Privacy policy
Last updated
Version 1.3, effective . This policy covers this website: the landing page, the email waitlist and the free sample test. The Hanamaru app has its own policy: Hanamaru app privacy policy.
In short
- This website sets no cookies, shows no ads and does not track you across other sites.
- We do not run website analytics.
- We never sell your data or share it for marketing.
- If you create a Hanamaru account here, we keep your email address and sign-in details for that account. It is the same account as in the app, and you can delete it yourself at any time.
- We email you about the launch only if you tick the box for it.
- Your sample test answers stay in your browser.
Who is responsible
The controller of your personal data is Nagy Tamás Dávid, based in Hungary, the publisher of Hanamaru (“we”, “us”). Contact: hello@nstudio.hu. We have not appointed a data protection officer; write to the same address with any privacy question.
What we collect, and why
Your Hanamaru account (optional)
You can create a Hanamaru account on this website, or sign in to one you already have. It is the same account you use in the app, so the Hanamaru app privacy policy covers it in full. On the website we store:
- your email address and, if you sign in with Google, the Google account ID, name and email Google shares;
- when you created the account and last signed in;
- your acceptance of the Terms of Use and Privacy Policy (which versions, and when), and your choice about the launch email, each with the date you made it.
We send the 6-digit sign-in codes by email through Proton. If you tick “Email me when Hanamaru launches”, we send you one email when the app is available; you can turn it off on your account page at any time. Legal basis: providing the account you asked for (Article 6(1)(b)); the launch email only with your consent (Article 6(1)(a)). If you sign in with Google, Google handles that sign-in under its own privacy policy. You can delete your account and everything stored with it on your account page, or by email if you can’t sign in.
1. The email waitlist (closed)
We no longer take waitlist signups; the account above replaces it. If you joined the waitlist earlier, this section still applies to you. When you joined the waitlist we stored:
- your email address;
- the version of the consent text you agreed to and when you signed up, which is our record of your consent;
- the language of the page you signed up on (for example “en”);
- where you signed up: the landing page or the end of the sample test;
- campaign (UTM) parameters, if the link that brought you here had them, such as
utm_source=newsletter; - the status of your signup (waiting for confirmation, confirmed or unsubscribed) and when it last changed;
- one-way hashes of the secret links in our emails, so the links work without us storing the links themselves.
We use this only to confirm your address (double opt-in: nothing happens until you click the link in the confirmation email), to email you about Hanamaru’s launch and beta, and to count how many people are interested. We do not use it for anything else and do not combine it with other data.
Legal basis: your consent (GDPR Article 6(1)(a)). You can withdraw it at any time with the unsubscribe link in every email, or by writing to hello@nstudio.hu. Withdrawing does not affect emails we sent before.
You must be at least 16 to join the waitlist. If you are younger, please do not sign up.
2. Abuse prevention
To stop bots and people from flooding the waitlist with other people’s addresses, we use two measures:
- Signup rate limit. When the waitlist form is sent, we turn your IP address into a salted, one-way hash and count how many signups came from it in the last hour (at most 5). We never store the IP address itself, and we delete the hash and its counter within 24 hours.
- Cloudflare Turnstile. The waitlist form includes a Turnstile check, which runs in a frame served by Cloudflare. It processes technical signals from your browser and device, including your IP address, to tell people from bots. We only receive the result of the check.
Legal basis: our legitimate interest in keeping the waitlist free of abuse and protecting people from being signed up without their knowledge (Article 6(1)(f)). We think this is balanced: the data is minimal, technical, short-lived and never used to identify or profile you.
3. Website analytics
We do not run website analytics at the moment: no analytics script is loaded and nothing about your visit is counted. If we turn analytics on, we will ask for your consent first (Article 6(1)(a)) and update this policy.
What we store on your device. The sample test keeps your progress in your browser’s session storage while you take it. We set no cookies.
4. The free sample test
You can take the sample test without an account or an email address. Your answers and score are kept only in your browser while you take the test and are not sent to us.
Speaking practice try-out. On the home page you can hear a Japanese line read by your browser’s own voice and record yourself saying it. The recording is made and played back only in your browser tab; it is never uploaded and disappears when you leave the page. Your browser asks before it uses the microphone.
5. Hosting and server logs
The website and its small server functions run on Cloudflare. Like any web host, Cloudflare processes the technical data of each request (your IP address, the requested address, your browser’s user agent and the time) to deliver the pages and protect the site from attacks. We do not keep our own access logs.
