, Anki, reading) is controlled by per-card toggles in the profile studio; newly added cards start hidden until you enable them.
  • Previous usernames: If you change your username, we keep the old one together with the date of the change, so that links to your old profile address can forward to the new one (only while your profile is public). They are part of your data export and are deleted with your account.
  • Profile customization: Optional about text, social links, card design settings (banner, frame, accent, flair, featured milestones), favorite picks, and your stats card visibility settings you configure in the profile studio. Included in your data export and removed when you delete your account.
  • Profile image: Optional avatar image you upload (stored on our server, resized to 256px and 64px variants). Visible on the leaderboard and your public profile if the respective settings are enabled. Original upload is deleted immediately after processing. Avatar files are removed when you delete the avatar or your account.
  • Cheers and follows: If you cheer another member's profile or follow them, we store your account, the target account, the reaction type and the time. Cheer counts appear on the target's public profile; when two members follow each other, the pair can appear in both profiles' Mutuals section (hideable in the profile studio, and only shown while both profiles are public). These entries power the recipient's notification bell; your name is only shown there if your own profile is public. Unfollowing or removing a cheer deletes the entry. Included in your data export (received entries without sender identity) and deleted with your account.
  • Notification state: So the bell can highlight what is new, we store, per notification type, the point in time up to which you last opened it. If you dismiss a single notification, we additionally remember which one it was and when, solely so that it does not reappear. A daily cleanup routine removes dismissal entries once they are older than four months; the read timestamps are removed together with your account. Both are included in your data export.
  • Personal notes: Optional free-text notes on milestones
  • Submitted resources: Titles and URLs of resources you submit via the submission form
  • Extension API token: Technical token that links our browser extension to your account (revocable at any time)
  • Extension version: The version number of your installed browser extension, transmitted with sync requests so we can ensure compatibility and safely roll out security updates
  • Support tickets: Subject, message, page URL, and browser info when you submit feedback. Admin replies are stored with the ticket. Ticket data is retained while your account exists and deleted on account deletion. Not shared with third parties.
  • Anki study data: Daily study time, review counts, retention, and card/known-word counts — only if you enable Anki tracking in the browser extension settings. Aggregated Anki statistics appear on your public profile only if you additionally enable the Anki card in the profile studio (off by default)
  • Reader reading data: Reading time, book/manga series or volume titles read, and character count, only if you enable Mokuro or ttu reader reading tracking in the browser extension settings (beta). For Mokuro specifically, this also includes your reading progress per volume (current page and whether it is finished). To show a cover, jp343 looks up the series title of Mokuro volumes on AniList (see third-party services). Aggregated reading statistics appear on your public profile only if you additionally enable the Reading card in the profile studio (off by default)
  • GameSentenceMiner reading data: Reading time from GameSentenceMiner (GSM) via the browser extension, optional and only after you turn it on. Processed locally are game titles, hook and scene names, timestamps, and line lengths; the sentence text never leaves your device. The extension checks the sentence text only on your device for Japanese kana and transmits per session only the number of lines with written characters and the number of lines with kana. Stored at jp343 are the reading sessions (start, end, duration), session IDs, these two line counts per session (so that non-Japanese reading time does not count towards the leaderboard or the public profile activity; it still counts fully in your own account), a random identifier of the GSM database, and a game mapping (GSM game ID, project, VNDB ID, normalized title, and normalized hook and scene names) so that the same game is recognized on a second computer. If you choose to import older GSM history (reading sessions from before you turned GSM on), the extension computes these sessions the same way and keeps them on your device, also without an account; after you log in they are uploaded, stored like the other GSM sessions, and marked as imported. This data is included in your data export and deleted together with your account
  • jp343 Reader: The jp343 Reader is a standalone web application at reader.jp343.com. Without a connected account it sends no reading data; books, reading time, and settings stay in your browser (see Section 4.2). If you connect a jp343 account in the Reader, it transmits per reading session the book title, confirmed reading time in seconds, estimated character count, current page or completion status, a random session ID, and the start time, over the same endpoint and the same access token as the browser extension. To connect, you sign in once in the Reader; your password goes only to jp343.com to create the access token, and the Reader keeps the token, not the password. Disconnecting removes the token from that browser. In addition, the Reader stores your reading position per book (character offset or page number, the total length, and the time you read it) so you can continue on another device. The position contains no book text. Never transmitted are book text, page images, OCR text, dictionary lookups, bookmarks, and covers. For manga volumes from the Reader, jp343 looks up the series title on AniList to show a cover, as it does for Mokuro volumes (see third-party services); titles of text books are not passed on automatically. Only if you search for a cover yourself does your search term go to AniList. This data is stored and deleted like all other tracking data (same retention, same export and deletion functions). No additional processing purpose.
  • Reading settings: Volumes you mark as finished yourself, series you hide from your public bookshelf, the cover you pick for a book or series (stored as the image address), the colors you assign to your reading entries, and the grouping of your books into series, which jp343 derives from the book titles. Included in your data export and removed when you delete your account.
  • Difficulty ratings: If you rate a video's difficulty from the browser extension, your rating (together with the estimate shown at the time and the version of the question) and the channel and video it applies to, used to refine the community difficulty levels shown to everyone. If you delete your account, your ratings are kept as anonymous community data — the link to your account, the specific video, the exact date, and your hours figure are removed or coarsened — so the community levels stay accurate for everyone. On channels with too few other contributors to anonymize safely, your ratings are deleted outright instead.

