ともぶ

Privacy

Updated 25 October 2026

Tomobu is a Japanese flashcard app run by MB “Tomobu” (company code 307543628), a small company in Lithuania. This page says what we keep about you, which companies help us run the app, and how to delete your account. If anything here is unclear, write to privacy@tomobu.com.

What we keep

  • Your email address, so you can sign in.
  • Your study progress: which cards you have and when they are due, your daily stats and streak, your timezone, and your settings.
  • Your decks (with their names, descriptions and learning goals) and the phrases you add.
  • Card ratings and notes, and any feedback you send us, with the page you sent it from.
  • Your IP address and browser name, stored with your sign-in session.
  • Our server’s logs (IP address, time, page and error details) and error reports, which we use to fix problems.

You need an email address to sign in. Everything else is up to you. We don’t save your “Ask about this card” chats: they go to the AI provider for an answer and aren’t stored on our side. We don’t show ads and we don’t sell your data. You need to be at least 14 to use Tomobu.

Cards are made by AI, and shared

When you add a phrase, we send it to AI services that check it and write the card, its grammar notes, its picture and its voice. Cards are shared: other learners can get, and see, a card made from a phrase you added, but never who added it. So please keep names, addresses and other personal details out of your phrases.

Why we use it

  • To run the app you signed up for (our agreement with you): your account, your study data, the phrases sent to AI services, and sign-in emails.
  • Because we have a legitimate interest in keeping Tomobu working and secure: session details, server logs, error reports and feedback.

You can object to the second kind at any time by writing to us.

Who helps us run Tomobu

Hetzner · Germany
Everything listed above. It hosts the app.
OpenAI · US
Your phrases, deck names and learning goals, card text and chat messages, to write cards, grammar notes, deck suggestions and chat answers.
Mistral · France
The same kinds of text as OpenAI, when we use it instead.
Hugging Face · US
A short picture description written from your phrase, to draw the card’s picture. We write it to leave out names and other details about you, and Hugging Face may pass it on to one of its image partners.
ElevenLabs · US
The Japanese text of a card, to record its voice.
Cloudflare · US
Card pictures and voices, which it stores and sends to your browser, and the nightly copies of our database.
Resend · US
Your email address, to send you sign-in links.
Sentry · US, data stored in the EU
Error reports when something breaks: what failed and the page or card it happened on. We set them up to leave out your email address, phrases and chat messages, and reports from your browser go through our server, so Sentry never sees your IP address.
Proton · Switzerland
The emails you send us.

Some of these companies are in the US, so your data can leave the EU. OpenAI, ElevenLabs, Cloudflare, Resend and Sentry protect it under the EU–US Data Privacy Framework or the EU’s Standard Contractual Clauses, as set out in their data processing terms linked above.

How long we keep it

  • Your account and study data: until you delete your account.
  • Sign-in sessions: until you sign out, the session expires, or you delete your account.
  • Server logs, including web access logs and app error logs (which can include a phrase you were adding), and error reports at Sentry: deleted automatically after 90 days at most.
  • Database backups: deleted automatically after 14 days.
  • AI providers keep what we send under their own rules, for example OpenAI for up to 30 days to check for abuse.

Deleting your account

Delete your account in Settings and it’s gone right away, with your study progress, decks, ratings and feedback. Copies in logs, backups and at AI providers clear on the schedule above. Cards you added stay in the shared pool, no longer linked to you. If one has personal details in it, write to privacy@tomobu.com and we’ll remove it.

Cookies

The app sets one cookie, to keep you signed in. The sign-in screen remembers your email in that browser tab, and the kana chart remembers whether you picked hiragana or katakana. The landing page sets no cookies. There are no analytics or advertising cookies.

Your rights

You can ask for a copy of your data, to correct it, to limit how we use it, or to object to it. Write to privacy@tomobu.com from the address you sign in with. To delete your data, delete your account in Settings, or ask us to.

If you think we’ve handled your data badly, you can complain to Lithuania’s State Data Protection Inspectorate (vdai.lrv.lt).