Privacy Policy

Welcome to Kumi, operated by Kumiai Inc. ("we," "us," or "our"). We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and related services, and our mobile application if and when it becomes available (collectively, the "Service").

By using Kumi, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use the Service.

The Service is currently offered on the web. This Privacy Policy applies to all users of the Kumi website and, if and when it becomes available, the Kumi mobile application distributed through third-party app stores such as the Apple App Store or Google Play.

2.1 Information You Provide

• Account Information: Name, email address, username, password, and profile information, plus optional fields you may provide such as date of birth, location, and time zone
• Uploaded Content: Files you choose to import, such as Anki decks (.apkg), which we parse to seed your learning progress. We process the file in memory and do not retain the uploaded file itself.
• Profile & Social Information: Your public handle, display name, avatar, biography, concept lists you create, and progress or mastery statistics that appear on your profile and on leaderboards. See Section 2.3.
• Learning Data: Your progress, performance, preferences, study goals, and interactions with learning content
• Communication: Information you provide when contacting us for support, feedback, or inquiries
• Payment Information: Payments on the web are processed by our payment processor, Stripe, Inc. If the Service becomes available through an app store, purchases made there are processed by that platform (for example, Apple via in-app purchases). We do not store or process full payment card information on our servers.

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent, and interaction patterns
• Device Information: Device type, operating system, browser type, IP address, and unique device identifiers
• Voice Recordings: When you use pronunciation or spoken-recall practice, we access your microphone with your permission and send the recording to a speech-to-text provider (Google Cloud Speech) to assess your pronunciation. We do not store your voice recordings; the audio is transcribed and then discarded.
• Device & Push Tokens: We store a device identifier and, if you enable notifications, a push notification token, so we can deliver notifications and sync your progress across devices. You can turn notifications off at any time.
• Analytics: We use PostHog to understand how users interact with the Service. When you are signed in, PostHog receives a stable internal account identifier (your user id) and usage events, including product analytics and session recordings. Session recordings capture your on-screen activity, including answers you type into lessons and reviews, so we can see where the product is confusing or broken. Password and email fields are masked and never recorded, your email address is masked wherever it appears on screen, and payment details are entered on Stripe's own pages, which we do not record. We do not send your email or display name to PostHog. Dictionary search analytics use aggregated fingerprints (not the raw characters you typed).
• Cookies: We use cookies and similar tracking technologies (see Section 8)

We do not use personal data for cross-app tracking, targeted advertising, or data brokering, and we do not participate in Apple's App Tracking Transparency (ATT) tracking.

2.3 Public Profile and Social Features

Kumi includes social and community features. When you use them, certain information is visible to other users and, in some cases, to the public and search engines. This may include your handle, display name, avatar, biography, mastery and progress statistics, achievements and streaks, your position on leaderboards, and any concept lists you choose to make public.

Information you make public is no longer private and may be viewed, copied, or shared by others. Please do not include anything in your public profile or shared content that you wish to keep private. You can adjust what is public and delete content you have shared through your account settings.

We may also feature publicly visible content, such as public profiles, public brain visualizations, leaderboard standings, and shared lists, on Kumi's own surfaces, including our homepage and other promotional pages. Featured content is always loaded live from your current settings and is never copied or stored separately: if you set your profile, brain, or leaderboard participation to private, it immediately stops appearing on those surfaces.

2.4 Information From Third-Party Sign-In

If you sign in using a third-party provider such as Google, Discord, or Apple, we receive basic account information from that provider (such as your name, email address, and a unique provider identifier) to create and secure your account. We do not receive your password for that provider. Your use of the provider is governed by its own privacy policy.

If you connect your Discord account, we may associate your Discord user identifier with your Kumi account to support community features, such as recognizing your membership in our Discord server.

We use your information to:

• Provide, maintain, and improve the Service
• Personalize your learning experience using adaptive systems based on your interactions and progress
• Track your progress and adapt content to your proficiency level
• Assess your pronunciation when you use spoken practice, and process files you import (such as Anki decks) to seed your learning progress
• Process subscriptions and manage access to paid features
• Send service-related updates, notifications, and educational content
• Send newsletters and marketing emails you have opted into (via double opt-in), which you can unsubscribe from at any time
• Provide AI and automated features, which may transmit content you submit to third-party AI providers to generate a response
• Operate social and community features, including public profiles and leaderboards
• Respond to comments, questions, and support requests
• Analyze usage patterns to improve our systems and learning models
• Detect, prevent, and address technical issues, abuse, and fraudulent activity
• Comply with legal and regulatory obligations

We do not sell your personal information.