6.3 Data Processing

Legal basis: Art. 6(1)(b) GDPR (contract fulfillment - providing account services).

Storage period: Your data is stored as long as your account exists. After account deletion, all personal data is removed within 30 days. Two categories are anonymized instead of deleted: your placement in past leaderboard season archives, and your difficulty ratings (see Section 6.2). In both cases the link to your account and any other identifying detail is removed; only a non-identifying community contribution remains.

6.4 Your Rights (GDPR)

As an account holder, you have the following rights:

  • Access & Export: You can download all your data at any time via My Account → Export Data as a JSON file
  • Rectification: Email and username can be changed in account settings
  • Deletion: Complete account deletion via My Account → Delete Account
  • Data portability: The export contains all data in machine-readable JSON format

6.5 Email Service (Brevo)

For sending emails (verification, password reset), we use the service Brevo (formerly Sendinblue).

  • Data transmitted: Email address, email content
  • Purpose: Transactional emails (verification, password reset, account changes)
  • Provider: Brevo SAS, France (formerly Sendinblue)
  • Privacy: Brevo Privacy Policy

Legal basis: Art. 6(1)(b) GDPR (necessary for account functionality).

6.6 Cookies & Session

When logging in, we set technically necessary session cookies:

  • wordpress_logged_in_*: Authentication cookie for logged-in users
  • wordpress_sec_*: Security cookie

You stay signed in on a browser as long as you use jp343 there at least once every 60 days. Each time you use it, the sign-in is renewed for another 60 days (at most once per day). After 60 days without use, the sign-in expires and the cookies stop working. Logging out ends the sign-in on that browser and deletes the cookies. Under My Account, you can sign out all other browsers.

For each sign-in, our server stores the login time, the time of the last renewal, the expiry time, the IP address at login and your browser identifier (user agent). This data keeps you signed in and helps protect your account. Logging out deletes the entry, expired entries are removed at your next login at the latest, and deleting your account removes all of them.

Legal basis: Art. 6(1)(b) GDPR (technically necessary).

6.7 Rate Limiting

To protect against abuse, we limit registrations to 3 per hour per IP address. IP addresses are temporarily stored (1 hour) in a transient for this purpose.

6.8 Data Security

  • Passwords are stored as bcrypt hash (not in plaintext)
  • All data transfers are encrypted (HTTPS/TLS)
  • CSRF protection via WordPress nonces on all AJAX requests
  • Verification tokens expire after 24 hours

7. Third-Party Services

7.1 Koko Analytics

This website uses Koko Analytics, a privacy-friendly analytics plugin.

  • No cookies: Koko Analytics does not set any cookies
  • No personal data: No IP addresses or other personal data is stored
  • Local processing: All data is processed on our own server

Data collected: Page views, referrer (anonymized), device type

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in website analytics).

