Yanamino Privacy Policy

Last updated: 5 November 2026

This policy explains what personal data the Yanamino app collects, why, who else handles it, how long it is kept, and what you can do about it. It covers the Yanamino app for iPhone and Android, and this website, yanami.no.

The short version

1. Who is responsible

The controller of your personal data is:

Atahan Caliskan, the maker of Yanamino
Norway (postal address on request, by email)
Email: support@yanami.no

Yanamino has no data protection officer; the law doesn't require one for Yanamino. Write to the email address above about anything in this policy.

2. What we collect, and why

2.1 Using Yanamino without an account

Your decks, progress, lessons, notes, settings and app-lock PIN are stored only on your phone. We can't see them.

To download Yanamino's free decks and dictionaries from Explore without an account, the app contacts our server, which sees your IP address. To stop abuse, the server keeps a one-way code made from your network address with a secret key. The code can't be turned back into the address, and old codes are cleared out regularly.

2.2 Your account

When you create an account, we store:

Emails from us: the emails that confirm your email address and that carry a password-reset code come from no-reply@yanami.no, sent for us by Resend (section 3).

Sign in with Google: if you use it, Google tells us your email address, and our sign-in provider also stores the name and profile-picture link from your Google account. Yanamino doesn't show them.

Why: to give you an account and keep it secure. Legal basis: providing the service you signed up for (GDPR Art. 6(1)(b)).

Your age band: why. Yanamino accounts are for people 13 and older, and running groups and sharing decks are for people 16 and older. Legal basis: our legitimate interest in keeping those age limits, which protect younger users (Art. 6(1)(f)). The app also keeps your age band on your phone, with your groups, so it works offline; it's deleted when the account is removed from the phone.

2.3 Sync and backup

With an account, Yanamino stores what it syncs:

When you study a deck from Explore, we record that you studied it on that day, once a day, to count how many people study each deck. Explore shows only the totals.

Why: to back up your library and keep your devices in sync, and to show how popular Explore's decks are. Legal basis: providing the service (Art. 6(1)(b)); for the study counts, our legitimate interest in showing and improving Explore (Art. 6(1)(f)).

2.4 AI practice

When you ask Yanamino to make practice questions from your material, or to grade an answer, the text involved goes through our server to Anthropic, the company that runs the AI model. That text is the material you chose (such as a lesson or your notes), the question, and your answer. We don't send your email address, username or account ID with it.

When you use AI Review on a quiz shared with a group, Yanamino sends the quiz's question, its expected answer and its source quote (written by the person who shared it) with your answer to Anthropic for grading, without your email address, username or account ID, as for your own quizzes. It counts toward your own daily allowance.

We count how much AI you use each day, to apply the daily allowance shown in Settings. The questions you keep are saved with your quizzes.

Why: to make and grade practice questions when you ask. Legal basis: providing the service (Art. 6(1)(b)).

Checking public items. When someone makes a deck, lesson or quiz public, Yanamino also sends its text (its title, description and content) to Anthropic, to check it against our Community Guidelines before anyone else sees it (section 2.14). We send it without the maker's email address, username or account ID. This check is Yanamino's own cost and never uses anyone's AI allowance.

2.5 Groups and organizations

Groups are for people 13 and older (see section 8). When you use them, we store:

Who sees what: the people running a group (its Leaders, and the Owners and Admins of its organization) see your username, your role and when you joined.

Courses that the people running a group make are stored with that group and deleted with it. Courses record nothing about how members use them.

Why: to run groups. Legal basis: providing the service (Art. 6(1)(b)).

2.6 Progress sharing in groups

A group can be Private or Shared with Leaders. In a group shared with Leaders, the people running it can see how much of the group's decks you've learned, when you last studied, and your AI Review results on the group's quizzes: for each quiz, how many questions you've answered and one figure for your grades, updated once an hour. They never see your answers, the AI's feedback or anything from Self Review, and they never see progress on your own decks or quizzes. The figures change only once an hour, so they don't show when you answered. Results start counting from the first full hour after both your sharing begins and the quiz joins the group, and they're deleted when you leave the group or become one of its Leaders, when sharing stops or the group is archived, when the quiz leaves the group, and when a question is removed from the quiz the group uses (then all your results on that quiz go, so its figures start over and never show the removed question's grade).

