Privacy policy

Why you don’t have to take our word for it

Most privacy policies are promises about intent. This one is held up by tests that fail the build:

• Only two files in the app are allowed to reach the internet: the update checker and the ranked-play client. Every other file is checked by a test that fails the build, and the test names the sentence it would break. The ranked client is compiled out of shipping builds today, and the update checker does nothing until you switch it on — so with it off, the app makes no network requests at all. The rule that matters long-term is the boundary, not the absence.
• The list of third-party packages is pinned, because a search of our own code can’t see a package that phones home inside itself. Add an analytics library anywhere and the build goes red.
• Tests prove neither object that can reach the network can even be created before you have switched it on.
• The exact field list of every outbound request is pinned to a file, so what leaves your device is a failing test rather than a code-review opinion.

Update checks (Android, off by default)

Settings → Updates → “Check for updates” lets the app ask this website, at most once a day, whether a newer version exists, and download it when you tap Install. Nothing about you or your training is sent: the check is a plain request for a public file, and the download adds only an update key that is the same in every copy of the app. Like any request, both carry your IP address, which our host (Cloudflare) receives. The download is checked against its published checksum, and Android refuses any build not signed with the same key as the one you have.

Reminders stay on your phone

The optional daily reminder is composed and scheduled on your device. No schedule, no notification text and no record of whether you opened one is sent anywhere — not to us, not to Google. Turning reminders on asks Android for the notification permission and nothing else, and turning them off cancels the one pending alarm.

The same is true of your streak, your levels and your test results: they are worked out on the device from data that never leaves it.

Neither option is anonymous

We don’t use that word, because it wouldn’t be true.

Ranked play puts a display name you choose on a public board. Diagnostic sharing links your sessions to each other under a random id, because a training history only means anything as a sequence.

Both are pseudonymous: not tied to your name, your email or your device, but not unlinkable either. Anything sent under one identifier connects to everything else sent under it. Calling that anonymous would be a claim the design doesn’t support.

Ranked play (built, not live)

Ranked play and its leaderboards are written and tested but compiled out of every shipping build. You can’t opt in, because it isn’t there. Here’s what it will collect when it ships.

• A display name you choose, 3–16 characters. It’s public on the leaderboard, so don’t use your real name. It’s the only field where you could put personal information into this system, and the app can’t check what you type, so this warning appears where you type it too.
• A key generated on your device. This is your ranked identity. The private half never leaves your phone. No account, no password, no email, no phone number, no advertising id.
• The session itself: which exercise, the server’s starting number, your answers in order with their timings, and any interruptions — the last so a phone call voids the session fairly instead of penalising you. The server works out your score from these rather than trusting a score you send.
• Optionally, a country. The board is more interesting when you can see who you are up against, so there will be a place to say where you train from. It will be optional, chosen from a list rather than read from your location or your IP, and anything finer than a country will be written into this policy before it ships.
• Your ladder position and scores worked out from the above.

It will not collect your training history or your test results. Those never leave the device under any current setting. Nor your location, your contacts, or anything about your device beyond what any network request carries. Requests carry an IP address, used briefly for rate limiting and not stored with scores.

Diagnostic sharing (built, not wired up)

A separate opt-in from ranked play. Agreeing to one doesn’t opt you into the other, and you can have either, both or neither. Also not live: the screen and the payload exist, but nothing is connected to send them.

It exists because bugs that only show up in real use are otherwise invisible. The app once shipped a scoring bug that made an exercise unwinnable for months, and no amount of testing here had caught it.

Before you agree, you can see exactly what would be sent. The opt-in screen builds the real payload from your own recent sessions using the same code that would upload it. Not an example, not a description.

Each completed training session would send:

• A random id made on your device when you opt in. It’s unrelated to your ranked identity and cleared when you turn sharing off. Opting back in makes a new one, so the old data can’t be joined to the new.
• The session: which exercise, the difficulty it started and ended at, how accurate you were, how long it took, who chose the exercise, whether anything interrupted it, the app version and kind of device, and the date, never the time of day.
• One row per question: right or wrong, how fast, which kind of mistake, the difficulty, and where it came in the session.
• Whether this device has ever restored a backup, as one yes or no. Without it, a history that jumps because you changed phone looks the same as one that jumps because you improved.

It would never send your test results, your ranked identity or display name, the time of day you trained, or sessions restored from a backup.

Retention: 18 months, then automatic deletion. You can delete everything sooner from Settings, which also stops future sending. Data already sent can be deleted but can’t be un-sent, and the opt-in screen says so.

Where it would live

Ranked data will be stored with Cloudflare (D1) in the Asia-Pacific region, with leaderboard responses cached briefly at Cloudflare’s edge.

Deleting it

Settings → Ranked → Delete ranked identity will remove everything held on the server — identity, scores, logs, leaderboard rows — immediately and permanently. Your on-device data is untouched by that and stays yours.

Lose both your recovery code and your device and the server-side data is orphaned for good. It can’t be reconnected to anyone.

This website

The site you’re reading sets no cookies, runs no analytics of any kind, and loads nothing from another origin — no fonts, no scripts, no embeds, no images from a CDN. There’s no consent banner because there’s nothing to consent to.

It’s served as static files from Cloudflare, which processes request logs including IP addresses as part of serving and protecting any site. We don’t add to that and don’t receive per-visitor reports.

Downloads come from a separate Cloudflare R2 bucket on the dl. subdomain. Requesting a file there is an ordinary web request and carries an IP address, like any download anywhere.

Children

Tanren Sensei isn’t directed at children under 13 and collects no information that could identify anyone of any age.

Changes

If this policy changes in a way that matters, the app will show you the new version and ask again before any further ranked submission.

Contact

A contact address on this domain is being set up and will be published here. Until then there’s no email address on the site, which is deliberate: an address in a page’s source gets harvested within days, so the answer is a dedicated address that can be rotated rather than a personal one behind a link.