We may share your information only in the following circumstances:

• Service Providers: Third-party vendors who perform services on our behalf, including cloud hosting and infrastructure, Stripe (payments), PostHog (analytics), Beehiiv (newsletter email), Google Cloud Speech (pronunciation assessment), Google Vertex AI and Gemini (AI-powered features), Cloudflare (audio and asset storage), mobile push notification services (Apple and Google), and identity providers such as Google, Discord, and Apple (sign-in)
• Publicly Visible Information: Information you choose to make public through profiles, leaderboards, and shared lists is visible to other users and, in some cases, the public, as described in Section 2.3
• Legal Requirements: When required by law, subpoena, court order, or legal process
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you explicitly authorize us to share information
• Aggregate Data: Anonymized or aggregated data that cannot reasonably identify you

We retain personal information for as long as necessary to provide the Service and fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

When you delete your account, we deactivate it and revoke access immediately. Your data may be retained in a deactivated state for legal, analytics, accounting, fraud prevention, or security purposes. If you would like your data to be permanently erased from our systems, please contact us at privacy@kumi.app, and we will process your request in accordance with applicable law.

Depending on your jurisdiction, you may have the following rights:

• Access: Request access to your personal information
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal information
• Portability: Request a copy of your data in a portable format
• Opt-Out: Opt out of marketing communications
• Objection: Object to certain types of processing

Users may delete their account at any time from within the Kumi app settings. If you are unable to access the app, you may request account deletion by contacting privacy@kumi.app.

We implement appropriate technical and organizational safeguards to protect personal information, including:

• Encryption of data in transit and at rest
• Access controls and authentication requirements
• Regular security reviews and updates
• Secure cloud infrastructure and hosting providers

However, no method of transmission over the internet or electronic storage is completely secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security.

In the event of a data breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law.

We use cookies, web beacons, and similar technologies to operate and improve the Service.

Types of cookies we use include:

• Essential Cookies: Required for core functionality
• Analytics Cookies: Help us understand how users interact with the Service
• Preference Cookies: Remember your settings and preferences

You may manage or disable non-essential cookies through your browser settings. Disabling cookies may limit certain features of the Service.

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

Third-party services we use may include:

• Stripe (payment processing)
• PostHog (product analytics and privacy-masked session recording)
• Beehiiv (newsletter and marketing email)
• Google, Discord, and Apple (authentication / sign-in)
• Google Vertex AI and Gemini (AI-powered learning features)
• Google Cloud Speech (pronunciation assessment)
• Cloudflare (audio and asset storage)
• Apple and Google push notification services (APNs / FCM)
• Cloud hosting and infrastructure providers
• Email and notification service providers
• Apple In-App Purchases (if and when the mobile app becomes available)

We do not use analytics data for advertising purposes or sell analytics data to third parties.

The Service is intended for users aged 13 and older. It is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13.

If you are located in the European Economic Area or the United Kingdom, the minimum age to consent to processing may be higher (up to 16, depending on your country). Where a higher age applies, you must meet it or have verifiable consent from a parent or guardian.

If you believe we may have collected personal information from a child under 13, please contact us at privacy@kumi.app, and we will take appropriate steps to delete the information.

Your information may be transferred to and processed in countries other than your country of residence, including the United States.

Where required by law, we implement appropriate safeguards, such as standard contractual clauses, to protect personal data during international transfers.

The Service is operated from the United States and is directed to an English-speaking, United States audience. We do not specifically target or market the Service to individuals in the European Economic Area or the United Kingdom. Where local data protection laws nonetheless apply to you, we honor the applicable rights described in this policy.

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• The right to know what personal information we collect and how it is used
• The right to request deletion of personal information
• The right to opt out of the sale of personal information (we do not sell personal information)
• The right to non-discrimination for exercising your privacy rights
• The right to correct inaccurate personal information
• The right to limit the use of sensitive personal information (we do not use sensitive personal information for purposes requiring an opt-out)

In the preceding 12 months, we may have collected the following categories of personal information: identifiers (such as name, email, and account or device identifiers), account and profile information, learning and usage data, commercial information (subscription records), audio information (pronunciation recordings, which are transcribed and not retained), and internet or network activity. We collect this information for the business purposes described in Section 3 and disclose it only to the service providers described in Section 4. We do not sell or share personal information as those terms are defined under the CCPA.

We honor opt-out preference signals, including the Global Privacy Control (GPC), where required by law.

If you are located in the European Economic Area (EEA) or the United Kingdom, you have rights under the General Data Protection Regulation (GDPR), including those listed in Section 6.

Our legal bases for processing personal data include:

• Performance of a contract (providing the Service)
• Legitimate interests (improving the Service, security, and fraud prevention)
• Your consent, where required
• Compliance with legal obligations

Automated processing: We use automated systems to personalize your learning path and generate mastery and progress metrics. This profiling is used to adapt educational content and does not produce legal or similarly significant effects concerning you. You may contact us with questions about this processing.

You also have the right to lodge a complaint with your local data protection authority.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page.

Your continued use of the Service after changes become effective constitutes acceptance of the revised Privacy Policy.

If you have questions, concerns, or requests regarding this Privacy Policy, please contact us: