Privacy Policy

Last updated: June 12, 2026

Toku Reader ("the App") is a Japanese and Chinese reading assistant developed by Darren Nah. This policy explains what data the App collects, why, and how it is handled.

On-Device Processing

The core function of Toku Reader is to help you read Japanese and Chinese text. All text analysis — including tokenization, readings, definitions, and dictionary lookups — is performed entirely on your device. The texts you paste, import, or read in the App are never sent to any server.

This applies to all content surfaces in the App:

• Text Reader — Pasted or imported text (plain text, PDF, EPUB, SRT files) is processed and stored locally on your device.
• Web Reader — The in-app browser lets you read web pages with reading aids. Web pages are fetched directly by Apple's WebKit framework (the same engine used by Safari), and text analysis happens on-device. Browser conveniences — browsing history, open tabs, per-site reading-aid preferences — are stored only on your device, are never transmitted anywhere, are excluded from device backups, and can be cleared at any time (History > Clear). The App developer cannot see your browsing activity.
• Watch (YouTube) — The Watch tab plays YouTube videos through YouTube's official embedded player and shows their subtitles as tappable text. When you search for videos or play one, your search terms and video requests are sent to YouTube (Google), exactly as they would be on youtube.com — Google's Privacy Policy applies to that traffic. Subtitle text and your recent-video list are cached locally on your device; all language analysis of subtitles happens on-device. The App developer receives none of this data.
• OCR Reader — When you use the camera or select a photo for text recognition, images are processed entirely on your device via Google ML Kit's on-device Japanese and Chinese text recognizers (see "Third-Party SDKs" below). Both ML Kit text-recognition models are bundled in the app — no network download is required to use them. Images are not uploaded, stored, or transmitted.
• Dictionary — Lookups use bundled offline databases: JMDict (Japanese), CC-CEDICT (Simplified/Traditional Chinese), MoEDict (Taiwan Traditional Chinese), JMnedict (Japanese names), KANJIDIC2 (kanji data), Tatoeba (example sentences), and pitch accent data. No network requests are made for dictionary lookups.
• Handwriting Input — When you use the handwriting canvas to draw a character, recognition runs on-device via Google ML Kit's Digital Ink Recognition. Unlike ML Kit's text-recognition models, the Digital Ink models are downloaded from Google the first time you use the feature for a given language (~20 MB per language, over Wi-Fi) and then cached on device — all subsequent recognition runs fully offline. See "Third-Party SDKs" below.
• Share Extension — When you share text or URLs from other apps into Toku Reader, the shared content is processed and stored locally on your device.
• Word Review & SRS — Saved words, review history, and spaced-repetition scheduling data are stored locally on your device.
• Text-to-Speech — Read-along audio is generated on-device using Apple's built-in speech synthesis. No audio data is transmitted.
• Anki Import / Export — Imported .apkg files are parsed in memory on-device and are not retained after import. Exports are written to a file location you choose; nothing is transmitted.

What We Collect

The App collects data only when you voluntarily choose to submit feedback:

• Error reports — When you submit a report about an incorrect reading or definition, the report includes: the word you tapped, surrounding context (up to 30 tokens in each direction), the error type, and any note you write. This data is sent to our server so the developer can fix the issue.
• App experience feedback — When you submit feedback about the app experience (via Settings > Give Feedback), the report includes: the app area, feedback category, specific issue, and any note you write. This data is sent to our server so the developer can improve the App.
• Anonymous device identifier — A random UUID generated on first launch and stored in your device's Keychain. This is sent with feedback reports solely to group reports from the same device. It cannot identify you personally. Because it lives in the Keychain it may persist across reinstalls of the App; it never leaves your device except as part of a feedback report you choose to send.

Optional External Integrations

The following integrations are off by default and only activate when you explicitly opt in. Each is independent — you can use the App without any of them.

WaniKani (optional)

If you connect a WaniKani account, the App acts as a client of wanikani.com's public API (api.wanikani.com). This requires:

• Your WaniKani Personal Access Token (PAT), which you generate on wanikani.com and paste into the App. The PAT is stored in the iOS Keychain on your device. It is only transmitted to api.wanikani.com over HTTPS, never to the App developer's servers.
• Your WaniKani subjects, assignments, review statistics, and study materials are fetched from api.wanikani.com and cached locally so reviews and lessons work offline.
• When you submit a review grade, the result is sent to api.wanikani.com to update your SRS progress on WaniKani's servers. The App does NOT send this data anywhere else.

Disconnect at any time in Settings — the PAT is deleted from the Keychain and cached WaniKani data is cleared. The App does not read, log, or transmit your WaniKani data except to and from api.wanikani.com. WaniKani's own privacy policy applies to data it holds on its servers.

Premium Subscription (optional)

The monthly premium subscription is processed entirely through Apple's StoreKit. Payment information is handled by Apple — the App never sees or stores your payment method, Apple ID, or billing details. The App records only your current entitlement tier (free or premium) and a rolling 30-day analysis-token count, both stored locally on your device in the iOS Keychain.

What We Do NOT Collect

• No names or email addresses are ever transmitted to the developer. If you optionally use Sign in with Apple, the name and email Apple shares (which you can hide) are stored only in your device's Keychain and never sent to us; the WaniKani PAT likewise stays on your device and is only sent to wanikani.com
• No location data
• No analytics or usage tracking by the App developer (a few feature-tuning counters are kept locally on your device and are never transmitted)
• No advertising identifiers
• No browsing history or web activity is ever transmitted to the developer (your local history stays on your device, under your control)
• No photos or camera images
• No payment information (handled entirely by Apple)
• The Japanese and Chinese texts you read in the App are processed entirely on your device and are never sent to any server

Device Permissions

The App may request the following permissions, all of which are optional:

• Camera — Used only for the OCR Reader to photograph printed text. Images are processed on-device and never leave your device.
• Photo Library — Used only for the OCR Reader to select images for text recognition. The App uses Apple's privacy-preserving photo picker, which only gives the App access to photos you explicitly select.
• Notifications — Optional. If you connect WaniKani, the App can schedule a local notification when reviews become available. Notifications are scheduled on-device by iOS; no data is transmitted to enable them.

Third-Party SDKs

The App integrates one third-party SDK family: Google ML Kit. The specific ML Kit modules used, how they behave, and how to avoid them are listed below.

• Digital Ink Recognition (handwriting in the Dictionary tab). Recognition runs on-device, but ML Kit downloads the Japanese and Chinese-Han-script models from Google the first time you use the handwriting canvas for that language (~20 MB per language, over Wi-Fi). Once downloaded, recognition runs fully offline. If you never tap the handwriting button, no Digital Ink models are ever downloaded.
• Text Recognition (Japanese) and Text Recognition (Chinese) — the sole OCR engine used by the App's OCR Reader. Both models are bundled inside the app (no network download). Recognition runs fully on-device.
• ML Kit's default SDK telemetry. Google ML Kit generates a pseudonymous instance identifier and may send basic SDK diagnostics to Google on first use. This is Google's default SDK behavior and is not specific to this App. See Google ML Kit's terms and Google's Privacy Policy.

How to avoid Google ML Kit entirely: don't use the OCR Reader (camera/photo text recognition) and don't use the handwriting canvas in the Dictionary tab. All other App features — text reader, web reader, dictionary text search, SRS reviews, WaniKani integration, paste-based reading — work without ML Kit.

No advertising SDKs, no analytics SDKs, and no crash-reporting SDKs are integrated.

Dictionary Correction Sync

On each app launch, Toku Reader fetches the latest set of approved dictionary corrections (reading/definition fixes the developer has curated from anonymous user feedback) from the same Supabase server the feedback reports go to. This is a read-only download of correction entries — no personal data is sent from your device in this request, and the App does not upload or identify you during the fetch. If the network is unavailable, the App continues using the previously cached corrections bundled with the app.

How Data Is Stored

Feedback reports (the only data that leaves your device for the App developer's servers) are stored in a Supabase database hosted in the European Union (AWS eu-central-1, Frankfurt). Data is transmitted over HTTPS. Row Level Security (RLS) is enabled on all database tables.

WaniKani data (if you opt in) is held by WaniKani on its own servers under WaniKani's privacy policy. Apple holds subscription and payment data under Apple's privacy policy. The App developer has no access to either.

Data Retention

Feedback reports are retained indefinitely to improve the App's accuracy. You may request deletion at any time (see below).

Your Rights

Under GDPR (European Union)

If you are in the EU/EEA, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Request portability of your data
• Object to processing of your data

Legal basis for processing: legitimate interest in improving the App's accuracy based on voluntary user feedback.

Under APPI (Japan)

If you are in Japan, you have the right to request disclosure, correction, or deletion of your personal information under the Act on the Protection of Personal Information. Data is stored in the EU (Frankfurt), which provides an adequate level of data protection.

Under PIPL (China)

If you are in China, you have the right to access, copy, correct, and request deletion of your personal information under the Personal Information Protection Law. The App processes all reading content locally on your device. Only voluntarily submitted feedback reports are transferred to servers in the EU.

Under CCPA (California, USA)

If you are a California resident, you have the right to know what personal information is collected and to request its deletion. The App does not sell personal information.

Children's Privacy (COPPA)

The App is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has submitted data through the App, please contact us for removal.

Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated date.