Privacy Policy

This policy explains how Synapse Social (UEN [UEN]), of [REGISTERED ADDRESS], Singapore (“Yomi”, “we”, “us”) handles personal data when you use the Yomi app or the website at yomilang.com.

We are the organisation responsible for that data under Singapore’s Personal Data Protection Act 2012 (PDPA). If you are in the EEA or the UK we are the “controller” under the GDPR. §12 sets out your rights under each.

The PDPA requires us to appoint someone accountable for data protection and to publish their contact details. Ours is:

[DPO NAME OR ROLE — e.g. “Data Protection Officer”]
Email: [DPO EMAIL — e.g. privacy@yomilang.com]

Write to that address for anything in this policy — an access request, a correction, a deletion, or a complaint.

In the mobile app

The app currently stores the following on your device only, using your phone’s local storage. It is not transmitted to us and we have no access to it:

• which Japanese words you have tapped, saved, or marked as known, and their state;
• your review history and spaced-repetition scheduling data;
• the answers you give during onboarding — your level, your goal, how much time you want to study;
• your display preferences.

On the website

• Your email address, if you enter it to join the waitlist.
• A short source label recording which form you used, so we know which part of the page works.
• Standard server log data generated by our hosting provider when any website is visited — IP address, browser type, time of request — used for security and reliability.

What we do not collect

To be concrete, because vagueness here is how policies mislead. We do not collect your name, phone number, contacts, photos, microphone or camera input, precise or approximate location, advertising identifiers, or biometric data. We do not track you across other apps or websites. We do not run third-party advertising or analytics SDKs in the app.

• Your email — to tell you when Yomi launches and to send occasional product updates. Under the PDPA we rely on the consent you give by submitting the form; under the GDPR, on consent (Article 6(1)(a)). You can withdraw it at any time — see §12.
• The source label — to understand which parts of the page are effective. Legitimate interests (GDPR Article 6(1)(f)); it is not used to identify you.
• Server logs — to keep the site secure and working. Legitimate interests.
• On-device learning data — to make the app function at all. It never reaches us, so we are not processing it — you are.

We will not use your personal data for a new, unrelated purpose without telling you first and, where the law requires it, obtaining your consent.

Yomi plays video through YouTube’s official embedded player and uses YouTube API Services to read public information about videos — their title, channel, length, licence, and whether they can be embedded.

When a clip plays, your device connects directly to YouTube and Google. Google may set cookies or similar identifiers and may collect data about that playback, including your IP address and what you watched — in the same way as if you had opened the video on YouTube. That processing is Google’s, not ours, and is governed by the Google Privacy Policy.

We do not send Google your email address, your saved words, or anything else that identifies you. We use YouTube API Services only to read public video metadata; we do not access any YouTube account of yours, and we never ask you to sign in to Google through Yomi.

You can review and revoke any third-party access to your Google account at Google security settings, and read the YouTube Terms of Service.

We use a small number of service providers to run Yomi. They process data on our instructions and are not permitted to use it for their own purposes:

• Supabase — stores the waitlist — your email and source label. Hosted in [SUPABASE REGION].
• Our website host ([HOSTING PROVIDER — e.g. Vercel]) — serves yomilang.com and generates the server logs in §3.
• Google (YouTube) — as described in §5.

We may also disclose personal data where the law requires it, to establish or defend a legal claim, or to protect someone’s safety. If the business is sold or reorganised, data may transfer to the new owner — we will tell you if that happens.

We do not sell personal data.

We have never sold or shared personal data for cross-context behavioural advertising, and we have no plans to. For California residents, that means there is nothing for you to opt out of.

The website does not use advertising or analytics cookies. It may use strictly necessary cookies to function.

The embedded YouTube player sets its own cookies when a clip plays. Those are Google’s, not ours (§5). You can block or delete cookies in your browser or device settings, though doing so may stop video playing.

Yomi is not directed at children under 13, and we do not knowingly collect their personal data. Under the PDPA, a child under 13 generally cannot give valid consent, so we rely on a parent or guardian.

If you are a parent or guardian and believe your child has given us personal data, contact our DPO and we will delete it promptly.

The PDPA requires us to stop retaining personal data once it no longer serves the purpose it was collected for. In practice:

• Waitlist emails — until you unsubscribe or ask us to delete them, or until [WAITLIST RETENTION — e.g. 24 months] after the waitlist closes, whichever comes first.
• Server logs — kept for a short period by our host and then rotated.
• On-device learning data — until you delete it or uninstall the app. That is entirely in your hands.

When you ask us to delete data, we will do so within 30 days, except where we must keep it to comply with a legal obligation.

We use HTTPS for data in transit and encryption at rest at our storage provider, restrict access to the few people who need it, and keep credentials out of our codebase.

No system is perfectly secure, and we would rather say so than imply otherwise. If a data breach occurs that is likely to cause you significant harm, or that meets the notification threshold under the PDPA, we will notify the Personal Data Protection Commission and affected individuals as required by law.

We are in Singapore, but our service providers may store or process data elsewhere. The PDPA’s Transfer Limitation Obligation requires us to ensure any recipient outside Singapore provides a standard of protection comparable to the PDPA, and we do that through our contracts with them.

For transfers out of the EEA or UK, we rely on the European Commission’s or UK’s Standard Contractual Clauses, or on an adequacy decision where one applies. You can ask our DPO for details.

Everyone

• Access — ask what personal data we hold about you and how we have used it in the past year.
• Correction — ask us to fix data that is wrong or incomplete.
• Deletion — ask us to delete your data, subject to §9.
• Withdraw consent — tell us to stop, including unsubscribing from emails — every email we send has a one-click unsubscribe link. We will act within a reasonable time and explain any consequence for your use of Yomi.

If you are in the EEA or the UK

You also have the right to data portability, to restrict or object to processing, and not to be subject to solely automated decisions with legal effect. We do not make any such decisions.

If you are in California

You have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for exercising those rights. As noted in §6, we do not sell or share personal data.

To exercise any of these, email our DPO (§2). We may need to verify who you are first. There is no charge, though the PDPA permits a reasonable fee for an access request and we will tell you in advance if one applies. We aim to respond within 30 days.

Please raise it with our DPO first — we would genuinely rather fix a problem than have it escalated.

If you are not satisfied, you can complain to Singapore’s Personal Data Protection Commission. If you are in the EEA or UK, you may complain to your local supervisory authority, or to the UK’s Information Commissioner’s Office.

We will update this policy as Yomi changes — and it will change, because accounts, sync and payments are not built yet. When we add something that involves your personal data, we will update this policy at the same time, not afterwards.

If a change is material we will tell you in the app or by email before it takes effect. The “last updated” date at the top always reflects the current version.

Synapse Social
[REGISTERED ADDRESS]
Data Protection Officer: [DPO EMAIL]
General enquiries: [CONTACT EMAIL]