Additionally, we count aggregate daily page views split by login status (logged-in vs. guest). Only two integer counters per day are stored. No personal data, IP addresses, or cookies are involved.

7.2 YouTube Videos (Lite Mode)

We embed YouTube videos via lite-youtube-embed. This means no connection to YouTube is made when loading the page.

  • Thumbnail: Loaded from YouTube servers (image only, no tracking scripts)
  • Video loading: The full YouTube player loads only when you click Play

When playing, the Google Privacy Policy applies.

Legal basis: Art. 6(1)(a) GDPR (consent by clicking Play).

7.3 Metadata APIs

To display information about external learning resources, we use the following APIs. Data is fetched only when you actively add a resource (the Podcast Player additionally queries Apple/iTunes and, as a fallback, the Podcast Index API server-side; see Section 7.9):

  • Spotify Web API: Podcast and music metadata (title, cover, description)
    Privacy: Spotify Privacy Policy
  • Apple Podcasts / iTunes API: Podcast information
    Privacy: Apple Privacy Policy
  • Steam Store API: Game and visual novel metadata
    Privacy: Steam Privacy Policy
  • AniList GraphQL API: Anime, manga, and visual novel metadata (title, cover image, description)
    Privacy: AniList Terms & Privacy
  • noembed.com: Generic URL titles for OpenGraph fallback

Data transmitted: The resource URL, your IP address (to the respective service)

Additionally, cover images and thumbnails are loaded directly by your browser from external providers (e.g. image.tmdb.org, s4.anilist.co, i.ytimg.com) when you view resource tiles. The provider sees your IP address when its image is loaded.

Legal basis: Art. 6(1)(a) GDPR (consent by actively adding a resource); Art. 6(1)(f) GDPR for passive image loading on pages you view (legitimate interest in functional display).

7.4 Icon Services

For platform icons and symbols, we use:

  • Iconify API (api.iconify.design): SVG icons for platforms (YouTube, Spotify, Steam, etc.)
  • Google Favicon API: Website favicons as fallback for unknown domains

Data transmitted: Your IP address; for Favicon API also the domain name

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in functional display).

7.5 CDN Services

We load external resources from Content Delivery Networks:

Data transmitted: Your IP address, user agent, referrer

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in fast and reliable delivery).

7.6 Discord Account Linking

You can optionally connect your Discord account to your jp343 account via Discord OAuth2 (Authorization Code Grant).

  • Scope: identify only (your Discord user ID, username, and avatar)
  • No access to your messages, servers, friends, or email
  • Access token is not stored. It is used once to retrieve your profile, then discarded
  • Data stored: Discord user ID, display name, avatar hash, and connection timestamp
  • Purpose: Linking your accounts enables Discord role assignment and stats display via our Discord bot

You can disconnect your Discord account at any time in your account settings. Upon disconnection or account deletion, all stored Discord data is removed.

Legal basis: Art. 6(1)(a) GDPR (consent by initiating the connection).

7.7 Ko-fi (Voluntary Support)

This website links to our Ko-fi page for voluntary support. Clicking the link takes you to ko-fi.com, operated by Ko-fi Labs Limited; any data you provide there is governed by the Ko-fi Privacy Policy.

If you make a payment on Ko-fi, Ko-fi sends our server a notification (webhook). To unlock a "Supporter" badge on your jp343 profile, you may include a personal support code (shown in your account settings) in the Ko-fi message; we use that code to link the payment to your account.

  • Data stored: payment type, amount, currency, tier name, the Ko-fi transaction ID, and the support code you entered, kept for badge attribution and audit.
  • Not stored: we deliberately do not store the donor name or email from Ko-fi. Attribution happens via your code, not your email address.
  • Internal notification: we may forward a payment notice to an internal team Discord channel (the donor name appears only if you chose to make the donation public on Ko-fi; the support code is removed beforehand).
  • Deletion: the stored payment record is removed when you delete your account. Payment records that could not be linked to any account are deleted automatically after 180 days.

Legal basis: Art. 6(1)(b) GDPR (providing the Supporter badge you requested by submitting your code) and Art. 6(1)(f) GDPR (legitimate interest in attribution and abuse prevention).