The app tells you before you join a group that shares progress. If a group turns sharing on later, you're told, and it starts 7 days later, so you can leave first. To stop sharing, leave the group. To show dates correctly, we also store the time zone of the person viewing the progress. If you're under 18, a parent can ask us to remove you from a group, and we will.

Legal basis: our legitimate interest, and yours, in letting the people who run a group help its members with their studies (Art. 6(1)(f)).

2.7 Decks, lessons and quizzes you share with groups

If you lead a group and are 16 or older, you can share your own decks, lessons and quizzes with it. Yanamino then stores a copy, including its images and audio, and shows it to the members of the groups it's shared with. The people running those groups see that you shared it.

Lessons you share with a group are stored on Yanamino's servers while a group uses them, as shared decks are. Members' phones keep their copies. Nothing about what anyone reads is recorded or sent, and ticks in a shared lesson stay on the member's phone, outside its backups. As for decks, the server counts downloads per person for a day to prevent bulk copying, and our hosting providers' request logs keep which deck or lesson was fetched, without the account, for up to 30 days (section 2.12).

Quizzes you share with a group are stored on Yanamino's servers while a group uses them, as shared decks are, including their expected answers and source quotes. When a member uses AI Review, the question, its expected answer and its source quote are sent to Anthropic to grade their answer (section 2.4). Where a quiz came from and your technique targets stay on your phone.

To keep downloads within limits, we record how much media, decks and dictionaries each account downloads from Yanamino, shared and official. These records are deleted after 8 days.

Legal basis: providing the service (Art. 6(1)(b)).

2.8 When you delete your account

Your account and everything synced to it are deleted (section 6 lists what can stay). If you're the last owner of an organization or of free groups, the app first asks whether those go too, and tells their members.

If you shared decks with groups in a space you don't own alone, you choose what happens to them. Nothing is chosen for you:

If you're under 16, or haven't told us your age, Keep isn't offered and the decks are deleted.

Anything you made public is unpublished either way (section 2.14). With "Delete" it's removed everywhere. With "Keep" it stays only in the groups you added it to yourself, and leaves every other group, and every library that got it from Explore.

If no choice was recorded, for example when an account is deleted by other means, the decks are deleted.

Why we keep decks you choose to keep: the groups use them as study material, and you chose to leave them. Legal basis: our legitimate interests, and the groups', in keeping study material that members rely on (Art. 6(1)(f)). The decks themselves no longer name your account. For a limited time, though, our backups still hold your account as it was, and our sign-in provider's log and server logs record when it was deleted, which could be matched to the decks (section 4 says how long). What's in the decks, such as your voice, may also show they're yours. You can object at any time (section 7).

A deck that someone in the space took over, or that someone got with your reclaim code, is managed by them. You can still ask us about your recordings in it.

2.9 Reclaim codes

When you keep your decks with their groups, Yanamino shows you a reclaim code until you say you've saved it. After that it can't be shown again. It looks like MNG-7K2Q-9XWD-4M8T-HP3R-ZB6N.

To stop people guessing codes, the server limits how often codes can be tried. For signed-out use, it does this with a one-way code made from your network address, as in section 2.1.

2.10 Reports, moderation and safety

You can report a deck, lesson, quiz, group or message that breaks the rules, or one card, page or question in an item. We store the report: what was reported and which part, the reason, the note you add (if any), whether you ticked that you believe it's true or asked us to look at the maker too, where you came across it (Explore, or which group), and which account sent it. When the reporting account is deleted, the report no longer names it. We work out ourselves who made a reported item, and we never tell them who reported it. For a copyright report, we may tell them the rights holder's name, so they can answer. We tell you the outcome.

If you report something by email without an account, we keep your email address with the report, so we can answer you.

Which reports can pause an item. Reports from several people can take a public item out of Yanamino's search, or pause it, until a person at Yanamino looks at it. So that a few throwaway accounts can't do this, a report counts toward an automatic pause only if its account came across the item itself, is old enough, signs in a way we can rely on (such as Sign in with Google), and hasn't made mostly unfounded reports before. We work this out from the account's age, how it signs in, and how its earlier reports were decided. It affects nothing else about the account.

Decisions. When Yanamino pauses something, doesn't make it public, removes it, or restricts an account, we keep a record of the decision: what we did, which rule, what we found, whether it was automatic, and who at Yanamino decided. The person it's about gets these reasons and can ask us to look again. A removal is a strike against the maker's account for a year. When we suspend an account, when it gets a third strike in a year, or when it's deleted while it has a strike, we keep a fingerprint of its sign-in: a one-way code, made with a secret key, from the sign-in provider's account number and the email address. It can't be turned back into the address. We use it only to stop a new account with the same sign-in from sharing or making things public: for 2 years, or for a deleted account, until its strike would have ended.

Evidence. We keep a copy of a reported item as evidence. That copy is deleted once it's no longer needed, and never later than a year after the item was taken down.

Legal hold. When a report is about a child's safety or something illegal, when someone's life or safety is threatened, or when the police ask, we can place a legal hold. It keeps the item, its earlier versions and its maker's identity (their email address, username and how they sign in), even if they delete their account, for at most a year, unless the police ask us to keep it longer.

The police. We report suspected child sexual abuse material to the police (Kripos in Norway, or NCMEC in the US for material from abroad), and threats to someone's life or safety at once. We give them what they need to act, which can include the identity a legal hold keeps. We delete our copies of suspected child sexual abuse material once it's reported, unless the police ask us to keep them.

Alerts. When a report arrives, or something waits for a person at Yanamino to look at it, the owner's phone gets a notification through the ntfy service. It says only what kind of thing is waiting and how many: nothing about the report, the item or anyone involved. ntfy receives no personal data.

Why: to keep Yanamino safe, handle reports and notices, explain our decisions, and establish or defend legal claims. Legal basis: our legitimate interests (Art. 6(1)(f)); for reporting to the police and keeping what they ask for, our legal obligations where the law requires it (Art. 6(1)(c)). We can keep evidence and a legal hold even if you ask us to delete them (Art. 17(3)(b) and (e)).

2.11 When you write to us

If you email us, we receive your email address and what you write. We use it to answer you and to handle requests about your data. Email to support@yanami.no is forwarded by Webhuset, our domain provider, to Gmail, a Google service, where we handle it.

Legal basis: our legal duty to answer requests about your data (Art. 6(1)(c)), and our legitimate interest in giving support (Art. 6(1)(f)).

2.12 Technical data and logs

When the app contacts our server, or you visit this website, our hosting providers (Supabase and Vercel, section 3) log technical details such as your IP address, the time and the address called. Our sign-in provider's log also records account events, such as an account being deleted, with the account's email address. These logs are used to keep the service running and secure, and are kept for up to 30 days.

Legal basis: legitimate interests in security and in running the service (Art. 6(1)(f)).

2.13 Device features

Legal basis: providing the features you use (Art. 6(1)(b)). For Google's recognition, your choice to turn it on. Google decides what technical information ML Kit sends it, and uses it under its own terms and privacy policy.

2.14 Public decks, lessons and quizzes

If you're 16 or older and have Yanamino Premium (a free trial doesn't count), you can make a deck, lesson or quiz you made public.

Checks before it goes public. Every new public item, every new version and every new description is checked before anyone else sees it:

Before public items can carry pictures or recordings, we'll name here the services that check them: matching pictures against known child sexual abuse images, and turning recordings into text.

The checks keep only a one-way fingerprint of each piece of text they checked, with the result, so the same text isn't checked twice. They don't keep the text.

What's decided automatically. Whether a person looks at your item before it goes public, and how many items you can make public, depend on your history on Yanamino: how many of your items we've allowed, how old your account is, how you sign in, and whether you have a strike. A check never removes an item: it sends it to a person. Section 2.10 says how reports can pause an item. Every time something happens to your item, we tell you why.

Studying a public item (Get). When you get a public item, the copy is on your phone. We don't record on our server who got which public item. If you study it, your progress syncs with your account like any progress, so it's stored there with the item's cards. Your phone checks from time to time whether the items you got are still public, and removes any that was taken back or removed (your progress stays). To keep downloads within limits, we record how much media each account downloads, not which item (section 2.7), and our hosting providers' logs record requests for a short time (section 2.12). If you load an item's pictures and sound before you get it, we count that for a day, to limit downloads.

Searching. We don't keep what you search for. We count searches and the pages you look through, per account, for a day, to stop bulk copying.

Hide Items by This Maker. We store that you hid a maker, with the title of one of their items so you can tell which, until you unhide them or delete your account. The maker isn't told.

Unpublishing. When you unpublish an item, it leaves Explore at once, and every group and library that found it on Yanamino. When you delete your account, everything you made public is unpublished (section 2.8).

If you don't use Yanamino and a public item shows your picture, your voice or your personal details, tell us (see How to report something on Yanamino, or write to support@yanami.no). We look at it straight away. If you're under 18, or a parent writes for you, we always remove it.

Legal basis: making your item public is a service you ask for (Art. 6(1)(b)). The checks, the review by a person, the limits, the publisher-name rules and Hide Items by This Maker rest on our legitimate interests in keeping Yanamino safe, especially for its younger users (Art. 6(1)(f)).

2.15 Yanamino Premium

If you have Yanamino Premium, we store where it comes from (a grant from Yanamino, or, once Premium is sold, your own subscription) and when it ends. Your phone keeps whether you have Premium and when it ended, so it can lock Premium downloads, such as the Comprehensive dictionaries, and remove them from the phone 30 days after Premium ends.

Others can tell a little from how your groups work: the people in a My Groups you made can tell from its limits on groups and items whether you have Premium, and its co-owners see how many groups you have across the spaces you made.

Legal basis: providing the service (Art. 6(1)(b)).

3. Who else handles your data

We never sell your data or share it for advertising. These companies process data for us, or receive it when you use their service:

WhoWhat forWhere
SupabaseDatabase, file storage, sign-in and server functions. Holds all synced data. Processes it for us under its data-processing agreement.The UK (London). Supabase Inc. (USA) may access it under standard contractual clauses.
VercelRuns Yanamino's server functions, which pass the app's requests on to Supabase, and hosts this website. Processes data for us under its data-processing agreement.The UK (London); requests reach it through Vercel's network around the world. Vercel Inc. (USA) may access it under standard contractual clauses.
AnthropicRuns the AI model for AI practice (section 2.4) and for checking public items (section 2.14). Processes the text for us. Its commercial terms don't allow it to train its models on that text, and it keeps the text only for a limited time.USA
GoogleSign in with Google, if you use it (Google acts under its own privacy policy); ML Kit handwriting recognition, if you choose it (section 2.13); Gmail for support email.USA and elsewhere
Apple and Google app storesDistributing the app. They may give us anonymous, combined statistics and crash reports, depending on your device settings.Under their own privacy policies
ntfy (ntfy.sh)Tells the owner's phone that a report or an item is waiting (section 2.10). It receives no personal data.Under ntfy.sh's own terms
ResendSends Yanamino's emails about your account: the link that confirms your email address, and password-reset codes. It receives your email address and the email. Processes data for us under its data-processing agreement.Ireland (EU). Resend, Inc. (USA) may access it under standard contractual clauses.
WebhusetOur domain provider: runs yanami.no's addresses, and forwards email sent to support@yanami.no to Gmail.Norway

Other people see some data because that's how groups and public items work: see sections 2.5–2.7 and 2.14. We'll also disclose data if the law requires it, and we report suspected child sexual abuse material and threats to someone's life or safety to the police (section 2.10).

