Privacy Policy

Last updated: October 25, 2026

The short version: we collect only what MoraFlow needs to run your account and track your learning. Your voice recordings for pitch practice are analyzed in your own browser and are not sent to us. No ads, no analytics trackers, and we never sell your data.

MoraFlow (“MoraFlow”, “we”, “us”) is a website for learning Japanese pitch accent, currently operated by Mason Young. If MoraFlow becomes a company, we will update this page to name it. This policy explains what information we collect at moraflow.io, why, and the choices you have.

1. Information we collect

Account information

• Your username, email address, and password. Passwords are stored only as a secure one-way hash; we can never see them.
• If you use “Sign in with Google”: your email address and Google's account ID for you, so we can recognize you next time. We don't receive your Google password or contacts.
• Whether your email address is verified, and when you created and last logged in to your account.

Learning data

• Your answers and results in quizzes, training, flashcard reviews and the placement test (for example which word, which pattern you chose, whether it was right, and how long you took to answer).
• Progress you build up: accuracy per word, levels, streaks, XP, achievements, study calendar and plan, settings, and the word lists you create.

Microphone recordings

Pitch practice asks for access to your microphone. Your recording is analyzed inside your browser to draw your pitch curve and grade it. The recording is not uploaded to our servers and not stored. If we ever add a feature that sends recordings to our servers (for example, automatic pronunciation checking), we will update this policy and tell you in the app first. We will only ever use recordings to improve MoraFlow's feedback if you opt in to that separately.

Technical information

• Like any website, our servers receive your IP address and basic request details (pages and files requested, browser type, time). Our hosting providers keep these logs for a limited time for security and troubleshooting.
• Your IP address is also used, briefly, to limit repeated login or sign-up attempts (to protect accounts from password guessing).

2. How we use it

• To create and run your account, and to show and save your learning progress.
• To choose what to practice next (for example, words you often get wrong and when flashcards are due).
• To send emails you need: verifying your address and resetting your password. We don't send marketing emails unless you ask for them.
• To keep MoraFlow secure, prevent abuse, and fix problems.
• To understand, in aggregate, how well the exercises work and improve them.

We do not sell your personal information, show ads, or share your data with advertisers.

3. What other people can see

If you appear on the leaderboard, other MoraFlow users can see your username and XP. Your email address and other account details are never shown to other users. Choose a username you're comfortable with being visible.

4. Services we use

We rely on a few companies to run MoraFlow. They process data only on our behalf and for these purposes:

We may also disclose information if required by law, or to protect the rights and safety of our users or MoraFlow.

5. Cookies and browser storage

We use only what's needed for MoraFlow to work — no advertising or tracking cookies:

• Login cookies (mf_access, mf_refresh): keep you signed in (up to 30 days). They can't be read by the page's scripts.
• Security cookie (csrftoken): protects your account from forged requests.
• Browser storage: remembers your settings on this device, such as light/dark mode and language.

6. Where your data is stored, and for how long

MoraFlow's servers and database are in the United States. If you use MoraFlow from another country (for example Japan, the UK or the EU), your information is transferred to and processed in the United States, which may have different data-protection rules from your country.

We keep your account and learning data for as long as you have an account. When you ask us to delete your account, we delete it and its learning data within 30 days. Database backups are kept for up to 7 days, so deleted data disappears from backups within that time. Server logs are kept only for a limited time.

7. Your rights and choices

• Access or export the personal information we hold about you.
• Correct it — you can change your email address in the app, or ask us.
• Delete your account and its data.
• Object to or ask us to restrict certain uses.

To do any of these, email support@moraflow.io from the address on your account. We'll reply within 30 days. Depending on where you live (for example the EU, UK, Japan or California), you may have additional rights under local law, including the right to complain to your data-protection authority.

Where the law requires a legal basis (such as the GDPR), we process your data to provide the service you signed up for, for our legitimate interest in keeping MoraFlow secure and improving it, and with your consent where we ask for it.

8. Security

We use HTTPS everywhere, store passwords only as secure hashes, keep login cookies inaccessible to page scripts, and limit repeated login attempts. No system is perfectly secure, but we work to protect your information and will tell you if a breach affects you, as the law requires.

9. Children

MoraFlow is not directed at children under 13, and you must be at least 13 (or older, if your country requires) to create an account. If you believe a child under 13 has given us personal information, contact us and we will delete it.

10. Changes

If we change this policy, we'll update the date above. For important changes, we'll let you know in the app or by email before they take effect.

11. Contact

Questions or requests: support@moraflow.io