7.8 Patreon (Account Linking)

You can optionally connect your Patreon account to your jp343 account via Log in with Patreon (OAuth2, Authorization Code Grant) to receive a live "Active Patreon Supporter" badge.

  • Access token is not stored. It is used once to read your Patreon user ID and your membership status for our page, then discarded.
  • Data stored: your Patreon user ID, current tier, active-status flag, and connection timestamp.
  • Not stored: we do not store your Patreon email. Attribution is by your Patreon account ID (proven via OAuth).
  • Status refresh: to keep your badge current, our server periodically queries Patreon's API for our campaign's membership using our own creator credentials.
  • Real-time updates (webhook): Patreon also sends our server a signed notification when your membership changes (created, updated, cancelled). We verify its signature, then update your badge status and store a minimised record (membership status and amount only). We do not store your Patreon name or email from this notification.
  • Purpose: displaying your Supporter badges on your profile.

You can disconnect at any time in your account settings. Upon disconnection or account deletion, your stored Patreon link data is removed.

Legal basis: Art. 6(1)(a) GDPR (consent by initiating the connection).

7.9 Podcast Player

Our Podcast Player lets you search for, subscribe to, and listen to public podcasts. It involves two kinds of data flow:

a) Server-side lookups. The following requests are made by our server (and cached for performance), so these providers see our server's IP address, not yours. They run when you search, view recommendations, open or refresh a feed, or subscribe:

  • Apple / iTunes Search API: podcast search and recommended-show lookups. Transmitted: your search terms and podcast/collection IDs.
  • Podcast RSS feeds: a podcast's own feed is fetched to list its episodes (also refreshed periodically in the background).
  • Podcast Index API (fallback only): used only if a direct RSS fetch fails. Transmitted: the podcast's feed URL.
    Search powered by Podcast Index.

Although these run server-side, your search terms reflect your interests and are processed as personal data to provide the feature.

b) Direct connections from your browser. When you press play, your browser streams the audio file directly from the podcast's own hosting/CDN provider, which differs from podcast to podcast. Episode and cover images are likewise loaded directly from the podcast's hosting provider and from Apple's artwork CDN (mzstatic.com). These providers receive your IP address, user agent, and, for audio, information about your playback. We do not proxy this traffic through our servers, so the recipient is whichever provider hosts the podcast you choose.

Legal basis: Art. 6(1)(a) GDPR (consent, given by pressing play) for audio streaming; audio is not requested before you start playback. Art. 6(1)(f) GDPR (legitimate interest in displaying functional cover artwork) for podcast images.

c) Local audio files. The Podcast Player can also play audio files from your own device. The file stays on your device, is played directly in the browser, and is never uploaded to or stored on jp343 servers. Only while you are logged in do we store the listening time and the file name (as the session title) in your account, like other listening sessions. They are included in your data export and deleted together with your account, like all sessions. The file name never appears publicly. Only the marker "Local audio" is shown (in the leaderboard's session list, for users who take part in the leaderboard, and in the activity card of a public profile), in addition to the hours per platform shown on a public profile. In your browser's LocalStorage, playback positions of local audio files (including the file name) are kept on your device only and are never transmitted.

If your browser supports it, added files are automatically stored in your browser's private storage on your device (Origin Private File System) and are not transmitted. For this, the browser stores a list in LocalStorage with file name, size, file type, duration, the time it was added, and a random internal ID per file. Browsers without this support keep the files only until the page is reloaded. The files can be removed in the player, one by one or all at once. The browser can delete them on its own when storage runs low, and Safari can also do so after 7 days without a visit to the website. The files also stay stored in the browser after you log out and are shown only in the player of the account they were added with. Deleting your account does not remove them automatically, because they exist only on your device. Anyone who deletes their account should remove the files in the player beforehand; afterwards they can only be deleted through the browser's website data.

8. Contact & Right to Complain

For questions about data protection, you can contact us at any time:

Email: info@jp343.com

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data.

9. Changes to This Privacy Policy

We reserve the right to update this privacy policy as needed to reflect changes in legal requirements or service changes. The current version is always available on this page.