Transfers outside the EU and EEA. Our database and server functions run in the UK, which the EU has decided protects personal data adequately (an adequacy decision, which also applies in Norway). Other transfers are made under standard contractual clauses, or another safeguard the GDPR allows (Art. 46), as set out in each provider's data-processing terms.

4. How long we keep data

DataHow long
Your account, synced library, progress, settings, group memberships, blocks, AI usage countsUntil you delete it or your account
Your age band"16 or older": until your account is deleted. If you're under 16: the month you turn 16, until that month comes; then "16 or older".
An account that answered under 13, or that a parent told us is under 13The date it will be deleted, until it's deleted 14 days later. If we lifted the lock because it was a mistake: the date of the lift, the date a parent wrote (if one did), and whether an age was on record when it was locked, kept with the account until it's deleted, so a second lock can't be lifted. Never an age.
A deck you delete everywhere while you have an accountIts cards and files are erased within 14 days. A small record of it without the cards is kept for 90 days, so it comes back if you share it again.
Decks you shared, after "Delete all my decks"Erased within 14 days
Decks you shared, after "Keep my decks with their groups"Until the group's Owners or Admins delete them, the space is deleted, or someone deletes them with the reclaim code
A reclaim code's fingerprintUp to 2 years after the deletion
A deleted organization or group14 days (it can be restored until then), then erased
Email invitationsThe address is deleted when the invitation is accepted, withdrawn or expires (14 days)
Notifications90 days after you read them, and never more than 180 days
Finished join requests and invitations180 days
Media download records8 days
Records of how often an account used a limited feature (such as AI Review, searches, reports or making items public), kept to apply those limits: the account and when (for a few limits, such as loading an item's pictures and sound, also which item)A day; 8 days for the weekly limit on making items public
Your AI Review results on a group's quiz, kept for the group's progress viewUntil you leave the group or become one of its Leaders, the group stops sharing progress or is archived, the quiz leaves the group, or a question is removed from the quiz the group uses (then all your results on that quiz go)
One-way codes made from network addresses (to limit abuse)They count for about an hour, and old ones are cleared out regularly
An item you made public: its public version, and earlier versions that groups, checks or reports still needThe public version while the item is public; an earlier version while a group, a check or a report still needs it. Unpublishing, or deleting your account, ends the public version (sections 2.8 and 2.14)
Your publisher nameUntil you change it or delete your account. A name you gave up: the name alone, without who used it, for 2 years
Results of the checks on public items (a one-way fingerprint of what was checked, and the result)A year. Fingerprints of pictures matched to known child sexual abuse material, or found to be sexual and severe, are kept for good, with nothing about who uploaded them, so the same picture is stopped again
ReportsWhile we handle them, and for a year after; then a short record (the reason, the dates, the outcome and the item's code), without the note, the reported content or who reported, until 3 years after the report. When the reporting account is deleted sooner, the report no longer names it.
Reports sent to us by emailThe email: 6 months after we close the report. Your email address in our record of the report: as for reports
Moderation decisionsThe full record for a year, or until its strike ends if that's later; then a short record (what we did, which rule, when, the item's code, whether it was automatic and who decided), until 3 years after the decision
StrikesA year
Sign-in fingerprints, after a suspension, a third strike, or deleting an account that had a strike2 years; for a deleted account, until its strike would have ended
A legal hold: the item, its versions and its maker's identityAt most a year, unless the police ask us to keep it longer
Evidence copies of reported itemsUntil no longer needed; never more than a year after a takedown. Suspected child sexual abuse material: deleted once it's reported to the police, unless they ask us to keep it
Makers you hidUntil you unhide them or delete your account
Where your Premium comes from, and when it endsUntil your account is deleted
Support emails about your data6 months after we close the request. We keep a short log without your email address, to show we handled it.
Server logs, and our sign-in provider's log of account eventsUp to 30 days
BackupsUp to 7 days

Backups. Our database backups are kept for up to 7 days, so deleted data, including a forgotten reclaim code, can stay in a backup for that long before it's overwritten. If we ever restore a backup, we first delete again everything we know was deleted after it was made.

