Privacy

Joshua Dirga operates meramu as an individual based in the United States. meramu is not operated by a separate company. This policy covers the iPhone, iPad, and Android apps, this website, and support email. Contact privacy@meramu.app about privacy.

A short explanation

Your saved cards and progress are stored on your device. No account is needed. Settings offers optional accounts through Account, called Backup in earlier iPhone and iPad versions. From version 1.2.8, accounts are open to players who select 13–17 or 18 or older. Earlier versions offer them to adults only. Adults can choose to share gameplay analytics to help improve meramu. Sharing is off by default. Players under 18, players who choose not to say, and anyone with no saved age range send no gameplay analytics. The public app has no ads, chat, public profiles, or voice recording. The optional iOS TestFlight hint-ad trial is described below. Downloaded lessons can be played offline.

In the app

The app saves your selected native and learning languages, discovered cards, level progress, settings, and player details on your device. Player details include an age range and, if you choose, a nickname. From version 1.2.8, new players pick an age range before they start playing. The app asks for a range, not your birth date. Once saved, the age range can't be changed in the app and stays on your device. If you have no saved age range, Account asks you to pick one once before you can use account backup. Age ranges saved by earlier versions, including Prefer not to say, also stay locked. Without an account, your nickname stays on your device. Cards and levels are saved separately for each learning language. Saved data from earlier versions may remain until you reset progress. Changing your native language keeps that progress. Optional account backup is described below. Your device's backup settings may include saved app data.

Pronunciation uses an available device voice, included audio or a downloaded audio file. The app does not record speech or access your microphone. Card movement uses device motion locally; meramu does not receive it.

Optional hint ads in iOS TestFlight

From TestFlight build 2026092702, adults can choose to watch a Google test ad for a hint. No ads appear between lessons. Players under 18 or with no saved adult age choice do not request advertising configuration, consent forms, or ads. A server switch can disable the trial; it cannot change this age rule. Test ads do not earn advertising revenue.

Choosing the ad lets Google AdMob and its consent service process technical information, including IP address (which can indicate approximate location), device and app information, consent choices, ad interactions, and diagnostics. The configuration service receives connection metadata but no player identifier. We do not send Google your nickname, account, learning history, or precise location. We request non-personalized ads with restricted data processing and disable publisher first-party identifiers. We do not request permission to track you across other companies’ apps or websites. Regional consent choices are shown when required; refusing consent leaves the normal hint available.

Turn hint ads off or review advertising privacy choices in Settings. This is separate from optional gameplay analytics. Google handles its service data under Google’s privacy policy; turning ads off stops future app requests, but does not erase data already processed by Google. For questions or rights requests, contact privacy@meramu.app. Network or ad failures do not block hints. A revealed hint still uses one star, with a minimum of zero.

Artwork and pronunciation downloads

Artwork and pronunciation files download from Supabase and its content delivery providers, including Cloudflare. Downloads can happen for players of any age, without an account. The hosting services receive your IP address and technical request details, such as the file requested, time, response status, and app or network headers. They may derive an approximate location from your IP address. We use this information to deliver files, diagnose download problems and protect the service.

The delivery provider may send a security cookie in its response. The app is configured not to store or return these cookies. Asset requests do not include your nickname, age, account identifier or analytics identifier. We do not use download logs for advertising or to build player profiles. Downloads do not enable gameplay analytics. Files saved on your device remain available offline until removed.

Our current Supabase plan provides seven days of access to API and database logs. Supabase also maintains infrastructure and security records under its service terms. This seven-day window is not a promise that every provider record is deleted after seven days. Requests may be processed through delivery infrastructure outside your country.

Practice reminders

Android 1.2.3 test builds and iOS 1.2.4 include an optional daily practice reminder. Availability depends on store review and rollout. Reminders are off by default. If you enable them, the app asks for notification permission and schedules reminders on your device at your chosen local time, on days when you have not finished a lesson. Android may deliver reminders later to save battery. On iPhone and iPad, the app schedules up to 30 days ahead and refreshes that schedule when you open it. The reminder setting, scheduled time and lesson-completion check stay on this device and do not sync with your account. Reminders do not register a push token or enable analytics. In versions with streaks, up to two chosen local times can be used and reminders pause after an absence. For adults who opt into analytics, these versions send events when reminders are offered or declined, permission is checked, a reminder is opened, or a reminder setting changes. Those events include only the permission result, whether reminders are on, and from version 1.2.6 which of the two reminder slots is involved, plus the common analytics fields described below. Scheduled times and reminder preferences stay on this device. Turn it off in Settings or revoke notification permission in your device settings.

Optional accounts and backup

From version 1.2.8, players who select 13–17 or 18 or older can accept the account terms and sign in with Google or an email code. Earlier versions offer accounts only to players who select 18 or older. Sign in with Apple is also available on iPhone and iPad. Android 1.2.3 test builds and iOS 1.2.4 add an Account flow with a Create account option for email and password. A new account must be confirmed with the code sent to its email address before it signs in. Existing accounts can use Sign in with email and password, or Use a code instead. Earlier iPhone and iPad versions call this area Backup and offer Apple, Google and email codes. Earlier Android builds also support existing meramu passwords, Google and email codes. Players who select Under 13 or Prefer not to say use local play without account uploads. If no age range is saved, Account asks for one before it shows sign-in options. Your age range stays on your device and is not sent to the account service. Signing in does not enable analytics, and players under 18 cannot turn analytics on.

Supabase handles authentication and stores a private account identifier, provider identifiers, email address when supplied by your sign-in provider, private nickname, language preferences, Japanese display setting, collected cards and completed lessons. In versions with streaks, signed-in accounts also back up the local calendar dates of completed lessons to keep their streak across devices. These dates are included in account exports and removed from the active cloud account when it is deleted. Streak dates stay on the device when account backup is not connected. A sign-in provider may supply other profile details, such as a name or picture, in authentication metadata. meramu does not display a public profile or send those details to PostHog. We never receive your Apple or Google password. If you use a meramu password, the app sends it to Supabase for account creation or authentication and does not save the entered password. The app stores session tokens to keep you signed in. Zoho delivers email confirmation and sign-in codes. Supabase and the sign-in providers also process connection and security information, including IP addresses and sign-in times. Account requests are not anonymous.

Your changes save locally first and sync when a connection is available. On Android and in iOS 1.2.4, sync starts automatically after sign-in when the local progress can be combined with that account. If the device has another account's progress or the account was reset elsewhere, the app asks you to restore saved progress and keeps the device copy separately. Earlier iPhone and iPad versions let you choose whether to combine local progress with a saved backup or use the saved backup. Copies retained on this device let the app keep different accounts' progress separate. They are not public. Age, analytics permission, reminder choices, sound and vibration preferences do not sync. The account database is hosted in Supabase's US East region.

Account lists Export my data, Reset progress on all devices, Delete account and Sign out. Some earlier versions put export and deletion under Manage data, and earlier iPhone and iPad versions put these controls in Backup. Reset progress in Settings clears backed-up progress while account sync is connected. Resetting backed-up progress affects every language and signed-in device when they reconnect. In versions with streaks, resetting courses preserves streak dates and does not replenish starter shields. Deleting an account removes its authentication record and active cloud profile, settings and progress. Local cards remain until you reset them or remove the app's data. Apple account deletion also revokes meramu access; if Apple verification is unavailable, the app explains how to remove that access yourself. Sign-out stops sync and keeps your local cards.

We keep active account data until you delete the account. Supabase retains operational logs and recovery copies according to its service plan and security requirements; deleting active account records does not immediately erase those separate copies. We do not use them for advertising. Analytics is stored separately and uses different identifiers, so deleting an account does not identify or delete past analytics. Use Delete shared analytics in Privacy for that request. Contact privacy@meramu.app if you need help accessing or deleting account data. You can request account deletion on this website without reinstalling the app.

Optional adult gameplay analytics

Sharing is off until an adult turns it on. If you select 18 or older and turn on Share gameplay analytics, the app sends gameplay events to PostHog. The app sends nothing before you turn sharing on. Players under 18, and anyone whose age is unknown or who chooses not to say, send nothing at all. Joshua uses these events to see where adults get stuck, which lessons are hard, and which parts of the app people use, and to fix what doesn't work.

From iOS 1.2.6 and Android 1.2.6, the app records these actions for adults who share analytics:

• Sessions. When the app opens and goes to the background, and how long it was open.
• Setup. That setup finished, the native and learning languages you picked, and that you turned sharing on. The app records these right after you turn sharing on, never before.
• Tutorial. Each tutorial step shown and finished, the time spent on it, the cards you tap, hold or drag, the pairs you try and whether they matched, each tutorial level finished, and the step where you left if you leave early. Replays from How to play are marked as replays.
• Lessons. Level starts, finishes and exits, stars, attempts and time spent. The cards you select, whether you tapped or dragged them, the pairs you try and what they made. Hint opens, hint offers and whether you took or declined them, revealed and used hints. New cards revealed, cards read aloud, and whether you chose Next or Path after a level.
• Screens and buttons. Which screen or page you open, such as the path, a lesson, Cards, Settings, the streak page, an account step or a legal page, and which button you use on it, such as clearing a selection or turning a page.
• Cards. That you used search, never what you typed. The Discovered or All switch and the category filter.
• Streaks and reminders. The streak length and remaining shields when a streak grows or a shield is used. Reminder offers and whether you accepted or declined, the notification permission result, which of the two reminder slots are on, that a reminder time changed (not the time itself), and whether an opened reminder was the first or second one.
• Settings. Changes to sound effects, card speech, vibration, Japanese display and your languages, opening How to play, and progress resets.
• Account steps. Which account screen you open and which step you take, such as accepting the terms, choosing Apple, Google or email, asking for a code, resending it, entering it, choosing which progress to keep, exporting, signing out or deleting the account. The app records whether the step worked, and an error type such as network if it didn't. It never sends your email address, password, code or account identifier.
• Downloads and errors. Download checks and their result (finished, failed, offline or storage full), pronunciation playback failures, and the type and area of any error message shown, never the message text.
• Feedback and privacy controls. That you reviewed, copied or opened a feedback draft, never what you wrote, and that you showed or copied your analytics IDs.
• Rating prompts. On iPhone and iPad, when the app asks Apple to show a rating prompt. Apple doesn't tell the app what you chose.

Every event also carries your native and learning language, catalog card identifiers where a card is involved, the event time, a random event identifier, the platform (iOS or Android), the analytics format version, the app version and build number, and an internal flag. The internal flag is true for test builds, such as debug builds, TestFlight, simulators and Android installs that don't come from Google Play, so Joshua can leave his own testing out of the numbers. It says nothing about you. Earlier versions send a smaller set: sessions, setup, card selections, combinations, level progress, hints, settings, languages, streaks, reminders and sign-in steps.

These events never include your nickname, age range, email address, account identifier, anything you type, search text, answers, voice recordings, device motion, advertising identifiers, precise location, reminder times or streak dates.

A random analytics ID and a minimal PostHog profile link these events across visits while sharing remains enabled. This is pseudonymous data, not anonymous data. Analytics uploads contain neither your nickname nor your selected age range, email address or account identifier. The app does not send typed answers, search text, voice recordings, device motion, advertising identifiers, or precise location through this feature. It does not use session recording or automatic screen capture.

PostHog receives the connection information needed to accept an upload. Our project discards IP addresses from stored analytics events and disables location lookup. We have disabled PostHog's internal AI training use of this project's data and third-party AI features. Analytics are not used for advertising or sold.

Unsent events are eligible for upload for up to seven days and are cleared when sharing stops. PostHog currently has no configured event-retention window. Our daily cleanup checks for analytics profiles more than 400 days old and requests deletion of those profiles and their remaining events. This cleanup does not cover events that have no analytics profile, so it does not guarantee a maximum storage period for every event. PostHog processes deletion requests asynchronously. You can request deletion using the controls described below. The app replaces its active analytics ID after 365 days before collecting or sending more events, so it does not continue using an expired profile. Local queue cleanup occurs when the app runs; device backups may retain earlier copies. Turning sharing off cannot recall an upload already received by PostHog.

Your analytics choices and deletion

You can leave sharing off and use the game. Turn it off in Settings to stop uploads, cancel pending delivery, and clear unsent events. Changing your age selection also turns sharing off. A later opt-in starts with a new random analytics ID. If someone else will play on this device, turn sharing off and update the Player settings before handing it over.

Turning sharing off does not delete events already received. Use Delete shared analytics in the app to turn sharing off and prepare an email to support@meramu.app. The app keeps analytics IDs on this device for 400 days after their last send attempt, including after sharing stops, so you can include them in a request. It removes expired IDs when the app next checks them. These deletion receipts do not resume tracking or uploads. You review and send the email yourself. Joshua uses the IDs to find the matching PostHog profiles and asks PostHog to delete each profile and all of its events. PostHog queues the deletion and completes it later, so sending the email doesn't mean the data is already gone. You can ask privacy@meramu.app whether your deletion has finished.

An email address alone does not identify your analytics data. If you remove the app or lose its saved data, we may no longer be able to connect your request to the random IDs. You can still contact us about your rights. We do not require an account or your real name to use analytics controls.

The retired analytics collector

On September 14, 2026, meramu retired its earlier gameplay analytics collector. It rejects new uploads without storing their gameplay contents. Older app builds may still display a Share anonymous usage setting and attempt delivery if you enabled it. You can turn that setting off. The new adult opt-in does not authorize that collector or restore its unsent events.

Before retirement, optional sharing was off by default. If enabled, it sent card taps, combination results, hints, level activity, language choices, session duration, and app version. Events included random installation and session identifiers. Those identifiers made the data pseudonymous, not fully anonymous. meramu did not collect typed answers, search text, recordings, advertising identifiers, or precise location through those events, and did not use them for advertising.

Previously received events remain private and are scheduled for deletion after 90 days. This is separate from the new PostHog retention period and from support emails. Vercel may still process connection information when an older app attempts a request.

Delete your progress

Open Settings and choose Reset progress. Confirming clears all learning progress in every learning language, including saved data from earlier versions. Your selected languages and settings stay selected. When account backup is connected, the reset also clears backed-up progress as devices reconnect. When signed out, it clears local progress only. In Settings, open Player to edit or clear your nickname. Current versions don't let you change a saved age range in the app. If yours is wrong, use Send feedback in Settings for help.

This website

The trial sends no gameplay analytics by default. In Privacy choices, adults can confirm they are 18 or older and separately agree to share trial activity with PostHog. We measure language selection, combinations and their outcomes, hints, level starts and completions, trial replays, app invitations and App Store link clicks. If you arrive through a tagged meramu link and opt in, events also include its campaign label and social platform. We accept only our predefined labels, never arbitrary link parameters or advertising click IDs. A store click is not evidence of an installation.

A random ID links actions within that browser tab. We do not send search text, account details, nicknames, full page URLs, recordings or advertising identifiers. We use no analytics cookies or cross-site tracking. Browser Do Not Track and Global Privacy Control signals prevent optional collection. Closing or reloading the tab turns sharing off; permission is never inferred from playing.

Turn sharing off in Privacy choices to stop new uploads and cancel pending requests. It does not erase already delivered events. The PostHog retention and deletion practices described above also apply to these events. Before closing the tab, use its deletion email link to include the random IDs needed to find those events. The link remains available after turning sharing off. Once the tab is closed we cannot find its events from your email address alone.

Vercel hosts this site and forwards permitted analytics requests to PostHog. Providers receive connection information while delivering requests; we do not describe those requests as anonymous. The collector does not forward browser IP headers, and PostHog IP storage and geolocation enrichment are disabled. Under-18 and unknown-age visitors send no gameplay analytics. Pages and artwork still reach Vercel, which processes request information to deliver and protect the site.

Tapping a card can read its word aloud using browser speech synthesis. Depending on the available voice, your browser or operating-system provider may process the word through an online speech service. meramu does not receive the speech request or a recording. The website does not request microphone access or record your voice.

Support email

In builds with Send feedback, your draft stays in the app until you choose to copy it or open your email app. You type the message and any optional word, lesson, or language context, then review the recipient, subject, and message. meramu does not automatically attach logs, screenshots, account details, age, or play history. Opening your email app prepares a draft; you decide whether to send it there.

If you email support, Joshua receives your email address, message, and any attachments you send. He uses them to answer your request and troubleshoot issues. Support mail is hosted by Zoho. Zoho and other email providers involved in delivery process these messages. See Zoho's privacy policy. Please only include information needed to explain the issue.

For privacy questions or a request to delete support messages, email privacy@meramu.app.

Children and families

Children and adults can play meramu. There is no minimum age for local play. The game is intended for a general audience, including adults learning languages and families, and is not offered in Apple's Kids Category. Optional gameplay analytics is available only to players who select 18 or older. Under-18 players and anyone whose age is unknown send no gameplay analytics. No account is required. From version 1.2.8, players aged 13 to 17 can use optional account backup. It stores the same data as an adult account and never turns on analytics. Where local law requires a parent or guardian's permission for a teen to use an online account, the teen needs that permission before signing in. Players under 13 and players who choose not to say their age cannot use account backup, and their nicknames stay on the device. Age selections always stay on the device. Parents and guardians can help with browser or device settings and contact us about privacy. Please do not send a child's full name, birth date, school, photo, or other unnecessary personal information in support requests.

If we discover that we have received a child's personal information without a required permission or legal exception, we will delete it or handle it as the law requires. Contact privacy@meramu.app to raise a concern.

Purposes, providers, and your rights

Optional account processing provides the sign-in and backup service you request and protects account security. Where applicable, this relies on performing that agreement and our legitimate interest in preventing unauthorized access. Adult gameplay analytics relies on your consent. You can withdraw it in Settings without affecting local play. Joshua uses website request information to deliver and secure the website, and support information to respond to the request you chose to send. Where a legal basis is required, these latter purposes rely on the legitimate interests of operating a safe service and answering support requests, or on a legal obligation when one applies. Retired gameplay sharing relied on the permission given through its optional setting.

Supabase processes optional accounts and backups and hosts downloadable artwork and pronunciation files for players of all ages. Its delivery providers process the connection information described above; Apple and Google handle their sign-in flows; PostHog processes optional adult analytics; Vercel hosts the website and retired analytics storage; Zoho hosts support email. Their services can process information in the United States and other countries. We require providers handling this data to protect it under their applicable processing agreements and the protections described in this policy. Provider contracts and applicable transfer safeguards govern that processing. See Supabase's privacy policy, Apple's privacy policy, Google's privacy policy, PostHog's privacy policy, Vercel's privacy notice, and Zoho's privacy policy. meramu does not sell personal information or share it for behavioral advertising.

Support correspondence, including deletion requests and any analytics IDs you include, is kept while needed to answer your request, handle follow-up, or meet legal and security obligations. You can ask us to delete it. Depending on the law that applies to you, you may have rights to access, correct, delete, or receive your information, restrict or object to its use, withdraw consent, and complain to a data-protection authority. Email privacy@meramu.app. We may need limited information to verify a request. We cannot retrieve progress stored only on your device, and an email address alone does not identify an analytics installation.

Changes

This page will be updated if meramu's privacy practices change.

Last updated September 30, 2026.