Legal basis: our legitimate interest in running a secure, working website (Article 6(1)(f)).
6. When you email us
If you write to hello@nstudio.hu, we receive your email address and whatever you put in your message. We use it only to answer you and handle your request, and keep it only as long as that takes. Legal basis: our legitimate interest in replying to people who contact us (Article 6(1)(f)).
Who processes your data for us
These providers process personal data on our behalf, only on our instructions:
| Provider | What for | Where |
|---|---|---|
| Supabase | Accounts and sign-in, and the database that stores account consents, the waitlist and the rate-limit counters; the server function that hands our emails to Proton | EU (Frankfurt, Germany) |
| Cloudflare | Website hosting, server functions, Turnstile bot check | Global network; Cloudflare is a US company |
| Proton AG (Proton Mail) | Sending the confirmation email and waitlist emails | Switzerland (EU adequacy decision); Proton is a Swiss company |
Our emails are plain: we do not use open or click tracking. Proton sends them as we write them, with no tracking pixel and no rewritten links, so every link in them points straight at this website. We do not send your data to any AI service. We draft some learning content offline with an AI model (Anthropic Claude); none of your personal data is sent to it.
International transfers
We keep the waitlist in the EU. Some providers, or their support staff and sub-processors, may still process data outside the European Economic Area. Cloudflare is a US company: transfers to it rely on its certification under the EU-US Data Privacy Framework and on the Standard Contractual Clauses in its data processing agreement. Proton AG is in Switzerland, which the European Commission has found to protect personal data adequately (an adequacy decision). For any other transfer outside the EEA we rely on an adequacy decision of the European Commission or on Standard Contractual Clauses. Write to hello@nstudio.hu for a copy of the relevant safeguards.
How long we keep it
| Data | Kept for |
|---|---|
| Your account, its consent history and launch-email choice | Until you delete the account (on your account page, in the app, or by email) |
| Unconfirmed signups | Deleted 7 days after the last confirmation email we sent you if you don’t click its link (our deletion job runs every hour) |
| Confirmed signups | Until you unsubscribe, or 12 months after the app’s public launch, whichever comes first |
| Unsubscribed addresses | Deleted within 24 hours of unsubscribing. Until then the address is only kept so a repeated click on the unsubscribe link still works; we send it nothing |
| Hashed IP addresses and rate-limit counters | At most 24 hours |
| Database backups | Up to 30 days; deleted data disappears from backups within that time |
| Emails you send us | As long as needed to deal with your request and any follow-up |
You can sign up again after unsubscribing; that starts a new confirmation.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- have it corrected;
- have it erased;
- restrict how we use it;
- object to processing based on our legitimate interest;
- receive the data you gave us in a portable format;
- withdraw your consent at any time, without affecting earlier processing.
To leave the waitlist, use the unsubscribe link in any of our emails. For anything else, write to hello@nstudio.hu, ideally from the address concerned, so we can check that the request is yours. We reply within one month.
You also have the right to lodge a complaint with a supervisory authority. In Hungary this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), naih.hu. If you live in another EEA country, you can complain to your local authority.
No automated decisions
We make no decisions about you by automated means, and we do not profile you.
Children
This website is not directed at children under 13. You must be at least 16 to join the waitlist. If you believe a child has signed up, write to hello@nstudio.hu and we will delete the signup.
Changes to this policy
If we change this policy, we will publish the new version here with a new version number and date and list the change below. If a change affects how we use your waitlist email, we will tell confirmed waitlist members by email before it takes effect.
Changelog
- Version 1.3, : you can now create a Hanamaru account on the website (email code or Google), with an optional launch email; the waitlist is closed to new signups; added the speaking practice try-out, which records only in your browser.
- Version 1.2, : our emails are now sent by Proton AG (Proton Mail, Switzerland) instead of Brevo, through a server function at Supabase.
- Version 1.1, : website analytics now run only with your consent (Article 6(1)(a)) instead of on legitimate interest; added the analytics question, a way to change your choice on every page, how we honour Global Privacy Control and Do Not Track, and what we store in your browser to remember your choice (asked again after 12 months). While analytics are switched off, this page says so instead.
- Version 1.0, : first published, covering the website, the waitlist and the sample test.
See also: Website terms · Imprint · Support