Privacy policy
Privacy policy for Moji Ninja. Your progress stays in your browser unless you create an optional account to sync it. Analytics run only with your consent.
Last updated: October 2026
1. What data we collect
You can use Moji Ninja without an account; your progress then stays in your browser. When you register, we collect your username and a securely hashed password. While you are signed in, we store your learning progress (what you have learned and when you practised, lessons, streaks, high scores, achievements) and the notes you write yourself (kanji stories and kana memory hooks), so they sync between your devices. Please choose a username that is not your real name, and keep personal details out of your notes. We do not collect your real name, email address or payment details.
2. Security records and server logs
To slow down password guessing and abuse, the server records the IP address of each sign-in, registration, sync and account-deletion attempt, with the account it was for, and of each visit with an invalid sign-in cookie. These records are used for nothing else and are deleted after about an hour. Like every website, the web server also keeps a technical log of requests (IP address, the page or file asked for, the time and the browser) to keep the site running and secure; the hosting provider deletes these logs on its regular schedule.
3. How we use your data, and on what basis
Account data is used only to provide the sync you asked for (GDPR Art. 6(1)(b): carrying out our agreement with you). Security records and server logs protect the site and its accounts (Art. 6(1)(f): our legitimate interest in a secure service). Google Analytics runs only with your consent (Art. 6(1)(a)), which you can withdraw at any time. We do not sell your data, use it for advertising, or make automated decisions about you.
4. Who receives your data
Our hosting provider stores the server data and processes it only on our behalf. If you accept analytics, Google receives the analytics data described below. Nobody else receives your data, unless the law requires it.
5. Local storage
Your learning progress, your notes and your settings (language, theme, daily goal, your cookie choice) are stored in your browser's localStorage, even without an account. This data never leaves your device unless you sign in to sync it. The app also keeps its own files in your browser, so that it works offline.
6. Google Analytics
If you accept analytics, Google Analytics records which pages are visited, for how long and roughly from where (country or city), with the type of device and browser, under a random ID kept in its cookies. Google Analytics 4 does not log or store IP addresses, and we have turned off Google signals and ad personalisation. Google LLC may process this data in the United States, under the EU–US Data Privacy Framework, and Google Analytics keeps the data on individual visits for at most 14 months. Analytics runs only if you accept it. You can change your choice at any time with "Cookie settings" at the bottom of the page, or install the Google Analytics opt-out browser add-on.
7. Cookies
The site sets the cookies it needs to work: csrf_token (kept for a year) protects sign-in and sync from requests sent by other sites, and is set when the app first contacts the server; auth_token (7 days, renewed while you use the app, for at most 90 days) keeps you signed in; known_device (180 days), set when you sign in, lets that device keep signing in while someone elsewhere is guessing your password. If you accept analytics, Google Analytics sets its own cookies (_ga and _ga_…, kept for 2 years). We use no advertising cookies, and your language and theme are kept in localStorage, not in cookies.
8. Keeping and deleting data
Your account data is kept until you delete your account, which you can do at any time in the app: sign in, open the account menu and choose "Delete my account". Deletion is immediate and cannot be undone; if the hosting provider keeps backups, the deleted data disappears from them as they are replaced. Security records are deleted after about an hour, and analytics data as described above.
9. Your rights (GDPR)
Under the GDPR, you have the right to access your personal data, to correct it, to have it deleted, to restrict or object to its use, to receive a copy of it, and to withdraw your consent at any time (for analytics, with "Cookie settings"). You can delete your account yourself in the app. You can also complain to a data protection authority: in Bulgaria, the Commission for Personal Data Protection (cpdp.bg), or the authority in the country where you live.
10. Children
Moji Ninja is for learners of every age and works without an account. If you are under 16, ask a parent or guardian before you create an account or accept analytics cookies.
11. Changes to this policy
When this policy changes, we update the date at the top of this page.
Turn on JavaScript to use the interactive app.