5. Your rights

You have the right to:

Most of this you can do in the app: edit or delete your decks and lessons, leave groups, and delete your account in Settings, then your account at the top, then Delete Account. For anything else, write to support@yanami.no. We answer within one month, and it's free. We may ask you to confirm the request comes from you, for example by writing from your account's email address.

After your account is deleted, we can find decks you kept from a reclaim code, or from what you tell us about them (their titles and groups). Our sign-in provider's log and server logs (kept for up to 30 days) record when your account was deleted, and backups (up to 7 days) hold your account as it was, so they could also link the decks to you while they last. Apart from those, nothing we hold links the decks to you.

You can do some things yourself without an account, with a reclaim code: in the app, go to Settings › Help › Forget a Reclaim Code and use your code to see how many decks it holds, forget it, or delete the decks. To take the decks over, sign in and go to Settings › Account › Redeem a Reclaim Code.

Each use above names its legal basis. We don't make automated decisions that have legal or similarly significant effects on you. Automatic checks and reports can send a public item to a person at Yanamino, or pause it until a person looks at it (sections 2.10 and 2.14). They never remove an item or close an account by themselves, and every decision comes with its reasons and a way to ask us to look again.

6. What can stay after you delete your account

Nothing you made public stays public: it's unpublished when your account is deleted (section 2.8).

7. Your right to object

You can object at any time to our keeping decks you left with groups, or to any other use of your data based on legitimate interests. Write to support@yanami.no, and tell us which decks (their titles and groups), or send your reclaim code. You can also delete the decks yourself with the code, in Settings › Help › Forget a Reclaim Code, or ask the space's Owners. We stop unless we have compelling legitimate grounds that override your interests, or need the data for legal claims.

If you're under 18, a parent can write for you. If you're under 18, you or a parent can ask us to delete decks you kept or that someone redeemed, and we always will.

8. Children

Yanamino accounts are for people 13 and older. When someone signs up, the app asks their month and year of birth; an account that hasn't answered is asked the next time the app opens. Someone under 13 can keep using Yanamino on their phone without an account: their decks and progress stay on the phone, and Yanamino's free decks download without an account (section 2.1). That answer stays only on that phone, for 24 hours, and isn't sent to us. Without an account, Yanamino doesn't use Google's handwriting recognition (section 2.13).

Running groups, managing people, sharing decks, lessons and quizzes, and making them public are for people 16 and older. Anyone with an account can study a public item. People tell us their own age; we don't check documents.

If an account says it's under 13, or we learn that an account belongs to a child under 13, we lock it at once and delete it, with everything synced to it, 14 days later. Its group memberships end at once. If it alone owns groups or an organization, those are deleted with it, and their members are told. If it was a mistake, write to us from the account's email address within the 14 days. A parent can ask us by email; we don't ask for ID. On the phone where the answer was given, the app keeps the time of the answer for 24 hours, and which account it was, for those 24 hours or until our server has the lock, whichever is later.

9. Security

Data is encrypted on its way to and from our server. Access is limited by strict database rules, and only the owner can manage the server. Reclaim codes and sign-in fingerprints are stored only as one-way fingerprints, and passwords only in scrambled form.

10. Complaints

If you think we handle your data wrongly, please tell us first. You can also complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no), or to the data protection authority where you live or work.

11. Changes to this policy

When we change this policy, we update the date at the top. Earlier versions are available on request.

12. Contact

Atahan Caliskan, Norway (postal address on request, by email)
support@yanami.no

To delete your account, see Delete your Yanamino account.